{ "Event": { "published": true, "date": "2026-03-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-02", "timestamp": 1772496181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "da8f719f-5b1d-492b-8305-ea3c3fe3b28b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4c1327-1639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772457214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457214, "uuid": "4a9dc32b-69c7-44cb-8516-9013c94b75b5", "comment": "Malware payload (Mirai)", "value": "c80b5429e3a2b27e717dc6ae3c28a0a0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457214, "uuid": "c5168abb-6524-4562-9514-5b4a29ce44d4", "comment": "Malware payload (Mirai)", "value": "01c257ed7493bf2702bcc0d788dbe82e74f8fd2e1daef64dd87e05137cf178ab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457214, "uuid": "88ab0091-980c-460f-986e-6577eb6de187", "comment": "Malware payload (Mirai)", "value": "e3f7508520015f77ceeb1f6782fe7fa48b4df6a0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457214, "uuid": "934bb148-4a57-43bb-ad41-9ea182de82f1", "comment": "Malware payload (Mirai)", "value": "d0d2ec1fb5f1b81a261794f57d9fbabd1c8c4c601c37c46047bf28f64b68fb34fb50083438fc8871512d1ba60a9dc64e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457214, "uuid": "b3713c87-3bc0-4070-b81b-b77ef25a609f", "value": "T1BEA623BA7518335CC40E88355C23AD55B3E2940E9DFC85AAF1E7AAC43F9B821D936F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457214, "uuid": "ffe075c6-13f4-437e-9a38-33dcb1eed4c1", "value": "1235e90f2d3513fe8ab32dc51b73c861", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457214, "uuid": "85e3673a-b5d7-47b9-8c8b-ee2bb00d8b65", "value": "196608:sf5lpi+B4D2XmW1EehuVlJm/DYi83kcJ5hzYVK29N8ro9Al1b:aHcDqmW10luYpkcJ5lYVK29qU9Al1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457214, "uuid": "4e2d3057-8ba9-47e4-b13b-9ced9a0592af", "value": 9635840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457214, "uuid": "b05c0401-cb7e-4626-9e8f-7f012458c542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457214, "uuid": "14846d33-6743-4436-a47c-48fc58f180c7", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5b88d7-162d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772452139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452139, "uuid": "9927d185-2f94-4826-a9b0-03548544eefc", "comment": "Malware payload", "value": "285a57dec0ae2965d101abaac41698af", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "securityhealthservice-ydns-eu", "colour": "#2D3F92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452139, "uuid": "4d655e99-ea54-4d4f-bab2-67753c179ac6", "comment": "Malware payload", "value": "03def7865fa7f571cf2616419e7bbefda214dc8ea3e91494dd1196b63243ccc4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "securityhealthservice-ydns-eu", "colour": "#2D3F92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452139, "uuid": "5cd31237-a67b-42c2-9c8b-f9631e9161e4", "comment": "Malware payload", "value": "e4a23b3da2709d1d89d8804a47f51987b3555df4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "securityhealthservice-ydns-eu", "colour": "#2D3F92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452139, "uuid": "2e35b8a3-f474-4f0c-a9f7-d0a2c121f6ed", "comment": "Malware payload", "value": "e8ea75e2361ca09dd27c1cf9d8d6913bccecef809574b942df944ddafee9f8b4b8534ea5f37029bdf1b9d967b0bf9d60", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "securityhealthservice-ydns-eu", "colour": "#2D3F92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452139, "uuid": "f350f4e4-b2da-4206-a166-c0749a77f103", "value": "T1A0157045C69505CCFAC989A31982EFE739BFA1B7684428F9C3F2CB99A0729F70514137", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452139, "uuid": "e03b8674-4f21-4a67-98bc-18a1605ef0de", "value": "6144:QKCsI4uTjcrLlKCsI4uTjcrLrKCsI4uTjcrLNKCsI4uTjcrLw:wr4uTyr4uT+r4uTar4uTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452139, "uuid": "8280f522-a8af-43f6-8615-98a3ae9fd369", "value": 934297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452139, "uuid": "f261cf40-9501-413d-b212-51bea1f7d75e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452139, "uuid": "0782793b-e846-49a4-a4d8-d78eed821725", "value": "03def7865fa7f571cf2616419e7bbefda214dc8ea3e91494dd1196b63243ccc4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4a5c01-1653-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772468402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772468402, "uuid": "7e113834-4936-4532-9d3a-00f4ef0daa1d", "comment": "Malware payload (Formbook)", "value": "c690ffc43b19402a3bd134ca947f4693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772468402, "uuid": "e0764d80-5597-47aa-9683-fc1cc66057e6", "comment": "Malware payload (Formbook)", "value": "049d02bca5fcfb5cc8f429493bd150a2363cfafc940a51fb60af9c298946cafa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772468402, "uuid": "13cfbba8-30d7-44ed-a9d6-6f74eeabbb6a", "comment": "Malware payload (Formbook)", "value": "0b3d7a9a04621ed9cbeabf0f6325a18a33aaa73e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772468402, "uuid": "789329d7-825a-46ae-a67a-cb74a4b5715a", "comment": "Malware payload (Formbook)", "value": "90c3fb70f1d9d318e8c65f7694cba3cbc1437cc73c669b24cf67f3403685de21d373a589355c6fba5d5bd8a3000f7989", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772468402, "uuid": "0cea3ff2-5690-4a86-80b2-8adc98358d50", "value": "T1E5350229AA27C90BC6554B3686F1F27413785ECAF802E2275FE87ED7BD67B564C00243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772468402, "uuid": "e2ec8104-b4a6-4dca-a6d4-3e134c1b99c0", "value": "24576:RKOgjG2xTHKHKxW783P0GLM8MkiHlk6O7WPDTf+xt8:EOgjGSHkKxW78fG81x7WPDj+xt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772468402, "uuid": "c41e7706-b54c-458c-a27d-0960d73b94be", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772468402, "uuid": "fecb4cba-4085-486f-821f-ecf54abbdb95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772468402, "uuid": "0770188b-5957-4e8f-912f-2f1cbb3adfa2", "value": "PO-453002.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754ffd40-1640-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772460152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460152, "uuid": "ebfeee9a-304f-403f-bc01-4fe137fbd85b", "comment": "Malware payload (Mirai)", "value": "7af0620d2d4df95d7cd5b838d8170de5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460152, "uuid": "bd50b55e-86a4-456e-8204-f4802ff973b0", "comment": "Malware payload (Mirai)", "value": "04bef955bdc88a55ee26db5b88f11cb9dd5f8da2d3a01df0e588459414bccc66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460152, "uuid": "9ac03e0a-562f-42d7-b044-5b100031ebd0", "comment": "Malware payload (Mirai)", "value": "f9c7f445c631f717c0ad2168d1efabfc5ad97fd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460152, "uuid": "4ef44286-ebdd-4afc-a086-744d2fd15bbd", "comment": "Malware payload (Mirai)", "value": "21b32b683160626b03b1b8b6c81cb5c671c596a57f6fc275477d2c29bf03606f4b4ec67eedf760c8b5a28192bd62ce27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460152, "uuid": "3a5a2890-9af8-46dd-b814-ee71f32221fe", "value": "T1FDF33906B30C4947D2632EB03E3FABD193EFBAC129A4B645391E9B8D91B1D321545ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460152, "uuid": "f87846fa-4780-4b85-9281-e0a32acca320", "value": "1536:lp3QMu8Y5nK3eXxFTYf1XIplNwxc4nJFH/aO+zlANKnBU6ApGvAfKCHmV+KzSINF:f3ZuLVuwKoNwxRHSO5NeBOvfO/g8agEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460152, "uuid": "3b7a715e-eb61-4452-ae65-0ec222fffdd3", "value": 160540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460152, "uuid": "3fa4543d-13ca-4ffe-bb9c-9fedf85b957f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460152, "uuid": "ac32ba7a-9ea3-459f-aa18-715f271ff8d7", "value": "csk_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc39608a-1632-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1772454312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454312, "uuid": "ecc86715-43e4-49ce-8350-cf49d00ff405", "comment": "Malware payload (CobaltStrike)", "value": "7a723c884f64d1f5b8cd9d8f2e276a90", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454312, "uuid": "0a00110a-b002-4ccb-8f1e-64f1be74195c", "comment": "Malware payload (CobaltStrike)", "value": "05dadebaac31e9fd676f9572a75ad826bea393970d308e1dc169b8bbcf4a8aff", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454312, "uuid": "e3f535d7-462c-4d95-9abe-fc07ffdbf26e", "comment": "Malware payload (CobaltStrike)", "value": "457e75446b1a396f179164355f4034fafa18a3e7", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454312, "uuid": "740d9e05-ac76-4898-a824-53c76f9e873b", "comment": "Malware payload (CobaltStrike)", "value": "76c5cd7efeab436a92f7ef7a4ec02b5511a17ebca61c238562039b2a32dc5e1f13b49fe3e0ec50d1b56421353f051eef", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454312, "uuid": "751e9808-aab2-4239-b93e-0d41f3d54f97", "value": "T1273340C47ED48CC6EE14663C51E692362A3DF6D4CA430B07A924B7321E13FD17DDA26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454312, "uuid": "5397f7a4-15e8-4691-b7da-b25f89fe9b7a", "value": "efaef4bb9ec3969126acbcd33c88bb30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454312, "uuid": "5ecbe855-05c8-49ee-abaa-aaac2294001c", "value": "1536:TQogXFmvd8T3jBHho6F8COgcP+CKbqz+0yXEucoKOmE+KNWREpSmlsVxIOquwTBt:TtgVo8rtvHUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772454312, "uuid": "550aea4a-66b8-4975-b809-e9eea8127a51", "value": 53943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772454312, "uuid": "e14f488b-2dfb-49cc-8f8c-c8bbeb3c208e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454312, "uuid": "cb8aeb89-88f7-462e-8382-84b8ea3a9bc2", "value": "05dadebaac31e9fd676f9572a75ad826bea393970d308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a40ca1-1614-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772441200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441200, "uuid": "e9e65aae-d0e2-4665-99b2-546bffd29df8", "comment": "Malware payload (Mirai)", "value": "d0ad61c6ff674365be0c44aa7224ce14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441200, "uuid": "8bf6a682-6dad-4d9e-9799-1e98b59aa5ff", "comment": "Malware payload (Mirai)", "value": "0714550700a0d004e2ad1f677804658b7e13735c5f634a43bca6ea847e482c4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441200, "uuid": "c97d5f73-a669-4ebd-83fd-13d3a92296ba", "comment": "Malware payload (Mirai)", "value": "0666175b52bcc7f78af52afe79cccecd852338dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441200, "uuid": "9f23a90a-417e-4d47-bb09-e49077551fc3", "comment": "Malware payload (Mirai)", "value": "d4059694029bb6fe83b7baa2f54009e94de6ec674a270648fcfa538869092104e95c3d5b04bf7bc3add403bf7010785d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441200, "uuid": "3785c9f7-69bb-4cc8-af43-41b4dfcfabb1", "value": "T1FBF34B46EA414A13C0D61776B6AF42493323A7A4D3EB73069D24BFF43F8679E0E67502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441200, "uuid": "17a5f9ac-b24a-47aa-8119-2cb9552a95a7", "value": "3072:fUcgzzJ0JjxHcGa32aTl10JRkomNZ2l7VwbZnYE2XV4M/9KlWP:fUjzzyJjx8Ga32aTl18R+N8lpwRYE2XT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772441200, "uuid": "499cffb6-c745-48cf-a1a1-ae66f20137ef", "value": 167387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772441200, "uuid": "c7700739-280b-4f90-b91b-d17be3f8d675", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441200, "uuid": "fe1992db-ade2-47be-adfa-686444bc0177", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6ed4ed-1632-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772454285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454285, "uuid": "9ac47da8-43e0-4666-b0b5-cabb05a90e4c", "comment": "Malware payload", "value": "29953b2e46aeaf0157d487c13c4a0643", "object_relation": "md5", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454285, "uuid": "02e71e52-101a-4fd8-b233-1bee62767061", "comment": "Malware payload", "value": "077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de", "object_relation": "sha256", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454285, "uuid": "4a333569-5f91-4c29-9827-1e97134d5a1e", "comment": "Malware payload", "value": "429efcf0370b53cc3c455b634dc066b1d08b568d", "object_relation": "sha1", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454285, "uuid": "bdb2d346-1fd2-4830-b932-75ef815e671a", "comment": "Malware payload", "value": "0d8b654524e4d7c4f52646a0956a38e401d56cf8e8656b1c1b8f4c75b597ff49b54f371f587a155aef2df1c15a1d7a65", "object_relation": "sha3-384", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454285, "uuid": "7984c9ee-c0bd-4171-80b1-674ed9531025", "value": "T1AEF7337F69340DA1F8A745F0F65BE0BAC8112C494A3410A177B56A7B3EFA51E812DF38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454285, "uuid": "7d8f714d-846e-4e53-a212-c31b98f9c82f", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454285, "uuid": "560629d5-49ee-4930-8f19-43d40f7d5f55", "value": "1572864:tpQL+rJ/Lu+bSBscfv7pGHe/zA6wa8iV/dU0pk39/kHE+au0brozD/N0in1OUWjO:tpQCrJ/Lu8DcnFG+/h8KdXk9/kHxaum4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772454285, "uuid": "1a8f2b4f-2606-4e02-a002-805104bb4aaa", "value": 75387632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772454285, "uuid": "df52eadd-dfce-4450-bcee-13f7bc63c0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454285, "uuid": "1641b822-f9f6-497f-b1c0-996935f3ad77", "value": "077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e333cca-1686-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772490178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490178, "uuid": "aa522502-9851-48f7-a42e-8ae1acc30877", "comment": "Malware payload (Mirai)", "value": "fed59816d85976bb1b79c389d7d7847e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490178, "uuid": "a6fa296e-915f-4868-b97c-c3ba8de888f9", "comment": "Malware payload (Mirai)", "value": "08f7f0edb5f1b8463cdb876567a0b0ea53998c9d9561578d8ae2d1adf164b0ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490178, "uuid": "8ac3543e-dc58-48c8-8774-9510881aba85", "comment": "Malware payload (Mirai)", "value": "0eae42d5858383fd59bf4e8d3b390fe1e60b3902", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490178, "uuid": "394c0641-fa96-4cc6-98e7-30549552a833", "comment": "Malware payload (Mirai)", "value": "76c9d658ab4f0aa852e958eb9e8235d8ed1e4150416f58bc40aecb913a5407636379fdb72124ec65499bb2bf64beac95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772490178, "uuid": "67edce9f-cd27-458e-b507-edcaa6616323", "value": "T1D0158D2EB2B3B5BCD00BC03457DBCAA25535F07522212DBB26C4DA353D6ADE11369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772490178, "uuid": "70ab3208-339f-41cd-9741-be027d8103dc", "value": "12288:ooMSxaNgCrIVdSad5HVsIl3+S/me/AeOOhWcPoubC8Jqoq57ayUHjAdLHX:3MIaNgCsVdh7bOgjPo38SMjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772490178, "uuid": "05b1cf7b-944c-44a4-998d-845f6790ff6c", "value": 957256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772490178, "uuid": "55557ad5-763b-44bb-a7ae-282d1c83149e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772490178, "uuid": "f0bd629d-1660-4d4d-86f9-da4f30c4e9ea", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b84da3e-1689-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772491516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491516, "uuid": "66ef00cc-28ae-4d86-87e5-402b54556ee3", "comment": "Malware payload (ValleyRAT)", "value": "80cfb32b29b00d05415b4990da151da7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491516, "uuid": "29f80eac-aa56-425d-81dc-57fd0dee6a41", "comment": "Malware payload (ValleyRAT)", "value": "08f8a286b6cd9ab0291e3b0e5f5d2fdce22024acc167634de0ad83bcb47a5747", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491516, "uuid": "b2a7e41f-632b-43b2-9f36-2b2ea648f582", "comment": "Malware payload (ValleyRAT)", "value": "d652abe1a678dab8f418fe31c47002f2a40a6a3e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491516, "uuid": "1b0f220d-db6e-4e83-a399-7a944a734902", "comment": "Malware payload (ValleyRAT)", "value": "2f3c7174e983d6f17d0aa4ab424f49037e684f0ea90f2e58502abca2420ab9ea4ad7297e9922ad3ad7f114d68c123f04", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491516, "uuid": "278e6e86-9a2c-44f2-9e11-83bae1ee6782", "value": "T1452633E4F4F86B32C89FC67572A34A8DBF953F3A8BAD85512B092819CC73B540935316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491516, "uuid": "f93088fb-332e-4b79-aebe-423a769bf1a9", "value": "8000ea7ef9a9a4dcbab815cb57b2ccc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491516, "uuid": "4e905eb4-fe34-42d4-8581-c4dc46346227", "value": "98304:3zcsiSENObk/iHnUbdnePIbCs80H45tDyILBlMY/VSMsyXcfo+ocyRPA6s:viFsbk+gEWSi45cqwZyF+LyRPLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772491516, "uuid": "04610fa5-ff15-49ca-8ea9-b0b9b227cde9", "value": 4653056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772491516, "uuid": "7e9dedc1-6a65-4178-a46b-9ee3030aab87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491516, "uuid": "12a84c1b-7de4-4b2d-9754-f4f98d4dfeb3", "value": "AISafeSDK64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babe3fa9-1619-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772443518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443518, "uuid": "796c9937-a533-4a95-b085-ecf5f749d70b", "comment": "Malware payload", "value": "1765ec93eabe3f43a92f3f8ed24a442e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443518, "uuid": "a7d31c66-f5cd-44e6-945f-3c76e6533c2f", "comment": "Malware payload", "value": "09a539fc775acb37e108272569d179487532d51875edfef538c054288ef905f4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443518, "uuid": "d350a683-d6d7-47d1-84ba-9d336088e4ee", "comment": "Malware payload", "value": "89f896fb22b6eb682a60f81a2bb47b886843c74f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443518, "uuid": "a5ef7dd4-d318-415f-833b-a0dbb44649e4", "comment": "Malware payload", "value": "6f60dc79afe8c6ee93569d4b0b0dfcea3949bcde58a25bea2eed89c4f8013f90b26ccfaff00366a2ff424ce3a00e40cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443518, "uuid": "1ae3a2f7-e23c-4d16-92d0-8fe6a7ac02e8", "value": "T123925DB512896C79FBD0CE399F3C6F4DADE8C2C42124A3ACBA4F39205A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443518, "uuid": "2fb58ce9-2403-4b03-9619-2008436a5ef8", "value": "384:gvqmcuQpWx+BL0SWL0g+zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:sqm8i+BL0SI01zsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443518, "uuid": "7b30e559-c71e-4e87-acdf-7e9c8d69d870", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443518, "uuid": "621ac775-e259-46b4-b36b-6c73c60d8a52", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443518, "uuid": "5153665e-4870-4c39-88f9-095a20878879", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e5f4d9-1609-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772436563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436563, "uuid": "263fa074-f534-40fe-8646-d639093d4263", "comment": "Malware payload (ACRStealer)", "value": "4cea251d3a67fda3b20d305ce6f52276", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436563, "uuid": "f74ec338-6f70-45dc-824e-faac47b553b3", "comment": "Malware payload (ACRStealer)", "value": "09c2e4c571e941fae4a97f717dd4ce6022038b8ebc3ffddbd79be0bb697efeb9", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436563, "uuid": "06f6141f-aa73-41b6-b32c-97968e26dd56", "comment": "Malware payload (ACRStealer)", "value": "8ed92e0fe0269252e33484df1438938fb3b16129", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436563, "uuid": "5665f68e-c21d-431a-91e7-2098d724ba6e", "comment": "Malware payload (ACRStealer)", "value": "3ed456e714ecd94972700c74fe6809139165a74383e23f12480c770f9bdf8e3163d5d4decc1e59da72ade708e1cfacfc", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436563, "uuid": "398e6093-575f-49e5-9b59-fd5ce7a1298c", "value": "T1B6A69D31B100A2E8C0FD90B5AB6F89ABDB727C14472191D321D5BA894F736D29EBF345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436563, "uuid": "5180732c-d06f-4cc4-add1-2ec60b18d6ca", "value": "d9fa9ad22ab5bfba6ce0430c19165b7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436563, "uuid": "e51495eb-1835-4b22-8d08-a2cda72a1f36", "value": "98304:il0g4N0aVvcGEs/HP3MHaC6PcfK2zFyIIA/yH:iq9cHfK2Fy6/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772436563, "uuid": "92f60d0c-c250-4318-8452-de4d1913f8b2", "value": 9774592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772436563, "uuid": "ce235df2-7202-472c-a24b-50f4213a9520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436563, "uuid": "edd9933d-756a-432e-b43c-0a514494d95f", "value": "python311.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a835d4ad-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475699, "uuid": "4c738908-a33d-411f-9852-f77c9c354c54", "comment": "Malware payload (Mirai)", "value": "22fbc3c8a593649e56c5a71f544b2252", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475699, "uuid": "5b0cce7a-fdff-49b9-9a21-1b655483fb8b", "comment": "Malware payload (Mirai)", "value": "0bb275b2f2d5855214521060a122453d47b631b6c8227015332cbacc943e0bd9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475699, "uuid": "682f9e32-2efd-4d5e-b945-e6ee914aa6ea", "comment": "Malware payload (Mirai)", "value": "d3833d81e706f7817153443a3c02babf271e9e10", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475699, "uuid": "6c40cc7b-cd52-42a8-af48-aac7802d6086", "comment": "Malware payload (Mirai)", "value": "f3d97cb03e7d0cefa9d46e6aaa8734692f1d8dcaa68605b4580563b24f3bf0a01c650b0cf288a01b7d3a5a8966cf3cdf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475699, "uuid": "c91b3bb8-428a-4a7a-8919-9db58ad0c296", "value": "T1A0D12FF2B4C5567CDE9FD83E611829BD2085BA9B1A875D6487FE20A57C89FCC1C409C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475699, "uuid": "87c8bf0e-68db-44e0-9e4c-580bc56f1bf0", "value": "192:IB3mBnIOBqEjp83p8C12wWk7sqSgnAOZPOZPZPOZPaofIG3NwDVgGpiMGUr8arxi:IB3mBnIOBqEjp83p8C12wWk7sqSgnAOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475699, "uuid": "e3bdd1b2-880e-4b3b-b327-ebf42ad59fe8", "value": 6419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475699, "uuid": "281a41e7-a424-4178-8427-2372e24d4ce9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475699, "uuid": "e552da88-858b-4b73-a5b6-8e65017a8c01", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7961958-166e-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1772480128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480128, "uuid": "aed15411-9798-4a29-918c-cee6f4e23124", "comment": "Malware payload (OffLoader)", "value": "2825162eb8738e9adbe32773619eb634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480128, "uuid": "7fd1c8fd-55d5-41be-82b8-4954afe20e93", "comment": "Malware payload (OffLoader)", "value": "0dd2c3aed88099df279f0f86ed2aea8cbd378ebebd553fde9760131ab157c34d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480128, "uuid": "943c60db-1f02-451c-9fba-b339d599b775", "comment": "Malware payload (OffLoader)", "value": "c3aaf78e5e4fdf00340f8f8937afce0358e5f918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480128, "uuid": "c7eabbd4-77e8-4663-8d32-fe9798e1c4a1", "comment": "Malware payload (OffLoader)", "value": "0ff53a4da6938245e5cbb3583018b25162e5dac18f0be157b42205e0d245c9fc81e4c023991da2245cf21de63a380250", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480128, "uuid": "1091a955-190d-4a60-89ab-d6e87e4092c0", "value": "T118B72337A38A633DE17E46374AB2D214583B7A61A51F8C57A7E40C4CDF2A0B00E7E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480128, "uuid": "3da6a569-23ad-41d0-ab7e-efe9efe58d22", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480128, "uuid": "f0485eb5-8c9c-4b41-831d-7dff42cb93f9", "value": "393216:U35xjoSipSO0grGccLUpb55sIkMLJfrSwu9R4WY7Lm7P:k5xjoWg9NLJfmwywm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772480128, "uuid": "e410c412-183b-4fd4-91e2-3f23f7038499", "value": 52389062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772480128, "uuid": "194a4980-caf8-4e89-9606-0ffc5e372bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480128, "uuid": "a6b06de1-d5a0-404b-ab6f-bdecb3cffc68", "value": "INSTALL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87700be7-1674-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772482516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772482516, "uuid": "7f86ef34-72f7-47f7-8413-735717e739a2", "comment": "Malware payload (RemcosRAT)", "value": "49efd867be8b4c8337d2064b6c3749d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772482516, "uuid": "f1a19306-c2de-427b-a6a4-eb604cfe2d39", "comment": "Malware payload (RemcosRAT)", "value": "0f1425848b9b390461924a03c4c9bac804cf1f9694ea66469d3222b730a816b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772482516, "uuid": "697d1b16-9252-4aeb-9200-e048e52c986f", "comment": "Malware payload (RemcosRAT)", "value": "a9cbc113409fca4bc5a635cb69f587d6cf986525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772482516, "uuid": "26c4f956-2795-4ade-8bb6-41e2733a0c0f", "comment": "Malware payload (RemcosRAT)", "value": "e226ff6d0fd23ccaee8e32457f759ce60072b1e8ece12e83dac177be7183b3474c8617a6da248ed643102c7d161742de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772482516, "uuid": "6896b542-8734-49c7-bf54-e0313c4dd990", "value": "T190B4B001B6F2C172D976A4300935E774DEBCBD201836997BA3D61D9BFD30150AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772482516, "uuid": "23d6bb05-5c08-48c2-a405-2a0eedaab826", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772482516, "uuid": "2574c0b5-e5f4-4c86-b80b-9ee4a136d9f7", "value": "6144:EXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZlAXiBcea:mENlHV9FGeDWv3jADnyYiCNrsPZlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772482516, "uuid": "840bb5cd-d3fd-4b87-b7b6-be504d5a099a", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772482516, "uuid": "c2aa0872-a2bf-4d82-9bf8-947a50de7a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772482516, "uuid": "5f70ba57-bb52-4a6c-94ab-1f7f0c1947c0", "value": "0f1425848b9b390461924a03c4c9bac804cf1f9694ea6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad17a69-1671-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772481153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481153, "uuid": "80f0e0bf-a230-4571-8b09-cfa6df25dfaa", "comment": "Malware payload", "value": "bc5715c85301735eb6fe14d9a44d98f7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481153, "uuid": "67550eb6-8347-4e9d-a1b0-627d437eecf3", "comment": "Malware payload", "value": "0f1aa6f26b2da47d33f239804f8b434b1dd9f977a10446103068465f8779429d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481153, "uuid": "6d28a79a-d7be-4eff-a6af-af2b265e40cc", "comment": "Malware payload", "value": "1c22b050517e7d33b6ce9096213844c34c53046d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481153, "uuid": "92b080df-ca80-4224-a232-1ebbe235363c", "comment": "Malware payload", "value": "6c2a049be56e24844ae440aa1fdd0dbf094ab39428366b3706171304919b193fe517ed28116b1d8593e9115a8179e63d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481153, "uuid": "f0b50c36-ef73-45fd-9798-1d869c6f51a1", "value": "T102924CB506497C79BBC0CE799F3C7F0CAEE582C42128E39DBA1F39705A2165DC60935A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481153, "uuid": "25d99381-fee9-49f7-995e-8ef05d6a656c", "value": "384:MSncuxOLnVYMSkzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:M5uQL+kzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772481153, "uuid": "26190a88-c5a3-4b4f-93c5-e6c16986ef39", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772481153, "uuid": "d84169ac-3c84-427e-b1ba-6280dc79781c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481153, "uuid": "ec9c594e-2dd3-4b99-b00f-a7c2f8319315", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf0a40a-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444728, "uuid": "a29d1cd0-e513-4f5f-809c-2fa6e849f2ae", "comment": "Malware payload (SantaStealer)", "value": "6b5ef4bc80a796de50bb62f028b5bd38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444728, "uuid": "2476c0cd-845e-4194-8904-f2585b91d154", "comment": "Malware payload (SantaStealer)", "value": "0f781da2990a50d96faddfe0d9330eff57cce5cd7ca73fc7c858997707df30a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444728, "uuid": "aaa22133-4b1b-4f04-be85-95d64c29e125", "comment": "Malware payload (SantaStealer)", "value": "33df0910a5db654ff5c0aa5588dfbc56789a652b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444728, "uuid": "1fbc60e4-81a5-4c16-b9da-8e608d171b4d", "comment": "Malware payload (SantaStealer)", "value": "3492c2bdbed7d07c6d0f2225c1eadfa1b863d591ba1ac81839ff0a37bd8b59682b14571febf49dbac796857dafab5ac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444728, "uuid": "8b72b74b-ffba-4f30-ae07-1dab2f19fd6c", "value": "T1FFC59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444728, "uuid": "90e184c5-a14c-458e-a93f-383ababce6fa", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444728, "uuid": "3225b626-0a12-40a8-8e88-bd8d576b9c8c", "value": "49152:GavY1Sn5eVNoHWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCLsdGY:BY1a/Uevc+9sdBg4x4DPPnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444728, "uuid": "44be81f0-609f-4a9d-b5f7-1f0a8a4b9dc7", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444728, "uuid": "aa81d541-1fae-4c00-b38e-e0025e3abdb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444728, "uuid": "cabbe2b2-2c4c-4a5d-bce7-d26852bba56e", "value": "20260301_210845_20260302_000837_G7147ZVV9911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18ae586-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475769, "uuid": "dd43c9e6-a30c-45e6-a3ec-90bb77f7c188", "comment": "Malware payload (Mirai)", "value": "58fb7a9149079bb93264eeddb031e995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475769, "uuid": "32956bb3-e245-493a-98c4-5c0bdd042ee1", "comment": "Malware payload (Mirai)", "value": "1014ff1ff3d45cd4fe60bd09ce87cfff56a30a42992bf61ccc5ddb4fb4c19c1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475769, "uuid": "7f13792d-9ac6-46b4-af28-a6183db7a1ae", "comment": "Malware payload (Mirai)", "value": "8e70ed2f8b10c2535fff4c67bcf97996eb1165ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475769, "uuid": "40fb90c5-87e9-4ea8-8edd-5e08d3e5ff0e", "comment": "Malware payload (Mirai)", "value": "f7cc13b125d8d73e5b015fd54624dd3164fbffdcbb75caadc476a071cfcc55f8679f97093a3ae2f894401d2d6f24d220", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475769, "uuid": "4b9b5dba-9241-4010-918a-4cc3d4467fa6", "value": "T158736CC2B747D0F0E92616322277FB324633D53E0069EA42D769D836ED52A41E66B3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475769, "uuid": "658d928b-4be9-4260-ac31-ad50e9a223c6", "value": "1536:gtWifOh1gr45LomAk7ov/l46ZwW3/tjEerkZsSYhRSz4:K8sr45ck7mN4ewW3VjEiAtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475769, "uuid": "f6dc9cf9-966e-43c6-a458-5d967b456744", "value": 80304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475769, "uuid": "51aba1d0-19a4-4ec0-83e0-27618adf37f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475769, "uuid": "06e4c9ce-4bdc-42fd-a58a-cbb8ceb38c1c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ff654b-161f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772445923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445923, "uuid": "e790d635-a8e5-413e-980f-9796d4161716", "comment": "Malware payload (AgentTesla)", "value": "7d661aecc14e70bb43bb5294a80ec530", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445923, "uuid": "05bc1772-68b9-4e18-8369-eb2c7b6f9718", "comment": "Malware payload (AgentTesla)", "value": "101a146f50c47d2c91c84a41786dbad4b3741176c344bf266ea9a42687736901", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445923, "uuid": "aabd12e0-fc44-42e8-90f8-e10638afa2ad", "comment": "Malware payload (AgentTesla)", "value": "3e37b404151f0df2e07f4c356d6a504a3c2dd3a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445923, "uuid": "aabfd13c-2124-40b8-90f5-c9fce0451984", "comment": "Malware payload (AgentTesla)", "value": "446a35f64d942a3e9c8659d2ee8ab7ff877f194a127ace1cf0ab1a5330fb539b3ee1851f07ad2ebb8c96bd84db7fbb63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445923, "uuid": "99be0c1d-fc26-4e48-985d-2d4381758444", "value": "T10F65AF44F8103B5D89D44907E9B667CEE6F0CE27D212F20BE6B79F43AB9D518BA1B140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445923, "uuid": "e7dce669-933d-4fe9-87e3-6cef09d7f112", "value": "24576:W3TFfSFVUfHtbHTStx0sO7bU4IsBSOQE16bA7EpwBvF:WRaFVmJc0scnfJ16cQpIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445923, "uuid": "7a3f6823-71a1-477b-81b7-8dd59946ed53", "value": 1428231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445923, "uuid": "3b2df519-1b74-40d1-b6f1-312604e95dd7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445923, "uuid": "b7b70072-a92a-4165-9e5f-e0cddaeb6f55", "value": "7d661aecc14e70bb43bb5294a80ec530.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4e276a-165f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772473341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772473341, "uuid": "e6d8a5dc-a7c4-4262-9263-eb8e3b11e5c4", "comment": "Malware payload", "value": "cedbccb3d16a643c9a8dcca5d9a239a2", "object_relation": "md5", "Tag": [ { "name": "download-rajpurohitdairyy-in", "colour": "#50FDDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772473341, "uuid": "b0a7c044-2349-4c98-95e4-a15aeb1e7c4b", "comment": "Malware payload", "value": "10a36874f6a91455de825e42f516c342ab5673178ae8ec033c4aa8312b7fcb5f", "object_relation": "sha256", "Tag": [ { "name": "download-rajpurohitdairyy-in", "colour": "#50FDDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772473341, "uuid": "3dfa6dba-5184-49b0-ba46-cb4904be0f12", "comment": "Malware payload", "value": "9bcf81a2b9ec7613773b204a63ebca68798f1bd4", "object_relation": "sha1", "Tag": [ { "name": "download-rajpurohitdairyy-in", "colour": "#50FDDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772473341, "uuid": "389b215b-1cc0-436b-a759-68c5ec0a6bf4", "comment": "Malware payload", "value": "0ca54d727512639970d7de5a7eb0ef4b1d98994fe7937495ef4599e0b9a19eb2e6ceb1ebe3cbb81a407bb9efc6642a1e", "object_relation": "sha3-384", "Tag": [ { "name": "download-rajpurohitdairyy-in", "colour": "#50FDDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772473341, "uuid": "03e7afbf-4fbd-486c-8644-03ae5a2c8de4", "value": "T1B9977C52B241693EC29B193E6537E6256F3B7E616DA5CE0763F43D8E4E314802E3B603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772473341, "uuid": "3888a327-4e17-4d33-8603-9eecd664bb46", "value": "44abd85186db616132a628e92197a007", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772473341, "uuid": "8de105f1-0f23-4851-babf-bbb87afe61d9", "value": "393216:5W1GcXrGz/iPD5rmvYVmSYVwuOErXr/D4s6gSvL7p5t:mLrGzaPDpaYXYL/WVvL71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772473341, "uuid": "72d05734-a4cd-49f9-8060-9266a6adea6d", "value": 40587784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772473341, "uuid": "8a47c573-670e-469b-af47-bd14375f96b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772473341, "uuid": "35a0c419-8d04-457a-a72d-c32f412e9bd7", "value": "Job Description.docx .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a780cf5-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452672, "uuid": "ca845638-f413-4222-8f5e-c9e72b535c53", "comment": "Malware payload (Mirai)", "value": "f2c258cbefcedf7f8b956a38ce202626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452672, "uuid": "bf47a23d-acf8-4fdb-b4ed-a91d53f93e17", "comment": "Malware payload (Mirai)", "value": "10b06fff4832f9820e1600c530298001d28a794995ca77f9249132100aa84eb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452672, "uuid": "8ab6c51f-a9c6-44d4-8245-f87ced5f7913", "comment": "Malware payload (Mirai)", "value": "90297c4166b4bf7915e2981afca90026bc2fa49e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452672, "uuid": "e085c191-0e35-4d1d-80c3-f400b2a16440", "comment": "Malware payload (Mirai)", "value": "b06670fbce56cdb710e14c75e4cf7ff5cad6ae702020977fb53220be2c0a527a7ccd7100f9acf11ec6c257415d60e325", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452672, "uuid": "877344bc-b1c5-4d68-a917-bb1ea45891f4", "value": "T1C8834C0173644F0BE8AA0AF5282F17E483FEED9021F4F5856A0FDB5A4235E37155AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452672, "uuid": "88b68b2c-0b5e-4126-9377-3db08115086d", "value": "1536:7QHQd18Vez/S1f+39FAwFKtMzXIeoGXxAq:7TdUXReoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452672, "uuid": "bd18e57c-69c9-4111-bab7-493ed13d4ae2", "value": 83040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452672, "uuid": "2a79118c-221f-4a6d-994f-45a501a2f80d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452672, "uuid": "59cfff22-a3fb-4421-8b25-5ef4b64f4db7", "value": "MMaaRRiiOisecTanee.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee46885-1617-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772442505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442505, "uuid": "c129ebf3-dbfd-4fbc-80df-7f04231ad908", "comment": "Malware payload (Mirai)", "value": "50714a501ffc6f3b6f2ec3202a7147ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442505, "uuid": "9ce84fca-2837-4997-ad49-12381c99fdd9", "comment": "Malware payload (Mirai)", "value": "10dffa2eb2d935a1d72c4f33579b2ae891346fddbcb814e1c62b258707a8564a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442505, "uuid": "856e0ef4-1a78-4cc6-8ef0-19638ffb7c6a", "comment": "Malware payload (Mirai)", "value": "bedfac2435b7872567b8617811049773b910f80d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442505, "uuid": "af3e8202-2f7e-4a04-b536-5941e498b938", "comment": "Malware payload (Mirai)", "value": "e7fd6b1638e898db92c1c8cddbae96d1193918cc8aa78a8df6edcc873eaf521f84b5a97e274dd9b9baec6a173553aeb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442505, "uuid": "bb9fbfc5-d137-4f08-a99f-1578ea857153", "value": "T17A933A41FD829A12C6C513B7FB6E028D331653A8D2EE7217DD11AF21B3CA91B0DAB552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442505, "uuid": "a65bfe71-bb79-42e3-a8a0-8fd1216452be", "value": "1536:IVvWLb/jpvffEM6cio0PwVtUeZ0ab2FJ3h3zqjxpHI3udMjzJ04v/fafZ+vd3wbB:IVvWv/jpX5fZL2Fth321pQudM++nhwbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772442505, "uuid": "647a3688-e184-45e7-94d7-3e0f47121362", "value": 91968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772442505, "uuid": "885496a0-1a81-4be2-b313-97742869d428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442505, "uuid": "270ea8e3-2c79-48d2-8030-cfbb9d7f39fa", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9403ddb4-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772434004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434004, "uuid": "9b0e176e-8add-4b05-b954-01eea84b149c", "comment": "Malware payload (SocGholish)", "value": "19d9d3c663fe2a147b2683895adb20a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434004, "uuid": "d6d1a7f0-ccd8-4dbb-8e67-52cec4c1c2f0", "comment": "Malware payload (SocGholish)", "value": "1140b0fb86f156087d9886e61e8d0c5a3a74ce73648fda609d507e6802b9af5e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434004, "uuid": "12a0e545-7e5d-4308-ad4c-1edd30100963", "comment": "Malware payload (SocGholish)", "value": "74ae7771e8fc9dc82985ef2c6f799471dd4c12c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434004, "uuid": "d95925c0-3a2f-4ae5-8170-cc8dc5872966", "comment": "Malware payload (SocGholish)", "value": "7e77e7a5bb36cbb29a8001168729753cf99306a0440fce2a50ced75231ed9e3643e61d2bebc47a39aacbc3863ef44299", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434004, "uuid": "6abb1900-83ba-4c11-a09d-2449d4c9dd81", "value": "T1F6D097A21C4674AD37A820AA3132870D23422268FCDA082288B64D411604A904C5EAAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434004, "uuid": "59db2749-8fc4-46e2-a383-39b60d35f528", "value": "6:qSE9/y3AgO9lcRW5E5OGId1BLWwayutbkgIzm:Ua34cRWQO99Ww5kbkgIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772434004, "uuid": "c7d53895-f92f-48d9-8460-42b72e1ff18f", "value": 244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772434004, "uuid": "5a9de91f-8a56-4e0b-88fa-2278a4611ebb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434004, "uuid": "cad5437e-fac8-46d0-be9f-1ad2693a3154", "value": "1140b0fb86f156087d9886e61e8d0c5a3a74ce73648fda609d507e6802b9af5e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ae7fa0-1619-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772443423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443423, "uuid": "9507c3d2-8874-4819-b227-87bb5d50e7a5", "comment": "Malware payload (SantaStealer)", "value": "b6fc99763722c927d5cb4c1cf20a0e35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443423, "uuid": "9f1d1bd2-25cc-41bb-b71a-f5f60cbadb85", "comment": "Malware payload (SantaStealer)", "value": "1222fd13b3aa49effa09d0076959ebee85a94bc85e73aa406c86daed6a2d57b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443423, "uuid": "8e08caeb-74a1-4b5c-accb-64157f371ce6", "comment": "Malware payload (SantaStealer)", "value": "115f62c517aa817e825842f411153d70b59cb44a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443423, "uuid": "0e3e5b96-e45a-4e9e-8b90-2982cbd20c26", "comment": "Malware payload (SantaStealer)", "value": "c1407415aead833712d7508964c5464c7fbd9bcd9e9db23e9973947e17f3ca96aaa6a3eecf0999a88f4fb66e2b829833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443423, "uuid": "b4f127cb-7652-43e6-bc1a-d7c7ec2c45a2", "value": "T141C5AE0AF1534AD5CC9BC0BC839B7131EA357D79CE282E9B17918B613E45B807725F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443423, "uuid": "abefa8bf-b95e-4e05-98c1-493bf33e51e6", "value": "aa756d232dc6341b93de4ea08c5fa368", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443423, "uuid": "76c1e836-0dc4-4f44-a8b3-2eb384a6cc8f", "value": "49152:xKVxKbdjNu40J41RC/oKCQOydhYMJucKK6q3MqCc/9kvOl2:xBbIMC/oFQOyrYMkcKzjw9ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443423, "uuid": "27ec349c-fa0f-48cd-814a-4c1062e5617b", "value": 2636288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443423, "uuid": "bd20e1c5-76aa-4c5a-8b2c-67bec4210e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443423, "uuid": "8a8e4103-dd6b-4e68-bf20-626563c2f527", "value": "20260301_191602_20260301_221601_25FHH24SL1N4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff15dd7-1627-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772449379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449379, "uuid": "96dacb84-9900-4aa5-8360-3df84fdc0bd8", "comment": "Malware payload", "value": "eab9768095307fff8bce814690cff2cd", "object_relation": "md5", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449379, "uuid": "7136b109-d0e2-4aa0-8d46-30d32f9263ac", "comment": "Malware payload", "value": "131b6f94d80f1ee6bc965fbd0a7b459a89044db32a4818dd3bd392f1e24adbde", "object_relation": "sha256", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449379, "uuid": "c5bc3a0b-32a7-42e3-9e87-578ddedd43c5", "comment": "Malware payload", "value": "5131eb71d910ef34f5eeeb5b5d5e39d31021b8bb", "object_relation": "sha1", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449379, "uuid": "c395ee63-e274-48f9-bcd3-f56cd8464b34", "comment": "Malware payload", "value": "5cdd7f04db579c1bd36cb0c4efa236cda76b17ec6f3982beb91825419c18b2177e9e12bcf37de93902d7227f5399cb12", "object_relation": "sha3-384", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449379, "uuid": "2cf9911a-6d7d-4b9d-9eb5-99f57be40a99", "value": "T15A11CEFED2E82CC5D79B22D4251C3B82116DA7337A298B1CBCDD0017BB5D9DA4C7824A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449379, "uuid": "ce18e416-cc0f-4adf-bf6e-3ba8511fc01e", "value": "24:Gg5Gro0BDdkeoOuuL+6MPk2KTtU6udf6MPk9E:Gggo0BDSPOuuL+6MPk2GtU6udf6MPk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772449379, "uuid": "2f740b18-0d49-45be-aac3-309ca9f5caca", "value": 1048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772449379, "uuid": "a09ddb15-dfd2-4b00-8e93-dbff09edb8ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449379, "uuid": "d955aa04-057c-43fa-a9d6-9fb79d5e619f", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67279b7-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475777, "uuid": "b2a1a22b-7064-41bd-a720-25a0cefa38e0", "comment": "Malware payload (Mirai)", "value": "4fc57ebf96c2a3b7c4564aab3e8b6f5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475777, "uuid": "84c8af8e-dfc4-43f8-b319-586598335b39", "comment": "Malware payload (Mirai)", "value": "13b88842e6c83833bee6d338457facbea25c4a0d2f6bc15057b272a1e7db406c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475777, "uuid": "6f87a829-8a56-4fe4-9fd1-a4debfbddf96", "comment": "Malware payload (Mirai)", "value": "20ab41123af74e1dc00d589145be22323b9f4e05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475777, "uuid": "73387a93-3a6b-4d8d-af27-5007ced0330e", "comment": "Malware payload (Mirai)", "value": "97195decb525b2be4e6f6ac833d5b13165a408a222dcfb434082961feaf0ebb352bd9e785007e4b56f0aeae5dc966359", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475777, "uuid": "f89b4363-044b-4688-b62e-251b6fcabf30", "value": "T18DC3F709EB610EFBE86FDC370AFD070525CC651722A87B7A7574D928F64A24B09F3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475777, "uuid": "2e2cafba-6f87-4b90-a474-0bc915fbe8f6", "value": "1536:wWeUSZ25Dy5uMePxR0hFXZHsGQHW2qDOUu3upPQiA1QpZOWmNEMvle643389jlxi:wWeUSZoDTR0N5FQiAOpdQDP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475777, "uuid": "a52db3ed-ec2c-4feb-be13-725e5ba89a56", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475777, "uuid": "d8b2013b-c4a6-4e93-8d7c-642269ecd885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475777, "uuid": "345adc08-5e8d-41bf-a55a-06d82c1f4528", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2ca8a9-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487522, "uuid": "4aadd6ec-ab49-487c-94f6-e03614de8f06", "comment": "Malware payload (Mirai)", "value": "ce9f605005920cfa50fb77f50263528f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487522, "uuid": "d954b58f-a73a-42ae-8b4c-2c3d1b3f2a11", "comment": "Malware payload (Mirai)", "value": "148b62493dc8d2301899f387fcd8137368ffd6e8f38c827e47d8fc383ed12595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487522, "uuid": "8c650eee-9323-4edb-a856-5eb09e845f30", "comment": "Malware payload (Mirai)", "value": "1fd9317a831fd58ae144719ab3184a165f4ede84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487522, "uuid": "f21bacbb-f740-409a-879c-f71b7d04e45e", "comment": "Malware payload (Mirai)", "value": "6de342f3d874b31c4d343ec6c8eabcf2bb052e7af2e6bfe37c16f9b1af1e143660b75f084335551f8a45e73ecf313afa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487522, "uuid": "608bb19c-588b-4f3f-868c-0d6aea8b658f", "value": "T1A9C33906F58180FCC58AC2341B6FB63AA936F1DD1238F2E76BD4AF123E4AE614D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487522, "uuid": "00ec36be-d30b-426c-b6ad-8d50d5944f77", "value": "3072:j586guLRkHQo8SsGTHb4p1oB4n2pvi5zlLVPmgt1FfzQhRN6Fpjyg4jc:jrguLRkHQo8SsGT74p1oB4n2pvalHXza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487522, "uuid": "a0d5f546-9e89-4622-ac5c-1808cb6d636c", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487522, "uuid": "e9400631-d8d0-49f1-ae0c-be9640c1dafd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487522, "uuid": "49260d30-000f-45b2-8a8d-fbda2c8fa8d1", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42516cce-1641-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772460496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460496, "uuid": "7f254f41-1009-4d73-a688-f7b016321a26", "comment": "Malware payload (NetSupport)", "value": "7d7ebfd81eef5bf98ddc86e867297bdf", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "thesolnov-com", "colour": "#9FD32D", "exportable": true, "hide_tag": false }, { "name": "whoiamsal-com", "colour": "#AB6A43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460496, "uuid": "43a65c7b-898b-4b5f-b3d4-ce1d99e13e29", "comment": "Malware payload (NetSupport)", "value": "14d47a0cb1b42e7146af228459a727c3bf28117dfba6cae91bf2a5319b9f942e", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "thesolnov-com", "colour": "#9FD32D", "exportable": true, "hide_tag": false }, { "name": "whoiamsal-com", "colour": "#AB6A43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460496, "uuid": "855bf669-66a2-46a8-b438-a1f060c93527", "comment": "Malware payload (NetSupport)", "value": "ca6f0dd2b30a743d112ec5f5216d063d97eda043", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "thesolnov-com", "colour": "#9FD32D", "exportable": true, "hide_tag": false }, { "name": "whoiamsal-com", "colour": "#AB6A43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460496, "uuid": "3bcd16d2-6947-4842-b836-646b2976725e", "comment": "Malware payload (NetSupport)", "value": "fbb487e0574dc372edb5225d67729dc26b4360c9529c4153f27a022d0e588c2f3b3b21f0ccbd29ce597e3a548440805e", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "thesolnov-com", "colour": "#9FD32D", "exportable": true, "hide_tag": false }, { "name": "whoiamsal-com", "colour": "#AB6A43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460496, "uuid": "ec8a18eb-520e-45b1-b1b7-b1135f415d3d", "value": "T1D6A5339A990989DFC95B4F74C10B5E1AD33E3A41F25E7080F6728252CC89B9F4BB871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460496, "uuid": "45ffa796-7613-4242-bfc2-17bdf33cbf16", "value": "49152:hCWKcquaRYrp7tnGVnJTmm3F+WVcBdj3b2+3bw/0JBAThAnE1N9H:h9quSSRG/VYj3b2+30/wBeVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460496, "uuid": "fd8ae931-ef02-46c6-a789-7f62e0cb65c2", "value": 2214677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460496, "uuid": "39e5258f-1721-451b-a929-15c6efc192d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460496, "uuid": "f8402357-f6ab-4ecb-85d3-f50171be20b6", "value": "asd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cd299c-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433769, "uuid": "c427dcb6-dd11-416c-91c0-f460d0aff3ee", "comment": "Malware payload (SocGholish)", "value": "bac8670b5f4cdaca30776dc5ceddb985", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433769, "uuid": "c83d0076-1a02-4dee-bc86-e0587dbebc66", "comment": "Malware payload (SocGholish)", "value": "151085ea6438df7c920efc97539f934f4b8fa1323439dd54fb4ba15785784dfc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433769, "uuid": "a29e8dde-fe9a-4470-9740-a7e995dbeae0", "comment": "Malware payload (SocGholish)", "value": "74569f6c3ef1a5357cc5d76f3172be24879ccf21", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433769, "uuid": "11709722-9db8-4627-80fc-9546b128d2d2", "comment": "Malware payload (SocGholish)", "value": "7f401b7b4617b79fd744034666fe25e738d280d349830dcaef345f9a6b729c97d06cc3ce3a1074024c73ad1e3588408e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433769, "uuid": "a10ca5d7-b410-4a3c-9b47-b9a612fd491f", "value": "T158D095FE34240514D7F6A9AD437F6104F00F194424021547CD99CD63502BDD3145968C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433769, "uuid": "7d402b11-a161-4e2e-b0f7-51c7a3cce1c2", "value": "6:qHi4wgO9lRRDRWL/tMo/ke6pdHEso8I4ipXLMKPTT2:XfDRWzt5ke6cs7cM++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433769, "uuid": "a8147825-0079-4a20-a177-fb47cbf32357", "value": 256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433769, "uuid": "a78f1f5f-ba80-4edd-a43a-51b723c46385", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433769, "uuid": "03974a1c-bc59-49e0-a7aa-fe92aeea834d", "value": "151085ea6438df7c920efc97539f934f4b8fa1323439dd54fb4ba15785784dfc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfb784c-1650-11f1-a769-42010a9c0008", "comment": "Malware payload (N-able)", "timestamp": 1772466983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466983, "uuid": "99866e00-b450-44c0-8583-1d981bf279fc", "comment": "Malware payload (N-able)", "value": "d59110bf5cfbb4331c9672752ed1b8df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466983, "uuid": "9c0ab327-17e0-4259-8e96-dcffae35bb81", "comment": "Malware payload (N-able)", "value": "1548929eab74a8b646aa01049af7ce02241a72a8a7f6a6fae6cde76a1c9d5fbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466983, "uuid": "0d0cf520-5ac7-4b90-8f40-a7d0ab894e2a", "comment": "Malware payload (N-able)", "value": "002406d292022b512989ca944922041d4d34e44f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466983, "uuid": "ef2f16a0-d010-4cdf-916d-d3389a30d460", "comment": "Malware payload (N-able)", "value": "40c92563996f3d7fff1170eb6dada647e820b5395e165252c9002fc9283590eee62208a9c638e8c437a3014cfe131303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466983, "uuid": "8f4911a3-ecae-4ffc-b11c-3d237a02b8d4", "value": "T162E633527C88DBBFD4212770C6419BB7529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466983, "uuid": "77e9a0d9-c7a1-45e6-b103-ec86e423f9a5", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466983, "uuid": "0dd4937e-1f95-4b80-97d3-d8230d4ec9b6", "value": "393216:iMF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1S:hrRxvoC/7a0jUxX7h1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772466983, "uuid": "d034e81b-50ac-4801-ac94-e4dece1c12d9", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772466983, "uuid": "f581e83a-b6aa-4e6b-a75c-e34672dd8401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466983, "uuid": "b079aced-7d2d-41ef-8f19-ac60e7a05a72", "value": "stm.bz.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53fb4fd-167b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772485600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772485600, "uuid": "93bcb903-0975-472d-8b14-62045cbe3530", "comment": "Malware payload (Mirai)", "value": "58f7c47193421ced3bff79bad2d9ee87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772485600, "uuid": "4145e486-a440-4c5e-abf5-110c4150bd97", "comment": "Malware payload (Mirai)", "value": "16041625a28eb024505fc031e9e41cef9e496701de24ff9bf268be203a672d07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772485600, "uuid": "a8d10a06-925d-46ba-b676-9d410dd40a50", "comment": "Malware payload (Mirai)", "value": "a13c44970a1b17ac3883b2440465444b3b1df958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772485600, "uuid": "617b1d62-3318-49de-a20a-25b0d50fc537", "comment": "Malware payload (Mirai)", "value": "15c6df2077dec0900d1c5e83e3bdf034d879a8971af0eb8dd23b3e27b7c3189aad9bf3e4388a23bfd0240775153807bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772485600, "uuid": "18f9f467-d95f-4832-a6eb-c97e9895c489", "value": "T1C714A61E7E228F7DF668873447B78A24975833D627E1D644F1ACC3185E2029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772485600, "uuid": "67332321-6add-4555-a5a2-5fb7cca0a4f9", "value": "3072:Zi8EeTAUVnwiVe+iOf6WBNeGT3jAbytpiHIJZ8hKVSs7:Zi8EeTD9pZVBks3AytpgIJIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772485600, "uuid": "b3383e42-b6b1-4064-a2d4-113ff69d49a8", "value": 208244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772485600, "uuid": "b9607e84-e4f9-4561-b0d7-57e921b894da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772485600, "uuid": "7653e322-201b-4b1f-8bb5-55639ad4bab6", "value": "csk_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac76c7c-161f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772445907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445907, "uuid": "fb13323e-6b91-4c2a-884a-500a3da9d037", "comment": "Malware payload (RemcosRAT)", "value": "4dbfb6243391b331061f06eee7975db3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445907, "uuid": "1c3c61f6-c276-486f-8f7a-c6ac802dfc5c", "comment": "Malware payload (RemcosRAT)", "value": "1667fb0fcbe87d1119010c4624b0f2c78cddd2b5012b143ec7cbd8c83f85bdee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445907, "uuid": "0feec6aa-d446-4ea5-9762-e33ca1d75f68", "comment": "Malware payload (RemcosRAT)", "value": "579912269988ec7cfae7c063a4ade531505fc402", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445907, "uuid": "de1bb927-63db-4568-8168-705530c7a168", "comment": "Malware payload (RemcosRAT)", "value": "afd43fcfce53bb5516f5d360eef63e610305d1f8d91110d18c146a6a728a59f03ef4b73e6a996e3c324cd05593316e3b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445907, "uuid": "e8de0e4c-4275-401d-bd6a-2794e82f9dc7", "value": "T12AE5D09467D83F5D84F86C2611FBEE349BB48EB52609E6CBBC6B3F1531324883916D90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445907, "uuid": "0f3d1a02-88cd-4b2a-bbbf-fbba8bdebb85", "value": "24576:0f/HGsFWjtcJYTFjsMeaTVsEn4lZjGvoaB6JpjNhENOYNql4rkunuwNKX253rU1y:XGcm+WdN8/w6H0ly0skm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445907, "uuid": "374234f3-17af-4cfc-bb4d-0855aacce5fe", "value": 3298628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445907, "uuid": "8e371b3e-0f69-4cd3-b6fa-67c5221f68b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445907, "uuid": "fe74f288-3073-440b-85fe-552486d19560", "value": "4dbfb6243391b331061f06eee7975db3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35659bb-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475772, "uuid": "29fb7953-7c93-4cdb-9b95-db7b13e45616", "comment": "Malware payload (Mirai)", "value": "7d005c0ba350e43887dfb8b14c8733a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475772, "uuid": "a3314a15-fec2-4fd6-b5ec-2c0cc762f44d", "comment": "Malware payload (Mirai)", "value": "16be4f7c50e4bdd814a329eed2c11e46046eda33a1be56d740922f212b6417ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475772, "uuid": "4002a533-a80e-4a57-8fe7-250882a5cc4c", "comment": "Malware payload (Mirai)", "value": "cf208d15fa3141152996238959326b2533d472e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475772, "uuid": "5be2e860-a5b7-4f70-86f5-723b5be64786", "comment": "Malware payload (Mirai)", "value": "b156f4ad8e14bcfc5d12e18455866ebf4d7786705513946d76857fdb5de516ce7ac7157aa2b7c20b09c1d01be977b378", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475772, "uuid": "1a8d50b7-3064-4a5d-a51c-23351f5723bb", "value": "T1428339C1BA8BC4F6D80748304067F33FCB32E5394066D75DEF6A9E26DA376416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475772, "uuid": "1deb5415-cfa2-4645-a229-ea8b9bd5ada9", "value": "1536:xp8qEknpXLVUkYWZW4SIWJawNK2oXcKQW2E/I9e:hEkp7VU5WZ6ouK7XXQZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475772, "uuid": "a7810430-9568-4ad5-af8e-801325f1e018", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475772, "uuid": "8fed6965-e659-4f4b-828f-b933b9682ae3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475772, "uuid": "491a4d26-2f5d-4274-9494-ad6901d57fe6", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b88333-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476304, "uuid": "bd3c5810-51a8-48b0-b255-9d6e0f5653f2", "comment": "Malware payload (Mirai)", "value": "fd959b7a5655d96db9905f5435b5975f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476304, "uuid": "fc9d06cd-7d74-426c-8065-d663c0a726fe", "comment": "Malware payload (Mirai)", "value": "16fcc12d6af8dfe811de7193f6f46f2e266d78db13d2f095f3b10d5aa1d73f8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476304, "uuid": "19c236df-aa2a-4d61-84f1-8e41c41b454e", "comment": "Malware payload (Mirai)", "value": "789ccd6a95d8bd4da4eada60dd7596c49242d437", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476304, "uuid": "a2677cf9-ef40-4037-8408-e14da71791f5", "comment": "Malware payload (Mirai)", "value": "955c5b0fdef12944eefa2d2390a5902bcb4a32578c3cbc5689376b8bd8ef653ecbb2a9fff6e862e62135cd99c660c419", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476304, "uuid": "6b71180f-422e-4452-844f-21bceaccef5f", "value": "T184531A52FD42CF13C5C321B3BB9E4A453B166BE8D6EA32029935BFA137874C70D26A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476304, "uuid": "cc8e3c66-1cde-40f8-85bc-cb34dbfa7867", "value": "768:cdq7L+I6zVlRbxxL1JAYBRGlNUCXw/cMDwJGtG8+8Cd0OC8xi/0npSMhbpTmaDVF:x7sItNUuoEe+jd0ObLZhFjDhqv7n3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476304, "uuid": "705d5a09-e71a-4e13-b6bc-48b614b6c676", "value": 65680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476304, "uuid": "a1eb2de6-4d8d-4a2f-8983-e37152d856f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476304, "uuid": "0aa65e30-e7e0-4014-b86c-c2969648a7bf", "value": "a-r.m-4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ae508a-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772465176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465176, "uuid": "69ae3336-e15b-45a6-aabc-fbe4643732c6", "comment": "Malware payload (SalatStealer)", "value": "7412764df59fff2b337bac97b8a8ca19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465176, "uuid": "2c9786e9-5d99-4dff-981f-b437c13fdf60", "comment": "Malware payload (SalatStealer)", "value": "170ca5429b1a2840c7c7eb5fb73471917c1f6f659a5423df4a8d6a21f2666e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465176, "uuid": "f9932a4c-8b73-42d3-a013-644576163f29", "comment": "Malware payload (SalatStealer)", "value": "3f73a1553335bc4553bf81a9337f1f345db594f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465176, "uuid": "b562968c-5bdb-43b4-b5be-674d25d438fc", "comment": "Malware payload (SalatStealer)", "value": "b0ec422b532e2ae288199ee04a872fde0396aadd2273d235271e2d871c6f97f95c06bc7dfba59263ab32fcf46b6bbf1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465176, "uuid": "6756a9db-407c-43e3-862d-95f06c9d3893", "value": "T1AAC6480EFF8ACCB5E5D2493D44A6D27E2331AC405A67877BA7043BEEBC776701926241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465176, "uuid": "50664fb7-8587-47b4-991c-8bde7c464014", "value": "49152:iyUDsb6g3Fq4z5IidYXjOVuVgH5DNf/PArssG8I0tpUtwsen6yPbEHNDvHPgkWbw:RUipV805N7Sqykmb3cKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465176, "uuid": "eb2a6fbf-dfc3-4390-840e-f1b838e6f7c2", "value": 11988992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465176, "uuid": "9f995ea6-d3bf-454b-a0a2-075264e52336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465176, "uuid": "4ec09086-1902-457c-8dc9-839601a734b4", "value": "j730xhg3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdde4d28-1612-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772440517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440517, "uuid": "2d5a34b0-c619-42cf-a60f-249f0edd9184", "comment": "Malware payload (Mirai)", "value": "cc4a95f57ad8a05f63ec5d41dfd44314", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440517, "uuid": "bef33edd-9526-491a-8ea3-73b96015207e", "comment": "Malware payload (Mirai)", "value": "17296f1c33dcd1d9ac5c6dea68d0f1d83c689d775a0e45fe9f5658d9c4bcb29d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440517, "uuid": "fcdc8737-a350-4c58-83db-8664223b5d4e", "comment": "Malware payload (Mirai)", "value": "4255056f5ac64bbfc1931d8cac49d3b64d78a600", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440517, "uuid": "166b3375-0e23-44c1-b3c3-317d3c568bdd", "comment": "Malware payload (Mirai)", "value": "dd6b95dc9f15922e0cf906303248e3d495ed63ffb188a6e91fc21eebb2ffd741b213ef98f0986899b2402852b74b9068", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440517, "uuid": "75129c2c-463c-42b9-969b-7465cf019d6b", "value": "T181361997B8914A83C4E43676BCBD81C433A75EB99B9713666D04FE3C3ABE1980E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440517, "uuid": "212c9e2a-d259-413a-95eb-ca209e5054e0", "value": "24576:Tfmr2UrHZrNzUAx8wPH6FhIIrzcpiKry2E0QB8e78Lst9zvfNA/iOcWnYdOjV31X:kuKofJ+ACI6Z6NituFkINlkNHXEr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772440517, "uuid": "750a9a65-ec76-4212-adab-c99fb3edb8fb", "value": 4915352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772440517, "uuid": "17747071-5e84-4fa2-b0a1-b0c88edef995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440517, "uuid": "cab061ed-aa75-4d3c-a948-9e366b0cefe0", "value": "android_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0915a77-15e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772420362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420362, "uuid": "c741766d-6cda-46e7-82ef-40f8fc21ba6d", "comment": "Malware payload (Mirai)", "value": "9d2ba43d55d094f25a68b027d0b1775e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420362, "uuid": "5f6a584c-6af8-4ce7-aa97-923c5d4bc019", "comment": "Malware payload (Mirai)", "value": "17ff5eb7506a556186ea1165b600940d2669510a4de6929fbbd911477f56d1fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420362, "uuid": "c89463e4-63a2-4690-ac9f-cd31a3dc8418", "comment": "Malware payload (Mirai)", "value": "85314b43917cf82b24edd1b29a39ac98960457d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420362, "uuid": "c52c7283-f6e7-44f1-9dd5-51cb006c70f4", "comment": "Malware payload (Mirai)", "value": "16c7f80b6562e165d2b548089ca6e212ff5a6d737214bdbb7093f22a15bf1dccf3a1127b8d36b8c91292028fe452d51e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772420362, "uuid": "6af563f2-2bcb-45ff-bac6-1a76d169c054", "value": "T1C10428C7F800DEBEF80EF73B44570909B230B7A614925B732257396EED3A1950567E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772420362, "uuid": "0513d148-5bf6-4072-93e8-3b9c33ca73c5", "value": "3072:/LJ1+wT6GolXf9lubOmdLt/smon8yHQDCIFtpZ9wpfyaoYHTtdd/skddVfjbibLR:/l1lT7Yv9Ukf8yHECIFl98ikdQLo7kF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772420362, "uuid": "fb8c0f28-c1df-45a0-b18a-06aaba9422b7", "value": 176800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772420362, "uuid": "3bfd2cd8-0c62-4245-b614-7314a3281578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772420362, "uuid": "28da5d37-8a2e-4ff8-86bc-b5f39ee1c5ed", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef210f42-1609-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772436734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436734, "uuid": "12125e21-1467-4ba2-899d-4837ea3de0ba", "comment": "Malware payload (AmateraStealer)", "value": "c2fb00c5319dcde0f23febe5df5dc517", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436734, "uuid": "692a6748-ed0e-4314-a98d-2fff031067b7", "comment": "Malware payload (AmateraStealer)", "value": "1809e9ca0c8091019527cdf598d985c07e28a4fdd4079193ee83aa3341660569", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436734, "uuid": "fb5c358d-8787-47b4-aca5-f98ce361f5c7", "comment": "Malware payload (AmateraStealer)", "value": "7bb567cda1be4b7dc5acfd2bc3a4ffd8d728c5bf", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436734, "uuid": "2b8235ee-9ce1-412a-8eb7-bdc3ad00d0dc", "comment": "Malware payload (AmateraStealer)", "value": "df1f5aee3f5eeee99e4e31f6c0d0fc284fdb7ad4fd53cc16fdb7b103646dfd120f11384551543c3413a1388293e520f8", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436734, "uuid": "aacb8681-cafb-4a5f-ba4f-8e26d4dc86c6", "value": "T1E4C533228E967CBD086CD23061BB065945E14DD09049FAEB73FA8BC7CB867E1445BCEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436734, "uuid": "c2d5c0ee-dc76-4ba9-9212-5725658bb44c", "value": "24576:pKt+wCZ1ENESRLgkkO+H9rO21hFxF0zB+kL63ho57TcAvd3sChnMv5lYpkpok6jh:NwCZAHESFE3rscGuEgd75Ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772436734, "uuid": "e20ba068-2e9c-4509-bda1-c7fa00f97cef", "value": 2741354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772436734, "uuid": "74b17b9b-6543-4ced-b9ed-b2d3ea6df7ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436734, "uuid": "eca03cc5-47b3-4520-a9c0-52fc116abf16", "value": "1809e9ca0c8091019527cdf598d985c07e28a4fdd4079193ee83aa3341660569.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931441bb-1619-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772443452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443452, "uuid": "8310dd05-f7b8-4cbc-b183-0280047b10c9", "comment": "Malware payload (Mirai)", "value": "7601c53353307ea03234d06f703898ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443452, "uuid": "29a862f5-ecea-41e9-a245-eff341657a49", "comment": "Malware payload (Mirai)", "value": "18146e589112802a694ed4bde7815a0c010fbba5730d3dba7fbcc62a2ea541aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443452, "uuid": "ff4eec18-f0f4-4fe6-8720-76b7660eb38c", "comment": "Malware payload (Mirai)", "value": "13deb5191f2844277ecab1c14ec0fb53570160eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443452, "uuid": "57066e6c-3577-40f0-954c-d323bf6991fd", "comment": "Malware payload (Mirai)", "value": "d6b905370aaa281af943ffc5243d4af0f493d7d501b12feb2463f805c167193e2d01edcce7d64fd4cc26bde142f08b6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443452, "uuid": "b3f33949-ec58-4d7b-a7d1-0d074abc7557", "value": "T1C8E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443452, "uuid": "e7aa40e2-1db3-4b94-88d2-8990ef874a5d", "value": "3072:Cv/WwsLgaq353qHiCOvhOpVqkDQHbeskmhxQwoVSUNu:KPLaq351hOpVqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443452, "uuid": "f227dafc-6a8f-4032-9d25-b1781e1ac5ad", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443452, "uuid": "c34fa9cf-7832-47ca-be2b-19fe511dd0b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443452, "uuid": "8a087b74-92dc-43f6-92c7-63c38d63c576", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac2f02a-166c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772479167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479167, "uuid": "a18641f4-df90-4384-b90c-f80239d76885", "comment": "Malware payload (SalatStealer)", "value": "ac39dd0a7c37d0dbd77633807bf07996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479167, "uuid": "1f05408c-9436-460a-b243-2c1a2cc33d93", "comment": "Malware payload (SalatStealer)", "value": "19566cf37f02560342499306c175fc85c5d8e95ed7d0b813410f51e4a99df995", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479167, "uuid": "2be84498-55c0-4bb7-b009-a3303085d926", "comment": "Malware payload (SalatStealer)", "value": "a6e5c086aa8330745764578d7b5a72dd1c5097d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479167, "uuid": "f30e7cdc-9689-40f4-b472-33187a14fd68", "comment": "Malware payload (SalatStealer)", "value": "a620b3aca6682af5aa2763a1a7842f74137e1b3cfd3a5974c942b2b1674e2031c700f900cfabf1a2a71fbfba2ce6139e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479167, "uuid": "6cbf8751-d013-4f7b-bdfd-771df9d81e68", "value": "T199E5339EA8703EDCD277803942D7A2DD125BF0DD42C2D8EE0368B9EE1958D158ADDC8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479167, "uuid": "3fe34c7e-2063-4939-9e81-081cf0c06083", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479167, "uuid": "154614ed-4489-4321-84fb-04dd82f3ac4c", "value": "98304:3XWsJibvQtxF9EPIbEAv09jAJQb8+CWwuNp:WpQtxaJAv09jAuTCWwun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772479167, "uuid": "73b38ef0-aeb1-493a-b963-83288586d9ea", "value": 3296256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772479167, "uuid": "15827d02-3736-4d59-b8fc-f2bb9582d78b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479167, "uuid": "3398c398-565e-49d1-b0f4-0723d6898746", "value": "NURSULTAN CLIENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872cb9a0-163b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772458035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458035, "uuid": "6f56d7f7-9ae7-49b4-9cb8-ca35c483fecc", "comment": "Malware payload (NetSupport)", "value": "aec765b565cb04b1c931390625b9f8a5", "object_relation": "md5", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458035, "uuid": "a70bb5d6-dc9b-4767-baf5-3ae305b2e933", "comment": "Malware payload (NetSupport)", "value": "1959286c5f8879eb354226d29937a46d769de7eeff842af22a06f07fdc03d88d", "object_relation": "sha256", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458035, "uuid": "649e9f82-acdc-409d-a067-9d3d51340c07", "comment": "Malware payload (NetSupport)", "value": "0346e441e071be98b99db73762e1c7e5fe6f154b", "object_relation": "sha1", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458035, "uuid": "b06acb53-0330-4b35-a22e-198d916d963f", "comment": "Malware payload (NetSupport)", "value": "2bbb4b4e9622ac66af6bafdc09cc0d5356e812e4500863b39dda5aaa799a5faa7d31589fc3749845670c75ba816d84cd", "object_relation": "sha3-384", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458035, "uuid": "9b43d841-09b3-411a-b9b3-67b289fee3c8", "value": "T10C617709E5A1883041838B9E88DE6C08A19B48CF811B5D64FD8DCE4D1F33A388F7E65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458035, "uuid": "753cb3d2-8ea8-4761-8830-d780cf998068", "value": "96:ZnQ8eCrOJ1NQDvZg8YRaxKiUTzgqxaybI4ooedb1qJAMrenR:ZQ8eCrOPNQzZg8Ycsi+z1cybI4ooIb1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458035, "uuid": "549d99d1-0f1e-4e61-8ec5-f852e591005f", "value": 3469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458035, "uuid": "81b432c6-f72b-4826-ba60-087dd4cc26c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458035, "uuid": "a61a7e3c-78d1-49f2-8fac-7cf42fb328ae", "value": "1959286c5f8879eb354226d29937a46d769de7eeff842af22a06f07fdc03d88d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef2252c-164e-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772466181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466181, "uuid": "3741b971-3ce7-4c9d-83c3-4b2585dc713f", "comment": "Malware payload (XWorm)", "value": "cd2469e3d7b8e716281f769c952a903f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466181, "uuid": "d7a29ad3-3e1e-4675-9458-59cf5e011e45", "comment": "Malware payload (XWorm)", "value": "19c6fed03e361b44e9becc7378847d800fee2d623e0aa7a0a9f096c9529e83e2", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466181, "uuid": "158f9dcf-ea01-4ea3-b55b-a8cd1f6295fb", "comment": "Malware payload (XWorm)", "value": "4b8f1e26d187912f35f95b5b31bd66e1c6389e9a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466181, "uuid": "719bf8d6-39f8-47c4-996f-dd43810412e0", "comment": "Malware payload (XWorm)", "value": "a3357630662ba88a596469ddbe9f1e5bdbbfca1ca35ae81f8324a46f1da05a004c0e23ad9fd730c0dfed693bcea12138", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466181, "uuid": "8ca14daa-7270-41a6-9edc-28273f312371", "value": "T191D18F97871EAE73C515DCB12E210EF158A020C13AB82A259C86F27D099BC5563FCDFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466181, "uuid": "ad5af6d4-09b1-40b2-8fe2-d2becffe6c4a", "value": "192:hr4wBDSiKhRY6ixhvP3JVBP3VeiMINNlZUBrZo:hrpB2iKfYDhvBLkiMAZmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772466181, "uuid": "86124ec0-c638-4970-8e5f-1e6caeb637ee", "value": 6592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772466181, "uuid": "2a7ca262-916a-4d42-9051-059b9d32c89f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466181, "uuid": "24afc05f-73e8-4318-848f-dd882e094033", "value": "Desc_Qtn_350_02_02_pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79eab2b8-1652-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772467891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772467891, "uuid": "eace1dd3-28c5-44a8-b9e4-7bcaff3cf152", "comment": "Malware payload", "value": "c16e34136024dcee8257f7847cd778a2", "object_relation": "md5", "Tag": [ { "name": "62-60-226-159", "colour": "#181FB4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772467891, "uuid": "b4a15614-499c-426b-9a00-0d448f3dbcc6", "comment": "Malware payload", "value": "19cf650c891876f51413ba4448ad3f29bcab6271a4af6146718c4dc6f1af8a8c", "object_relation": "sha256", "Tag": [ { "name": "62-60-226-159", "colour": "#181FB4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772467891, "uuid": "ba7d07d4-e2a7-4ed2-a378-e80f329da9a6", "comment": "Malware payload", "value": "8e3d94579080b2efb8d9d2fcd3c3b5546bfc88ee", "object_relation": "sha1", "Tag": [ { "name": "62-60-226-159", "colour": "#181FB4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772467891, "uuid": "a1414b72-04ca-4a65-88ed-1e3f0fb1eb23", "comment": "Malware payload", "value": "1cfe873583a8cf87ea66cddd2546d1308a71f6b46a490ebf2574d608233b17b7855b1efc2f5cbfc7e4c86bb249ebc99f", "object_relation": "sha3-384", "Tag": [ { "name": "62-60-226-159", "colour": "#181FB4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772467891, "uuid": "44f3307d-56a9-4856-b8d9-153f5cc5e6fe", "value": "T133547C15B3A414FDEA6BC17DC9424945EB72BC5647A1EBCF03A04BA22F136E09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772467891, "uuid": "f4d62f1a-bef6-4160-a039-f6d0970cbcfd", "value": "8f1204fd0f9e5fde1ea21874e8cd273b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772467891, "uuid": "3a3f66c2-0121-4d70-b586-c6d1d39d2763", "value": "6144:Y7W38hxAg1cLdQiZGP19vPdbbP5F41AcM:Yk8XsdjkXvRbH41U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772467891, "uuid": "0914521e-5491-4a9d-b025-34efa6005ae9", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772467891, "uuid": "f6f075b7-db18-491c-a43b-8912d5e8c541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772467891, "uuid": "930bbfe0-1de5-4dc2-a810-40634c852637", "value": "3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11f428b-1643-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772461595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461595, "uuid": "8d13852f-ca32-497c-b5a5-d62426d3abdf", "comment": "Malware payload (AsyncRAT)", "value": "878bf5702402cb58f6ae038b148d6e11", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461595, "uuid": "dc0f7153-ca7f-486c-a1e2-1e5bc95d6f18", "comment": "Malware payload (AsyncRAT)", "value": "1a193ae47578bbded0a252070695b36d6ffea7ddf264917aa4b45afd3ec4361a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461595, "uuid": "bddd4e9b-4376-4765-9deb-9f136949433f", "comment": "Malware payload (AsyncRAT)", "value": "a0129dd59b9c7d6090674627f7bed7b73c1e7809", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461595, "uuid": "28e4506e-ac19-4eb0-8bc3-710955132f23", "comment": "Malware payload (AsyncRAT)", "value": "6f51daf8cf5b14d1873360384e77ec1f32e5df6a352398a4958c98f3388b96e309a5dd77c80c6b17a54f2c089185a1e7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461595, "uuid": "0dfc4c66-3c62-4558-9385-5693b4733acb", "value": "T13CD24B08B3D88561E1FD56B94D7293048775EE5B9973DB9E1FC440AE2623B88CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461595, "uuid": "693b1a3d-4202-443b-a5b9-dac91219da81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461595, "uuid": "9a897418-a1fa-4433-a785-fcc0a6774f5b", "value": "768:9MARXV643iqBkgg/cIRGqoW/Rb7fB/dTB/+:2ARXT3iqBk51ioRbN/r/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772461595, "uuid": "9bd54318-6886-467f-bd0b-455a42bbd3e3", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772461595, "uuid": "d23195ab-f439-4b26-be1b-46e5cf5c05a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461595, "uuid": "47c4d2db-44f4-4e16-a7a4-28c31a51ee71", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b165a26-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433802, "uuid": "99c1d295-6026-488c-8378-2e5e171f5ed6", "comment": "Malware payload (SocGholish)", "value": "3b60863e4d67649851c77330af03aa4c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433802, "uuid": "9a5f9346-7af4-45b5-a652-a477a064945e", "comment": "Malware payload (SocGholish)", "value": "1b5535d779d9106299d687b3f1987b8150c33c35f52f9d48503d2a27a5970a68", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433802, "uuid": "1b915ceb-d5bd-46cf-9fbd-ac610337aee6", "comment": "Malware payload (SocGholish)", "value": "8aae8450e03f0b86ee169eedd25955823b2ea740", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433802, "uuid": "07f895d3-a9e4-40b3-aede-99c0f737d72b", "comment": "Malware payload (SocGholish)", "value": "a52e9a6caec079402b6bd9dc74722edc640d72eccedd2d92e8b8eb6c027059d8b36a68f680af5303c700e68666d2a31f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433802, "uuid": "c8b9b824-6427-4e96-aaf7-3fa08e60f90e", "value": "T132E07DB71C8B04283A365DE1977691ECE1423728A614A8B6C927CC14F6106E615567DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433802, "uuid": "fba68bf0-5def-4d59-98ec-5942abb56748", "value": "6:SYsCJQjd3AgO9lvYKyuRWJhh8U6pdsG+652SuSg+H46I9QnHgIWf+QGjyn:sCed34AvuRWJ38U6v+o46IqnHgIYB/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433802, "uuid": "89f47fb1-690a-450d-8231-f2f01493c4d1", "value": 319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433802, "uuid": "4ba1458f-adbe-4dc0-b344-7fefd2ca4654", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433802, "uuid": "9f176295-f18e-4897-bbbb-905d2ef68ae6", "value": "1b5535d779d9106299d687b3f1987b8150c33c35f52f9d48503d2a27a5970a68.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fe104a-166d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772479486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479486, "uuid": "4fbe64e8-ba2c-4f29-9286-2f3e33970cdd", "comment": "Malware payload (SalatStealer)", "value": "26f1f38a8119680c60f7d923a0375410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479486, "uuid": "a20f9d2f-6f29-44d8-a022-ed735f779b4c", "comment": "Malware payload (SalatStealer)", "value": "1b6bf7991b2126158de51b8a798da5d0d3b5f169a09cfb4b0f3a9a1d2efe9c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479486, "uuid": "b89556fb-efce-4bc3-b02d-a88be5956e5f", "comment": "Malware payload (SalatStealer)", "value": "1a594d98be585eb58b873ba98c0dde24e7df0631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479486, "uuid": "ec070b48-b847-4e7b-b9a4-c05d853c4032", "comment": "Malware payload (SalatStealer)", "value": "22d909f5eb4b7d31b4c5ea02e9f701143ae8f37af1cc583a912b7321a86f8790cb5f4a51fb53319d323c7fbb828d1654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479486, "uuid": "c26a0dff-41a6-4144-815c-566044f8f551", "value": "T1DAE533687C2A9B30F8F346F64AE6C59AADF6105F40B01B1E4409DAF9D73B5C1AC814F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479486, "uuid": "110b6224-7e49-4457-ad8f-9c11c10866b7", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479486, "uuid": "92a12384-04c9-4243-b57b-04a2539fd7c2", "value": "98304:+BN8mpKUu3KC3uD1n0OhjGEMiyGI0Bt73ufUHy:+3M3uRhjGEMiykt7+fT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772479486, "uuid": "e56800b4-b4eb-486a-a1f1-4aeeeb4780c5", "value": 3296768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772479486, "uuid": "a1ecfff6-0d5d-484c-8628-336a58abc1dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479486, "uuid": "b09239b9-6529-4a39-8c83-e4c769105369", "value": "Nursultan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e290e8d2-163a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772457759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457759, "uuid": "f93b2b1e-36dd-4c1c-a619-930c98ba06dc", "comment": "Malware payload (SalatStealer)", "value": "8c19968ee0f191457f72fe035ac3ce80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457759, "uuid": "b76ea152-04bf-4b89-a802-e30cb75d7dd5", "comment": "Malware payload (SalatStealer)", "value": "1c3ef7fdc5976509be05d36c0b41ae0c727ac9045adb16180b7289c6a34adf59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457759, "uuid": "aac7503d-8cc3-4f44-b0ba-fd2cf774478f", "comment": "Malware payload (SalatStealer)", "value": "d2d06b5ce92fd091baccdf6ebbde2fcf1a01b9ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457759, "uuid": "6ef6359e-d83e-4dbc-b2ec-050d890885cd", "comment": "Malware payload (SalatStealer)", "value": "f8b5b9c11742f39fac27cc5cb4298397e16ef72fb0c4c510af4fd688227c4dd3ca29fb29511f6ea7511f20f2577a62b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457759, "uuid": "e6671076-d976-4f12-902c-c499f95a16e3", "value": "T1C8C66D41FA8B58F5ED035931506BA23F23359D048B38CB9BEB547B2AFC77A821D76205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457759, "uuid": "906cdc9d-d4b2-41a7-b921-792691c35a2d", "value": "98304:oGUG+Hzthl9uNXqcq2C1c4Z6iDMTV4yEpzV:MbgrV4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457759, "uuid": "82a2459b-24f6-44e6-9675-587ee1cb6740", "value": 12107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457759, "uuid": "40e0c8c8-2051-4c8c-80ef-cec727be4675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457759, "uuid": "4f8bde0e-cb5d-4f2a-accb-fb297ed47072", "value": "wbgqs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eaaff1c-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772465214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465214, "uuid": "1c68b151-c393-43b3-9d7b-a4653eb9efb1", "comment": "Malware payload (SalatStealer)", "value": "5e5086d181e8651f478d57a89637a330", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465214, "uuid": "08e2caa9-b723-4e91-8f79-07af8519ddd4", "comment": "Malware payload (SalatStealer)", "value": "1c68e112ceab669b78fbb2a717370577a43f4a2bc38e4741798ee2de22ee693d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465214, "uuid": "4420dda6-8bab-44cf-b9b3-6e188225df0b", "comment": "Malware payload (SalatStealer)", "value": "6aeec8d925a6a1ab75587bc5c4dd1383e9cb95a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465214, "uuid": "e71bfab9-82f0-475f-ac5b-1b9682ba6636", "comment": "Malware payload (SalatStealer)", "value": "da61f8bc0653abb6c4601b0d56da87c725f602a4bc14d7f16aa11cd0005914ba74e81a872f0dc000e9263880b093936a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465214, "uuid": "83f8d6ab-69d7-475a-882e-a8e4bd74fe68", "value": "T1E5C64A41FA8B98F5E9031831406BB23F63315D049B28DBDBFB547F6AFC7B6911966208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465214, "uuid": "98bbacbf-39ee-4556-b304-f3c388f30c28", "value": "49152:kHsMJ55Q36bKKGpw3F+0hN+pYgcSp1iPylE5iJ/nPNFax3BQ9rMEak+SqpmWACDC:K7J55AKSi8J/DaxWhV+DZ6bCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465214, "uuid": "7e071fc5-d279-4bd2-bbb8-d64719f6e25e", "value": 12115968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465214, "uuid": "43c92570-d9b2-467e-9e01-69ce4dc4d34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465214, "uuid": "b6a91070-c9fb-4e27-ba2a-79c6936db472", "value": "TEST2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02c5341-1633-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772454668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454668, "uuid": "67f39a14-9389-4f26-a4df-c9a43734bc7b", "comment": "Malware payload (Mirai)", "value": "8e81641bd3dda08846a39f40a56bef94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454668, "uuid": "ef290f18-34cc-44b4-9462-2c0d05cd9845", "comment": "Malware payload (Mirai)", "value": "1d2aca751901d2958422871f47d7c2322c33345eaa29b088f0cefabae5b11d8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454668, "uuid": "b75a0063-a30d-409b-ad35-3e3441933c5d", "comment": "Malware payload (Mirai)", "value": "33ceed7c13c1b2cf0d3fe59cd03ac924302009c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454668, "uuid": "02d52c1b-fcad-4fee-9063-ee9d544a1a1e", "comment": "Malware payload (Mirai)", "value": "69b82464b924a5e2da3eb90969ac4dba53b7767ff932bdea022b08337746f0fba6d64245f3d4765576cd764fb170d538", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454668, "uuid": "fbc63f5f-9d7c-402b-8dfc-996b6aac1074", "value": "T1B7362850FECB04F6D9031E3144ABA22F53315D098B24EBD7EA547F2AF93B692193621D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454668, "uuid": "e7084e2e-7c9d-4aba-8717-df2b0c26ee8c", "value": "49152:S4gA/zY1+GA48fB4DRpEz1a5caBGQ9Qymj4QIimb:DgArYEGzlWab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772454668, "uuid": "f1466fa1-3302-4947-a5b7-3d797d24f0dc", "value": 4894872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772454668, "uuid": "ddf7977a-bd68-453d-a700-c395954f6943", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454668, "uuid": "7769ffe3-038f-43c5-bdd5-9630d1fae45a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d9baa7-1676-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772483207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483207, "uuid": "581d78ab-184c-4e77-abb0-90084645914d", "comment": "Malware payload", "value": "644b0aacb211638c230e06ee562ed3fd", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483207, "uuid": "10cfd9c3-d9e1-41b9-a80e-3a421de4cb1b", "comment": "Malware payload", "value": "1d51c02139abf63d723ad02a22d67a365bb297a5d97ad5db4c22f5afcf905391", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483207, "uuid": "a099e4bd-6dc0-455d-97c7-84ed15518ddb", "comment": "Malware payload", "value": "72b4238be301331e80063bfda32901a5dfc6d675", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483207, "uuid": "0c4b9bd4-4bf9-49b1-8226-5370057be9f1", "comment": "Malware payload", "value": "c0e5d52badd2be63aaa61fe9927d0e8ac4b08cbb32371c79b83b09d7959b0e989ed03ff7108f7a246376a8fb9a6fae31", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772483207, "uuid": "0f7dbde1-7ec9-4c4f-8ae0-bb6886cc8957", "value": "T19CA383153E49E56582F3A779DD93D808EE3B512B12295504BAEC85C02FF0DA9C3B8FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772483207, "uuid": "84b0c503-014c-46ac-ba88-f596fafec560", "value": "1536:2sq3SicLdsMSYM8ZNiGiMKlrdshJmPxjhQtyV:2N3SicLdsMSYM8ZhwdshJmHQYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772483207, "uuid": "144f2b3c-6cc1-4b0b-ba02-9ff575dacb5b", "value": 99201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772483207, "uuid": "b1fbf9ed-de32-49eb-870e-0f0528a11f41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772483207, "uuid": "de720a23-2ad2-4d41-94ba-567b35068270", "value": "SpotifyUpdater.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5da198-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433782, "uuid": "28f81f56-7fb4-45df-94da-49eacbf3a54a", "comment": "Malware payload (SocGholish)", "value": "60c2d0c6e5259d4e2e467b1e363c1b82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433782, "uuid": "c581fef3-1e15-4758-8584-26fad0d620e7", "comment": "Malware payload (SocGholish)", "value": "1dc346e2d2bd74f2be43a1b91c42f9e926772ae82f6af5691629340cb4fd6f81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433782, "uuid": "cf181297-8f70-4093-aedb-0142a46de390", "comment": "Malware payload (SocGholish)", "value": "d8d4babe5c77aded5ddcd374c142fbf655a89acd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433782, "uuid": "cda0bb31-4672-41f7-9336-7e1f2aa4fa3e", "comment": "Malware payload (SocGholish)", "value": "7e922eaf8094130233fdc032693563ec478296999c8c5277e3f96506bca1224f025c8c7046cda9ac2f0ef43456911543", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433782, "uuid": "cc172290-4f8f-4bff-a43f-247ae273e1bd", "value": "T106016B808B4471F38D032C23326FA586F583A800505FEE2DEE6AC54A54999DE4223E7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433782, "uuid": "b5982660-2e57-489b-90a2-76bf75cc8704", "value": "24:rSEB5sK18uZIsGSEB5sK18uZrguRWeLh8pGO85:rRlGRllweCGO85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433782, "uuid": "02b5f432-585b-4820-9d8b-a3c91a9f4aa8", "value": 824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433782, "uuid": "5fe3d042-bb80-4824-95e3-b3a25e92533c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433782, "uuid": "bcee64d9-14af-4ee0-a526-4a5e180a2fa1", "value": "1dc346e2d2bd74f2be43a1b91c42f9e926772ae82f6af5691629340cb4fd6f81.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad71f3d-1612-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772440217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440217, "uuid": "5a24a77d-bd8d-4755-bd7f-288c3b433f5e", "comment": "Malware payload (AsyncRAT)", "value": "3fa19c46122e236c26ed1608221e4c81", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440217, "uuid": "0ec547ff-8e09-4438-b009-8a7533345ccb", "comment": "Malware payload (AsyncRAT)", "value": "1df76ba49d5aa97b72d9ca83456b26a1ff4d02dae9582ba2a755ddd6bb89c2a5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440217, "uuid": "f6e2cb91-873c-411a-aa1e-e63db84ecb6b", "comment": "Malware payload (AsyncRAT)", "value": "450e8e6cc584960014707c2486c9be4e02f8a3bd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440217, "uuid": "908780af-faa9-4227-bde9-62b514d804a8", "comment": "Malware payload (AsyncRAT)", "value": "8068c0c4b85732099c635b91e4d5b4b32da34bcacf682b6f088e87f5178370b79e0ec4e8bfa0cdec8cce5862451c8ab2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440217, "uuid": "a4e420c0-7fe8-4839-8238-37037c9ae835", "value": "T144F3AE0071D2D475E872157609FC8DE98A2DFE700B429EEBB3D809AA4F309D1E93695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440217, "uuid": "c734d4b7-8544-4f20-bcfc-641011ca1926", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440217, "uuid": "c986c222-a3e4-4132-acd5-d891f61d4b05", "value": "3072:W3AlCua6Ty3XctCkh3jBzBueU9audXzWcXaw3aRHQ/PY8AuarHAtR:DlHWct/jKdXf3aRHQ/PYJuaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772440217, "uuid": "577c9a1d-5bce-4e81-9de4-17ae9341cf4e", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772440217, "uuid": "38fdc232-186b-4db5-bb4a-c6f8a76f720e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440217, "uuid": "f76efcb1-02c9-4b5e-974d-8bd2990a0fa5", "value": "3fa19c46122e236c26ed1608221e4c81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4524b01d-15e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772420987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420987, "uuid": "d335c962-2230-4a0b-9773-af5bd717e4a8", "comment": "Malware payload", "value": "5c82f557738311c1299bd3f9e9c3fa2f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420987, "uuid": "3e54dbc8-9de2-46c6-b0ce-b1571eb60c34", "comment": "Malware payload", "value": "1f501c1e60333b10d8aa7543bb6fa9ae69439a71b6b12d8a0d4fbbdcd079cb3c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420987, "uuid": "a221cc83-2813-4e90-8032-353a5291e820", "comment": "Malware payload", "value": "7444f2e661b2936522291abfaaf2e3ae16a35f31", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420987, "uuid": "7359865d-65ab-45cc-9d4c-6046e4800cd4", "comment": "Malware payload", "value": "373559d354490d5de0c3694e201d37918b46b282544ba02a56e715f85f38b700c306e5d3a41c7f816e5354b182709d49", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772420987, "uuid": "a6454864-5f8f-40d0-a48f-be04a2fea861", "value": "T163F0264000E33D92A3765D589454C94D21572753A293BF34A1F14BD51F7B0C0739F7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772420987, "uuid": "436a9230-cb3c-4823-ba78-b7c40805602d", "value": "12:MquhRnFxvhsQiMDfYd0lG5YYnfbBeYYHj6X:MfnnDh+CYdAG5Y0ofD6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772420987, "uuid": "d6c0f424-e252-47da-b0a5-0dcf47ff71e2", "value": 554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772420987, "uuid": "d46b6a1e-de53-478d-a2a3-27fabe6b6daa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772420987, "uuid": "00de1104-e182-4986-97b9-fdfb85e24bff", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73156a8-1614-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772441472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441472, "uuid": "2ebb742a-1dd8-4daf-812f-4ace4ce2ebd0", "comment": "Malware payload (njrat)", "value": "174da6a93856106586b7cb0dc53b0419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441472, "uuid": "fbdeec01-4883-4582-8f76-6a039c17472e", "comment": "Malware payload (njrat)", "value": "1f8a2fd2b7fbdf3a65fe5bb1718f64f61f8110b512ea76f1bdd050dd44a1cffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441472, "uuid": "82c35a3b-6ca2-4251-9183-778016fc43ad", "comment": "Malware payload (njrat)", "value": "bb7a782bc4948e7c410ab2186d637e4a69cdcd6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441472, "uuid": "ed14d4d3-7add-400b-b193-f72124ed5d6f", "comment": "Malware payload (njrat)", "value": "16aecf0122cd51eb62935bd8c7342ef4653e4ef6c3d92235400b228e92888a5e23a2ad6b2c26e1e0e297703eedadfd26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441472, "uuid": "f1f7e808-392c-49f7-850c-bff809c38e84", "value": "T1FEF3BA9D766072DFC85BD472DEA82C68EA5174BB831F4203A02716EDAE4D897DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441472, "uuid": "a88a842d-53f0-4b80-844e-651dc14fc789", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441472, "uuid": "3e14793d-cf9f-4a19-ac91-2ad5b9d6e4e4", "value": "3072:IButIrtJxiyTWCFmrbnhTL+S/UZvl1jaoXGdcdFA:IAIrtJxTTJYbhTL+S/UZvl1jaoXGdcdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772441472, "uuid": "18d84614-dbe7-4c15-8a17-441fc6752180", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772441472, "uuid": "a1bf854a-4e0c-4d72-ae5b-30c166838eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441472, "uuid": "3a6bf674-9c07-4e42-aa40-f2489cb140ec", "value": "1f8a2fd2b7fbdf3a65fe5bb1718f64f61f8110b512ea76f1bdd050dd44a1cffc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e665e269-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433713, "uuid": "d9099d8a-9e30-4334-b20a-b26a79c8319e", "comment": "Malware payload (SocGholish)", "value": "a39798f77e3aa06202d81e57b5d81acf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433713, "uuid": "5c8d7028-2edb-4340-984c-aebe4705faf8", "comment": "Malware payload (SocGholish)", "value": "2083c85030e626dd734f81a67d5a3931b179a82797aaf9f260d89c4c4a7096cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433713, "uuid": "0c218286-f994-4b70-82cb-ac4745c2dfe7", "comment": "Malware payload (SocGholish)", "value": "c0ff470c3a7739d3d88ffe23692755ebd8d3a2f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433713, "uuid": "91b1b291-035a-4937-aa3e-31a29f37b31e", "comment": "Malware payload (SocGholish)", "value": "7156a5d9ecca3b8a1b4c35e708b71667cd33c7fa9a8a1b51c5d001abedd0c3eb53a4d9fcaaf8e4cc465b638ffcbd625c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433713, "uuid": "8a4bfc0b-b45a-41fa-acdc-16a958d94140", "value": "T1E6D023FD3C4651341BDD169417BFC75D350636145031C6D6DC7DC84007147FA457955C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433713, "uuid": "bfbacf44-e71b-47ac-8671-6255548eaa46", "value": "3:Sdf64UYJJfLHAgO9lNcfJeARDRWUO9U89uNosgKGIRXGX0pNEE/TQBdOMPfiP:SEYJtHAgO9lrAxRWF0osPGIddL/TRMCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433713, "uuid": "7360e275-e8f9-44c7-9bb5-8e9bc49821f2", "value": 213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433713, "uuid": "136d9dc6-c394-4f55-adb7-f611286c6df5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433713, "uuid": "f88e8b7e-886d-4b99-8977-5b03bc7c5a58", "value": "2083c85030e626dd734f81a67d5a3931b179a82797aaf9f260d89c4c4a7096cc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe4360b-1616-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772441970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441970, "uuid": "5c79125a-5f24-4f4c-87e8-f82b02835c59", "comment": "Malware payload (Mirai)", "value": "6b3413657891a026e645bd897192831b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441970, "uuid": "39ba3a96-04ff-4c4b-acd0-d86232ca257a", "comment": "Malware payload (Mirai)", "value": "208697dd0b3579d6479ea35591e710b8295832fa99941df383a5465a6cd50710", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441970, "uuid": "fb8f94e3-d667-4646-aeb2-e24da9454e8f", "comment": "Malware payload (Mirai)", "value": "b35a2433aaf37d0505b7d051210ec96318b0004c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441970, "uuid": "9fa300f5-0c6c-4f88-bf72-57c16167f51b", "comment": "Malware payload (Mirai)", "value": "e79921d19e938b3414a8d5d3e2248790b2575d79faf59b3d59fd52ded23a514444bc12916640e255a9af19fcfa412090", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441970, "uuid": "4fe88e43-053c-4a63-8b39-ebbf7dd7d9e3", "value": "T183834A51FD829A22C5C423B7FB6E428D371663E8D2EE7207DD116F21B3C681B0E6B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441970, "uuid": "ab2057f4-c3ec-4a36-99d3-c190f88fff1d", "value": "1536:RxacwhxszzG5p5+hUgOSYKE3PIoPDgmI7SY6hHYEIMI6wGNK5YfwbZne:RxathxnW5OhK8PIo0rSJEFGESwbZne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772441970, "uuid": "ef00f950-241a-48a1-a873-70419a653926", "value": 88456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772441970, "uuid": "f3a8d028-3aaf-4767-b778-39d1c8b76da1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441970, "uuid": "a59b6820-f2bb-43aa-90c4-d83e36a015e6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe9eb8f-1629-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772450318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450318, "uuid": "a93b65b2-b5a2-4e6f-ac75-7c25ee227605", "comment": "Malware payload (CoinMiner)", "value": "a98c150c2f4a46f58503495b71137fb0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450318, "uuid": "f5f213f7-e454-45e8-b8a0-bd250d71c0a0", "comment": "Malware payload (CoinMiner)", "value": "20dc254b66b8616088c5122b29211d7102306484b550f75caee7ec9b2a02e71f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450318, "uuid": "aa8001de-81f9-4ba5-87ea-050e2d1ffe82", "comment": "Malware payload (CoinMiner)", "value": "0fcd796d6caec82be82ec07480513d28c036a68e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450318, "uuid": "bd4485a4-cab4-45db-bffe-6c309367db48", "comment": "Malware payload (CoinMiner)", "value": "e170dc884e0a747a1af7783c20ab619fa1bff796f751f00c1a9915ea577bab42eeaabc0deb566f9cd9b89967d8f227e7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450318, "uuid": "869e6b2f-28ed-4cf6-8e44-6d9ddbf79c9b", "value": "T176B63319FD9359BAC593A97118AFB37AE7361A0E0607D9F7CF901DA0ED7B7020924306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450318, "uuid": "a211edf0-b9e8-4f47-8a6b-b018362d7a5a", "value": "4794687cac0beee76bb775325b829d22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450318, "uuid": "91e6a8fb-7614-4e57-b663-4b0eb301396f", "value": "196608:k8AJgyeuPivvI4+7IDSJB9CL8PxLrIyrIuUVqmLqBILER1wpbmoP5:jzvvIpIDSJAg3IywtkA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772450318, "uuid": "90e0e8a1-8ef5-4840-abae-dded082ddc46", "value": 11268608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772450318, "uuid": "d8dcf3bf-1fd5-43be-905d-18219c3f934e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450318, "uuid": "42f6b20e-cfb4-4869-aa6c-3834200ff9bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34de64a-160f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772439184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439184, "uuid": "47ac03b7-9999-4b80-907f-ea4b6178fadc", "comment": "Malware payload (AsyncRAT)", "value": "4b5c8139df261f5131f0fa54a0d0c81d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439184, "uuid": "dfd0a0aa-97e8-4bdf-85d9-6b092a173afa", "comment": "Malware payload (AsyncRAT)", "value": "21aab6cb7a1af9f21a0641965c964c4de72ca4a1a45432523be041bef6d761e7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439184, "uuid": "3123343b-b350-4053-bcfc-ac516fd2edfd", "comment": "Malware payload (AsyncRAT)", "value": "00a98e921c3e106573a8fa9ada67e51f07574d1d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439184, "uuid": "3d274c4f-ebcb-428f-b058-e5b1c870d98c", "comment": "Malware payload (AsyncRAT)", "value": "ae8b9efb55f0ee21a0594db7ddae3af3e38fb7edee2f3cb248024c1b97930f763d715c4309a5ebace70eefa57e1a2e7d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439184, "uuid": "16f61791-f834-4289-a2df-d79fb3534e72", "value": "T14BD23A08B3D88561E1FD57B94D7293048771EA5B9973DB9E1FC440AE2A23B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439184, "uuid": "c3dac72f-035f-479a-828d-e487bd4776af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439184, "uuid": "8e8a2ddd-8383-467b-9626-a709a5c2f010", "value": "768:AuGRXHMMVEo8Yg/cIRGqou/Rb7fB/dTx/+:9GRXxVEo8B1igRbN/7/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772439184, "uuid": "59355c52-1f9d-4398-bf14-7c093c6a613f", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772439184, "uuid": "99e0fa3c-40ce-4689-b2eb-74aa73a83058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439184, "uuid": "cd04c7dd-3494-4468-8048-4af4541ad541", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66448ad6-1644-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772461845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461845, "uuid": "37fb37ac-ce6f-4186-947f-09db9e4926b6", "comment": "Malware payload (Mirai)", "value": "0be8dc5b14f065c35cf728bf22e60f39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461845, "uuid": "24706cee-c677-4b35-9637-10d7de0246c9", "comment": "Malware payload (Mirai)", "value": "21bdf4e619089690261543b5425d190451368eb9e3cdde9fab2807c14fbbb263", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461845, "uuid": "cba10882-f5a7-4868-927c-e03db989ace8", "comment": "Malware payload (Mirai)", "value": "86906e8e7f2bd95a256754486b6320eec933f41c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461845, "uuid": "e078cebf-23f2-44ec-8792-b0480b9aee2f", "comment": "Malware payload (Mirai)", "value": "9275ca2623dc07506d10202a10780178fd856af012b41a24cb62fc7981960d252d402bd79f9521b0b822dd29be1c4396", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461845, "uuid": "87aa2fd6-3723-45f7-ae01-d9bfb841fb79", "value": "T1D7360A47B8924A83C4E4367ABCBD81C472A35EB99B9713666D04FE3C3BBE1990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461845, "uuid": "0fc210f3-ea25-4155-87f0-ada6ffca6915", "value": "49152:EBHzBUH1Ai3req0+WYqd21gG7gHM3Fwr6Qm3i:EBHzGAi3r3CVG7gHl23i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772461845, "uuid": "bdbb3ac3-31be-4e12-919a-0272f3fd7320", "value": 4980888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772461845, "uuid": "44b21bf3-3dbc-41b7-8574-a99e500a7cdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461845, "uuid": "10ac4416-7f86-4f47-9fc9-0c5f8a30d99f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8062afaa-1637-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772456305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772456305, "uuid": "790ff60c-c811-4703-8296-0f95db906ac2", "comment": "Malware payload", "value": "712a3a8f441222800336c74012035baa", "object_relation": "md5", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772456305, "uuid": "aeb838fb-55d8-4e55-81ab-5e023a8c3507", "comment": "Malware payload", "value": "224a12837198b357465a7b2763fc050835a06df84bb7bfd0dcf49358a0283841", "object_relation": "sha256", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772456305, "uuid": "26c9e497-4be6-4650-87f0-7a3ec49fb626", "comment": "Malware payload", "value": "41d0f400037ba26844ae303abf56b24b1a2f98ce", "object_relation": "sha1", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772456305, "uuid": "8f5a470c-89f4-43f2-8af3-5b89fce68b9d", "comment": "Malware payload", "value": "b9aa3d90bf15cab1849ed366311c817e8bcd42a7fc71bb8c15e05a821b45bea8ad006b59114fcbe50a89c92703fe6f49", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772456305, "uuid": "3c87863a-3e29-44b3-9f69-58234c099faf", "value": "T12A64813D6702D48DAD731F3BFCA41B21A269EE93DDCB76C414AE40862BF09BE3114695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772456305, "uuid": "98c7ac0e-a2c9-42bf-bc11-a970e8cb7b6f", "value": "768:ORX8h79zKbQXCr2F7ADbrUdBrc4I2jGNRX8h79zKbQXCr2F7ADbrUdBrc4I2jGO:o8h79zKbQXBZAPIK8h79zKbQXBZAPIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772456305, "uuid": "34b8d1d3-b351-4285-9419-51b1aa44b614", "value": 331568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772456305, "uuid": "dbc564c6-7b31-436a-a8fd-d73cad95f208", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772456305, "uuid": "a989f7ca-c0b6-4886-bc48-5aff4f73433b", "value": "booking.com.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893fad08-1619-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772443435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443435, "uuid": "fc0ff9a2-019e-4245-b0d3-c6df1ee6d25c", "comment": "Malware payload", "value": "50d91a497d606eb2f6cdb8cf17731224", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443435, "uuid": "92c83466-8edd-4149-8c32-20380c6151d0", "comment": "Malware payload", "value": "23e3264d1792ad0e9a37ff2e613f3da16c8ae38b945adc18627ab9162527e5b7", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443435, "uuid": "140f3433-e17d-4df1-9c22-dcc1051cb022", "comment": "Malware payload", "value": "d068f38c59b6e65eaac5e8b424d64d1d1dd2e84d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443435, "uuid": "b0cc6069-fdf0-4faa-a260-781826d41ff0", "comment": "Malware payload", "value": "54ada61a93d13effd5e07c8bf69ae84bc4e1923379f61aac29b4e0101e7024bd632b8060b8ad5cd34ec2e9aaae34c937", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443435, "uuid": "45e050b6-393a-4991-ae46-f44ced9f9da6", "value": "T1ABC31271F35386ADDBDAF3B82AB453314914EC108EEC968371A12F838DC61F60A5BE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443435, "uuid": "599e2a0e-dfe6-492e-8cee-9327416bcac0", "value": "3072:JuDA0/IU0DklDt2HsvKcE2UL01/v+jpOPxOAtY9HFD8:JuDhIU0D8DMMvK3xL9IxzY9lD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443435, "uuid": "3427da45-3b59-4aef-b390-a74a7b1f915d", "value": 120564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443435, "uuid": "4d4441dc-1f78-4e75-8444-d9eba13f1863", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443435, "uuid": "1da7095b-1827-4c5a-91f4-c22d374fb253", "value": "2315.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83a8fd8-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1772476639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476639, "uuid": "81ef5414-d593-4be5-9387-2184179505b3", "comment": "Malware payload (Efimer)", "value": "cf1c554e93a371e7ef74e5390dd2ba39", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476639, "uuid": "65873d98-9ce5-418f-823a-21f3b56385e7", "comment": "Malware payload (Efimer)", "value": "2414141dd238daf74d27e7c3395bf35e506071d1dd948d0a5553123dd4f10a05", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476639, "uuid": "f7f2271f-491c-4a87-a752-725330ab4c34", "comment": "Malware payload (Efimer)", "value": "ee4b69c7be2c152f968e7a6ac3f003d79bc03fb9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476639, "uuid": "92c98e2f-503e-497b-859c-652c78075fac", "comment": "Malware payload (Efimer)", "value": "937ff20b90d4eae5a11dc7ff729e743e4c0c704f9c098b00566cb5696918e15995cad63f81195d5b4309f5a85e9fdfd8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476639, "uuid": "8e26a0a3-7632-498d-a41c-1753a272d621", "value": "T188C63318D0E3A1EDCA77D270BFE11BF4A4A578785375C92BA794C3B16803960EB39463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476639, "uuid": "1a5858de-a8ae-46c3-a579-38ec2472bb37", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476639, "uuid": "7d3ca75a-9731-480c-abd4-599de996991d", "value": "393216:cBZIKfbwPw/hvKMsVHg2XMCHWUjXocuI3/PGTAI:cBZBfQmIMSg2XMb8XdH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476639, "uuid": "8f2e1e5a-e02e-440c-a3ea-94c244d09574", "value": 12599711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476639, "uuid": "2fd3d9f9-0c0b-4e6d-9d04-04c56a5d4073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476639, "uuid": "5a78c065-452c-44a4-8ca2-d313ea19f2b3", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700d3a68-162f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772452842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452842, "uuid": "cde71b73-6bbd-45f5-a86f-7fa31e32f584", "comment": "Malware payload", "value": "439c0a0a46627bd166e08436f383ad56", "object_relation": "md5", "Tag": [ { "name": "Donald-Gay", "colour": "#118411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452842, "uuid": "7fb580c8-b371-4b65-8c4e-d81595d67301", "comment": "Malware payload", "value": "24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14", "object_relation": "sha256", "Tag": [ { "name": "Donald-Gay", "colour": "#118411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452842, "uuid": "2d8e6df7-fe2e-4bf4-a548-9560d3d91fd1", "comment": "Malware payload", "value": "c16099c29ccdb34764e4d15b1dab2d141d159950", "object_relation": "sha1", "Tag": [ { "name": "Donald-Gay", "colour": "#118411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452842, "uuid": "1e86fc87-e1b6-4d55-929d-99975bc82a82", "comment": "Malware payload", "value": "059e7f476365b1b16922bbc0fc4781946cd8df0633d9282206789693d4da94b868f0c6d57fbe27e4c86f322ff9a4835b", "object_relation": "sha3-384", "Tag": [ { "name": "Donald-Gay", "colour": "#118411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452842, "uuid": "8a41a2eb-0592-454f-bd1a-09ff9e66f150", "value": "T165646B047DD0C0B2E46119345567EAB15E7DFD311E608AA723E53E7F3E30BC1E2296AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452842, "uuid": "876c0a48-b8f6-4c02-931f-2259b88fb61d", "value": "9963ebabcee092908eac2414f7c4661a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452842, "uuid": "406dca07-45c6-4eba-abe6-3ad6b8742059", "value": "3072:+LSMqpdvXugbMnvqYhYBCDOh4zUdORB4mRD8wT6T9yRT6Wml5jbxaq1Ta:+WVplAnrYBdYRBZmxaqla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452842, "uuid": "03c9a9ef-837c-49a0-8a65-958ef9291d79", "value": 307656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452842, "uuid": "d6e76134-f09c-47f2-b6cc-92c739aa94ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452842, "uuid": "07dabbdf-6f63-476a-acbc-b18fcd6e9a13", "value": "DIDS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c09bba1-1632-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772454204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454204, "uuid": "82c064d8-b208-4c31-9381-cdc43e5057bc", "comment": "Malware payload", "value": "c20f69d4f4f929bf4c28c43bcc6219c6", "object_relation": "md5", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454204, "uuid": "259514f6-666d-4c95-8438-70b23c9d2459", "comment": "Malware payload", "value": "24864b8a4af8919cded4377dfa33420068316ab2e58f722a12c98537c76e2b2d", "object_relation": "sha256", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454204, "uuid": "6d4e68b5-4dd6-4182-8796-50912b01b423", "comment": "Malware payload", "value": "9ad2a74a74f5490ef74af9699ab25741a8e2f854", "object_relation": "sha1", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454204, "uuid": "66e79b3e-7a6c-4e3c-9ed6-a0296e6a8ab9", "comment": "Malware payload", "value": "35183f040d022b4492fa384bfb6bf2f9c5054ff02eb8b8a14903728735659b5d9e20a2c8e425aa7a7a6ee13d60c51b3b", "object_relation": "sha3-384", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454204, "uuid": "d76caa15-b876-47e8-a01f-d424ee8542e3", "value": "T19E75AE17B2A600EDC06EC17987565121FA71BC850730BAEF17A8A7252E36FD06F3DB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454204, "uuid": "354ef687-f8b2-4164-b18f-2872ae3e49fe", "value": "aa2128f23bdddd707adc570f98d82415", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454204, "uuid": "4b75a527-46ec-41ee-a839-660c79b6f92c", "value": "49152:NxKA15VC4s6BwJQRVp5r6vzCpJXXiILleQK:N7GCp53E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772454204, "uuid": "be85d57b-5baa-4670-8ef6-f1380a472082", "value": 1699272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772454204, "uuid": "6cc31f63-45b7-4ad8-8c16-b6b39baeebd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454204, "uuid": "2218e68a-c8e7-45e9-95e2-6b433999115b", "value": "24864b8a4af8919cded4377dfa33420068316ab2e58f722a12c98537c76e2b2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea30b0c-163b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772458020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458020, "uuid": "0e90e234-1374-4540-8c65-c9f2ec452190", "comment": "Malware payload (NetSupport)", "value": "f266043ddf16ad745c9701803b972aec", "object_relation": "md5", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458020, "uuid": "ddb6c8c2-d3b3-45e2-8bb4-b9e55c829758", "comment": "Malware payload (NetSupport)", "value": "25865914ff0ec9421a5fa7dff2f680498f8893374f24d0b67a735bd8369299e9", "object_relation": "sha256", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458020, "uuid": "4775a53e-14a0-4ead-846c-0b8b7f6d9526", "comment": "Malware payload (NetSupport)", "value": "70505b9a697cc80ca4535aac602972a5d4b0019b", "object_relation": "sha1", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458020, "uuid": "f5f5e2ed-80d2-444f-a644-aa3023ac1e29", "comment": "Malware payload (NetSupport)", "value": "15ac9e323c2c043a722ceea9392c031d499082ab3618aeb711945a679f47883917e1f2c3d39311165cfb0f7c143f2db7", "object_relation": "sha3-384", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458020, "uuid": "2c891b7f-84d8-44c6-af35-8413b8e14e2e", "value": "T1B5617608E5A1883041838B9E88DF6C08A15B48CF811B5D64FC8DCE8D1F33A388F7E65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458020, "uuid": "7b67b883-ddc2-49d9-84c0-712691c17863", "value": "96:ZnQ8eCrOJ1NQDvZg8YRaxKiUTzgqxaybIvooedb1qJAMrenR:ZQ8eCrOPNQzZg8Ycsi+z1cybIvooIb1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458020, "uuid": "a249e0fc-4f03-4f7f-9cd1-f6f8b9e06385", "value": 3466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458020, "uuid": "69f5233d-c4de-4fb7-9763-1e7542a0a6b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458020, "uuid": "bb390172-7b7f-4e30-906b-b5491a68b89a", "value": "25865914ff0ec9421a5fa7dff2f680498f8893374f24d0b67a735bd8369299e9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0375a3-161e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772445559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445559, "uuid": "6cfd8fdb-9ca3-4a53-86a7-98afbbf2b346", "comment": "Malware payload", "value": "e22c74604665bd91c132139d41a939b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445559, "uuid": "61c07be7-1a6c-497c-99ac-8ed91022201d", "comment": "Malware payload", "value": "258b0dc1c9e1df289b2a0e971f0b49648f725c3b540b8f3af42be3403ee31239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445559, "uuid": "fdff71f6-55bb-41dc-8855-ea6a3355b456", "comment": "Malware payload", "value": "4b7e903fb54b3b711fb029dcd659c6a0e2df2f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445559, "uuid": "86d1d2ee-8052-4fe0-b397-cc6d1f8dacb3", "comment": "Malware payload", "value": "0bc549ba74554d00860b3b5cfd70a49f3743727e7b97ef1c98370d0b7c50cbc95c2f11c60f24373002793306ce024a65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445559, "uuid": "a32bad53-7528-4a8a-8f8f-52e9f84027d8", "value": "T1B2B42690926C8724D8A418B4AC63446A2F74BC3D4CE6955D7DDB38DB2775332EA3C22F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445559, "uuid": "6e7d42e5-e2d4-4d8e-8bf6-20583443997d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445559, "uuid": "17d56e3d-e77e-4bbb-8a75-76665ad0a84e", "value": "6144:jInodSpIAQr1WnzDVZRa+61R8/D9SIAQr1WnsDVZR:jInodDjxWzDVt678/DljxWsDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445559, "uuid": "23bb9bc6-5a3c-49b6-9057-52beb9cd5884", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445559, "uuid": "4a7b1e46-0f25-474d-9b04-b4d15764654b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445559, "uuid": "3fea7b52-624f-43d3-a933-d7bfcf20d6d9", "value": "e22c74604665bd91c132139d41a939b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af3f98e-1650-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772466980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466980, "uuid": "a8b7727d-8d82-4114-a8e2-d477ee0953a9", "comment": "Malware payload (GoToResolve)", "value": "f38c7bc1e358cc6ad45a87d7181b2e7e", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466980, "uuid": "4719669b-13b1-4a64-aacc-e7e91d61b4c6", "comment": "Malware payload (GoToResolve)", "value": "2593ba89dcb356927f13ce11a05c82268b898542de3e3d0a3a4595b3a05e32c3", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466980, "uuid": "208a1ef8-1d69-44c7-bb0d-9845ad088a04", "comment": "Malware payload (GoToResolve)", "value": "281d2aefc045c69815be2fd9f55ae667a8828098", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466980, "uuid": "f978ff7c-23b8-4a3a-bc3d-6ce2d4aa7109", "comment": "Malware payload (GoToResolve)", "value": "557950dafd7fcd51937a812fb98ca36ea21874082c8d8d418c62017de07b39eb6b3e6c6af3694c9ba23d4f0061f52d08", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466980, "uuid": "1219174a-1050-4b7f-ad75-126058d4342a", "value": "T125373312744BC636DA9F5133402DABF5633C6E505BA481D3B3DCBA7A6B302C2177269B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466980, "uuid": "c679e640-eac7-4833-abf6-1e827acafca0", "value": "393216:qjy36SLgW1nJoKIfnxW+2BF+fcY8g53DqdB8IlflOnb7ywg/bVScr8efi:cvWZ08+2Byh5zkB8edYb7pibf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772466980, "uuid": "9aea0118-5113-43be-a7fe-a49ba2e1d5ab", "value": 24379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772466980, "uuid": "4e23c506-f4a0-4c47-bb37-62c13a7b5d6b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466980, "uuid": "d35563b3-4fe3-4199-abfa-50f023895dd4", "value": "Adobe Acrobat Reader.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5224d9e1-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433894, "uuid": "ab973432-c029-4959-b23c-42f31b820946", "comment": "Malware payload (SocGholish)", "value": "25ea75f213b67424306ddae6606360db", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433894, "uuid": "98506d99-a4f9-4e36-a5a6-9d78180ebf66", "comment": "Malware payload (SocGholish)", "value": "2598f0e5be830d58ee452f6811acce98d2cd55fd20b2460d59ae05ffdeffd994", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433894, "uuid": "4fc53147-982b-41b5-a592-9b6566955243", "comment": "Malware payload (SocGholish)", "value": "374a2e8b491e0ef93114bb20f4912c2e1556cebd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433894, "uuid": "8dbb132b-33cc-4958-87fd-7c8af2cfd154", "comment": "Malware payload (SocGholish)", "value": "a23ad12a88d6b313855c307e7c5f83f7abceeac61328430ff6d8f32bdc08ea05fbf5af9e60e5c2a52e089059f4785a0b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433894, "uuid": "fed4e4d9-47a7-4a38-b060-a4f9714d559d", "value": "T111D097ED3578205C3EE75025B133A9093022200BB0A08AB2889AC4208A24BC30017BBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433894, "uuid": "209ced59-1af9-4c32-aab7-198452cd912c", "value": "6:S9YE7gO9l5AxRWaVqFdoCPGIdvrRfAJOIJ8HqtVe:LER5AxRWeqFdom+8Hqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433894, "uuid": "300d2ece-47b3-4f65-bc61-661ccf01a66a", "value": 243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433894, "uuid": "1f877a8e-d4da-4aac-a0df-0ba13e6061e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433894, "uuid": "0d914f9c-b248-490c-b2ed-0b45468d4d88", "value": "2598f0e5be830d58ee452f6811acce98d2cd55fd20b2460d59ae05ffdeffd994.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1138b73b-160a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772436791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436791, "uuid": "d8a88691-30cd-4bc9-a78b-f37de83e70d9", "comment": "Malware payload (Mirai)", "value": "46adbf8182c820dedb3049f1f077420f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436791, "uuid": "2797a99d-5db8-4d2c-b3cb-9d2a7d035050", "comment": "Malware payload (Mirai)", "value": "265f9ef067a53b8d01362897401fc97a832f73ab0c5cd937f49d737e74c5dad8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436791, "uuid": "e0d1e325-37d7-402d-a6ef-82a631d00471", "comment": "Malware payload (Mirai)", "value": "10540aba7992e5e1e5a9eb8bfadf463f52d7b43b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436791, "uuid": "5460f0f6-edef-4971-bd7b-ab9eeefbc329", "comment": "Malware payload (Mirai)", "value": "75152ea1a6500f6a7af1e4e630cfa91422dbeaffea8aa6ad75559d65a885afa0fc9e4f4cec66180c46dcdf202c11f971", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436791, "uuid": "2659a9ff-6020-4315-b442-4df6e82463fc", "value": "T16F733B02770C0E43D1A75AB0263F27E0F3EEE59011F4FB89651EAA46C175E33568AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436791, "uuid": "6113de2e-af17-4a87-8875-1074b033d036", "value": "1536:5xeisAefG7qPYN6OqcSjTaajWVUkN3FIlS2tzBgimgP99Yoz/wbZnIE:reis5lOqcvHjFIBtgKAmwbZnIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772436791, "uuid": "b3bcd318-2082-481a-af6c-6cebc57eab59", "value": 79956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772436791, "uuid": "edf27497-2c06-4eb7-aeec-2b3ae9ff7be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436791, "uuid": "d205a63e-1e4c-4f12-ac3c-4da0b569bfcb", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf82b5b-1619-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772443413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443413, "uuid": "0c3dad91-4dfc-4461-8434-dd5f436610b4", "comment": "Malware payload (Mirai)", "value": "afb1714cf344e4b18f927dbf42bec80e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443413, "uuid": "9c1a6680-075e-40d8-bf5b-6c5eb70917ef", "comment": "Malware payload (Mirai)", "value": "26d5551255e8acb8e5c3e6e426ae7b1afdd508ca18bbd80a97083d3e552adf2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443413, "uuid": "182484a9-eccf-402a-a20a-f223286b6ca6", "comment": "Malware payload (Mirai)", "value": "63351b06f0c854b848f633191dacfd34e258c746", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443413, "uuid": "81cdae6d-7c65-4c03-8ca4-a5df840dcb12", "comment": "Malware payload (Mirai)", "value": "1018dcdee914cea06e4f07f8b48cc0e0a5e4afdae1fcc2626f4e3e4f5e5d16613c8d9cec7f369f5e024487ee9e57c755", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443413, "uuid": "6bbb159f-4f25-4eee-a231-538eab874e06", "value": "T114832B02770C0E43D1964EB4263F57E0E3EAA9D121F8FA89650ADF06C6B5E33554BEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443413, "uuid": "8865b46a-05cf-4c41-a887-0fb6480e6cfe", "value": "1536:S85VqEf102qpFa2GWLFGghfhbkIVt1n+UPd4TppWdnroozJAkqwbZnyh:v5Vzma2GWE+fuo+UPspsnrl8wbZnyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443413, "uuid": "94298975-73e5-40b9-94bd-1178285b5f7f", "value": 87468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443413, "uuid": "6b6bcd92-e6a0-4b9b-affa-f9572a0681ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443413, "uuid": "8bc6670a-594a-4b9f-a0c3-ff886d7dff52", "value": "440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c96118-15d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772412054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412054, "uuid": "8301af4c-0df3-458f-816c-a6769622f628", "comment": "Malware payload (Vidar)", "value": "95e0218c12896ef050d4e39cc1bd0eb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412054, "uuid": "85078737-4512-4bdb-ae8d-b12777cc636e", "comment": "Malware payload (Vidar)", "value": "277b945d039af188d64bde7ad3ca72fd81c5b290431ac340868f77bbcc8a5e21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412054, "uuid": "eb0ed239-3f26-42b4-864e-8809f763978f", "comment": "Malware payload (Vidar)", "value": "ce32d93255ab0a933e278bb1642a0bc222471d85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412054, "uuid": "81cd8441-1a91-4727-9c3e-3fcc0776ebce", "comment": "Malware payload (Vidar)", "value": "c8860f2b206092f688dcaa759306841b691e162ba6f5222dcf8fee2bf78f2d124571c469380f3cb2e671b20796fd705f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412054, "uuid": "c03380c4-cd25-4fd3-b961-cb93f9e64487", "value": "T190E6066B6F528569C1DD823ACCA28B0595F370B90723C7E74EAC07681F46ED34E7B624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412054, "uuid": "fc39360e-74e0-448e-a7a1-c3870344d716", "value": "9c852624a95579595d84bfcfbd14cb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412054, "uuid": "6cb7fe4b-b3ae-45ee-8f47-1bcaa923a3e0", "value": "98304:5fbvYfLRXJbWCnI8jJd/8+pjen8bGIdQI:5fbvMXbocWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772412054, "uuid": "ab17bf92-7094-4e4d-ba3d-0d8263d9b675", "value": 14149120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772412054, "uuid": "796f6e96-33cb-433b-a52b-28d738e471dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412054, "uuid": "485a02c0-76ba-4574-be65-566cf687ba66", "value": "SecuriteInfo.com.Win64.Evo-gen.16146636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b799ca13-1640-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772460263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460263, "uuid": "a52e5e57-ec53-4f88-9cb8-bce42ffce640", "comment": "Malware payload (NetSupport)", "value": "e40a9f7dcfb8dc18b49ef99617bbe9f8", "object_relation": "md5", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460263, "uuid": "e55b6e05-09aa-4f35-931b-894d60daae91", "comment": "Malware payload (NetSupport)", "value": "280c7fb3033c6c34df88b61a4c90eb03e1ae7d1dc00355ca280a83903b776473", "object_relation": "sha256", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460263, "uuid": "21bcc339-cc84-4fc2-b445-9f5446fb012d", "comment": "Malware payload (NetSupport)", "value": "c07fa6c91287907943b81bf18668a9dc51c98e7a", "object_relation": "sha1", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460263, "uuid": "614bd31a-e1d9-4e08-9454-a08ea395779a", "comment": "Malware payload (NetSupport)", "value": "ee6cec54ed16c12cd561ce1eb54c579d6e67710f5ed6a6a53549f5afa8a89de301b612f020bd15ec51f020cffd22dee8", "object_relation": "sha3-384", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460263, "uuid": "87a01469-a71d-43b8-8b9d-71bc447fdc36", "value": "T17C715408E5A38C304147979EC8FE6808A15B48CF811B5D64F88D8E591F73B388BBB659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460263, "uuid": "0b3d2f8c-80ac-4f8c-be48-57a725c1d4b9", "value": "96:ZNQ8eCrOJ1NQDvZg8YRaxKiUTzgqxaybI2ooeduIZ1qv0AMrkGnR:XQ8eCrOPNQzZg8Ycsi+z1cybI2ooIu4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460263, "uuid": "874b6957-2102-48f5-be40-db83732f3e15", "value": 3570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460263, "uuid": "35342f41-a518-4524-83b2-33b111273235", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460263, "uuid": "5a2df624-4622-4ef7-a112-bbacbbf82cc7", "value": "280c7fb3033c6c34df88b61a4c90eb03e1ae7d1dc00355ca280a83903b776473.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae7bf64-1626-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772448807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448807, "uuid": "e54e88fe-8e05-44a7-81a1-92351c10ccf4", "comment": "Malware payload (Mirai)", "value": "871c544b83d6c6e499b3731abf49ff3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448807, "uuid": "c3de6016-95a4-4e2f-a81d-6aa291cb53fc", "comment": "Malware payload (Mirai)", "value": "2820126eb8ed1daedf78e7afd5c2c85b149e7ded97e21068f3de4136809c8682", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448807, "uuid": "0b5b007c-12fb-4ed6-915c-da9d73ed49fa", "comment": "Malware payload (Mirai)", "value": "a8398c8e20402fb757eb89602af0663f87ef0acd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448807, "uuid": "5b4ed752-cea3-4d0d-94df-80af8ba22f19", "comment": "Malware payload (Mirai)", "value": "cb8e7e354579f145dd4a4435ea39f4ac1253e6efdd8ab8e4b0992e2b10c4b491660cddd9d301506b75a021dbecb09ea9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448807, "uuid": "d7a3dc76-e673-481a-9e30-72f2fc0e3772", "value": "T162A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448807, "uuid": "070d6ad3-28fe-4300-853f-8ce28a12e33f", "value": "3072:VK1z13U6HzHoXRtmTUhQogXEmmFVcqq0GnDZT:VK7DDeKlogXEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448807, "uuid": "d6199460-cc28-454b-a2fa-535a46bb1a60", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448807, "uuid": "7e3d33f9-2d00-4426-af59-c07b935e219f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448807, "uuid": "600e7635-8e73-4850-8794-8251d4e08bef", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c63ff74-1626-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772448809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448809, "uuid": "3288f686-c776-4d44-a2b0-63898b855b20", "comment": "Malware payload (Gafgyt)", "value": "44d8d1601171f12363ef24d816b83012", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448809, "uuid": "60567cef-a58c-40da-915c-1888a4f565ba", "comment": "Malware payload (Gafgyt)", "value": "2938c6a12a81402c0b0640a5626dc00ad2e64ac5756fc3e1a2dd62682db87af7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448809, "uuid": "30beb88d-43be-4547-ab61-87ee9a63de3f", "comment": "Malware payload (Gafgyt)", "value": "1b8b66e21a268ec99a831ccb70fd9e7b21f61fbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448809, "uuid": "d7920fbc-64e7-4697-8b2e-d0d2fc5b10b7", "comment": "Malware payload (Gafgyt)", "value": "f7cc5e0c1ac8539e6af0d53bc6b7383bcaede1a2388aa94740c17438d4e0032abcfdba4f3b2288bfc3e756cf0beb1999", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448809, "uuid": "ffda5ca9-5040-486e-a00e-313d249ce9b7", "value": "T1E5C3F831E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448809, "uuid": "a1dc16a2-9308-4bd4-85c1-12fff1821f67", "value": "3072:6jVlyaL5JCrIpv04s1bttiEiTmP46aQyfPlfKsNb:yoCJCN4s1bHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448809, "uuid": "07c03028-f353-4734-a66a-7304d1b99817", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448809, "uuid": "95c1c7af-a96a-419a-8cb7-e8652e7d3fe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448809, "uuid": "78d0f628-2c10-45a0-b3d2-185295f5c6bf", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21be904-164a-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772464630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464630, "uuid": "aba6e3d1-93cc-424a-8956-53278ccfff34", "comment": "Malware payload (SantaStealer)", "value": "498135f6cc439b2e594c124f64e0bb3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464630, "uuid": "3d511775-235b-4ef0-b212-788b026c3371", "comment": "Malware payload (SantaStealer)", "value": "295b4cf4963b0fff87d7aab05bb71a8b5abebf977754003efeb6223e11dbb2cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464630, "uuid": "68d68485-5f3d-4ff5-bef5-4f8acb27e22c", "comment": "Malware payload (SantaStealer)", "value": "23cfd43c3aeb0acf9c252d98752b2bdab43f6dab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464630, "uuid": "83c4ded2-9f5c-4a1d-8ab1-2e5737661410", "comment": "Malware payload (SantaStealer)", "value": "1bbc398bef5c9b02453e5465dab79e0a324fa2df89a06d16343afd3cd4a3669c020c485152393d0aa7f855a08489b9b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464630, "uuid": "628f9b74-e046-4eeb-b4e8-bc0b93229cf5", "value": "T19F46AC59B75B3CBEC30B4238852B97357419E684462ACD7F46E2C3B0FC30A55169AEF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464630, "uuid": "cdf780b2-a8bb-4776-89fa-3ef6a3bc134f", "value": "07d333ce0be6bfeaa14f1967a4a77e72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464630, "uuid": "0dc0c7d4-5608-4c70-8ad6-087dae255539", "value": "98304:iaNHqLGz/ESdBvtcdtaDNYd0C/gsJ51ZflSbcugq2iIbC:iIHqLyZvtcTVdKqHfMl2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772464630, "uuid": "8618ae83-82a8-405c-92f7-06503c76a7d3", "value": 5658624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772464630, "uuid": "cba89c69-ddd9-443c-ab24-06bbb226fdb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464630, "uuid": "d19aa3ff-5c91-4032-9060-5493f2a79c5f", "value": "WindowsCodecs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adb0f05-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444753, "uuid": "69e17c16-489a-4d2d-97bb-f63397d03155", "comment": "Malware payload (SantaStealer)", "value": "35b1fb09286ca0d6cab0d28cafceff10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444753, "uuid": "2b3f95b2-c15d-4cc7-a9b8-f2ce4629ebdb", "comment": "Malware payload (SantaStealer)", "value": "2976f07e340cfe44ab63a7b38dd68cac379673c13d331f6380a85f1df26cb081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444753, "uuid": "6bfdea17-168a-40b5-a862-7b30b074a0c8", "comment": "Malware payload (SantaStealer)", "value": "2a6c9a364e6937254f3d1f7b30b479cad8bf86dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444753, "uuid": "4a1eb876-3c0b-49a9-82d7-085b7d304fe1", "comment": "Malware payload (SantaStealer)", "value": "b33618705756f7d8f58bb43cca52c66552507dd1929f14a46be5ab71840aa96fe4af02bba504b51232e36ae7886dae01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444753, "uuid": "af3dfeb7-8aac-45ae-b30d-54a8cfa9f1c4", "value": "T125C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444753, "uuid": "e074506f-8bbc-48c7-8e44-048b0b7496fe", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444753, "uuid": "1f550f07-a2ac-4cf7-b39d-961144a78df1", "value": "49152:pavY1Sn5eVNo8WFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCasdGf:4Y1aUUevc+9sdBg4x4DPPnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444753, "uuid": "141f1af2-d4e3-4bce-9a34-102fc0aa546e", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444753, "uuid": "a548b96b-1605-4c58-95b6-24cf7ea3da80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444753, "uuid": "b4c71fad-7238-44a2-9069-dc338640ad84", "value": "20260301_222357_20260302_012356_6P969WT155ZD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815358eb-15d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772412069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412069, "uuid": "950cc5dc-c84f-4f93-a796-38a320ef8f7b", "comment": "Malware payload (Vidar)", "value": "b2432282eb0e0fddc785bdbbd4959198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412069, "uuid": "ea2d325f-dc37-44d5-8941-687dbce5f572", "comment": "Malware payload (Vidar)", "value": "299f253ef5a0f06b347cdfeab309c849cf7951a227ed4c13efb61ddf48c1c8e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412069, "uuid": "3ad227c3-6d2d-4c3b-a2d7-a40fcff1df16", "comment": "Malware payload (Vidar)", "value": "01514a603f6eb9ec37d8e8dd04458e73b479a44c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412069, "uuid": "bf9cee0f-2788-4067-8405-f954b80f14e7", "comment": "Malware payload (Vidar)", "value": "5d7fed85ac78efb95b6cd067e002642ef79d3701c7f287aac04349068b54bf3eb5ce3585ec8e11849bc8d11d39f32a8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412069, "uuid": "58a5695f-2bc7-46b0-8a12-ee953bbcaa84", "value": "T1C7C57B4B6CA409EAC46E93728DB342923B74BC490B3223D72E91BA782F777E05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412069, "uuid": "670216eb-9a77-4801-a0c1-c79a7f3fc0a4", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412069, "uuid": "d1f5a061-54ee-405c-ab43-f62bd1e6b13e", "value": "24576:GHkak7V6sbwMbTpHsqNtPl+geBNZMlJIrp76E5rtVTrs5HVPvMiPgPte6Rbwuc:GHkaSV6sbwMbeqsgYw+d2yLXovUle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772412069, "uuid": "7e6e9bb1-34c7-4c9f-9fe9-f0614f6355d5", "value": 2564096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772412069, "uuid": "b2981d1a-74f0-4c6d-b94b-cdc48c1eb8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412069, "uuid": "63b8667b-f1e2-43e1-9b98-987f0938e294", "value": "SecuriteInfo.com.Win64.MalwareX-gen.89231932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a74aae-1663-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772475083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475083, "uuid": "169e8639-2163-4850-800a-af7f8f8cce18", "comment": "Malware payload", "value": "9bf8d8e34084a0b0b099ee1d3f9c41c9", "object_relation": "md5", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475083, "uuid": "77c207a4-7734-4731-b4bc-bcb035e4bc9d", "comment": "Malware payload", "value": "29c033702f351f386569fe76140b8a5bd76a0c5a95b8b6e0e3981853efdb69db", "object_relation": "sha256", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475083, "uuid": "25876ef3-1d94-4959-9e11-eaa6d7154fa6", "comment": "Malware payload", "value": "376505cd4080d1113d9aae3e6da1e372f921c007", "object_relation": "sha1", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475083, "uuid": "bd1a2f69-b09e-4786-a5e6-2a44ebf0979b", "comment": "Malware payload", "value": "665fc415100762dfbafb4b3584e945945ecbf3a3c852167699096df4dcf903c23a2e4bd0e76381a0a2e7c6f175f2a969", "object_relation": "sha3-384", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475083, "uuid": "a6372299-9ea2-46e1-993f-f4084c6caddd", "value": "T10D956B88B1D2F46957E701E6407F140AF33E1D69781EC450F278ECDAB8A5888627BF6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475083, "uuid": "de7f9fea-1593-413a-abbd-2cfa8c695dfb", "value": "49152:q4uHTkucV3IyoNTcKHGcTkw2mxP7NeOaPL7VVnwqKEZUA:elNTcKHGdmx6TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475083, "uuid": "2a31b1d5-9f90-4ed2-9109-61369e912237", "value": 1893770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475083, "uuid": "d09c2bff-d788-4f5b-9fa0-c8fd86ed8b7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475083, "uuid": "7d226d33-7408-4692-a6c6-5be8afbb6aa3", "value": "29c033702f351f386569fe76140b8a5bd76a0c5a95b8b6e0e3981853efdb69db.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae2eaad-1632-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772454310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454310, "uuid": "c13cb69e-334d-4435-9029-3a70f713d28a", "comment": "Malware payload", "value": "5c057af2f358fc10107d5ccdb39938ad", "object_relation": "md5", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454310, "uuid": "26361287-9d4a-4dcd-b4e7-011e88c0650a", "comment": "Malware payload", "value": "2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5", "object_relation": "sha256", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454310, "uuid": "aeada379-6800-41ec-881a-8f1d0e126ee3", "comment": "Malware payload", "value": "e2e8516b4f275e8c636620b7377ee3b9f9f47bb0", "object_relation": "sha1", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454310, "uuid": "2c831f0a-b835-4335-9f63-33cc0319cf8a", "comment": "Malware payload", "value": "6ebb6f875d71621fcd51a2668ba5a0ddc0fb067a0554002c426c98efa357e763959e1f825dbb74042d0c9fe6ef59c003", "object_relation": "sha3-384", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454310, "uuid": "fc90cd6e-2126-4c26-909d-5894ceb77b41", "value": "T141352314FCA42B1FC60B1F32550BDA513FED6D42DF7150636328B2996A373B1BAD206A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454310, "uuid": "5d566a34-0e9b-450e-aee8-4b3b551e6dda", "value": "24576:5NOmTRC/KmPbeqL+FnXvO9+f1KUw+T/s/e:vOmVv+bD+1X29WKwE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772454310, "uuid": "3546fef1-b458-4c3b-b1fa-8a360dc7562f", "value": 1096704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772454310, "uuid": "2a43a5e4-f73e-4f85-b75b-9f0539c446be", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454310, "uuid": "364bd5cd-0b4f-4a52-b16f-0999d619010a", "value": "2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2beef2-15d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772413884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772413884, "uuid": "9dcb7fc0-aae9-4711-913b-a4e3c36c0e93", "comment": "Malware payload", "value": "633e64e15c1608a86362d7b9e049b244", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772413884, "uuid": "52ac67a3-d7ff-4b50-8d66-cf42a3ddab87", "comment": "Malware payload", "value": "2a229b637f23b1f389d5bb15927bcf32a883d680c4d5fa490ddff279e674b8a6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772413884, "uuid": "76ca82ef-ccd2-4a51-8b42-e441a1fb0003", "comment": "Malware payload", "value": "842595c10601085db08798d5acd1bec29ecfa923", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772413884, "uuid": "1790f8fd-869d-49ad-86a0-8b47c3378325", "comment": "Malware payload", "value": "1ae60fd81de4d876ded302e6c56bfd2f064de40d293d6779cbe2165bb406d0856af11b333d612e2ff58ac3de7ed5f89d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772413884, "uuid": "e107aafe-0536-4baa-a755-e94e481c9635", "value": "T127517B4F70118522726AC83A6B95F64418572AE31FB1DD16BE7D28D03FB9A007F1B7B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772413884, "uuid": "c9d21928-f800-45ea-8714-abb2a67696a9", "value": "48:HsKRDRM/Sco5whWrDztDz+ULN8swRQRfSjgVAhGiGlLIWQqUkAo6ePvdsWJS2gly:HsKBiqTamDhDCkxwq05GiG2WQbl/e36y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772413884, "uuid": "a805e5ba-1a0d-4034-8daa-03e8e91f9a6e", "value": 2919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772413884, "uuid": "6c0b03b9-6674-4e81-a3cd-75833bcc49e8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772413884, "uuid": "d068c627-0f12-4be5-86a5-babf079b2c32", "value": "8x6h0a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bada26-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433902, "uuid": "6c9f2dc3-40ed-49c7-9582-0f9f66e13e5c", "comment": "Malware payload (SocGholish)", "value": "343f8d7005e774bc40aa1d82bca48885", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433902, "uuid": "f7af4142-78b7-4efe-a9f1-e63c75b97bbf", "comment": "Malware payload (SocGholish)", "value": "2a6d445250acbb994cd5f87dec23dabadedddd1f1209e7f1d5388d3a132d0944", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433902, "uuid": "d37bdd0c-af9a-4744-99bd-e208038d1029", "comment": "Malware payload (SocGholish)", "value": "ca21ed7839ea06e0bfe12269ddb958ee05320663", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433902, "uuid": "6b7b68c8-ff5e-429f-8052-c52ff9f67893", "comment": "Malware payload (SocGholish)", "value": "f31c6680cf3167256b1daa31ce226d8f2c85c3776cdefa2813726d39167ca3da4cdbb36258012acbab6c339a2d387177", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433902, "uuid": "523a0f9c-28f1-45da-89c1-3fec4944b69c", "value": "T16DD09707385460182FFA32E8423BC28A3005220CA09988E988ABE10852A82E7112712D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433902, "uuid": "96311ef2-5bee-40cc-9076-b2504f6a8561", "value": "6:SKJbAgO9laxRW4VOttSk8MGGIdvrRfAJOIoyVux3YfRy:6oRW7twk8vnyVQU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433902, "uuid": "be7f8c89-b224-407c-9499-c379119b1d53", "value": 239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433902, "uuid": "38c6b2c6-c5f2-48a8-8ae1-276c326bc2f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433902, "uuid": "82a85e10-6bb2-4cd2-bfde-6d57400565f3", "value": "2a6d445250acbb994cd5f87dec23dabadedddd1f1209e7f1d5388d3a132d0944.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3e519e-1665-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772476027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476027, "uuid": "38f538e5-61ce-45f2-8756-25435040d82e", "comment": "Malware payload", "value": "45a3b8ece1a09a773c5b1aa8bd9e25ab", "object_relation": "md5", "Tag": [ { "name": "172-205-172-243", "colour": "#286BE7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476027, "uuid": "095cccfb-cd3c-44e1-9691-40fc1ad27dc8", "comment": "Malware payload", "value": "2bb2d0e12b0238d71a43cbdeda28f39aecebcfd41fb1090c648c19c283b9007d", "object_relation": "sha256", "Tag": [ { "name": "172-205-172-243", "colour": "#286BE7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476027, "uuid": "72b21666-86ee-4950-bbb4-de433a58efa7", "comment": "Malware payload", "value": "1274c904a9580bddc219346e25796c016df397a4", "object_relation": "sha1", "Tag": [ { "name": "172-205-172-243", "colour": "#286BE7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476027, "uuid": "693c059a-070a-4231-871f-28a0661722ca", "comment": "Malware payload", "value": "d5b94978ee84632a0557eed4dc2e82a00e1bbb28542643a4bc9fac3f85fc82a0ec60687421bf89abb85f6ab88aac90cc", "object_relation": "sha3-384", "Tag": [ { "name": "172-205-172-243", "colour": "#286BE7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476027, "uuid": "4f77f048-741b-4df0-801a-3a81122b7f70", "value": "T14DC3120455DD42E45C664E0D5ADCF40A97F0CCFB99E8932A3FB6A961060329B47B38BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476027, "uuid": "2e01847f-0f4e-481c-8070-080c9bb506dd", "value": "3072:h1U8uadtrGZ9H5l76j+3JCdc/+oQdDTXJGr0LtAsQ4:h1nuaHrGd4j+ZCOXqD9GrIek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476027, "uuid": "52931971-9a25-4c89-b39e-749f9ee6bf93", "value": 120796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476027, "uuid": "add8ebeb-2a88-4064-bbc1-be2c7e90f7cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476027, "uuid": "9d2edb04-8884-4c51-b3d1-15362b041f27", "value": "browser_stealer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78538708-1608-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772436105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436105, "uuid": "dc0265fb-4b3f-401a-8608-28da9a1bc990", "comment": "Malware payload (NetSupport)", "value": "5dd12cf3e514ea2ac60542d33c1f2149", "object_relation": "md5", "Tag": [ { "name": "45-131-214-85", "colour": "#E03320", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "vadusa-xyz", "colour": "#285C7B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436105, "uuid": "767556d9-c860-4646-a91c-ed790ac411aa", "comment": "Malware payload (NetSupport)", "value": "2ce5db538acaea158858708f701fb1d8a9abeaffec6314a91ae30d111510f1da", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-85", "colour": "#E03320", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "vadusa-xyz", "colour": "#285C7B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436105, "uuid": "7177a66d-4bc7-469f-a54f-a9211537ad0e", "comment": "Malware payload (NetSupport)", "value": "17d7fb93e271ad1603f93d3dd07813ba15807436", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-85", "colour": "#E03320", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "vadusa-xyz", "colour": "#285C7B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436105, "uuid": "4409b1f3-5a45-4a18-abd1-e494c7f7cf6a", "comment": "Malware payload (NetSupport)", "value": "faefa795c2fba44cf62c251a998cb66c652919e73d86ed3e06853aca27bd32f45bc179e02d5720d9c5c5a29ba2be67be", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-85", "colour": "#E03320", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "vadusa-xyz", "colour": "#285C7B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436105, "uuid": "b9d8bc86-cdb8-44b2-ad1a-e4b0ad3ed24d", "value": "T120A2D016B29C7562FFB45AF5244286004FB3B84F63EB24A0E6D0ECEABC711740BC3456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436105, "uuid": "52acf75d-d918-40d6-b10b-5f2c010f000d", "value": "384:F2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSfKn0ca:F2+x6TLKQXK1myQCSr2VS4jTXaRnPC0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772436105, "uuid": "29ffb8fb-d93b-4b0c-bff0-6f82b616dc88", "value": 22194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772436105, "uuid": "b498d54e-7b6d-47f4-85c6-f2264139bcb0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436105, "uuid": "880ba899-8de9-4b23-a7df-e37fd0ffe867", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7e0e63-160a-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1772437002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437002, "uuid": "a49929a8-d1ed-4d10-8d0d-b2173c23c277", "comment": "Malware payload (EternalRocks)", "value": "274b2c47b9f069edaec60e4728dfd761", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437002, "uuid": "d6ccb938-867c-46cd-be78-2dd597939261", "comment": "Malware payload (EternalRocks)", "value": "2d66bc1bcf9bc41c5c607d0665a16af209857cc141edb6944927279d31bafa6f", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437002, "uuid": "0f609d59-dd16-467c-8530-b8647087a77a", "comment": "Malware payload (EternalRocks)", "value": "d3ec9b6a805f486aa3592914b414abc00d8bf35e", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437002, "uuid": "432d9968-1eff-4ebf-a071-5a9acec64f6a", "comment": "Malware payload (EternalRocks)", "value": "12e33c38b5fdaf3a1e7068c93b79cf78a903585e1213ba6ebb71a2ed982aa10da8f67e04bc516b12803580d51b13f940", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437002, "uuid": "734bb3b1-3129-4480-bb94-5837ad77d1de", "value": "T16A1733E3E3155CBAD6176B3663660221B9B0A514D5707B0E73C488FB04E3B894CDAEDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437002, "uuid": "6f82e29e-b08f-4ebc-b718-28b626930d9b", "value": "393216:ezot5ktVb9U4SjHoSPCznIBJ6CzkBqyjPqZ1DkVtsqcbEallGWYi:emMRSMSaTIBQCzgZeCVKRl2WYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772437002, "uuid": "bea9e9b7-3ce8-4059-86b3-f47b0e9a0c50", "value": 18617647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772437002, "uuid": "0830d3f6-80b0-46f2-a0aa-be88f65bd9bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437002, "uuid": "bd65f422-be99-4835-90bb-47f6e9305141", "value": "2d66bc1bcf9bc41c5c607d0665a16af209857cc141edb6944927279d31bafa6f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70e88cf-166c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772479187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479187, "uuid": "94ff7f62-f827-4082-9ea9-b54f3eefd872", "comment": "Malware payload", "value": "995b4a3fa7a9f4d2d41256f3d9bd0913", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479187, "uuid": "a854f116-4853-4c5e-99ea-bbaaeb18e3bb", "comment": "Malware payload", "value": "2e3e8e4694c056508944a04e471e943718ba9a02289687536d712e32df58d9bb", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479187, "uuid": "72c085a0-1307-4339-8a96-ad9c45b940de", "comment": "Malware payload", "value": "dcc0f48eb24d6364816f8f45fb6c8c2792e4db36", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479187, "uuid": "0c17e84b-0a0c-4516-9309-0df98b47692b", "comment": "Malware payload", "value": "352c7fdba6d396bc004091079bef33e95db02b8194ad241e9bcf552cae40cfd7c2ea6024e544b8e60da1f95e2bdbe9e5", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479187, "uuid": "6f2d347e-5fd6-4a87-b0b5-9f45aab9e0a9", "value": "T1FFC7336A98A75B2CA03855F1965807F72811EC119CB2DD732F7BC1A66FFF782981C10E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479187, "uuid": "7b59afc2-f62a-4031-854b-4fa865b1846e", "value": "1572864:TwJmhhi52VGIIBWVlKyTvUm4T50Vr4i/R9sgqvWpg26HqM:tzVa/qUn0BDZ9sgqv326x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772479187, "uuid": "6d579700-6ec8-4f5c-a288-ab62a896b308", "value": 55677342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772479187, "uuid": "9c91fa59-9822-4fab-9520-354ce8d8f50c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479187, "uuid": "17bc2d76-2375-4176-839f-ca14ccfa2f7e", "value": "handle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d547750-1656-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772469534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469534, "uuid": "59e64b7b-c4ad-4d70-8dc3-2dc2bcb54fd7", "comment": "Malware payload", "value": "c2a5a64a39c898bda06f08e6dd11370c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469534, "uuid": "a51583f5-9e07-474a-959b-9394cfe7118f", "comment": "Malware payload", "value": "2f07590fa613389eff5c6e508797eb04a1206d52474e66c58add590909d42344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469534, "uuid": "aca18c8e-5d5d-4bac-83a9-20ff9c287562", "comment": "Malware payload", "value": "4bcafaac679d0dbde44e0212357a83da4e914b27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469534, "uuid": "e3f1d05b-8e3d-473f-8bf5-7e0e3c54624f", "comment": "Malware payload", "value": "5492c87e2d45b109191fabc905388b65570070bc37ce6dd9593b20fd10d3ea9abc65ef9a237d31774267e5f77ad80493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469534, "uuid": "6a8a9dc3-7004-41a7-833e-18c4aa1140bf", "value": "T168459D66A7A840F9D0AFC178C9564607EBB2B415137097CF03E48AA62F23AE15F3F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469534, "uuid": "383911a4-fdf8-49af-8bf2-499319f7144b", "value": "a21161adda12d436de4ed9210ace2276", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469534, "uuid": "5f5810a5-a350-43bd-8108-98826b12de0f", "value": "24576:jLOnSKGveLTvCSkYBLSHVOjbDtVRZVpGObDUcYAO/BdIh0lhSMXlaCn9:i5GW+SkAqOjbDtVRZVpGOUzA0rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772469534, "uuid": "6f5cad26-dd8d-4a2c-9f6b-d826b479b8d2", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772469534, "uuid": "d20f61fc-c846-4a32-b66c-7e8531d3d3b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469534, "uuid": "18832a16-fb28-48b0-93a1-8c6d8296b5fa", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8896461-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772434093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434093, "uuid": "b3f022fa-e853-4bb9-89ad-74a500ade6c7", "comment": "Malware payload (SocGholish)", "value": "9cbad5646c877218af29fd6cc88849c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434093, "uuid": "05db86d3-76c5-460a-b948-ee432da00c33", "comment": "Malware payload (SocGholish)", "value": "2f9e5ea05aa8cd81c1c1f0914220557c5dc4a8bc42ee822bd327e3cfc3328f45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434093, "uuid": "3af6f03b-eb82-4892-afe9-0298aadfbb42", "comment": "Malware payload (SocGholish)", "value": "1d443700bc459c8c08e4261af05af2127f3351a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434093, "uuid": "ffa5e4c8-d826-4270-b5b4-2b6cf4e39f70", "comment": "Malware payload (SocGholish)", "value": "d49599ad2c97417302f274f4e84224d7cbf1e6b2af6f74b3163c7ab7df6f67c8d70c6bd9839c538d1148dcbbf2a8f6ca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434093, "uuid": "1ae34f36-b0f5-4462-9d82-e7040c8298be", "value": "T1C2D02B6B244811784B6625E0497B6A887951130818811571DA7A88652711FAF5566B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434093, "uuid": "7fb639e1-7d2a-4934-89ce-a541d765062f", "value": "6:q7X7e+IAgO9lZaLyuRWDagyQ7eQuS5Nv6pd7g6MXuVetQd68m:Ia+I48LyuRWWFQLTv6jg0VetkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772434093, "uuid": "629860ab-b967-48f1-ba04-6f33b7471f61", "value": 270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772434093, "uuid": "1ce4ed8f-e278-4498-b35f-39e67dd81896", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434093, "uuid": "bc4e8246-08d6-40b9-994c-2e012f53275a", "value": "2f9e5ea05aa8cd81c1c1f0914220557c5dc4a8bc42ee822bd327e3cfc3328f45.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095cecee-160a-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772436778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436778, "uuid": "3542ea4e-9b59-4a38-af03-8d9b1b0ec659", "comment": "Malware payload (AmateraStealer)", "value": "a12c645b3a2bd03ebad7333e8eeca865", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436778, "uuid": "6c16b53f-2492-4190-8eab-418ef80c942c", "comment": "Malware payload (AmateraStealer)", "value": "301c13e5d056767aef2b5b44de1800098bc3aa1dba1e00e8d713514fbd37b640", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436778, "uuid": "c2ada264-7b81-4561-83d8-3b0ebe66c4d3", "comment": "Malware payload (AmateraStealer)", "value": "987135dde37f5e5511f9264c579e385166b16111", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436778, "uuid": "6ba51c61-5b22-483b-a2be-a1c37a104d66", "comment": "Malware payload (AmateraStealer)", "value": "30b36477d5c87f3a68e4c0bca021d335d168d1bd2906350c998df60d389ab4f389f8cbd8d323b82e7e03fea2575e9ec0", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436778, "uuid": "3f34c56a-da17-4dc6-aa5e-97300c6d14f0", "value": "T1C996CF02FAC185A3D872013195BB97BA1936BD342B1581D3A3D53A7979313C25A3F3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436778, "uuid": "38c53d7e-be61-4a1c-9adf-867c97af60ce", "value": "934db389b4cba78a7e04a36c983d4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436778, "uuid": "f4759b2a-9e0c-4f82-b2d5-2ced569461f7", "value": "49152:IalegVsqcVNVJ6HhinRJB17ZhkTYT0DVaPrFgvJ/TyIgpvkcgmH9kci30:B9PcjVJ6HhinBhZhkThh+FgvHrmyc40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772436778, "uuid": "5f888cd4-d3c0-47ed-a81d-05073365778f", "value": 9079520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772436778, "uuid": "2acb4b80-c431-4641-af1f-6e1ed96c85b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436778, "uuid": "86c94639-d4fb-4555-87eb-e6b4bca34ba4", "value": "301c13e5d056767aef2b5b44de1800098bc3aa1dba1e00e8d713514fbd37b640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744c41c2-1640-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772460151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460151, "uuid": "5fbd46b6-6170-41cb-9faf-7fb4b7ec9e14", "comment": "Malware payload (Mirai)", "value": "8c53f59e2dd51088971e4e408e539550", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460151, "uuid": "e6128774-2e88-446e-9a5b-0ebf33a59105", "comment": "Malware payload (Mirai)", "value": "30383ecc25a65e2149246e4352e26a2ce1278a99dacb4fe7f7445280f87a61a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460151, "uuid": "6ce344f3-b8de-4337-ba98-3478881ccd3a", "comment": "Malware payload (Mirai)", "value": "d4192eb3d7f7e2daf1e7c93bc5bf1a90ba1fb6e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460151, "uuid": "58eb4168-08bb-4dff-8a0a-d275e5a38d50", "comment": "Malware payload (Mirai)", "value": "9cdfa95e83248287322e94e98e008f3584203f4eab72a76505d16d67509e35afc60c67095cbe20acfdaf3bd2301bd7ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460151, "uuid": "8d1fca4f-e914-4038-8fcc-b22307fd107d", "value": "T1DE363A53ECA545E9C0AED23586629263BA717C484F3523D32F60F7782F76BD0AAB5340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460151, "uuid": "d1f8357f-19f6-4df9-aad9-6596a8591fef", "value": "49152:V1aTMI0iwpQeU0yoLkOaaysXSRW3y+owiQT5EoO4TPBsP2RGjXbBd:KKpPyrsXCWdosEok245d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460151, "uuid": "684e8bb0-c993-43ac-a6f1-488da20cd6bf", "value": 5066904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460151, "uuid": "b58e1a36-6daa-4296-8446-10ead1a88f99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460151, "uuid": "badad422-cc29-400e-bbb8-24c7f5d68e19", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2245af3c-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433814, "uuid": "9ab865d4-3985-4563-ac4d-c4203fd952ec", "comment": "Malware payload (SocGholish)", "value": "f30dae4bd06170ccf2eaa0bf0f516876", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433814, "uuid": "e119265a-e647-4450-807a-7ad73c487251", "comment": "Malware payload (SocGholish)", "value": "30bccc3b41684ce4f0e96cd31f29cd35cb8c75352a2478e68d39d6fc16025cf6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433814, "uuid": "d4c2d287-3028-4ff5-9cdb-ec35d31ad662", "comment": "Malware payload (SocGholish)", "value": "e833af480d099ee398cd4aac0f2193c74b8a777b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433814, "uuid": "51047225-d3e8-4d0f-8992-b199873e564a", "comment": "Malware payload (SocGholish)", "value": "1238e70b32113bc18b84c50891d7f7b7f1f2b66cf9709ed1c539668aa10696e5cd3c272409f4def8cc27c3fb0e3d07e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433814, "uuid": "adcc43b5-81ac-4d22-a3c7-cff7ee99e5ee", "value": "T121D0A75E14484828175A6A2E82F3CA0C7A57353D64825452CD3AA9AC61A0996691B9AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433814, "uuid": "d98ec594-73fd-40e9-bf76-afe2decc2051", "value": "6:SlUgO9l9LtRWPIj8oHMd6pd7LxQJQiDE1kjiUSf:wsptRWPIj8oo6TLxQ1hjXSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433814, "uuid": "8c794db6-0295-452f-acff-6cc3249876e6", "value": 244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433814, "uuid": "e01ffd04-9d79-4a16-9744-66bf94455a18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433814, "uuid": "61bb1278-8f49-472f-a848-0084dbe80396", "value": "30bccc3b41684ce4f0e96cd31f29cd35cb8c75352a2478e68d39d6fc16025cf6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6a051c-160f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772439015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439015, "uuid": "bce39e23-39c3-47d8-8b8e-c07f31176f7f", "comment": "Malware payload (Mirai)", "value": "0ee40e200ff981389851da32670bc629", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439015, "uuid": "18e2cebb-c1f1-4251-9dce-3e2a7c5c7d29", "comment": "Malware payload (Mirai)", "value": "30bdc858f11049aef70f897f27690a8e03739a232b78f1af2a971a7c6fecdd08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439015, "uuid": "bbec35dc-baca-4891-a096-87f7d922aef4", "comment": "Malware payload (Mirai)", "value": "3b5ce318c5bf731e0d43e53c09dc8fa6589ba6b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439015, "uuid": "dbcc4372-c79e-46e4-ac0e-83b094c3478b", "comment": "Malware payload (Mirai)", "value": "ef5e32b2de72ac79e489e65c692b77eba9b45471b8b09c2d1f5a7c93b481963fa367bc58981fbbddab9db321685f92f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439015, "uuid": "a7b17b32-0d9e-4e36-bad6-9021bf5351d8", "value": "T162732B84FA4BC8F1D8574D30416BF23FFA31E5794030C66DDF5AAE26DD27A02B216299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439015, "uuid": "909fcfa0-54a8-4b75-9463-86106c6e286d", "value": "1536:yVmrjr4IlChbTBjFmMGBkiT0zEV2SfWOhXyKk0WBSBU+z9OrAUExLEWUwbZn5:yV2YsChbTBkBbT0zEV2cWAh4ABUI9OM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772439015, "uuid": "2f09e7cf-7044-450c-b64f-911389b87862", "value": 78932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772439015, "uuid": "c79f990d-a453-4fba-92bb-95ef3223d87c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439015, "uuid": "41933a62-364c-43da-94c3-32436642e937", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c780b74-161f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772445910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445910, "uuid": "f49e1de9-6b15-4746-9b8f-85c50a5c61b5", "comment": "Malware payload (RemcosRAT)", "value": "333be281c90f81042ddf12a2df6b64f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445910, "uuid": "816d84cc-22c0-4b87-96e8-1fe3b3a4a711", "comment": "Malware payload (RemcosRAT)", "value": "31160a473733c5d174a4e79933a7353f4fb69b51034df7385f232af79e4554df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445910, "uuid": "3f2fad00-7ae4-4ae0-bbbb-bc51160bc0b1", "comment": "Malware payload (RemcosRAT)", "value": "8388dd0cd7ef51e6ff9763062da5352d3500e10e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445910, "uuid": "d1d57ea8-548f-4857-b4d1-6988f3a89651", "comment": "Malware payload (RemcosRAT)", "value": "20bbdc101919d8990a919c478c5ee463316081e5cbc0fa6a34e2f615770bdca7d37a451d9ed786b68a860e042eee9b2a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445910, "uuid": "318f7399-b9f1-4242-a6bc-49ebe25e77e4", "value": "T13FE5DF9467D83F5D44F86C2611FBEE389BB48EB52609E6CBBC6B3F1531324893906D90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445910, "uuid": "6c77f892-ceef-483d-a745-bff3f5bf13f8", "value": "24576:THGsFWjtcJYTFjsMeaTVsEn4lZjGvoaB6JpjNhENOYNql4rkunuwNKX253rU1I+X:KGcm+WdN8/w6H0ly0skN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445910, "uuid": "0af95439-c65b-468b-951b-9d13e1c47b49", "value": 3291021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445910, "uuid": "e05df5da-ec81-45f5-8e59-37de9499ac9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445910, "uuid": "78231086-10c0-4ec5-966b-3c945408252a", "value": "333be281c90f81042ddf12a2df6b64f7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06c2d59-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475713, "uuid": "2b541bea-b64b-4e2a-90b7-a77594ba74d7", "comment": "Malware payload (Mirai)", "value": "a2085bde1a693ec6084eb5069b46d078", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475713, "uuid": "59c92953-b0c8-4dca-a887-7fec33db4d0f", "comment": "Malware payload (Mirai)", "value": "31591c3356cf8c2f9b9c70eee2a2337b812902fe26290c3611c063c4a575ed0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475713, "uuid": "edb7b4f1-bc70-442c-a040-8833f34517b5", "comment": "Malware payload (Mirai)", "value": "a78a786d5389ea96d65eea9f45de759b7d7def2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475713, "uuid": "de121ce9-a018-4be4-af9c-0b8eae103250", "comment": "Malware payload (Mirai)", "value": "edd6bc6d6cecb8a8a5097f617abcc227e013f4cf92b9ec3ee01f6cc504b78939da3e66da0ff09f2b4b942cc875e817de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475713, "uuid": "c7cdc490-ff4e-42cf-99de-0b05b49b5ee2", "value": "T11C13F18DC6C0A587CE7E473E00185660DEE670C813DB1F427B585EE5689790FB4DCA1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475713, "uuid": "719029f9-9907-408b-b7d3-9b533149162d", "value": "768:shqKs5iKrLl85YHIk/K28QXZbbpoOIHQyTPAbiP652v2nKWZ:yqB5iKdHDD8Wl1ZIH/Y72Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475713, "uuid": "55532ab0-fc51-40eb-9150-4c4183afd002", "value": 44060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475713, "uuid": "f1091b24-9095-48e5-8876-5cdba701fe6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475713, "uuid": "900c092b-43e9-4312-bdf9-02d13cf1d13d", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46c3cdc-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772465412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465412, "uuid": "8eaf6cfa-f943-4915-84c5-ccb56868cf5d", "comment": "Malware payload (AsyncRAT)", "value": "f5e567a01659314418cdd256b476d7c1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465412, "uuid": "b0e5268d-736d-40e8-b926-82fcee947dcb", "comment": "Malware payload (AsyncRAT)", "value": "3168bef5dc8cc04f106ab6b3a9dbfde01534f2d1af6d64e98aa35bdbf4e8c239", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465412, "uuid": "33f8f0aa-b2aa-46ed-885b-14818da704ee", "comment": "Malware payload (AsyncRAT)", "value": "358c6458e0d0d95497a3b0e8467d801b0f4cab33", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465412, "uuid": "30d3edeb-21ca-475e-8648-5e1c5d4c0b0e", "comment": "Malware payload (AsyncRAT)", "value": "1b6dc26076472a20d050ef2050146baa87665a66677456edd4e77e966ae1c54f9abac24fc6617f141379bed3e3dc5d48", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465412, "uuid": "f71fe48b-4942-441f-82c7-ff676a8d6582", "value": "T1AAB3C7143FFA502AF17BAE70A9D075F289FEA6532503F5560CA682C60A43BC1ED43D79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465412, "uuid": "4e217f42-03bf-4ed8-a71e-e858911c40d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465412, "uuid": "87fd98e4-415f-4468-804e-81227bf1aa6d", "value": "1536:fWBrr+LHP3sw+ZJb8JSxl/RKXkxzjJb33xJbJlVbmyz5vaHYF9s8sZ+x:Cn+Lv3YlCUtJb33ftlVbnle8sQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465412, "uuid": "d88f9434-15ed-42aa-9ab0-2f4fdb8f5d63", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465412, "uuid": "d0728faa-cdc6-45dc-9054-10fc062c24ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465412, "uuid": "e29df136-6c69-4ddc-9a45-15f402789f13", "value": "paylaod.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0824493e-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452668, "uuid": "0ca537ec-d017-4b37-8d07-fe32d3531959", "comment": "Malware payload (Mirai)", "value": "88d57ed7c3e6afb54a62f4df781134d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452668, "uuid": "4394dc0d-06a5-4f16-84f1-0b567fcf8cbe", "comment": "Malware payload (Mirai)", "value": "3260978d10198fa256802aff7acf269911fa77e5aa237000228dba639c2ada91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452668, "uuid": "11a87527-ca69-41af-8970-73e7948136da", "comment": "Malware payload (Mirai)", "value": "02e700a1fd482c36e5d69cd81484014f8a077480", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452668, "uuid": "f3e2fc09-d06d-4d45-8f92-8132e1379e83", "comment": "Malware payload (Mirai)", "value": "e9dacd6ec62add92dd3d15a0aa9b3ebb58e60239ad8c15c2d4393bd862e47557f375b84ad1557d73e661cceb651789d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452668, "uuid": "139b4570-b406-476c-a996-27da33842b5e", "value": "T109832A02B9C085ECC089E138077F763AC425F1BD627AB2D73BD5BF1A2C19E501B1EA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452668, "uuid": "f6645b24-3e51-4dee-ae0d-50b034bf6368", "value": "1536:ATNuOfMLWePYeNnVTbBub63gbyLa47Yj0ZOYhMsQEDdiqYRKROELMgU:cHBePDNnlNub63gbyL/Y2hMs5DdiqdRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452668, "uuid": "29d26b04-b119-4c68-9b99-dc24c0c0351a", "value": 85248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452668, "uuid": "bafbc3b1-c2f8-4747-9491-c2051c4e0377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452668, "uuid": "99323324-51cf-44e1-a79d-2c9a59a81645", "value": "MMaaRRiiOisecTanee.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445db014-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433871, "uuid": "a76853cf-661e-4eb7-a376-6f03a2caf05a", "comment": "Malware payload (SocGholish)", "value": "5cce702746709dbb2f89c5b40b862374", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433871, "uuid": "640e8fe2-43d0-487f-94eb-6acfa490bf70", "comment": "Malware payload (SocGholish)", "value": "328a41d5897e2d2b7973403ffe34434047054f27299e476ca3466cc120c49376", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433871, "uuid": "df123b73-bfaa-4be7-8e88-66fab565b3a2", "comment": "Malware payload (SocGholish)", "value": "b5c540bf744b065fddcbb60487dc3b02fcb21e6b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433871, "uuid": "ec76ca8c-f689-457c-852f-c25fdf835f19", "comment": "Malware payload (SocGholish)", "value": "270d93c0eccba6c1b36b33165156a01ae3eb5cbeb47e51bf61b78b7255644a4bb97e6fa9b5f25f731df2c57301679590", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433871, "uuid": "324835f4-5241-4949-8aa7-90edd4198ffd", "value": "T158D0238F3400014837D727F44773DC653C050042300488F78C7B80625524AF300679CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433871, "uuid": "b6b927e8-d119-498f-b7b8-84c339c145ab", "value": "6:SqYy3AgO9lzYBRWVoCcS6pdvrRfAJOI65EC1m:iR0BRWbcS6h1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433871, "uuid": "f8b0a166-fc28-421d-be24-7c88181773f9", "value": 232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433871, "uuid": "197472e6-5412-4160-b5f6-98b222fd38a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433871, "uuid": "81289ea1-b35d-4c5d-8c9e-fe8fb74d2bd1", "value": "328a41d5897e2d2b7973403ffe34434047054f27299e476ca3466cc120c49376.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0f373c-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475709, "uuid": "1ed0fa3d-aa21-48c6-97e7-c484b05d1294", "comment": "Malware payload (Mirai)", "value": "7d1a5dc3767dd8c17a25a5f579a0af86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475709, "uuid": "2dcb41b4-1a0f-4432-b4b0-84bd7a1be8d8", "comment": "Malware payload (Mirai)", "value": "32d89b0e80ce5a85553b495a1efac09df9468e1182701bdbb0b44554732b9548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475709, "uuid": "f8650572-ecc5-44a8-ae20-e46058818419", "comment": "Malware payload (Mirai)", "value": "b836415ac40f1b3abbfccc6eae8d48fd20b87628", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475709, "uuid": "67aed317-12b7-41ce-b214-21d4c6b8e73f", "comment": "Malware payload (Mirai)", "value": "3f837622b122b72328f191bd4dbcee8ce24f003d2c52ffc4dc3df941ec1507c02442c8d63b255e3f93e1ef97ecf51433", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475709, "uuid": "72c4028f-e35d-4472-ada8-6da5afb5f8dc", "value": "T14A83AD73C86A0D28D44844F0B0A4AF3597A3E112C5972FF69896C679E08BEDCF5463F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475709, "uuid": "1f86807f-af2b-4729-940d-eea473e3acf0", "value": "1536:m3JrMxaPDE1qaKX2YHKKWBSY37gKPCnc+zIGypn:mVMx5WX2CNW77gKPtK/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475709, "uuid": "28fcc7a6-6db4-4e51-a393-e7e70263b850", "value": 81140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475709, "uuid": "e7b8240f-153a-4233-8a40-438bb780448f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475709, "uuid": "17c06c0a-eb68-4c25-a9d8-ade8bef69573", "value": "nwfaiehg4ewijfgriehgirehaughrarg.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fa4942-15d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772416046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772416046, "uuid": "2f84f4d7-e043-4ba3-b5a2-dce28e6e0b20", "comment": "Malware payload (Mirai)", "value": "2adb3f60a38a226c21b51289d2680919", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772416046, "uuid": "73eae1e6-b4f1-40af-86fb-8b5d69e12269", "comment": "Malware payload (Mirai)", "value": "336687311750c9c8ec9483b664289c61a2869bbe68696c217e56f077a342551b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772416046, "uuid": "f93b1c31-8fb0-4f1b-950d-9264945bc573", "comment": "Malware payload (Mirai)", "value": "e94a8cd1060dd64907ede0763c90bf10e5ccbb17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772416046, "uuid": "afbd70eb-24b8-4a6c-81b2-792a6247ded3", "comment": "Malware payload (Mirai)", "value": "0ea594ac330852d5c18dca76e6c46deb61ff168bb9250dc0634da0e53709c9cb15c422d4008a95878a27e1629cc1d269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772416046, "uuid": "903f370e-ff9d-4184-9cbb-9cc7e541faa9", "value": "T1C7B30A56BD528B23C5C321F6FBAF424837136B7DD7EA3142ED147FA0274A4EA0E26611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772416046, "uuid": "feefb748-a978-4de5-99c7-f4ac3ab29a7d", "value": "3072:SxkOIfK3imSSr8tbpTkAc4KiLxxHMCqhscX:6pIfKShSAVpTk2KiLxJM4cX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772416046, "uuid": "1f5d47eb-b5a3-4f77-81c3-af0e73e6b829", "value": 117164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772416046, "uuid": "26f49e9b-d640-4be6-afbf-65500dce48e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772416046, "uuid": "f90f27d8-5c99-4d56-8f64-b0414654573e", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77276615-1614-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1772441257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441257, "uuid": "0887a047-011f-4abf-873c-7215c4b2f382", "comment": "Malware payload (DattoRMM)", "value": "47eff4f9fa4d60aac73869d6ec3f599a", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441257, "uuid": "328e795c-93ff-4688-b3f6-8053c9e5f2b2", "comment": "Malware payload (DattoRMM)", "value": "33ed2ca29115c757b7f6acd595491919ce2d7683d9c9c1e1a305a409dd3a231d", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441257, "uuid": "f252827c-66f4-4db3-bcf8-2f17cfeedb14", "comment": "Malware payload (DattoRMM)", "value": "9e8d16fe0df67661d04c117910d25e94776e8f80", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441257, "uuid": "83ecd4c6-93f2-4261-9050-74c2506db52b", "comment": "Malware payload (DattoRMM)", "value": "a19e3b06ac3091e369244d65ddffadaa7d4fb5841ea41dcc30580604fc11e752fc11cfaea0c609d72965d5bca948aa0a", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441257, "uuid": "207a86d3-e232-46b2-aead-f56e78d172fe", "value": "T18DB63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441257, "uuid": "d8eb70a2-f1c7-4b66-a7e4-863b12411eeb", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441257, "uuid": "1a87f5d5-6067-4740-9f78-c9973d862406", "value": "196608:8aZk+w5P+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:On8mzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772441257, "uuid": "1978a301-2ee4-4741-ae58-2a21f4af6257", "value": 11056120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772441257, "uuid": "528297e7-8520-482c-9f8a-896872300164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441257, "uuid": "cd6548d3-34d4-4cdf-a7af-cdec2999657f", "value": "Mirco_Teams.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f58415-1641-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772460395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460395, "uuid": "c7f3e022-5bda-4b82-9e3c-50d725884278", "comment": "Malware payload (NetSupport)", "value": "dc8f13eaf52c0342758fd63402fc260f", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thesolnov-com", "colour": "#9FD32D", "exportable": true, "hide_tag": false }, { "name": "whoiamsal-com", "colour": "#AB6A43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460395, "uuid": "82edc478-de38-489c-8d1f-3f912796ceee", "comment": "Malware payload (NetSupport)", "value": "340e5d67e5cd7587c28fe69773466c5b56760baeb049e024f2266e2458d7c1ae", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thesolnov-com", "colour": "#9FD32D", "exportable": true, "hide_tag": false }, { "name": "whoiamsal-com", "colour": "#AB6A43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460395, "uuid": "c47d96d4-54ef-4b83-9b67-117e3a1fc1f5", "comment": "Malware payload (NetSupport)", "value": "df6358e7cb56368c7b3065820974667f690d9be1", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thesolnov-com", "colour": "#9FD32D", "exportable": true, "hide_tag": false }, { "name": "whoiamsal-com", "colour": "#AB6A43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460395, "uuid": "bf9aca21-d816-4569-94f6-cd43c5b34e27", "comment": "Malware payload (NetSupport)", "value": "08743688fe1236a1f5f935b0b30ad4e0a53e918ee2435ec4fd3488a0b661bd71446048c1a73550b99c04d5e80c786728", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thesolnov-com", "colour": "#9FD32D", "exportable": true, "hide_tag": false }, { "name": "whoiamsal-com", "colour": "#AB6A43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460395, "uuid": "c28eae10-edbe-43d9-8a2d-8fda86793ccc", "value": "T18A717618E2A189304197879EC4DE5814A55F48CF820A5D74F9DE8A8D1F33A3C9F7E348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460395, "uuid": "7666f666-6ed0-4171-a23a-921c5257a900", "value": "96:ES+QIKQYeCrOJ1NQDvZg8YRaxKiUTzgqxaybILoovjiP7IqJAMrenR:ZFfQYeCrOPNQzZg8Ycsi+z1cybILoov3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460395, "uuid": "de5cd145-b764-4064-b093-61afb7274cb3", "value": 3675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460395, "uuid": "8d8f2e35-712c-4c52-86b2-176215d871b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460395, "uuid": "6af31cb3-14fb-4357-b40d-2a418bbd1cd8", "value": "340e5d67e5cd7587c28fe69773466c5b56760baeb049e024f2266e2458d7c1ae.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbed0f9-1666-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772476621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476621, "uuid": "e16beb02-12b2-4dc7-99c9-bfd72c3ce4f5", "comment": "Malware payload", "value": "5f2b474f0c95fbc9dca2e083d0f1a489", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476621, "uuid": "623dde2b-2a05-4dd7-b7b3-409429421ad9", "comment": "Malware payload", "value": "344ad37454c87d35b61d6928849d12285525a63191c2fb1633d85a1450535c72", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476621, "uuid": "74886959-e19d-4be2-a74a-7c76d11c2ad1", "comment": "Malware payload", "value": "9f0f954d4aaf0b10de2556e5675a85002e84f8b4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476621, "uuid": "7e2e9c4b-8cde-4a88-8f4a-5c8ce8b2dfb0", "comment": "Malware payload", "value": "fdcf2b7b2180b675cd8ea66e3e539c8594a62c35e1a187c22c817ab4e234aa609e4d5bef3f07f2b9051754cc4ca8ddb5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476621, "uuid": "6d76ca56-0c0f-427c-a343-8d6bd000d7e8", "value": "T1EAB42366C5B32D7CCBBF1C34497E1A81BA1D518BE4E9AB68094806D34F5E7B9258330E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476621, "uuid": "32448ce8-fcb5-45e3-9d1f-e788425c28be", "value": "12288:M5NSBQCj9Sj/TG6MbtzJo+GOuo+PJGTT6h20oU83/blCZlrwZpM:qoTj9l6Wtze+czPwTmhsUC/bUniM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476621, "uuid": "136266dc-46ab-4105-be2f-baec493aa79e", "value": 523351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476621, "uuid": "0dde67e2-a0f9-4b52-9ccd-b1c56dfdf010", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476621, "uuid": "6b643211-b495-443d-bf13-b386a83de24e", "value": "SecuriteInfo.com.Trojan.GenericKD.79567158.20480.24136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17509538-163d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772458706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458706, "uuid": "9dafa4e5-5899-479a-a3a5-ccde61727475", "comment": "Malware payload (Mirai)", "value": "76b71b835cff151d9d401cd7a7bac9e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458706, "uuid": "25a31a0e-deb7-4ae2-b302-9160382d1aea", "comment": "Malware payload (Mirai)", "value": "34c852e4647c4fec62922a5215fd69720daf21d195592846ddef37cab04d74c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458706, "uuid": "131cd167-3df0-44af-80a4-1bcac88fde8d", "comment": "Malware payload (Mirai)", "value": "50e78ce2826cd1b4b97e10d723f8a1ac2813a645", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458706, "uuid": "858739f7-c5db-475d-af55-145669008cd8", "comment": "Malware payload (Mirai)", "value": "4e555758a270a0a0366a05e3a6d253a7f321f613200341699d8f07e21797acbc750d8a91dff7a4b39baea489b76ec74b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458706, "uuid": "c2b7d8ce-4b6b-4ffa-87a3-f212bddc2d57", "value": "T190934B41BD825A12C6C513B7FB6E028D372623E8D2FE72079D116F11B7CA92B0D7B562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458706, "uuid": "e51fbe02-9bed-477f-9e1e-958aba2b7588", "value": "1536:J6yUnFDKbEphm3oHEKt5h0VUYLGcunc9fJGkkiv218UK0B7WZZZMvoowbZne:J6yUnFwfK10VHLSnSJJki+1EZELwbZne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458706, "uuid": "2181ce03-b43b-4c6f-bd4e-591ee41b0b79", "value": 92724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458706, "uuid": "b9113ad3-980b-4b64-9ce7-758e2c9c9abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458706, "uuid": "b510ac40-418c-46a0-867c-8008809b9f95", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17738929-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433795, "uuid": "2576ef72-4799-4d73-bb0b-975ea41c1954", "comment": "Malware payload (SocGholish)", "value": "f6ca114ad856ed6c8ffabbfdaf4eb6e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433795, "uuid": "972f0412-315c-4a90-a56b-4ce86fc1923b", "comment": "Malware payload (SocGholish)", "value": "34ee9cfa881bbfa06eef959f2d306cf92a14a04158b2d76a41db82ea0872eaa9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433795, "uuid": "7769fd52-aa97-4811-977d-fa0c3398dd32", "comment": "Malware payload (SocGholish)", "value": "b5ef785112d8fb9cc0e507df76c5c4b440b63082", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433795, "uuid": "4447c046-b918-42c8-b0d9-96f472a955f2", "comment": "Malware payload (SocGholish)", "value": "fcf9df8d5781845687bd5a55d80abfbc6169837bfd622b905eab2a01b33b82396ae359e678e575945e0b3d9ad1b7a4a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433795, "uuid": "b4b1c928-04ac-4892-bfc0-51210d20cd1a", "value": "T1E1D02BDA28495439E9DE186612F65D8570532A086C655B66CCAAC49409B97E688063CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433795, "uuid": "30f80477-67f7-4490-85b8-50b209352bd4", "value": "6:uI57X7BWyG3AgO9lH92AGuRWd8LHtj8OHMd6pdDdYzUSAH3vnLWm:H57m34H92AGuRWd8Lh8eI6bOAH/LWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433795, "uuid": "a210abbe-55c3-4537-b66e-569946a2fff5", "value": 283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433795, "uuid": "ebaf9d88-577c-4686-bdee-e8585e9d0f32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433795, "uuid": "7fbe8158-f100-4d5c-a574-db7b61af2c7f", "value": "34ee9cfa881bbfa06eef959f2d306cf92a14a04158b2d76a41db82ea0872eaa9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bae601d-1643-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772461478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461478, "uuid": "b899c215-f272-4ca6-8194-ebe0f21eb5bc", "comment": "Malware payload (Mirai)", "value": "90a50a878bc847aeef5d27252889491f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461478, "uuid": "cac66d18-9226-404c-aa0f-c4e774a77194", "comment": "Malware payload (Mirai)", "value": "358c3a8620fe090f9152532120a363d3ad30ba587ccc3ea1a04dcbd2272e7b87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461478, "uuid": "f1f52e82-b912-4ca4-abbc-4055e1a5217e", "comment": "Malware payload (Mirai)", "value": "a44f9c497774c9b480d118a6cdee9de483993987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461478, "uuid": "9186df99-3c4e-46ba-b73f-ddea86fe9afb", "comment": "Malware payload (Mirai)", "value": "dcd0169cb7dba74c0136c25a76ab13b970ffa0e92e694a9e8245736c48fc2dc8f6e301d4fe4296c34ce10363965b3273", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461478, "uuid": "7c28e7b9-c6fe-422b-9e8f-a16017b368a2", "value": "T1D0933A9AF800DD7DF80BDB7B44A3090AB670B3514A934B3A6357BD53FC361A54863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461478, "uuid": "b3d96d0d-7c47-41ee-8161-2dd3736f5066", "value": "1536:/WPz1KCqpu2+ETKcxYcLwpfhVbiASNlR8Y7I3WAJ9L56YQNwohuoxs4tr/BeTBng:uA+MbCcQmASNlRQLgYMBs4trJeTBnW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772461478, "uuid": "7f03a48d-528e-4c4b-bbc2-b3ea587a10b3", "value": 97388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772461478, "uuid": "1a363910-6ca6-4b8e-84e2-686dd18bd3d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461478, "uuid": "6f602c86-8f55-4bcc-9c26-a8eec787f69d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1441adf2-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476310, "uuid": "b696103b-8428-4b85-b6ca-42905861946d", "comment": "Malware payload (Mirai)", "value": "db22036a9daa446a889a59dc9f2dc4b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476310, "uuid": "8a355948-626a-4b47-ac2f-952df675630c", "comment": "Malware payload (Mirai)", "value": "366958c7ec6a9f5525a7394dcb7ad5d049dee87b71723e3a984c76a23b4c631b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476310, "uuid": "c35c68a4-687c-493c-9720-926ac9eed6b3", "comment": "Malware payload (Mirai)", "value": "f518a6fad723b99faeb434b623c7d570527a2ffa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476310, "uuid": "adea798f-bda2-4be0-8445-6368a333836b", "comment": "Malware payload (Mirai)", "value": "76d24cef5d8f340ec4d73ed1b93f351e22ebadfb878cdb4722762f726a4f901c91683831cf83917251291cc320d77131", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476310, "uuid": "4c8a5dc8-e00a-4ef9-ad1e-256a740dea11", "value": "T17393C706FF118FB7C86FDD7305AD8A1128CDB89725A5373A7170DAACBA5618708D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476310, "uuid": "2c4b9d9c-036d-4148-a2b8-a6223b78b3d8", "value": "1536:u//U62k+PpE1UxdYVOPZhesr6Vx55gYOEnOHYN8Jjk:uUHXX/axsDY2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476310, "uuid": "aa470ac7-6498-4580-af5e-9ae85635abd2", "value": 90348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476310, "uuid": "8de63944-0ce1-4798-99fe-d3b43acac659", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476310, "uuid": "b6bee125-b175-4e5f-a9bd-1afdbd7f3f58", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edd1b28-160d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772438291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438291, "uuid": "a8ffba75-ca0f-4eef-9b7b-a8f4c4633eaa", "comment": "Malware payload (NetSupport)", "value": "dfae5885fa0f55b6f54afe0263d27901", "object_relation": "md5", "Tag": [ { "name": "116-203-167-195", "colour": "#D0DADF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438291, "uuid": "455b9b07-43ed-4ba3-9492-3825d1267241", "comment": "Malware payload (NetSupport)", "value": "369a079956e89b337f797e4a7e8788c2ab574358c23cb907136144d9f5371e5e", "object_relation": "sha256", "Tag": [ { "name": "116-203-167-195", "colour": "#D0DADF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438291, "uuid": "ee64fce7-02c9-44ed-835d-3ed9edd8af08", "comment": "Malware payload (NetSupport)", "value": "995cd7b26017c802f39b4a316a9de95db812d836", "object_relation": "sha1", "Tag": [ { "name": "116-203-167-195", "colour": "#D0DADF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438291, "uuid": "d41e761e-4051-417d-94b5-a3839800e423", "comment": "Malware payload (NetSupport)", "value": "217e3d7efa2b88bde4cb51d8ec219686c44418263d79e58063c8ee6ce05fd0a80b1828a54af6e22967b2080eb84d01cc", "object_relation": "sha3-384", "Tag": [ { "name": "116-203-167-195", "colour": "#D0DADF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772438291, "uuid": "0d70fac4-8697-43fd-838b-148ae6bf14b7", "value": "T159B633B141BF8634FC3EF632ADAC62957D23C60181508B69122B1FA7248D37FE9FA554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772438291, "uuid": "4cf30b34-268d-4f6f-aa00-cbebab815592", "value": "196608:B7FdlIhlC9oBmdRRAkQWHA3bXDImgyuld/M8DjMNImu64/GenkEbAaO:BFdUCeBmRRQfwhLtnEbmpk2vO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772438291, "uuid": "f7bdc337-bc70-481f-ad8d-d81293a9aff5", "value": 11318237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772438291, "uuid": "564b89ea-b8d6-49d2-a0e3-f9447c0cd97d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772438291, "uuid": "3d3941bc-b902-4dd7-9e9b-8524543615b7", "value": "369a079956e89b337f797e4a7e8788c2ab574358c23cb907136144d9f5371e5e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf9f712-164e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772466230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466230, "uuid": "d6bf9354-1101-4070-a1f1-1862991c8709", "comment": "Malware payload (RemcosRAT)", "value": "7ccba52c7610021e39a76fffd6bfe4b2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466230, "uuid": "8d3fbdfb-7601-4cf4-8974-3ddfebcafe29", "comment": "Malware payload (RemcosRAT)", "value": "377b8acd9b7402d77002d021962bf8ab0ccb668a423df97212bad3d717b0193e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466230, "uuid": "6a852fce-f8dc-4224-bf51-6c8d62223103", "comment": "Malware payload (RemcosRAT)", "value": "cac9d4b8ba0de73689356cc37699dd461cf98711", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466230, "uuid": "39e67724-c2df-4ceb-b64c-753c6f4f7b5c", "comment": "Malware payload (RemcosRAT)", "value": "190385bd306adf027e4323483096a74b6d787c86a3cc3d211c58bf45ee6a167cecd02254f4b865d96409d54889256933", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466230, "uuid": "74abb359-2c59-450a-a5d2-c76efcc40bf9", "value": "T10D4513D958D3958C1C7A02F2EF3C75209F7D301A3AA91EFD34C04ADB225958B5493AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466230, "uuid": "d9a4adaa-0e03-4064-b168-c38faefcd49c", "value": "768:A44444444444444444444444444444444444444444444444444444444444444l:ncI5SFFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772466230, "uuid": "efd0f52c-f3e7-4364-8134-72c98c5f0ce7", "value": 1238119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772466230, "uuid": "20cb53ca-1d51-4f23-ac8d-4360bc0e852c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466230, "uuid": "1f6bd993-67d5-40c2-8d22-baffeed67217", "value": "Productos listados.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2e2d18-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772434073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434073, "uuid": "c3208ef5-a5d5-4283-897c-26478fb64238", "comment": "Malware payload (SocGholish)", "value": "e0e2a64bba76b50b433c1ae8e89a7d9d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434073, "uuid": "6e527cf8-4d99-481a-8189-a5c06c09cadd", "comment": "Malware payload (SocGholish)", "value": "3862b771872c705cb757d851d7714de369cbf8db548d8dcac7edcc46933045e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434073, "uuid": "ae32ebab-b653-4586-9c1f-68f4f94e448b", "comment": "Malware payload (SocGholish)", "value": "aba9d951147884860a5e5d96772c7e2d575bac0b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434073, "uuid": "eb99ba95-3232-4938-bd5e-8d63ad4d4181", "comment": "Malware payload (SocGholish)", "value": "163eed2abe631a3f669cdea0745f3ece55d9a15d403d6ab295815ee6e6ed2cd21907110825a41d8cf53391d705e8e0aa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434073, "uuid": "50dcbaca-7073-475a-ab7f-14518ecc3c60", "value": "T179D097B6188A21B83A9950AA3033C20D324A3258F8EA2876C8FE4C410604EE2085F61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434073, "uuid": "2c3fc2f4-a269-42ae-8a2f-c5fda0a0c549", "value": "6:qSE9/y3AgO9lcRW5E5OGIdnvYk3wgyutbkgIzm:Ua34cRWQOfL4kbkgIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772434073, "uuid": "bb4c0694-7f90-497a-98df-3e7ba26d4882", "value": 251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772434073, "uuid": "f87e2b9b-f3b7-4251-a65e-32b0b3f82979", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434073, "uuid": "0ea4b56a-278c-4ffd-b067-354a497bd886", "value": "3862b771872c705cb757d851d7714de369cbf8db548d8dcac7edcc46933045e0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06982553-1622-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772447082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772447082, "uuid": "d9d29aca-a698-4523-9d6e-f9661446afc6", "comment": "Malware payload (Mirai)", "value": "50df9c43e0ef5fc28b2e1e4b1a15da6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772447082, "uuid": "271cd27c-3d2b-4458-b6a6-98283533426a", "comment": "Malware payload (Mirai)", "value": "395618f2573b6b0a0fccf0cd97bf1d81b47516607ff72920c9b0f311a28c6322", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772447082, "uuid": "b6cd4e5c-c709-4b5a-8392-9042ed80e712", "comment": "Malware payload (Mirai)", "value": "656b1b94da7faef4a9dfd78b656178042887c564", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772447082, "uuid": "8765e9e6-95e6-4396-ad37-d8d7b346877e", "comment": "Malware payload (Mirai)", "value": "cdf008b22848edb8ea5879db0bb66ada5d8a2ae0af4bce17570165dde44b6e431496c7981835f9fc72b31472d23a5bc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772447082, "uuid": "7d9daa11-fac0-4721-97c3-370be6998232", "value": "T12F833A41FD829A12C5C423B7FB6E028D371663E8D2EE7217DD216F21B7C681B0EA7552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772447082, "uuid": "20fa4c29-15c1-4109-809e-5c85a9451419", "value": "1536:LeJQWPIqC9PFG5bWoFY7EzL3V2HwDFh/hIcZOi9DpPzLJnDXDpXsewbZne:SJQWPIqC4v/zLViwD7JZOSNXNNwbZne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772447082, "uuid": "6367f429-1e5d-4f6b-91b1-a28b7e0b882e", "value": 88472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772447082, "uuid": "c8dbef74-d198-48d3-827b-c9847844d649", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772447082, "uuid": "32535a76-3711-455b-9670-4f2e8888ab58", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2daa6ad2-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433833, "uuid": "0bf0c43a-e7bf-4136-815f-de6eb1780e39", "comment": "Malware payload (SocGholish)", "value": "a6625b76f6a2632044e544ff887f32d5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433833, "uuid": "4ea6e54d-53fe-4369-a1f8-c61de1ab9301", "comment": "Malware payload (SocGholish)", "value": "3960860ed9b76d13e5fef1de990d3f83165e4db0c180e4d6d088d0b94bc2c3dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433833, "uuid": "93d9ee9e-8133-4b84-8d6d-fca4985a3a6e", "comment": "Malware payload (SocGholish)", "value": "4a55406e63ed4ab8653a967ed7f01a65eba93401", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433833, "uuid": "4060ff08-7ad3-4a3e-abe1-24570706a0b0", "comment": "Malware payload (SocGholish)", "value": "1fa54b6316a5e2005ea24f4175221d3a62345020a78d8da3d2b3961d890a7af2cc082c13ef1973827eab5e8b046f1ab4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433833, "uuid": "d6e72ea6-07a0-4f4a-9af2-fc007eef2f2b", "value": "T10DD0979E380600152ED81D3402FA9A0A32833C09240494A1CCFB5828E020BC4029222C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433833, "uuid": "d878c162-a0c3-457c-ba99-43ede0bfaa3f", "value": "6:fO9gO9lfTRWF8tK8dGIdt2RvVTPT46VaR:GTfTRWF8tK8dVUVPvVaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433833, "uuid": "89a83303-c7d8-4f94-8558-ef1c94a62329", "value": 233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433833, "uuid": "9c897f8f-3d74-4761-81de-5aa6b89b7ce5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433833, "uuid": "50a79a9e-4590-4eed-b220-8929453e137b", "value": "3960860ed9b76d13e5fef1de990d3f83165e4db0c180e4d6d088d0b94bc2c3dc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9ec3b6-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433911, "uuid": "2de02b79-8044-47e1-981d-219ec5702ef7", "comment": "Malware payload (SocGholish)", "value": "50d9adb32d22f3ee6386dbb26b52fb9c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433911, "uuid": "3c657ea5-5619-4137-a07c-dede251caa82", "comment": "Malware payload (SocGholish)", "value": "39bd6476057eb7a4a6b6880a1abcda4e87dc62ad44e46c7256e0e2817f780fbe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433911, "uuid": "613eb793-1ea6-482b-a4a9-9dd537a89e70", "comment": "Malware payload (SocGholish)", "value": "4ac3caba118323772f4e961a7a9e75cc15c00fdd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433911, "uuid": "c735c53b-5171-4fb2-bea8-e95e67d3036f", "comment": "Malware payload (SocGholish)", "value": "5a0ff248d12b1aee21301fc23ac9923355a76f3bc6114cc48737b0a1855fe2e3ca4b98bd45038b82cdb746ba16e912fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433911, "uuid": "021c69b5-0b6a-4574-821b-fd6b6fc7275b", "value": "T14AD0974738902D180A1901BE2233DBCCB0213019354256259C3A90B941946E00B5B88C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433911, "uuid": "4fdb8cb2-3cd1-42ba-b136-c823dd62369d", "value": "6:SekAgO9lRuRWcVTaGIdUO5rK9E/eTwnVfl:rk4RuRWUaJKMhnVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433911, "uuid": "9915e7aa-9fff-412b-8ebe-96757ce9a482", "value": 226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433911, "uuid": "d8eda0a0-7a1a-460e-85fe-8d0ea7a4965d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433911, "uuid": "23c3d4f3-eb9f-4630-bd77-c07e9c27206e", "value": "39bd6476057eb7a4a6b6880a1abcda4e87dc62ad44e46c7256e0e2817f780fbe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe786d2-1656-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772469619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469619, "uuid": "84c813e3-88e9-45db-a6a2-70738d045433", "comment": "Malware payload", "value": "16dee4d51ab836bd14f15524bb3c8704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469619, "uuid": "708e37a8-d4d1-4b2a-9ebc-b8b46f43acbc", "comment": "Malware payload", "value": "39d237d7af4e4aa65b09ce401106a45a04a6ba859bcc8bb54f2834fd4de99f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469619, "uuid": "31d791d4-fc12-4a82-91a2-ae5dcee2d434", "comment": "Malware payload", "value": "e8d18eaaf7bfa47fe0f9bbf4af14075ea09126b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469619, "uuid": "8054e721-612f-4738-a125-c7752b5cdc8e", "comment": "Malware payload", "value": "f667c021a23baa6f8fa171c83c0e91337c66bff0ace13b054553a7e07a907fb4184801056ba456a9ee0831611f779b72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469619, "uuid": "751ab387-2bc8-4959-b603-1069dd4d1f66", "value": "T18545AE66A7A840F9D06FC178C9528607EBB2B455136097CF07E08AA62F23BE15F3F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469619, "uuid": "268db671-7281-4c88-b104-01b6091ad9ce", "value": "96c553a0fe1234b7a3e2caed69efe697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469619, "uuid": "f19a2a4e-7ce6-43ce-82a9-438ed308c5b7", "value": "24576:MJwVcXn4pdhPeynhMdwgstjTz/QpB61LZBNVR9DfIh5B9h0lhSMXlK:pmn4RvMagMz/QpB61LZBNVzAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772469619, "uuid": "738cf3bc-f513-43cb-a06b-b278760257e3", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772469619, "uuid": "e4950b64-44b3-4412-8a5a-9624c1bc5afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469619, "uuid": "ca41736b-bb95-4547-b224-e4d24e29a20f", "value": "39d237d7af4e4aa65b09ce401106a45a04a6ba859bcc8bb54f2834fd4de99f28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336d8e30-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487529, "uuid": "76848ce4-88ba-4f90-84d3-84b978d6e78d", "comment": "Malware payload (Mirai)", "value": "e29b95e9f40c8a697b8360b2d823c9d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487529, "uuid": "b41dc96c-33b4-49aa-85d0-6782940776b4", "comment": "Malware payload (Mirai)", "value": "3a626e3f4d25efd58e494ef132163c2578b04594b944597fc119d0a915f6c7de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487529, "uuid": "f7a191f2-37a7-4bf2-961d-ec70c54e8642", "comment": "Malware payload (Mirai)", "value": "b5495d84a946fedbcd3d28a5b8514dba3ad5db9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487529, "uuid": "65b3ce02-7f84-4ad3-879f-354e0966ed3b", "comment": "Malware payload (Mirai)", "value": "f2b7011ce0890a28ef1876030a4037539c92daabbdca5a435e8fda43be105e3f49d008f075ca89f9e5d096c0fbadae05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487529, "uuid": "b5fc1886-85ad-4836-9810-c54cdcadeeb5", "value": "T1D5B339C0EA47D4F5DD1642302277F73B9A32F17A1139DA93E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487529, "uuid": "044bbab9-a213-4d88-84f4-6fa2be85a7de", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEhuohHw0pJbLm:XFmzY5mXBypzjYYZ/5+J7lHLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487529, "uuid": "eca31818-50e5-4325-b054-4f97121ba396", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487529, "uuid": "33b6157d-1992-446d-9767-95dee7104174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487529, "uuid": "2bd9b0b3-2646-4f51-9358-77f5e9740474", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcf0d92-1673-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772481937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481937, "uuid": "8144ac60-a835-402b-9889-d24eddca5d62", "comment": "Malware payload", "value": "809139c237c4062baecab43570060d67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481937, "uuid": "952f23d3-1f86-4bbb-99e3-3a20182d5f17", "comment": "Malware payload", "value": "3a66ae5942f6feb79cf81ee70451f761253e0e0bde95f0840abdd42a804fad39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481937, "uuid": "7675d81b-090b-434f-bf73-825eaf64af8b", "comment": "Malware payload", "value": "8735ee29c409b8d101eb3170f011455be41b7a91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481937, "uuid": "032e6771-eaa4-470e-9b7e-07d65ce92647", "comment": "Malware payload", "value": "12bc1f94afa438ba9e77b397e0a63db7650bbd9e30acfbf296840153985c18c703183f58deb4846ee796918ec13de567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481937, "uuid": "14212a10-9fab-4cbb-aec1-58e77dbfb0d8", "value": "T150B49E0427ED4B57E1EF5BB5D0B2A592C3B1B462693EEB8F5C4424EE2C17390C911BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481937, "uuid": "16cdfab5-f902-4203-8698-54da54271d9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481937, "uuid": "07a5bfc9-8445-49cf-83d1-086e40b007a7", "value": "6144:5TtuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/W:l1QL32ikCaUS4csRBse6sfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772481937, "uuid": "1ff8cd18-30dd-4342-95ea-cbc7aa709b7d", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772481937, "uuid": "967a07a7-3041-4cdd-935e-249fae6df39c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481937, "uuid": "bca38663-e3c0-44dd-895a-7db77a16c9eb", "value": "file_oct_surv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a44ee03-160d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772438283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438283, "uuid": "3e5d0217-aecb-42f8-8335-113dff3ca731", "comment": "Malware payload (NetSupport)", "value": "8a8394738695efe39e31ac71d4afb374", "object_relation": "md5", "Tag": [ { "name": "116-203-167-195", "colour": "#D0DADF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438283, "uuid": "f1f54958-b0de-45c6-a38f-8594c4bc6eec", "comment": "Malware payload (NetSupport)", "value": "3a9c1b39fac927a569c014428d75755037c371f6bf8b3cf98dcae8bb35d8eedf", "object_relation": "sha256", "Tag": [ { "name": "116-203-167-195", "colour": "#D0DADF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438283, "uuid": "aae9891f-2db0-4874-a45c-366c8d335372", "comment": "Malware payload (NetSupport)", "value": "fa7ce13fc0834f561fd7dcf521f99737de7e8345", "object_relation": "sha1", "Tag": [ { "name": "116-203-167-195", "colour": "#D0DADF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438283, "uuid": "aa8b8ca5-e721-4dda-bb9b-83e1d56e7dee", "comment": "Malware payload (NetSupport)", "value": "939520924a345989fe77ce66b83d81c8e35451914803d9adc36a0c993b9b86efd8fe1f58d428b375bad03d364cc8b39a", "object_relation": "sha3-384", "Tag": [ { "name": "116-203-167-195", "colour": "#D0DADF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772438283, "uuid": "220016d0-fc16-4b43-a481-a53d3a7c71a8", "value": "T193A533D4CBCE9264AE6472C7E3E780A7A4F7CE549736A184253C3C497EF24B09D30699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772438283, "uuid": "932905f4-ee6b-4e3f-b1b0-17d656d86d8b", "value": "49152:woskegvcYHEZBvWQaEHqidizkVxhg7P3WCM7SUXKG6CbHPlh:woJe/Yk3B4zkVQ7PlM7jj9HPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772438283, "uuid": "525ae0dc-f8ef-4234-8714-01d27abf7a98", "value": 2233200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772438283, "uuid": "3bf94e57-8dec-4547-a11e-82fffcd4ea5f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772438283, "uuid": "2014694c-7d69-4284-89ce-bffebca97f32", "value": "3a9c1b39fac927a569c014428d75755037c371f6bf8b3cf98dcae8bb35d8eedf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a761797-1656-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772469583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469583, "uuid": "6d664a62-2e9c-4dad-9e65-1430ef7a828d", "comment": "Malware payload (Formbook)", "value": "0b9c022bb4bf1dd3c425624472cd5ce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469583, "uuid": "1c41952a-1be8-4c84-baaa-a1e86617f547", "comment": "Malware payload (Formbook)", "value": "3c3986cc2354ae8cb2eea13b9b853bbf001bb58c81f4340a6e0a7a72464a70bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469583, "uuid": "5c395943-1294-4fe4-a7a9-07f16e69be66", "comment": "Malware payload (Formbook)", "value": "6355cd5a5f562670d669dc930f2d2f193e78f76f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469583, "uuid": "7e632d02-9e7f-4b28-92c0-85d447284975", "comment": "Malware payload (Formbook)", "value": "8132731014b62b3114db2686d0f1b3721a2a0897f43399955e35bcf99d92f22a39dbed27ebb5739ab5db631c2cd2dd44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469583, "uuid": "b796f112-c33d-4ece-9945-398385dda5c0", "value": "T19445F11066A6DC16C37D873218A5F17C87748EC6B111D25A7EDE7EEB7B2AB0109C2783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469583, "uuid": "e8c43da1-8cdd-45c2-aa9a-d95a27a4ee8c", "value": "24576:QaNoKPv1GK1IwYSwIQR0xxx407vzpfmqZGOJ5mpOdKgI5aO:QaNoK31IwY+xxZnDYRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772469583, "uuid": "f9548335-a11d-4f2d-af75-56f78e9e05cf", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772469583, "uuid": "35b09899-e31e-4f64-bbcf-dfd151f48032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469583, "uuid": "640765c9-2133-456e-bee6-661096472eff", "value": "PO345657.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043a8c83-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772465116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465116, "uuid": "6aa1e70f-f6b4-4bbe-9a36-5a12c0599d64", "comment": "Malware payload (SalatStealer)", "value": "51a400480b57e79459f4b45736dd24b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465116, "uuid": "fc221c07-9e65-4bdc-8ba3-82a3bf530cc4", "comment": "Malware payload (SalatStealer)", "value": "3c4a7917f2d2f635e74d6661c1f1605d1aaa22e37b80f9a796b810370433574b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465116, "uuid": "4bda301b-a08d-449f-b6af-cac9671e48a4", "comment": "Malware payload (SalatStealer)", "value": "5a1278cef30729f353857a86f1dfb413ee429895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465116, "uuid": "74aca871-1b36-48c8-9151-efa3a665c0f0", "comment": "Malware payload (SalatStealer)", "value": "75e8b825aa5585ceebfb32dc0dd7a8a68ec3cfad1278953885b301191996d5207cc5368defca6c9eb6bcdb5912a0f103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465116, "uuid": "278f4f9c-bb1e-4e5a-a4e5-4debe23a207e", "value": "T13FC66C41FA8B65F5E9035931405BB23F23316D448B38CBDBEB587A2AFC7B6821D76604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465116, "uuid": "49683db3-45f6-41a2-bfd5-726e04c4345f", "value": "49152:Qub/u5TwzWxFt3E42tc58O2MLZxumHlz0d34SNKy/oNnPf3CQ6zUnmXQz7ppl484:jzu5TZ3caiNKyqPfyp8WBSpeb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465116, "uuid": "9553c4f8-a84d-4592-a4a6-f034858c8ec9", "value": 12108288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465116, "uuid": "fd6372aa-3541-4c1e-86e4-d922c80ffa51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465116, "uuid": "9cd2a343-fdbc-47a0-9dd6-5f39eed42568", "value": "5vnja6z5m.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744f4490-1656-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772469599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469599, "uuid": "67325e6c-2c92-43a7-b436-076aea14ffee", "comment": "Malware payload", "value": "773e1cf76a1f2972aafde1d0dbc2ff6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469599, "uuid": "157d5c75-0d01-449d-9e58-89d9766d6d2b", "comment": "Malware payload", "value": "3c68426f1efd7fccb22b0368088d683ff5ff6ee08b87cb46ed04aa0759b4780a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469599, "uuid": "3a84fcf7-9c9f-42ac-8a1c-347bbcaf40bf", "comment": "Malware payload", "value": "214133aca9c38b645c5e2175115f0e7c103b81f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469599, "uuid": "3150927d-0a88-4370-9436-a42ddd04d41c", "comment": "Malware payload", "value": "ab9933e779d0d66f8f21bd4db29eeb63919f14635bb595bc59283b4e3b7157d24d9eb05e46c991d5fd0233433413a9ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469599, "uuid": "ea2c0c35-b097-4e17-8bec-1a041aef6015", "value": "T143459E66A7A840F9D1AFC178C9564607E7B2B415137097CF13E08A6A2F23AE25F3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469599, "uuid": "62b1e090-0cb9-47ea-9ac2-40f8282f7635", "value": "e76f4d9939ad93da8e256ff50d55bd58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469599, "uuid": "265ceb6c-c3af-48be-809b-833358f3a4a8", "value": "24576:XKZEnMy/5GxnqtNmWP95427DVf5dfMf/DVqskuRxLNh0lhSMXl:X9D/i0NVM27DVf5dfMf/zkeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772469599, "uuid": "b985ed9b-ac71-4e08-8be2-15f916190c64", "value": 1222656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772469599, "uuid": "40429853-1c80-448c-b72e-03f0b753f6f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469599, "uuid": "c26b4dcb-76dd-4801-8fc2-2e0e5c5aee4b", "value": "3c68426f1efd7fccb22b0368088d683ff5ff6ee08b87cb46ed04aa0759b4780a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277bcf58-161a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772443701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443701, "uuid": "971bbb7b-eb67-47da-ab5c-176f40051baa", "comment": "Malware payload", "value": "27e7a22165b74388a55bd2b582a5a4f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443701, "uuid": "e78f3e1d-cde2-426f-864b-9b376f4f5183", "comment": "Malware payload", "value": "3c8b25ecb7fb705c5937777b02e3b111eb5eac24d249d60268874467311845b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443701, "uuid": "5c86e1d6-3ff3-4d3b-b1dc-f81e2f166e1f", "comment": "Malware payload", "value": "2cc047467313ed6666ad685194dce0845353fe82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443701, "uuid": "056bfabb-8ac4-4104-9003-731940d7f036", "comment": "Malware payload", "value": "86ae0669f1e296fe7d0fb1eae967a5b7772598753c581f2901533b65d39b00e86ed8393874c89f1255cc4610d844cb33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443701, "uuid": "733204fe-a8d1-435f-b692-4cf37760577c", "value": "T1C1D3545E6E229F6DF668C73447F74E34975D23D62AE1E684D2ACC1101F2028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443701, "uuid": "0a6455e9-7746-4e56-9556-ed59956d2642", "value": "1536:nONHdJK8USMwsc7ZydVk2VxDAUHxJs+zpvJ+3UKo/pVsQjztQFXmfNT67Ce8BnCN:nON9c8UCsc7cHbNL+uxVfz2W1e9Uyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443701, "uuid": "84d51420-245f-48e1-afe2-6521940a5309", "value": 130756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443701, "uuid": "ca85e388-a909-453f-a80f-c7963091e8fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443701, "uuid": "660b8d85-b19b-4151-aaa4-0e495bd93530", "value": "9e3363f017c60726bf610a2a472040144T.", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc953507-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475761, "uuid": "36c681ce-47fa-402a-bc87-f201a016d408", "comment": "Malware payload (Mirai)", "value": "c2a61972d702c0ae2bddd14db76642ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475761, "uuid": "ccb35617-2648-4390-9214-b8f4aa9ee8e5", "comment": "Malware payload (Mirai)", "value": "3d6325799d6cf9d9649cfbed5d4cf02cc609bc2d67827a906cac65fdc15772ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475761, "uuid": "069d5ca7-a002-4e08-8b8a-5ed46ae9f306", "comment": "Malware payload (Mirai)", "value": "a760700f201998cb9ebb96971ff1346f59c33661", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475761, "uuid": "89dca4df-05e8-4ebb-b6e1-071fbf9aa0ee", "comment": "Malware payload (Mirai)", "value": "54a48ef17fd993f8aed49cef38f21fd1c57312b092f2c454470752eb4ebb1d2c55a473fec188fb39e80307d2b00a3dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475761, "uuid": "7d1607ed-47d0-4a36-a218-423ac585417f", "value": "T117934B42B71C0E47D0576DB02A3F27D1D3EF9EE120F4F684691EBA8691B1E321586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475761, "uuid": "1900154e-e4ef-43ea-820b-c2c847e1b81c", "value": "1536:ye5eOry/nT7Grq5yaaOuVFoeiP9dOgF+tZrcLA7Z1q866o1Gw+FjnFt:p5en/TH1hFOj7ZF6Fmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475761, "uuid": "39d952d8-b824-4223-b871-002f0067368d", "value": 89528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475761, "uuid": "f8d32d2c-d5fa-485a-b5ba-52cd54aa8f1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475761, "uuid": "e983e3e9-e26c-4d12-926c-f7cc5e38c6db", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d82a507-1626-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772449026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449026, "uuid": "a2d01964-b6ba-4831-89af-f4db36d7d39b", "comment": "Malware payload (AgentTesla)", "value": "5c40e273901403756f3ebff955ca5b0c", "object_relation": "md5", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449026, "uuid": "25a48898-41b4-4db2-9ea7-8871a982ebc5", "comment": "Malware payload (AgentTesla)", "value": "3dd33674755654a3dc5e182bc04bd1d4bc96cdeec6c1a201819b113e98922b58", "object_relation": "sha256", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449026, "uuid": "8480534e-b838-4d69-a992-a16c0ae810cf", "comment": "Malware payload (AgentTesla)", "value": "b1b385047ead2e252e9152fe5ce8e9f8523ca8c9", "object_relation": "sha1", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449026, "uuid": "ba44ecf7-5102-4b97-a5d7-6df8d900a448", "comment": "Malware payload (AgentTesla)", "value": "f14985a6b8e1850afcefaaf29b1c588782d142c2d74501218a8c7b4c51a9ee1f87ee2806ab037f3c755b142bbcebff24", "object_relation": "sha3-384", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449026, "uuid": "44317fbd-f5f1-45e7-8465-4607fad843ec", "value": "T1A2163B44FD48B6A92F23CE363BB471D186C2645B7D4A8582F02B9EB1BF63185ED20D35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449026, "uuid": "3cd6573d-4bc6-4b71-b4cc-3aac5f55095b", "value": "98304:7rbCiR9BNflz0xIpiqrQuaDEWhUW3dIwTPojeycAavX9RzsqAnA2fB5EbsiJnpkQ:7n9RPIxba9aDEWhUW32wToS2avgqr2p8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772449026, "uuid": "0babed34-b1b3-475d-8cfe-2cf2fa573c4f", "value": 4279762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772449026, "uuid": "c96fa493-7864-4826-9582-547a5e6c0ebc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449026, "uuid": "a3f79efe-7e97-4833-99af-b2eea6e81971", "value": "f9sd9fd0809g7sd8f789g73438g97dsf8g798s7df98g.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65048a2c-1650-11f1-a769-42010a9c0008", "comment": "Malware payload (N-able)", "timestamp": 1772466997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466997, "uuid": "ac8f6e9a-e4dc-4a04-a4ea-8f9b83159b8a", "comment": "Malware payload (N-able)", "value": "9488cd40a3478f9114875d0e9709d44c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466997, "uuid": "5d774619-2bd2-4035-b956-302ea7bc3e1e", "comment": "Malware payload (N-able)", "value": "3e9ed4331ad21a4fc01ad5e13974b6cd720f98204ea7abcc7f3231eab042048e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466997, "uuid": "05934f9b-85af-4f02-8291-3b14922119d9", "comment": "Malware payload (N-able)", "value": "34f194f1b56998c70358d449ee7688a5bfd5ab8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466997, "uuid": "52d53678-cefa-4d46-96dd-34acbbbd794a", "comment": "Malware payload (N-able)", "value": "1be90594a793677684fda5c7c0e73ee09f31fcd1011a336d5009701d8cfd9ac57c9389e72191cfd6111746f806bb2a9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466997, "uuid": "33e5ed43-977f-4490-8a84-d72e33d4bec6", "value": "T1BDE633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466997, "uuid": "55d6db82-1cbd-43ba-a222-c11652b31937", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466997, "uuid": "02285ede-8f5c-4620-8b7f-2a07f5b35a3c", "value": "393216:IpF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD10:orRxvoC/7a0jUxX7h10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772466997, "uuid": "99e78023-9a54-49f9-9304-1f4a3ad5362a", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772466997, "uuid": "f212236b-72da-47c3-8154-c7ed011fa8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466997, "uuid": "392cbcde-046e-4782-9bc4-fb3e710da0c6", "value": "ccgbank.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcd4150-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487520, "uuid": "acbd24da-a4ed-4fc7-a8f3-5ce729e33779", "comment": "Malware payload (Mirai)", "value": "75653705f484557bc537331ca5963c20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487520, "uuid": "f13394c1-b41e-4069-af7d-8b5e40501491", "comment": "Malware payload (Mirai)", "value": "3eee375eae55de032f95c48186c72e1e9c06ca123bb28d41c7cf5d6e7f5d05a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487520, "uuid": "9e044a14-036f-4ad9-b892-c07b95a8aa9f", "comment": "Malware payload (Mirai)", "value": "32ba253b55b2844420ce68af5ddd8502f095c786", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487520, "uuid": "00b2424f-e4d2-4eef-a189-ad11580bbec9", "comment": "Malware payload (Mirai)", "value": "792516ad40899d0b19634e5869d45bceae726b8c8dcc23c6cbaf9361e11705555a933edacd1b6910fdd32a27a23e5c80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487520, "uuid": "82b7e15f-92b9-41bc-8707-8f34295c963d", "value": "T18F041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487520, "uuid": "30db2d62-f4e5-4af8-b11c-cd9bbef3138c", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPMnEzvQ6WJ9G2/7ZiYlTBVmJTA:J3CTRdrD5GFnrPUEsNzZt0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487520, "uuid": "08128f22-6660-4b74-8d4c-e568ffde11e3", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487520, "uuid": "208d4892-65bd-4478-a7a6-ac8972a9cfd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487520, "uuid": "aae438ef-ea8e-4200-85e2-c0099708d010", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19cbc31-162e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772452630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452630, "uuid": "1d206191-493b-425b-a209-a64bce201d87", "comment": "Malware payload", "value": "3f1c85df1b33ebb56f99daa95364c9d6", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452630, "uuid": "9a0328e7-32c0-4080-bdab-82af1e8a4b53", "comment": "Malware payload", "value": "3f6da1f78c2df142e7c79ba2b168d8444b19fecfd6dfe4930a60e9024e9e91a6", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452630, "uuid": "17aef7ec-7c86-48ec-b347-3086c6ed505a", "comment": "Malware payload", "value": "3f087c68025d606e8975500c2ef62c1fe44c2010", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452630, "uuid": "417a0ad5-1278-40f9-9ff7-45b8890128d4", "comment": "Malware payload", "value": "96015ed44a9b304ead096cf6e744e4e0373ee632efb721bb38fe4345a69c950355853bcc07bb17d745f1913c4645988d", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452630, "uuid": "351667ab-3857-4c85-b565-015848c3be47", "value": "T1607533DFB41884A68F1947F301C4A781C63D0EA8DC463B7B56894936A466FCD2DC76CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452630, "uuid": "3a10a04c-0709-4237-9e8d-5c2a6d4cc313", "value": "49152:0KqJqEvc1uEm8SGyyQq35335s8/LEVjGT6Ga8QY0QQZf:0FvcsEm8xd5H5QhKbcQQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452630, "uuid": "9945bbc6-f693-49f5-88d3-c8e3cb35fb85", "value": 1692028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452630, "uuid": "77842a50-42f7-4b8e-ad48-e5c5065a79f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452630, "uuid": "d740f2f0-9e56-44f7-86c3-dabcede7ec4f", "value": "4f5a0ad75409e099522c26c62f179a8dadf51c1597ef21fee8434361ce136fa0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82de08bf-163b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772458027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458027, "uuid": "3bec5df2-0e3f-45bb-9a91-c487b6b2475f", "comment": "Malware payload (NetSupport)", "value": "92e92c7205bb49c126a7fece0a4b3f5a", "object_relation": "md5", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458027, "uuid": "42c5a1ff-f3c6-4a1e-aa22-7c576e848b8e", "comment": "Malware payload (NetSupport)", "value": "3f8202dacab7371e760e83b7d2b8fbd5d767f5bd408ed713ab0550c83ae82933", "object_relation": "sha256", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458027, "uuid": "3e0a0dd5-d093-4bdf-b304-1c11edcd3f8d", "comment": "Malware payload (NetSupport)", "value": "12e680cc928a39aa5185365b35a02a6b2061420a", "object_relation": "sha1", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458027, "uuid": "e38ca97e-0d84-498d-ada1-b5e5005356ee", "comment": "Malware payload (NetSupport)", "value": "8ac96f302dc6f611ee10c2563d03d4d9f5c37e0e02db731d8f41b374047049bdc7ef85721506da8a3032a12a8e5f8077", "object_relation": "sha3-384", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458027, "uuid": "3ba10e00-96b2-443b-90a5-6c1916ef67c1", "value": "T1B1812419E603D53441B34BAAD5DA5808E66F44CF86120625FD9EC88D2F32A389B6FE4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458027, "uuid": "0c92946b-e3ec-42ab-aef0-36b8ca9fbd66", "value": "96:IwgDLQ1ggD4ZIOP61gv3tU8D3xxpnTdoxxpyg3oo2klh78qDAHrO15:k8igD42OC1O3tU8D3npTdoHpyMoo2klD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458027, "uuid": "f910402b-7232-4d11-8675-aa23e4902ed0", "value": 4107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458027, "uuid": "cd1a86b6-5aab-4a57-95b5-58b4eef7437a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458027, "uuid": "612eacc4-6056-4eb1-89ac-3d31656bd010", "value": "3f8202dacab7371e760e83b7d2b8fbd5d767f5bd408ed713ab0550c83ae82933.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd2cf8f-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433669, "uuid": "54fe4836-31f6-43d9-abf9-c485dd3146ec", "comment": "Malware payload (SocGholish)", "value": "fba3a3edd71994e908a14a5950ada760", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433669, "uuid": "1426b629-3bc4-4e34-aa70-58ddb835c47b", "comment": "Malware payload (SocGholish)", "value": "407741644f276d9053036797344c491483d7a2bb906242cfcb1b6258f4d96c03", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433669, "uuid": "e219bdad-578a-4b7f-b637-b02b7d718daa", "comment": "Malware payload (SocGholish)", "value": "aa0e80ecb1aadb73bec627b2ff1b729bb7b2c430", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433669, "uuid": "d290f8d7-344e-4911-be60-847c5db35c22", "comment": "Malware payload (SocGholish)", "value": "5ec4dc6dcbbf3c40bd5be3e55ba479453cd9e1d811083f54573c84d24aa1055b52ec7d099cb4578fc1a3a1e84026c497", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433669, "uuid": "a34ea49a-3bbe-4c37-a7da-cf8124f248fd", "value": "T101D095CA3015562E33D5321331B3DB4D3001311C8048491FD5BDCC101790BF015DA7ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433669, "uuid": "73eec2b7-8699-4853-90c0-f8aa68e5a137", "value": "6:SuKGYALGwgO9lvtEuoRWW/jyQGIdBlrlR+Eu3pY2U61L:7KG5GoHoRWW/j/frlR+Eu3t5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433669, "uuid": "091a6987-a2b5-43d3-8532-ff03f63e8f02", "value": 251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433669, "uuid": "0ca722b4-5150-43a2-826e-a7a1086df9a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433669, "uuid": "a2927443-8823-4b8d-8d26-7049656ebb12", "value": "407741644f276d9053036797344c491483d7a2bb906242cfcb1b6258f4d96c03.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06dc7d31-1612-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772440210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440210, "uuid": "0f2e422d-09a4-4599-b8d8-fba7f3f6bb5e", "comment": "Malware payload (PureLogsStealer)", "value": "4c6ea993c87237f0fb3d84f5faac4149", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440210, "uuid": "c4f7e66e-955d-49aa-a77d-8c9e8462c0e8", "comment": "Malware payload (PureLogsStealer)", "value": "4089ee994e7fbfc8a6714de3bad76b5e713096e0aa3841d1ef38ae490d4bfdec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440210, "uuid": "6869c305-1b70-486a-a253-15cda1eafe88", "comment": "Malware payload (PureLogsStealer)", "value": "16178ae0a29496369031e5221b44f92f7a59c603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440210, "uuid": "310037f2-e429-4493-b798-b327da8cf192", "comment": "Malware payload (PureLogsStealer)", "value": "d4d43b566ec1b3f735583d3b343b849e79bd29b75ac83d67e2d26362b5287066eb21e032a1fa8f3cfb31cebd4e5e558a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440210, "uuid": "2af89796-f7e4-4ab9-9043-55b796b85c26", "value": "T18205010074C2D876C5A740B9AE67DAFA0F1EE510871B15CBBA5A5ED81F234C0F63663E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440210, "uuid": "244308c0-c6cf-4fe2-bf52-981e94e24fd7", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440210, "uuid": "6b45eecf-4e1b-4a53-aa48-2c5ffbc4a89d", "value": "12288:ql4UjCRRHEfi7GEeyyrP7/fK01AWUY2mFylWPZLlRFX+ZNEBDhdyWYst:kCfUEGEly//fKyGm5Z5RFOrWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772440210, "uuid": "9458c904-d2d6-44c5-88a0-19433e45781e", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772440210, "uuid": "f789703e-8d13-469c-a2b6-86983985db04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440210, "uuid": "59a61dbc-779c-4c3a-902a-839435ee35dc", "value": "4c6ea993c87237f0fb3d84f5faac4149.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e37ca6-1612-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772440284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440284, "uuid": "e0a6bd40-466e-4f89-a0ed-90165a8daf30", "comment": "Malware payload (Mirai)", "value": "024b0c8c40f28b3ed2832e1d511135cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440284, "uuid": "416723f3-bcec-4e00-bd56-aaa0ff760fc2", "comment": "Malware payload (Mirai)", "value": "409f101c97ea77c98d7f61ebccb73a2af0db280d9dba49249c928a1cd14882c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440284, "uuid": "f5c4e750-dff0-4ff7-8a36-293fc00e3d31", "comment": "Malware payload (Mirai)", "value": "3123bf729a993aca6f25b6129a8ba124d9c4c493", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440284, "uuid": "1b091093-b430-468a-93ad-337e19408d9e", "comment": "Malware payload (Mirai)", "value": "fb8692185c816db532aa8958f843cfa4a2c6416e9a7ba7732bb6e3d78027a803efe8bad18ef96bdbd8dd25faf3ebc6e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440284, "uuid": "a29f832c-cc8c-4ebf-b6e8-0a687e3fad04", "value": "T1019339DAF801DDBDF84FD77B4463090AB670A3914A930B3A2757BD93EC361A44853E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440284, "uuid": "47f3ef84-9ea7-4a59-b286-aa94866d495c", "value": "1536:U1wtW3H9s3xAhqU51HZHimpTt8zxbsDpQKYo+UIpfDqNsgoSrq7BeTBnYs:UW/AhLH5zpTYKDYFUM0oSrq9eTBnYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772440284, "uuid": "25469fb5-5525-4deb-b232-33e6fbd1478a", "value": 90068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772440284, "uuid": "61bc92e2-590a-4a34-a5b1-7a173fbb5d5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440284, "uuid": "64c037db-8129-452b-a673-61930a8485c2", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9564eef6-166d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772479533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479533, "uuid": "a8fd4bed-e5fd-4ef7-af1f-01cd2d213172", "comment": "Malware payload (SalatStealer)", "value": "cc24c72c9653a1864c9f78c7e24e5bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479533, "uuid": "9bda383c-35dc-4d91-a94c-8cf9ab74d521", "comment": "Malware payload (SalatStealer)", "value": "414231a4345291e68fc64ea0b80f135666b9b75483ed31332370a3be3ea9af8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479533, "uuid": "02bcedd2-7693-4f8e-90ea-bb65feb8c6ad", "comment": "Malware payload (SalatStealer)", "value": "c7d50b5c905cf6579e8d441b481aa8be4e7effba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479533, "uuid": "c1ec1bc0-3083-4ae5-8791-be93ebf1efa9", "comment": "Malware payload (SalatStealer)", "value": "b06260427f0efe32c5672653fbbe4a87ad69c3969aa7b482aea5ddb9444c8ca89779bb5028550748b5ca664cce1d4e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479533, "uuid": "5c624440-24cf-4070-b0e7-4113df857216", "value": "T138C65B51FA8B54F5E9031831416BB23F23315E048B68DBEBFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479533, "uuid": "89590f20-7e8a-440d-b348-69acee651518", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479533, "uuid": "8aa652c0-096c-4305-95af-d8192e58284e", "value": "49152:JtxktkFkPWLDl01NLE1UcQpYjS6x167Du0jKKDDcv0YJNo+CeOr0HPQoqJdW9wPO:bCtkFllZflv0R+C3eqvi9pmVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772479533, "uuid": "fee9943a-32c5-4168-985c-4ce488b3057b", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772479533, "uuid": "897d8a77-8a5e-4ccf-8d7e-2d7792151d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479533, "uuid": "b93fa199-f76a-4d39-bd8e-85d6409f83c7", "value": "DELTAXPC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43f1d9c-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444769, "uuid": "f1b02563-9fee-4b8f-ba38-ad12c94c380b", "comment": "Malware payload (SantaStealer)", "value": "ee2f4b0187ea5bf1183264d0eef7f4a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444769, "uuid": "74a8d4cd-68fd-4835-b46e-c5c208d863f9", "comment": "Malware payload (SantaStealer)", "value": "418d870b9d9aa7b6cbc14af987ff4c2648cb180eba1c8cd09d35bf3d79fd5284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444769, "uuid": "922a486f-f3f1-4eba-937a-561cd86976b9", "comment": "Malware payload (SantaStealer)", "value": "d4769df38b7aaf3f4f62979b98fa5d5fc0c6f3ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444769, "uuid": "aaf09787-fb44-4fa0-919f-993a339ef007", "comment": "Malware payload (SantaStealer)", "value": "d0baa7252c637223dc5688945cb22c416401d519f27f6158140da65f1827808234642191e14e49b0516f20dba7c56ee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444769, "uuid": "2acc0c1d-f4e6-4252-b01f-e93c1624f91f", "value": "T1F8C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444769, "uuid": "f98c09e9-019f-4987-89f4-94bffa775d96", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444769, "uuid": "68249834-f27b-4a8a-869f-77d62bca6be0", "value": "49152:+avY1Sn5eVNopWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlChsdGT:5Y1aRUevc+9sdBg4x4DPPn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444769, "uuid": "27290756-09cd-4e2a-b015-276861b6fc60", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444769, "uuid": "c5d5d1a7-3e62-4631-9b5a-f9691bb25320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444769, "uuid": "3d76287c-7f15-4b5b-beb7-d7bb9880bc2c", "value": "20260302_084454_20260302_114454_A8G6P91V3T19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2405db-1619-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772443470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443470, "uuid": "dd14077e-0908-4fad-9014-42c9177dae93", "comment": "Malware payload", "value": "02fea3b13dd129956030d5104bd37008", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443470, "uuid": "313c939a-b273-405d-b5a6-043c0b873329", "comment": "Malware payload", "value": "41ac10108b6d118ba6e27429d4cd12805d56d2898d61c9a7808f8a43a21f1d22", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443470, "uuid": "0b13dcfd-41a4-4658-b8d5-347c752c5396", "comment": "Malware payload", "value": "f9b46d5208a3b2265c5365bb30babe95fc73d668", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443470, "uuid": "c27fbf83-0e92-442b-8a77-8798f4591daa", "comment": "Malware payload", "value": "3e94eb23adfbc07c45d7de0e87b7f1747ec0a807ac6415e38cce9f77a5f5d07b94102eb82d079187004c1bb9e15d5271", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443470, "uuid": "0060f29d-7195-4a08-ba2a-9e4697f5c438", "value": "T1AD33E044C7E4960EEABB793E556A2143D629B5ACCD00AF4D03B014ED4EA7F516F23C2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443470, "uuid": "ef988dac-222c-41ff-84de-fa3b2be45025", "value": "768:8rGty4jmVk6iJmSYrNZdnq8ObKbg2qaRXZCPop2vYONLt35735a35DCkiCk5CkO:8rQy4dJYrN7nq1VaRJES2vZnkFk4kO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443470, "uuid": "abf7ead9-ca0c-4fb7-88e2-6308f2e6216f", "value": 52789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443470, "uuid": "64a41f94-8f4a-44a4-9b1b-040e8201d647", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443470, "uuid": "18fda122-3c9e-4e54-833a-32020344f79d", "value": "451_kwaak3_arena_v0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f33fb3f-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433862, "uuid": "6c5ce0ac-b68d-49f6-90c3-d001d096a665", "comment": "Malware payload (SocGholish)", "value": "73fe9af1c57546244a8cff0a29b56d29", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433862, "uuid": "10be3fc7-d08f-44d0-89c7-4a09558340fe", "comment": "Malware payload (SocGholish)", "value": "41b76ecf5385466ccc0f051b4e84ead556881ea9a739c1165d5d4f6b34c0577e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433862, "uuid": "43004306-7b76-4a7f-8103-8a595bec162e", "comment": "Malware payload (SocGholish)", "value": "cfd16ae93364f7050c17971d315df6e38f14f029", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433862, "uuid": "b8a73e92-517d-4eef-9f21-69061de0ad07", "comment": "Malware payload (SocGholish)", "value": "f27f1dfdf8d5ee0ac98b55789cc0a1d33856a9cd3186fd606fc3241fcd7595ad08c9053761cc999a78ccbfc02d7a56fe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433862, "uuid": "69074efc-e6a2-4263-8004-34ff769fea35", "value": "T146D0A74F384815522BA600BA16B78B2D34912509A2114D57D8B7C6D45024AD3455BB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433862, "uuid": "b976b22a-2a31-486d-ac4e-8b62602e0adc", "value": "6:fHQBHwgO9ldRW30MMHMv6pdtLHQn1uwkm:vQBHodRW30ZMv61En1uXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433862, "uuid": "913727d9-b1e6-4cca-a7ce-f52364b25104", "value": 230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433862, "uuid": "5d2cf5ac-1207-4c8f-9879-2803caf9107f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433862, "uuid": "fec6265b-0a97-4191-bdde-c6e2b867ab97", "value": "41b76ecf5385466ccc0f051b4e84ead556881ea9a739c1165d5d4f6b34c0577e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7c4d9b-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452677, "uuid": "a9f9a1cb-fcfd-4217-a4d3-d3998ee662be", "comment": "Malware payload (Mirai)", "value": "33c68055f29dd01d809ad3ec6fbc3ff6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452677, "uuid": "31d11ab6-a56c-4332-ac46-eb7c75176cb0", "comment": "Malware payload (Mirai)", "value": "42a203baf3b3b53c68a444adf3b7c6750b473e8918e961f00619d0f2c7d6568f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452677, "uuid": "3c01b2a0-96e6-4312-aa81-00ece276b2ee", "comment": "Malware payload (Mirai)", "value": "b44e82cb05352b4a34d1e0213dcafd3899e4281e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452677, "uuid": "faa8272c-46cd-40d3-9156-b4caf1cc026a", "comment": "Malware payload (Mirai)", "value": "2b4e8bf26f09b94c7935e4815e7d06ddea8b41687872f61c935849a20e81c3d98e8befd1edc26d6b7276a37fdc1cca4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452677, "uuid": "eda13b3e-c2bc-40db-af4b-00be19b149ac", "value": "T196834C9AB4019F7CF98BE9F940120E0DF93163145B530F27A76BFDA33C620A5DE42986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452677, "uuid": "d6c82307-9c01-4c31-8fb5-b84b6da9f04e", "value": "1536:sgMdj6jOe3FOcbmsf1zMXEkhTOuGOpWnA8tdHh98dPn:y0Oc6sfZaESTbFkxdB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452677, "uuid": "c544f31e-7232-4189-8132-6141d9379571", "value": 83864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452677, "uuid": "502378d5-9269-4774-af6d-b74df4635041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452677, "uuid": "30541f52-b391-4dc7-a913-7f2daee75fbe", "value": "MMaaRRiiOisecTanee.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898339dd-164e-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772466199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466199, "uuid": "e6804f97-5594-477a-8005-02b83b1cdadc", "comment": "Malware payload (XWorm)", "value": "d2ea4a33c75190336f69b760498b2912", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466199, "uuid": "6c3529c7-fa58-40cd-91f2-db577336097d", "comment": "Malware payload (XWorm)", "value": "42a244583d3a49d5f9dc00ecd99e2d4d2951938faeda0b4baf879f19d82e5525", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466199, "uuid": "3bd69503-3311-4d72-b048-3f17590bd2fb", "comment": "Malware payload (XWorm)", "value": "f8ea2554737e9401619fd5f7cf842adfb3faf10e", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466199, "uuid": "d0d0b769-9d23-4b68-8cfe-691191a6aa37", "comment": "Malware payload (XWorm)", "value": "a8d5ade118ad7024708cdcb5279716179999e9efe2394564bc219d57dd202a5c17b0980097c792cef22e9de13deb63af", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466199, "uuid": "e3307edd-6c9d-46c7-b9c4-bacd8e511eaa", "value": "T11172853BE908DFF40B2F51E0108F6D06505857A6B53A49ADB4CEC15C7F277108BEA8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466199, "uuid": "f0a132b9-6e53-41e7-a613-d1e1d07afe9a", "value": "192:IDWc7CZgSOKRbfDrmtxGLclTXSVVoDh6vCPKzbYtn1uP5d4P+CTlMPqaojW17J/O:oWOvSOQfDq2UTIV2Uvp4zuxiZNJC/qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772466199, "uuid": "56c5d106-7c40-484d-9b72-060e9127f889", "value": 17057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772466199, "uuid": "68f48ab9-a55f-425b-b4e2-fc799d5886b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466199, "uuid": "9cadd8f0-4adb-4e61-ad54-4dd1f9aa8a81", "value": "Desc_Qtn_350_02_02_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1b5276-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433996, "uuid": "f4f6e299-035d-4643-a48e-fe3ebac1f13c", "comment": "Malware payload (SocGholish)", "value": "7e0d41fc10cfa7b0047546a932f2be62", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433996, "uuid": "80219dac-ecf9-4b85-8aea-9e00bccc60f6", "comment": "Malware payload (SocGholish)", "value": "436a97f14051ed97063c9b2e12a25b0068984a0ebe164001e51615539561e64e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433996, "uuid": "1aaed4e6-985a-4a29-b415-31150f5a87aa", "comment": "Malware payload (SocGholish)", "value": "1e8a09992b4f68f7cb10f0f48a63ea7ce4187651", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433996, "uuid": "06566e12-f08d-4489-9111-95c3d30cbb9b", "comment": "Malware payload (SocGholish)", "value": "49b7af3d4315d22b7339c24a6a0bd00401c7bb4fee75a57995f92233748e620b693dac0135510ccd1345c4a0838bfb26", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433996, "uuid": "29d50d20-7adc-495d-8ea1-b6d4d07f96a2", "value": "T1E7D0978AA418391D176A00E82BBB8F0E7252213CA962982DC82F48482690E900CA65BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433996, "uuid": "80093beb-8eb6-4d41-a49c-e39e7b441368", "value": "6:qSAgO9lBqRWbvcW9eZwGvGId1BLIb66AQQZIiJ:s0RWTcW9owGv99y661Q/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433996, "uuid": "a8985b06-40cd-43ec-b443-34d9f8778b84", "value": 239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433996, "uuid": "a2d47135-a994-4b8f-9ccb-b4499c177bea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433996, "uuid": "dd66319c-391e-474b-8d8e-ab7ae5ef8dca", "value": "436a97f14051ed97063c9b2e12a25b0068984a0ebe164001e51615539561e64e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a7a664-161f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772445904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445904, "uuid": "d2a53fb3-3233-464b-bfb1-576b91d7445c", "comment": "Malware payload", "value": "6cf3153720c3794a86563e916afb566c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445904, "uuid": "81bab4c7-91fd-409d-8614-36c8101c3c10", "comment": "Malware payload", "value": "443c3f3884305358e7ee88374cc9ab2349da592938efb0fb2afb8892fe536737", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445904, "uuid": "ab5a8c49-0d4f-43f8-9431-4cdcc64c50e7", "comment": "Malware payload", "value": "4024457b99d635c224fead5d959b4c3e7dbbf04a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445904, "uuid": "b5d4a06a-94cd-42fe-8781-6887d6beb961", "comment": "Malware payload", "value": "82575148e595223eb3e3eb647f5653e3c0796cbfdb2ecd433d334d44af8f0d2b03f8d7b5cc9d7f44fba908a72fe1c5f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445904, "uuid": "f0758c09-0d62-4806-ac78-c394319ca23e", "value": "T128E0AB3F9F30DBC9971AB34545252C1F22E21B39B27A592CEA0F8534463631CDE0222F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445904, "uuid": "c73cbebc-03a4-4f34-9d39-9b57d56fd6ff", "value": "12:yxCMJsVDwcfF9vNIQI/DgIW1kXkqGzknNqEGfAm46Wn:yxC9fTGDLW1ckQNqEG4mTWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445904, "uuid": "77ccdd8e-d062-4ad5-8e60-a66460459720", "value": 419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445904, "uuid": "d0fd12b9-1e01-48ec-a55f-d7e921cfb3ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445904, "uuid": "bf0c14f8-c2e4-4353-950c-2ca70746118d", "value": "6cf3153720c3794a86563e916afb566c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81910375-15cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772409922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772409922, "uuid": "6f807894-63c9-4a63-8d41-f80d80be5f29", "comment": "Malware payload (Mirai)", "value": "0926b9308ecb93df79faa6af5fdf1536", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772409922, "uuid": "11cac98a-2a65-420e-be7b-9249f7983ec8", "comment": "Malware payload (Mirai)", "value": "4460eb7e8fd5c0911990d5c3e86b766e936ea2eb597f441dca9289148530893f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772409922, "uuid": "877336a0-c632-493d-9293-c16c38c333e1", "comment": "Malware payload (Mirai)", "value": "5e2d3909b26b9bcfc507fa8807b4c47fe2c050da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772409922, "uuid": "3c7b966e-1f4a-431f-9a1b-dbfbffa2151e", "comment": "Malware payload (Mirai)", "value": "e537d63cf9855405531d9217a6958067c179e6885d88415500eda8bcea748f1534eed901c79618fedc7ed5d91dadfa15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772409922, "uuid": "590f2906-346d-4f1a-840e-d76def2238b4", "value": "T197E3D60ABF650FBBDCABDD3702F90B0225CCB85715A53B797534E918B50A18B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772409922, "uuid": "b2b03294-2857-4b6c-bb1f-1858e1950669", "value": "3072:U4gkXaotGju7fJfmkzB98vWZi1BngTYns:Irju7fBmk998uSBnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772409922, "uuid": "b2111d96-3555-4e7b-9965-e72a69190147", "value": 153668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772409922, "uuid": "9a9b5bcb-c108-4760-8903-3c9ced19c590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772409922, "uuid": "07c5d246-cbd9-485a-8363-9cd8e38c3dc6", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfd1726-161f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772445859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445859, "uuid": "2430c147-3072-4e3f-93a6-7d9cb273076a", "comment": "Malware payload", "value": "1d7ab69b8ed6da37ac7523ffb3073ac8", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445859, "uuid": "6045f283-252e-441e-8053-c6e98e9646a5", "comment": "Malware payload", "value": "44aebac330929cfd5cd8f679d855141bd4190a0f0ea76eee750dbc2e8bb93c95", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445859, "uuid": "931cb625-43d5-4d45-b5cd-359494fa2c11", "comment": "Malware payload", "value": "94ef1b07ca1fbda70e2b7e492a02bf8bcb4e9492", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445859, "uuid": "a54b6319-4d3a-4301-a007-5f0b6af15ff9", "comment": "Malware payload", "value": "ac9345511ec0d861c56da2d76b10be56bf97264e3de5a8463806f5e52c33b050a3e81a97706ed5fc040425ab647eb3a9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445859, "uuid": "92422a16-6baa-4900-b76e-2e2cc9ae39f4", "value": "T197F633EF5149A043279B9CF42D2EC2B38522F48FF562E588FD8523D0762165C4A98DFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445859, "uuid": "00b44b8f-51c7-4d90-aaaa-0f7b8bc6e7a1", "value": "393216:Ua6M2DesXbO5dAmyWBlgyYEZ2OqaELL0BF:wzTS5yuTPgOEAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445859, "uuid": "15ceb7f6-1646-479c-b15b-948b1cf5f8de", "value": 15752690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445859, "uuid": "7ac0b6e3-d3de-4ae9-88d8-0c0f4f6a2f4f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445859, "uuid": "79f30940-503b-4e92-afd7-853778ef9bce", "value": "dfgh.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bb1119-166d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772479539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479539, "uuid": "1f769ae3-a427-43d3-85b7-37c8e69bd1db", "comment": "Malware payload (SalatStealer)", "value": "3074617f590a007f4e6572c087760a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479539, "uuid": "9d133fad-d2d8-4ce8-9824-7fc1d66c53e9", "comment": "Malware payload (SalatStealer)", "value": "458d34568f5d62807cbfc621729f831b9fa6bd9a7b076e43fca0a74b0bbf45f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479539, "uuid": "267e7659-ffdd-4215-839e-8cc987252d7d", "comment": "Malware payload (SalatStealer)", "value": "111d981ea06ea42542b6f57a3cb8e6a2c4b6290b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479539, "uuid": "1d3c992d-5747-4d55-9be6-96c6e8963e4a", "comment": "Malware payload (SalatStealer)", "value": "9af1453128c3770264121f0e1cbcf63076581dce93d35a75ddb3ef70ae491fb8fc1fcb0fb2ebf1d3a6970f4e9b23c548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479539, "uuid": "c0eb68e1-9497-484c-b340-308c2a16c172", "value": "T17BC65A51FA8B68F5E9031831415BB23F63315E048B28DBDBFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479539, "uuid": "15dabf2c-56c7-4a97-8226-bc6a705b0122", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479539, "uuid": "df564a3b-a91f-4108-a800-35f6b273874e", "value": "49152:JHVgzQb+WYSaZIogVhfUphwfueOVH0zwl8D+hap1yCNW+zZvDtQ5PBQkQkCDMmDI:1CzQbgZsiUp1m+zB/k1AkeXQ9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772479539, "uuid": "cd50b69f-91cf-4f96-b1fd-606e6be17c8d", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772479539, "uuid": "d17ea4c9-8797-4b24-924b-5641c0da72ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479539, "uuid": "9c8bcab4-1069-439c-b4b2-af078537108b", "value": "Nursultan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af9db8a-1644-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772461799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461799, "uuid": "4a01d566-a66b-4218-b263-cfdbc0d0d436", "comment": "Malware payload (Vidar)", "value": "89219dad7a5492f97f417c307459ae0c", "object_relation": "md5", "Tag": [ { "name": "pw-bluys", "colour": "#8D34F0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461799, "uuid": "2b2a4e6c-3bc5-4352-9dbe-67edb957856d", "comment": "Malware payload (Vidar)", "value": "45c2e6ebf15e47d8df5e0623af42b124509cb52288c54f234b6ddcd2397c751c", "object_relation": "sha256", "Tag": [ { "name": "pw-bluys", "colour": "#8D34F0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461799, "uuid": "353d3cf3-c1ee-489f-908f-d221ba02542c", "comment": "Malware payload (Vidar)", "value": "deb100398dbb0b035c839827e13ce57bde941cec", "object_relation": "sha1", "Tag": [ { "name": "pw-bluys", "colour": "#8D34F0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461799, "uuid": "241a5f78-0890-4e3b-a61a-2772e1563033", "comment": "Malware payload (Vidar)", "value": "bd381df2f94e6b55740969097a0e9274b7eb3a79c1505771b309db231a4763f0dfe2694e0ff917f2ffff282fbdded21f", "object_relation": "sha3-384", "Tag": [ { "name": "pw-bluys", "colour": "#8D34F0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461799, "uuid": "d549e1e7-e3cb-4fa5-b022-232b8c4bb074", "value": "T1F11633D8169031E1DCB5593F7CC883D68AE8CF59B15AB56804DE81E84FF6282C87B5CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461799, "uuid": "dbc98a4b-68aa-491e-9984-ead7dabe0893", "value": "98304:VrK2dH9UbwCE/69RB7ZkCSgulmPxOY05u9BtJz8R:9HN68z/69RTkHgF5jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772461799, "uuid": "0c7d7625-be4c-40c8-8be8-125b00b4f542", "value": 4295293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772461799, "uuid": "159c27e4-0a8f-4e8f-bf9a-47cde7536ee0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461799, "uuid": "cd2d4f25-2171-4e8f-a57f-9e0edf000f8b", "value": "Bootstrappper-9.998.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722ff1ff-1672-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772481622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481622, "uuid": "03d37198-ed18-4ea1-a542-b135af5d7798", "comment": "Malware payload", "value": "ccfdf09c0641fa285b8150281d85f397", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481622, "uuid": "ff46c3b6-46ac-4324-82f1-0d324350bed3", "comment": "Malware payload", "value": "460203070b5a928390b126fcd52c15ed3a668b77536faa6f0a0282cf1c157162", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481622, "uuid": "de2d63e3-c81f-415b-9d4f-d5f9db2b5dfc", "comment": "Malware payload", "value": "504f6dc86f71176f66874fca6154d4449ba1c589", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481622, "uuid": "083706e1-0403-4b8c-bbbd-981935a8a7df", "comment": "Malware payload", "value": "bdfb35a998e682215bc3b6c53018fd144843eb9b38a20315065b65d8f53629b78356ffc2ea9e7c182b1f11db05465137", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481622, "uuid": "6ff5c773-9432-4a68-b118-37142d94c66c", "value": "T164E633965EB240A7C241F833D1826BBAD3225FF2BE54969D320C5EE0B70F3A7C6455E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481622, "uuid": "aa470122-578f-459b-a28b-c25574fa447b", "value": "196608:aojvVUr3zJQugkIoANC5d90KV5Ee6r/FKNlWa7CwI84c40gYLAoVN3imRSko04:aBJBI1w9RqLxKNlWBwmc40gYvvSccF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772481622, "uuid": "7c97e0f9-2632-4e5e-9e6c-6ba3839645b5", "value": 15085568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772481622, "uuid": "28b8d250-2788-4ea2-a6be-cfcfd04fc61b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481622, "uuid": "97920c64-b8f1-4da2-89d1-a160a2134831", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a809625d-161d-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772445205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445205, "uuid": "ba162fbf-f4ef-421e-a01c-003d63441e9d", "comment": "Malware payload (CryptOne)", "value": "500730fab0ae6331bb6fe755dc1ef5e7", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445205, "uuid": "de9031ca-715d-4afe-8e0c-f9519a003b6f", "comment": "Malware payload (CryptOne)", "value": "4688a4b42eeb0c9cff184fccef3cca7b7bd054d31db5b769a4e9bf3c4248dcaa", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445205, "uuid": "4429942b-b7ce-4e0d-ab1a-e0b7b4274e0e", "comment": "Malware payload (CryptOne)", "value": "53d5e0937198a5709397c180221a115521824b2b", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445205, "uuid": "7bb25013-f1ff-4936-a01e-30782f7e1156", "comment": "Malware payload (CryptOne)", "value": "2fc4c461e7ed393a21937e04c5ecaee60538f492117e47787ce4cdbc42af1f306ca646415591e6f36fbdd804549e8caf", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445205, "uuid": "cf96870a-91ab-4488-813a-baf6a1cae199", "value": "T1FF46E115F3801133DA2F0E36A82F6E7D81B7AB1C4725F80565A81AC89E16E97E5D37C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445205, "uuid": "25be870e-1f5c-4dc4-83b7-e17cdda70efd", "value": "c49145fa1609ea5c9df8ad5668221f7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445205, "uuid": "e3ab58f2-cc21-45f7-884f-45231e133573", "value": "98304:M6o8+CebB7J8PhYaChoKViAdRvwN2HKVl/6fUTn5Rpg:PO/9khBCfVrdtwOfUTn5Rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445205, "uuid": "55004a13-a03b-4523-a11b-a4204b07b1b5", "value": 5832192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445205, "uuid": "32c98f80-acc1-494e-a25e-c7fe5c87ee29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445205, "uuid": "53b3c313-020a-4e18-8458-7dfcbf43a5f5", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914e02ac-163a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772457622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457622, "uuid": "cbc3b4ee-24d8-4108-bf2c-423045344e8d", "comment": "Malware payload (SalatStealer)", "value": "f5a1076a6b38dd77ab63505bd41a0be1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457622, "uuid": "77261506-b6af-4181-9cb6-a33fadac0aaf", "comment": "Malware payload (SalatStealer)", "value": "4775fb1cd0c5661ce8644e6da1ea8630ff83cf6877429e4509a9337c05646839", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457622, "uuid": "cd6a2c22-7f30-4495-a910-d777d47eb4d0", "comment": "Malware payload (SalatStealer)", "value": "285a7c3c76da451f452572b77f12e9b1616031a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457622, "uuid": "3a9487f5-a7e1-4668-9406-840b49b1c32f", "comment": "Malware payload (SalatStealer)", "value": "731c9d2ecb9fb4e834c79555733b1da8300fcaec611b4c5f30ed7f038a7ed087d6ec8cf5b8c69bb3d9f15ca1a550268d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457622, "uuid": "0f2fc2f5-f0ae-437d-a3a5-b71c69c40e99", "value": "T1E5C66C61FA8B94FAE9035831405BB23F63316D04CB28DB97EF547A6BFC776821967204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457622, "uuid": "ae52c663-9249-4b78-82cc-0d923a21315e", "value": "49152:xpu6TI4lSWJUPjx6QaowCp+8D2iGCJlsnNjwTNYGmNN3U1ZQqDxPDv428lHDqk7W:n7TI4hJAxTtZNBUU13lIljPEo3KvK8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457622, "uuid": "ad0e924a-fe6d-4980-8b4c-d7565812bbec", "value": 12108800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457622, "uuid": "582699f6-9c47-4425-a8b9-bdd6d6f1ad37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457622, "uuid": "02aedcb1-11c8-415a-bd94-e40b4e70ae46", "value": "3epvprwm0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e55a986-1629-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772450208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450208, "uuid": "ac091264-2130-43fb-b281-e1e78a626bf2", "comment": "Malware payload", "value": "f8ddfe1e532234bf9b998910c4db9036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450208, "uuid": "757741e4-4ec6-475d-8d3c-1faecd1a9db1", "comment": "Malware payload", "value": "48a52c03a9635c842c5244a2960261bf2b22e93b18bfd7ea5e27d8d77b21cba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450208, "uuid": "c45ecf29-6523-4449-9abc-0ea981f369d0", "comment": "Malware payload", "value": "a597b49a576ad9db888f96152c869d2995769cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450208, "uuid": "6a9f94ae-f139-41d0-b324-7b1e6335d0eb", "comment": "Malware payload", "value": "2d02c6a268ea7a4f93976c5feffb14725324b85a30dd57485507cc688da8831b72d5c0dc9ebe5836c23ea29d278aedf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450208, "uuid": "521a0c3b-9d3b-4d6f-8d08-e2d1d5be054f", "value": "T105146C5863FC8B12F1BF9BB4D8B05285C776A61BDA5DEB4E2C4C60EC03627855883763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450208, "uuid": "1dfa4508-da27-4e5a-86d2-66fbd1e00e9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450208, "uuid": "0ba24670-a14d-4d16-8d62-e51e1722010e", "value": "3072:bzfC2eoHkZOwYfP/KKBN7Vww5Spj31Pi5HF+1BSAHsYhCaoZMq4O6bo6cz27WYkA:bzfC2eoHkZmPSSAOavbo4uUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772450208, "uuid": "855af7d0-0570-4185-a177-5d81d4ab33cf", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772450208, "uuid": "715c6af9-cfa9-468b-a816-b42e3b095a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450208, "uuid": "ef781fd3-4d32-4f17-8203-0c1076c72907", "value": "48a52c03a9635c842c5244a2960261bf2b22e93b18bfd7ea5e27d8d77b21cba9(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dae9b0-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452669, "uuid": "06ca6ada-f8c7-4439-a542-cc03e09d7006", "comment": "Malware payload (Mirai)", "value": "48d686d70b7dfe81b5e63a61bd97cedd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452669, "uuid": "e47f0a0f-35f7-4f30-80ec-248a4db20858", "comment": "Malware payload (Mirai)", "value": "4aa02b2b2e8b9027916724eb185a24a8b794c655b6069a1ccb9a79be50fc4899", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452669, "uuid": "f21ca599-029f-4307-b033-91f051c36a9a", "comment": "Malware payload (Mirai)", "value": "fe816f7e24ca4838ba2839d05ef96f8cb517b069", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452669, "uuid": "229affd2-1791-41f2-a0f8-38d050d902aa", "comment": "Malware payload (Mirai)", "value": "9669d29c651ba5b625e8b188fb31fc79533b7c51a80776c8a80d2f8158964b6abe1e3949092a0a6ce48dd693487fdbb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452669, "uuid": "51009eae-9edf-4c01-9de1-8642a72437c2", "value": "T134934A25687A2E17C8D4A23E11F78752F2F5330E24B0C66E7D760F8EFF15680A5462B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452669, "uuid": "80e061c4-f9b7-452d-b59e-e7ca1d326f5e", "value": "1536:1KFdSaiZ2vPhnKORFS5P+lSMrhJ3HWwJnV6WO7HauvAe8:WNrZKl1NM9J32wJnV6WO7DvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452669, "uuid": "2ce28e15-200a-48b2-bbee-c88b33757736", "value": 92664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452669, "uuid": "afd07e6f-fa8a-4dd1-bb1f-654fa6409e5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452669, "uuid": "f0da0219-b275-4367-b276-53cf1ef60fbf", "value": "MMaaRRiiOisecTanee.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b9c30f-1626-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772448803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448803, "uuid": "9d61f0cd-28e5-4b01-ad65-86d8d2a145fd", "comment": "Malware payload (Mirai)", "value": "3ab5aaabbd94f354bc2fa9fd52d90a58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448803, "uuid": "c19cc868-5b02-4dcc-aa43-ec65818843cd", "comment": "Malware payload (Mirai)", "value": "4ac504cfe7f164bf7497f10fcfdd58426feb62aa4d02b0e2ba0afa28d756df1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448803, "uuid": "012e7dea-2484-4cd8-9a55-effdd93410d8", "comment": "Malware payload (Mirai)", "value": "9126f2125a258b4e738a948b45d23eae63c5e0da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448803, "uuid": "6b5a56df-9979-4902-a1d8-61745d4e84ae", "comment": "Malware payload (Mirai)", "value": "5b9f03cd66fd91d194ec7cbf7a82a2aef7aafacfd9e4a2a8da407a3888a3b00d52ea33b66850c02b0338849d43bc48db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448803, "uuid": "b61b85d2-b8c5-4e5b-81b0-0915e7dc8b1e", "value": "T1C2A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448803, "uuid": "8cd6fb51-5f82-4262-821d-4c246e94466c", "value": "3072:wW8FUmgujld6Mkxm6AJ+4f7HmmFVcqq0GnDZT:wJFv4Lm6AJ+4f7HmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448803, "uuid": "6fe41f2a-3ab0-40e2-92cb-e4ed53d5365c", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448803, "uuid": "bd009365-43db-4379-9cde-eb3ddeadfa70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448803, "uuid": "b8d7fffa-c813-4525-aa60-3cc1ae3ad8ea", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5439545-1632-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772454273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454273, "uuid": "012cd826-b1a8-408a-9fef-da9c31dfb2ee", "comment": "Malware payload", "value": "56a4b425aba37ef886bdfbd8343a1bd5", "object_relation": "md5", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454273, "uuid": "3a86b36a-da9c-4077-80f2-3e198dcf9b03", "comment": "Malware payload", "value": "4aef998e3b3f6ca21c78ed71732c9d2bdcc8a4e0284f51d7462c79d446fbc7be", "object_relation": "sha256", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454273, "uuid": "2c71378e-b2e3-4f87-bded-cdf97d6d6d20", "comment": "Malware payload", "value": "3ab3fee4daac90bb7bee470b5b2de8ee0d6bec8b", "object_relation": "sha1", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454273, "uuid": "090a21d6-e94f-40be-bc57-115a4ef7c61e", "comment": "Malware payload", "value": "61e39b009fc48857d2e1bc4171facb010e9e37beefc5d82ccd11791dc7903324b7e324df8f3b9aa66b3ba73e0d23685e", "object_relation": "sha3-384", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454273, "uuid": "4b88b92f-8d29-4ed0-94d4-c8ffdb50087c", "value": "T1DE183380CE62D061C5380479FA573601CFB2DC33EF166DEB5C597A6AD6BF848A81E42D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454273, "uuid": "dbd96b43-ac32-44d1-8250-5f84370b324c", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454273, "uuid": "6b742eba-2be3-41b8-8477-ad3a6b7e3dfc", "value": "1572864:3Zcy/5CmaOQKGk55K5QWn50nfM81pzdBfGuJQXGGTqK6eV1+Jd8Cv5qPV:3ZJFH3WninE81pfDoGGTJVYhv5qN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772454273, "uuid": "cba07df4-3d32-4d5e-84c1-c6bbcc82d5d2", "value": 88529896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772454273, "uuid": "c8d5c3fa-2619-476d-a3ae-1e396f60400e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454273, "uuid": "8c7a63f0-6b6d-42b0-b73c-649ea848af1e", "value": "4aef998e3b3f6ca21c78ed71732c9d2bdcc8a4e0284f51d7462c79d446fbc7be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87059ed-168a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772492021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772492021, "uuid": "f3629477-5a79-4a65-b4f5-584bcccfe6a7", "comment": "Malware payload", "value": "ff0a0d47229a92d95139f1d6bd8ac691", "object_relation": "md5", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772492021, "uuid": "b9f7faa9-6f84-4801-a2ef-1c43462543b2", "comment": "Malware payload", "value": "4b41f36f82db6da8767a0a1c2997c8242d80b2d10a8f1d28c252a9306ec152b5", "object_relation": "sha256", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772492021, "uuid": "b75b4def-2353-4170-a24a-e3f9e4498b4d", "comment": "Malware payload", "value": "2d253c21f68aa9e60368e8e55011b0c43dba0fb2", "object_relation": "sha1", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772492021, "uuid": "ba956806-9a9b-4cbd-93ea-d18785409b2d", "comment": "Malware payload", "value": "1f7149e4446381e9a2a21162451350dd9072173bf7eae044c7c066a7ed927f385d245c3a77160de11af8b9183e9f7a34", "object_relation": "sha3-384", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772492021, "uuid": "52433132-9bc1-4679-8707-5c3ebbe16148", "value": "T15C765B03ECA145E9C1AAD6358532D253BA717C495B3163EB2B50F7782FB3BD0AA79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772492021, "uuid": "5948a56a-bcd1-4ece-94cd-c8c18f02ff63", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772492021, "uuid": "2e884954-3184-4a94-b940-32a8998c9086", "value": "49152:EfbIHj1mf8NrKYHRkZz7F2LAOuSPD+6PGKHTyF+Zojp9ZetnZSCapXaVC252uwKr:EsbGcLAOfTKZ+ZSCaCBVGjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772492021, "uuid": "e8689e1b-f504-45e1-8f96-2cd9f5dfc4d3", "value": 7302656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772492021, "uuid": "92e88663-b7a0-496e-a149-a963e8500d60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772492021, "uuid": "53251004-bcb9-4ad0-b6d0-e923185a37dd", "value": "agent(2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e97b854-162a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772450611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450611, "uuid": "a8d06629-8e11-473a-b140-aa1116ec4946", "comment": "Malware payload", "value": "62abb3e021bab94b0dbfbd30186e3316", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450611, "uuid": "7fb97bda-48b3-4c1d-9e9c-8807ae55526d", "comment": "Malware payload", "value": "4b62cbdbfe44401685ac3db7d9e6b41b1e41dbd07f8435d6535a3bef36cefd16", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450611, "uuid": "49f02d12-14a9-4ef4-986d-c7ad7b2f9cd2", "comment": "Malware payload", "value": "5349ef498fe54bb0f12dcc35805890ce9fc43dee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450611, "uuid": "3142041c-dbf0-4fb0-b8d4-1259af64307d", "comment": "Malware payload", "value": "23cab4274c4fa2a4eadb1f8748991bfbd78e3613f79de64cb32d648cc302a635ca9fa497d962b00622c962c061e935a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450611, "uuid": "8cebf052-e012-440c-bf62-5898ac5cedfd", "value": "T13AF41A1871CCEB10FA2C4B3FACB34A14E37965855699D38F30C77A651693FAD498C28E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450611, "uuid": "b2121627-a70a-4b4c-aed9-9a03c8d54ca2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450611, "uuid": "88a7daae-7807-4ae5-a6f2-f2dd67f7932a", "value": "12288:hxuHZzp4s4UXLcf/JlwekEs5+jd1+E0A+1qcw:W94s4yYnJaezs5+j3H0A+1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772450611, "uuid": "82027b4a-63bf-430c-a8bd-601b96bde377", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772450611, "uuid": "647d2463-9bb3-4055-86e8-b471039a9c1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450611, "uuid": "4bad1b21-c555-41bd-82dd-cbaebdec4db5", "value": "4b62cbdbfe44401685ac3db7d9e6b41b1e41dbd07f8435d6535a3bef36cefd16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdab2456-15e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772420357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420357, "uuid": "5bdb53e2-ea62-4837-9cd3-01debb0a4d43", "comment": "Malware payload", "value": "967d8f41fb31440ff3d125056d8d4fbe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420357, "uuid": "6d3bf79f-4534-42fe-a1ce-baa8c444ba98", "comment": "Malware payload", "value": "4befa64cd60218406c1f73c8dbdb633f456fe175e9c09ede5da0ac6317a55f5d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420357, "uuid": "4c31c662-b16f-4281-b281-f6fbd700837d", "comment": "Malware payload", "value": "167669c93fc7018ac55c798b08a57cba7c96757a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772420357, "uuid": "424175c2-56cf-49ad-ad49-571a969ef5f9", "comment": "Malware payload", "value": "7e082ad1d9959f18ce36b27b7063800c39c6a59fb1fc8efb17c9d7b07acec33ed29d3eac29c0c3c72a79ccfcb9c68ada", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772420357, "uuid": "86827b53-54ed-499f-bf2a-1e32bbe86dd6", "value": "T176925BB916496C79BBC0DE7D9F3C7F0CADE4C1C02218A3ACBA4F39615A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772420357, "uuid": "2dbb4721-009f-472b-b43b-3c9967bd6970", "value": "384:B0E0M3vgRjGlsaq7QzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:BDmjf0zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772420357, "uuid": "b4a74d03-295c-429c-ba4a-ff111af1015d", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772420357, "uuid": "97917efc-c01d-4cb7-9ef8-066c91a41450", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772420357, "uuid": "87e2c499-c882-4b6b-ac4f-82ada4c4ebb1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381cff76-160c-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1772437716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437716, "uuid": "b1d2e1a1-4910-4010-9f73-f7f2bcad75e0", "comment": "Malware payload (Adware.Techsnab)", "value": "b458f17154319cd81710a03fde81490d", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437716, "uuid": "95aa3b6e-226b-4ac8-962c-9a37cddd1425", "comment": "Malware payload (Adware.Techsnab)", "value": "4bfdb2a8f9f3cf83c656c7f25352d46c46a58f5b685a407cf7210aecdc1464f7", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437716, "uuid": "3a682e97-1300-4295-9f2a-038ed827a082", "comment": "Malware payload (Adware.Techsnab)", "value": "ccfb106b9e213cc02eec0bac87c88e94822fffa6", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437716, "uuid": "7358dcc5-f59d-46ce-90f3-a3e7f9dee47a", "comment": "Malware payload (Adware.Techsnab)", "value": "5fe87dd3c8b94c1bb56e592ec9b3c44382d6ac0855af6c877e2bf714187b0a2753efbad00bc878d1c2dbe39fb78e5a3e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437716, "uuid": "f6ff30f6-0a68-4e10-9fba-c74d3221d362", "value": "T16B9539216E5FAFE601D069DBE6D7F46CEF3D910F613625E436D8814832F9AE8138885C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437716, "uuid": "7a9b024f-bc2f-49be-959b-f9ede52e07b2", "value": "12288:RyVF5VSi/ajf5Xm1xZVOduMV1oGXzsd/MrS5EVRVmTwF4cFQos5Qhka60DATjLQ:sVFLRy9yZAAMfM50S2pFtuQ2a6HTvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772437716, "uuid": "8e8f787a-259a-4055-b388-53cdf8e3b9c4", "value": 2059838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772437716, "uuid": "a6ed5eb2-dd41-4c79-93fe-adaf8823ff19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437716, "uuid": "de819b2a-f326-4fc5-8ac8-57c6b59434df", "value": "4bfdb2a8f9f3cf83c656c7f25352d46c46a58f5b685a407cf7210aecdc1464f7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05e9783-162e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772452628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452628, "uuid": "972cc46b-6d72-4ce4-8b5c-844e34916de1", "comment": "Malware payload", "value": "278ca08e1b9c2b06ae77c44868849db7", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452628, "uuid": "608ad877-e1d7-4c81-a888-3133876755fb", "comment": "Malware payload", "value": "4c5146af21f1ce0b5c91d624b446f76ae524fad26425d63a23c1f890bca9d5b9", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452628, "uuid": "bf2d8680-6bfc-4e9d-ac44-4365d62fc414", "comment": "Malware payload", "value": "768e0fc589a2afaa6ded53614ca3f7c22d1f14f8", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452628, "uuid": "6c4be350-d7fa-4894-b825-79f1cf4dcd38", "comment": "Malware payload", "value": "b63baf890ed4544bad0cad6440ead0730f0677a31e629145a692289a782ca00fc0524e488d2fdf7ce210eba8e870fb64", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452628, "uuid": "8e523253-aa9f-4aac-aed5-bbc56a28b31f", "value": "T17A95337E382404A56F2455A3269DE714C4FE4FE4CF2AAB3E95EB527A5102FC244C2BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452628, "uuid": "b9e8a5eb-5f43-49ac-9ddf-d4d10910b2a9", "value": "49152:rKqJqEvc1uEm8SGyyQq35335s8/LEV5Tp4zHcUReXiraaVyJK1k:rFvcsEm8xd5H5Qx4z8MraayQ1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452628, "uuid": "d2751e5a-d955-4576-92bc-b80707d3dedd", "value": 2052415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452628, "uuid": "91ca3e11-f103-4997-81f0-d3683e79b3d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452628, "uuid": "1451e3c7-7081-43cc-bff3-32968a24b2cd", "value": "7b0e05ace5ddb02f3fc8f664d09f795a642a2d77a096a86d7a744e705a94d620.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce22ccf1-163c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772458583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458583, "uuid": "c43c1163-3232-41c9-8f4d-c75dbfeaf972", "comment": "Malware payload (NetSupport)", "value": "12dbb92a18332dbb5a2dc1fd928a3d63", "object_relation": "md5", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458583, "uuid": "e56fa571-9a32-49f7-b7e9-6762c755ec73", "comment": "Malware payload (NetSupport)", "value": "4ca8b9bb80e60ab1945bd20ddf801041c22a66df09d2106114043b3d8ae0c330", "object_relation": "sha256", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458583, "uuid": "d74896be-df69-4924-886f-9dcbe4ced2b2", "comment": "Malware payload (NetSupport)", "value": "345cc6eef29bbcf8e94923c4370d573f21cdc724", "object_relation": "sha1", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458583, "uuid": "a0f886b5-3a84-400d-ab8f-70bc8abb6a85", "comment": "Malware payload (NetSupport)", "value": "5403eca1834a2b26d37c2708eb202151ae44101eba4cb1f1226490ba4fa1e20bc694abd9e619be6bb2c5f9b963d3badf", "object_relation": "sha3-384", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458583, "uuid": "2df873e6-c141-4a70-8dd1-af51527a2fef", "value": "T193E0AB0C164C0271A0DE863BBED612023AB6E41F800A6E007C7CC8443F611BACFD1280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458583, "uuid": "e9aaca38-b0cb-4b34-a800-4888f7c9cabe", "value": "12:xylGBqKQDh4j1Mn8nxTFYxqzX1OUTw3pMd:xylBdDjyVEqzFOUTYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458583, "uuid": "5a147bf6-89bc-4cf0-aebf-917ff0890589", "value": 417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458583, "uuid": "1814ba91-683d-41bb-9571-9598dd82a4cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458583, "uuid": "135c8e96-79b0-49d1-be83-1b8a7b4108af", "value": "4ca8b9bb80e60ab1945bd20ddf801041c22a66df09d2106114043b3d8ae0c330.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d8021c-1643-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772461604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461604, "uuid": "e0e0a352-bf2b-4aad-b938-71047462065b", "comment": "Malware payload (Mirai)", "value": "1ad4c6db88c993644e781a1cd6305e21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461604, "uuid": "004cf2b4-a784-4bb6-bfab-fd940876043f", "comment": "Malware payload (Mirai)", "value": "4d33b002f920964c2b3c8e3ee484a49d0f7b00d1ca5783256fe36916c3c70f69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461604, "uuid": "90957750-4671-4ed8-b933-1996db65ba1e", "comment": "Malware payload (Mirai)", "value": "bbb2abc09dc60fecfd2f9eec0089d9a3aa8aeaf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461604, "uuid": "4894ef1c-ef67-49bb-9364-bd064550d347", "comment": "Malware payload (Mirai)", "value": "50bc89e99752adff252b2a04d9c269f69db353e4b011765605dbb76d129a17917e55383afde5912b442c3c5e8d2ccad3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461604, "uuid": "6c1f9741-b2a8-4c30-8ddb-129ad4de0283", "value": "T149C3B509BF610EF7E86FCD3746E91B0635CC591A21A87B397A34D818F64B54B0AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461604, "uuid": "ca1bfb95-9605-4d6f-889a-3e6986919740", "value": "3072:LJy8FqhSLqHqGeH6ydO/oMD2RkNwbZng:LJy8FqhGH6yU/oKwRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772461604, "uuid": "e2148c82-b155-4b11-b689-91be22c3fc08", "value": 118304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772461604, "uuid": "d0c0dd90-da25-42b1-ac0d-210401a6407c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461604, "uuid": "fb125bce-70c8-4c8a-8998-8764722c1f8e", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66839c0-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433740, "uuid": "75b9a7f7-d829-4289-b4e4-dc5fab57a2ab", "comment": "Malware payload (SocGholish)", "value": "5f6236f1b4901fe70faadf7886cbe23e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433740, "uuid": "0cb90aea-02e9-4483-a2f3-07be2a32dfb7", "comment": "Malware payload (SocGholish)", "value": "4d924a0712abd90d2a236e963d3dd18b801f3b85655eefeaede5363678820b8b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433740, "uuid": "2b624858-6fbc-4f8d-839e-1a8d32bc17a4", "comment": "Malware payload (SocGholish)", "value": "c64cec8b85a50d401a5a27f62e7074193f85ca55", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433740, "uuid": "4fc691f6-1c13-4f3f-b5e1-99b1d1453cec", "comment": "Malware payload (SocGholish)", "value": "5c9d201ff854ea8eec9aef40e015470adb766a16d97449c00bc1d47bf4a5f015a338cef0c09d18b715381b0255dc60b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433740, "uuid": "db01936c-0239-494d-ba30-2ade7a98b95c", "value": "T13BD0978AA408292C1F6A01D42ABB8B0C718622BC60A2982CD85F88081290ED1096622E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433740, "uuid": "287eb197-7069-4873-a2e7-c7668caffc87", "value": "6:qSAgO9lBqRWbvcW9eZwGvGIdPMuEBN20a66AQQZIiJ:s0RWTcW9owGvXMuWa661Q/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433740, "uuid": "4cd79a38-1dc5-44f1-b2bf-492732f719a1", "value": 235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433740, "uuid": "52f30cf4-11f9-48da-bf7f-c6eabd8aaff4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433740, "uuid": "c47cbd40-99f0-45d8-a647-f84ca06d02e9", "value": "4d924a0712abd90d2a236e963d3dd18b801f3b85655eefeaede5363678820b8b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54062ffe-1656-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772469545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469545, "uuid": "d2e11e6d-d56e-4877-9b7d-9228c884a545", "comment": "Malware payload (SalatStealer)", "value": "eff1cc605fbf692fa2321457c81bfbf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469545, "uuid": "a29e842c-9519-4535-a02a-c655a1c74b06", "comment": "Malware payload (SalatStealer)", "value": "4ddb16f8e60eb1917655f524878ac4c5a9801f2a26e02754861eeff73a6468b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469545, "uuid": "948192a8-d461-4093-8ef0-414fdce5d676", "comment": "Malware payload (SalatStealer)", "value": "6d1cbc55b397712aa7bb886d711f3b1efe71719c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469545, "uuid": "148ae815-92eb-495e-b97b-71bcf3798c8b", "comment": "Malware payload (SalatStealer)", "value": "f2ddb7d0d0753e3ab5068e395181684b4b7fb3ace79bf94008496e6875310ed3e46ac7ae437176358387dc61b13259bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469545, "uuid": "41b7a9eb-5f35-4690-a66a-b3c484a06c8e", "value": "T1A5C66B51FA8B54FAE9031835805BB23F63345E048B28CBD7EB547F6EFC77691192A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469545, "uuid": "7165c797-ca3d-46d7-8cec-103afdf5e38e", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469545, "uuid": "8eb0c215-1c7b-4439-827c-21293f278ed5", "value": "49152:+3O7kX/Rzxhicujmvhi7rqkqt3MAF6n0EN7nO30Ytbt8NZ3768HAjcrqU/LgVi/q:IikvR7u6vJ/5s+UkVcnEmAJGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772469545, "uuid": "7f09ecbd-20d5-4d28-ae69-cfd27d88fcec", "value": 11659264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772469545, "uuid": "f4b522eb-45fc-429b-98e7-ebb4568ffafe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469545, "uuid": "09b08cbe-dbbd-4f7d-aa54-71b73419ba3f", "value": "webrat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138a5aaf-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476309, "uuid": "cd042f7f-f15f-4a69-ba02-538f94ef2a85", "comment": "Malware payload (Mirai)", "value": "6d338c3a4bc4cd9e6a9f1849f0a4769a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476309, "uuid": "e431ada2-7f8a-4dfa-a25f-59f402df9437", "comment": "Malware payload (Mirai)", "value": "505860c334f196ad99155b6a7fc383d6ad08af28beee6010e831e5354d6ff403", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476309, "uuid": "568d70eb-8d90-4eff-98cc-8bb87114cc5f", "comment": "Malware payload (Mirai)", "value": "6dd10b6ce2c4d18e241e34e380721c921fce7856", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476309, "uuid": "6bf51b8c-ed41-45b2-9a24-89976b62839e", "comment": "Malware payload (Mirai)", "value": "20d2eacc8d8d977edf376aa7f96fb189dd0fe0c6ea70901de22868cbc760bf36cb1550014cb845c9c7783c012be8bb35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476309, "uuid": "e44950d6-85c9-441e-949f-f27f55922303", "value": "T10B43E746F603CAF3D45305F101ABAE7A8E31FEEA5822D396E3747DA5D9630C16503BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476309, "uuid": "c5b30863-2223-4d04-9e7f-cd978ec1b013", "value": "1536:UUGqZFB05e481/UdeLyyVzx9OkWkmI62:UUNZFW5e4Q/UdeLBVy5VV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476309, "uuid": "d593300e-406e-4905-bbd7-54052379c99b", "value": 57456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476309, "uuid": "fe9b0e28-2173-4537-a4d5-49d1cb61fe24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476309, "uuid": "1523d58d-a7f1-4452-9854-67d65ae6611c", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5812436a-1610-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772439487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439487, "uuid": "a11d1c9b-6eba-456c-b43a-adeabbccf750", "comment": "Malware payload (Mirai)", "value": "254654724db7696420d5934517171124", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439487, "uuid": "b094ad23-9ab9-459b-876a-8a5047b51484", "comment": "Malware payload (Mirai)", "value": "50c7532bf92d696d1ca8094da5b9e7ebbf19549947c26e764e3e5a08cc7f369c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439487, "uuid": "470110e0-b315-415e-b252-eef0787d1d6a", "comment": "Malware payload (Mirai)", "value": "c2e15191d7901d583aa8da93f5073ef3010bd500", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439487, "uuid": "cd254c68-ceef-40d2-9318-6efca8fe15ae", "comment": "Malware payload (Mirai)", "value": "2e1faf4304edb929712aebbc83ec3d2a3997fd30c927e4d2309f77d3b858481788fa493b595e473f9a6d96ceea8fd37b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439487, "uuid": "663b8129-c4c7-4b48-af8c-f3897569ee7b", "value": "T15C639D33CE163D54C14C82B5B5B48E387793E84086672EFA6A96CA6AC057EDCF0453F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439487, "uuid": "f2802184-ae42-4667-99f8-f7bc81504894", "value": "1536:Nxa2/bL2p36Nh9tibyJoiXgRVKMzSga1QlCUquVAJI/wbZnU:/bjyyjtibyRQKMI1QlS8AcwbZnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772439487, "uuid": "69a41fa9-24f4-469e-9030-af6a7eb8edf7", "value": 73088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772439487, "uuid": "45a7423c-51f2-49d5-9add-eb1ba4c80ff2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439487, "uuid": "defbe8fb-ab48-4f51-b0e6-30178e375833", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47233a29-15ce-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772411112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772411112, "uuid": "28e381d0-c14c-4c7d-9b3b-5bb4db687d81", "comment": "Malware payload (ValleyRAT)", "value": "0ebec962cfc6984781d1ef05f357a73a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772411112, "uuid": "91c2942f-26d0-4a0b-a06e-7485a6b434b8", "comment": "Malware payload (ValleyRAT)", "value": "51ad20df394a264f8b95638314af850fda3039a1c76adf732f02585fbd01eed1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772411112, "uuid": "3336b2ef-76dd-4ec5-8887-7e6793f5ff9c", "comment": "Malware payload (ValleyRAT)", "value": "501f1ce75b8d80e6156e01270f81cd15d05e30e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772411112, "uuid": "9002e895-cb69-452c-8473-30a113231e02", "comment": "Malware payload (ValleyRAT)", "value": "82f4dddd2a280231c37027fe6d35795b2d6b61a57acebed334d3eacb1886de65ce90cf362a56417492ddd2c724b0f982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772411112, "uuid": "d26864af-8458-4dbd-a241-66f32af886cd", "value": "T10FD36D4733A450F9D4A7C279C9A25A06E7B374660735A7CF17A086AA2F137D0BD3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772411112, "uuid": "f447649b-a592-40e9-a7cb-452b897edaf0", "value": "fb51ede541a9ad63bf23d302e319d2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772411112, "uuid": "b45261f6-22c3-4f47-98b9-1904a1ccac03", "value": "3072:lO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6oF:lO5n5d56TYZQnB+Dpekyyqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772411112, "uuid": "02204d75-b026-4345-98c4-76ba9243e8ce", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772411112, "uuid": "afbca6a1-351b-4a7f-984e-bca473ce6613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772411112, "uuid": "809050d7-405b-4352-8e53-870170018cfe", "value": "0ebec962cfc6984781d1ef05f357a73a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054b8ee3-1681-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772487882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487882, "uuid": "640507db-06bc-4c93-a0e4-efdc7a98a07b", "comment": "Malware payload", "value": "89eb6b053077fca13df09d71a6c618e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487882, "uuid": "3e34edd3-4e67-47f3-a45d-aa7c54c0f947", "comment": "Malware payload", "value": "5245f7cc30526c621867e9cbe9df8a2bd6dff32f3145efef7e7682a4fa9c651e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487882, "uuid": "bf17f5bf-7851-4557-8355-b7db3f4dacff", "comment": "Malware payload", "value": "5918376af849303ff3973de553fc28f18d3e15f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487882, "uuid": "ee532fa0-3e23-4b1c-a67c-a03ca5070903", "comment": "Malware payload", "value": "da010c7bcc562ca0474be558d14bd01981308253c1e6581b56fcf68dfc52bd4ce65efe733f4c045abecfc5f0812d7e35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487882, "uuid": "c67a7f37-5566-4658-8e5e-8f352c6414e0", "value": "T123745C3671557CFCC80538FA88145EE3AE3EBD200B60CA9712995ED9DAF71908AF97C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487882, "uuid": "4fb686ac-675a-418b-b4e5-d29d6aab5a6f", "value": "375976e45b94467cd83269a1dbbb488c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487882, "uuid": "e0d9dfdf-bae8-4600-91b4-261919f64f67", "value": "3072:zkwWN9uXUipMyPaIjxHRPpg1r7a5G+0jvCjYxQWrIGwE63dYth5ihImSX1+9cr:zknojacxPpgtaX0QYFMEOdUnmSFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487882, "uuid": "33dc7a65-b757-4127-b478-7a52e2bbb743", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487882, "uuid": "4ac3d3d3-49c2-4657-b18c-6b4c89b03e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487882, "uuid": "31d5d3a1-1d99-45bd-b478-ee7647bc0d87", "value": "5245f7cc30526c621867e9cbe9df8a2bd6dff32f3145efef7e7682a4fa9c651e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fc2b48-1678-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772484396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772484396, "uuid": "5fd060e6-e3ed-4012-94dd-54a833127101", "comment": "Malware payload (Mirai)", "value": "c64c9d911728da2405adc5ecede835bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772484396, "uuid": "77d89526-90a6-4419-928d-6a81dd450cbb", "comment": "Malware payload (Mirai)", "value": "534f244b8074541cbbbf619e75659e81b5334224deef75f8ac1a1b9501203b62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772484396, "uuid": "9176ea5d-7e98-4bd4-9281-e83a220e062b", "comment": "Malware payload (Mirai)", "value": "d5b63400c45d792d17f738fbfccf633d0b84c311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772484396, "uuid": "033c4e19-43ad-428b-b207-1f2f6e157654", "comment": "Malware payload (Mirai)", "value": "8aeff179278557db49b6aa5f4033234da99c1a145483ae94182f063a0d775800c970090f1abcc6c27e4f1510d6cf0bc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772484396, "uuid": "b02ad120-36c8-434c-8dcc-6af83e20e8dd", "value": "T16264F1CAFF11BD3AE984067529AB074DB3B59F99D3C3F150F290C61E39A9285AF610C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772484396, "uuid": "1e629820-b46b-42f3-9f26-88ede13c91fe", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio1wPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiifPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772484396, "uuid": "28487fab-d3eb-47fb-9882-7d1d61a89135", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772484396, "uuid": "74d53ebd-aa88-4c0a-8922-33faaed8de79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772484396, "uuid": "95f55e5b-2d7a-4c7b-aa66-793a226397ae", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adcaed9-162d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772451840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451840, "uuid": "da6cf509-0814-4f1d-9d7a-697d2cc775c4", "comment": "Malware payload", "value": "d687fe65222730b402583a4f7db5e965", "object_relation": "md5", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451840, "uuid": "a05cdf08-c3f9-4a6e-8a49-728ffafe48c4", "comment": "Malware payload", "value": "548494b017a3b87cf9372c0b90b6487ab158baa926320b2419a2bff2fb2c392a", "object_relation": "sha256", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451840, "uuid": "f440f969-c003-41c7-91bc-76576dc2adc0", "comment": "Malware payload", "value": "cf8798786fc1fd7bbe5fcadf4b8b05fa15a87711", "object_relation": "sha1", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451840, "uuid": "a7227dc6-7d78-42b2-a773-4293064b2381", "comment": "Malware payload", "value": "163eb455536891aad2cec11476aaf365109a89bf4ecbdadf0652bc5ddeffcc60de4a813cbfa18a62fbb41200e951e50b", "object_relation": "sha3-384", "Tag": [ { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772451840, "uuid": "d81f2ede-45dc-4213-9b52-ee2433fac2a8", "value": "T1331642323ECF1192C8B440284F6006C6F6FECB49AEDB744A7865AAC5DE347766376871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772451840, "uuid": "66701ba8-e78c-457d-84ae-bd0cd1129f5c", "value": "192:8V9f9B8CU/LXlMs5Yn9xsb3wM9f9d9jW9Wy9H9de9T8jU9Nic9XbbuH49u9g9e9f:7PpTwq6ms6kUkw7m/VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772451840, "uuid": "a992d61e-89cf-4239-8bc9-ff7420517678", "value": 4112512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772451840, "uuid": "f03e28f0-7af2-41aa-8ada-e84467d765f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772451840, "uuid": "7c6d8ba9-b5f1-4566-a108-223915a23522", "value": "548494b017a3b87cf9372c0b90b6487ab158baa926320b2419a2bff2fb2c392a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1952008-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433732, "uuid": "7a00a44e-1a7d-48ec-9c63-74f860d05ba8", "comment": "Malware payload (SocGholish)", "value": "4fe1b2bd10c879901c28915defb34868", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433732, "uuid": "a6661850-f03a-4c04-8e7e-67d5132c308a", "comment": "Malware payload (SocGholish)", "value": "54fe0bbd46949e427e32e42be755c0ce5557cb6794aa6960405cd051cf1448d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433732, "uuid": "6ae756ad-3691-4f88-a398-a8f0c1cced41", "comment": "Malware payload (SocGholish)", "value": "e28761d9bdc88b8f7fd2e2c6e3c9ebbb0d02a5e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433732, "uuid": "83787a90-e7fc-4ea6-b74b-ce33bf6f36ff", "comment": "Malware payload (SocGholish)", "value": "e17a4c51684f560be64c4ed2467a028f4a47ba2ee781ffa7b5b26a31a0b7e35852bdb244df5f4ba389daf9592776f999", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433732, "uuid": "01113a3f-e694-4e85-b87b-5019b47575bb", "value": "T1E3D097A21849207C3FA810AA3033830C3246229CF8D908728CB688100200AD1095E70C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433732, "uuid": "403dd8eb-fdda-4c36-995c-58110ae8f961", "value": "6:qSE9/y3AgO9lcRW5E5OGIdPMuEBN2jyutbkgIzm:Ua34cRWQOXMuMkbkgIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433732, "uuid": "c330f6e6-de23-4e52-b32a-d52e82214556", "value": 240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433732, "uuid": "71f4dd87-758b-4aee-8f06-ebe59ef478f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433732, "uuid": "d4271eb8-e14d-4e33-915e-c776bacd5e11", "value": "54fe0bbd46949e427e32e42be755c0ce5557cb6794aa6960405cd051cf1448d4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3084d9b3-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487525, "uuid": "d6eac347-3125-4874-972a-24c6d40590af", "comment": "Malware payload (Mirai)", "value": "f6bc1c7c7bd4d02323b3f4cd8af8215c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487525, "uuid": "4d82f7be-4979-494d-9fb9-1ed869463eca", "comment": "Malware payload (Mirai)", "value": "55ecf98d7eeadc30bb0f58a782937965cfe0099e64fc3167675e4fac286ce631", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487525, "uuid": "91ae8134-8f14-4584-acc2-f8c531f60647", "comment": "Malware payload (Mirai)", "value": "4edb2879a108057e153a00a79e1a6063e0f9f3fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487525, "uuid": "54e804bc-85b8-44b6-a078-2560811df3ec", "comment": "Malware payload (Mirai)", "value": "4141bd16868bd900e9a9232850e4ae7ac4a6047ba31dfe982926f592e85386bcd41392d11c50e1d17a7e24af8f9f4586", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487525, "uuid": "89c7e223-82f7-4228-a092-0dfc2aa023da", "value": "T1A793E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487525, "uuid": "a102e7a6-a7c9-4a1e-a418-12abcbda7736", "value": "1536:Kd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8vn:U+tsCurVDN+ouw8Lun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487525, "uuid": "a3a30a7e-0003-4683-9cf0-394b6764265e", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487525, "uuid": "eff5faa0-1c25-4df7-ad91-158307f52a75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487525, "uuid": "0eab529a-ebc4-46c0-b39e-eb9b571af2a4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eaa7b34-1641-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772460651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460651, "uuid": "c548676c-6abd-499f-92a0-b67993487be3", "comment": "Malware payload (Mirai)", "value": "a2130e5cce9e7abe99ca2e1582a11e77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460651, "uuid": "8ff93c90-9609-4726-bacf-868b90ac6b82", "comment": "Malware payload (Mirai)", "value": "574574c428b1eb8f9b9fa10cce838b678df69c3341b12f89b1352a163425a6ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460651, "uuid": "70ea2df5-4274-4023-bb95-ab5eec2ca7ed", "comment": "Malware payload (Mirai)", "value": "23e6dd53c9c1861f5ef850490030656bf5171aed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460651, "uuid": "11dd6823-2c0b-443c-abcf-7326333e3ca4", "comment": "Malware payload (Mirai)", "value": "21a4b74e566166b5b33b2f404f53942e181b302ce30bd2ec060a16413c3fbdd019cfe850ad338b092701dfa5bf56f719", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460651, "uuid": "36b9edf7-7700-430d-84a3-7d1c7e59013f", "value": "T1EF24C709BB510FBBD8ABCE3706E90B0129CC655726A43B353674D72CF54A94B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460651, "uuid": "6561ab08-d4c0-4a3c-b35d-5387eade79cb", "value": "3072:V/7c68aHFw1lEJ/k/9357rM0DPx3yB1ghhZ8r2:V/7c68a21lE0p7VLRs1UhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460651, "uuid": "122dc91f-73d0-4a7f-86ee-574028de1481", "value": 210040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460651, "uuid": "39a46a31-4cc9-4bfd-96ff-2f0af8241968", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460651, "uuid": "8e0107d9-3174-43e1-9515-10f1301158b5", "value": "csk_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee00aed-1650-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1772466987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466987, "uuid": "97d4b275-8e95-4344-8f76-f61d5015ff9d", "comment": "Malware payload (DattoRMM)", "value": "9a4eceece204a3596744edf6f8c9860f", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466987, "uuid": "be0d7a68-1e69-45d9-b07f-6f14c02285bc", "comment": "Malware payload (DattoRMM)", "value": "57d07dd4f86df5bdcb6e09e863ed3b1d6ac09847f8b9d0948c61527c3845943e", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466987, "uuid": "9bf4ddbe-4b51-4f68-b808-481a9de7632a", "comment": "Malware payload (DattoRMM)", "value": "9cc6acc0ac044bdd4e4b4e48e5aaa048e1c9f6ac", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466987, "uuid": "a31535e5-2013-4760-aaba-2aca2198d23f", "comment": "Malware payload (DattoRMM)", "value": "4610140ffdbfca31fc754e1bcfd89ea9ba6227f84cc3fabe9d6d0ba5809e4955ce18b2a8a05bd892202bc2beb071075c", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466987, "uuid": "2744c391-8ea7-490b-a1d2-b504ba01034b", "value": "T14FB63313D57BCCE4CB234678D6E10A46BB4A018A9C5AB8D4F584633E55D34ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466987, "uuid": "a8554c6d-b854-4daa-9b41-65a967cfd85f", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466987, "uuid": "3f648d10-b39d-455a-ae36-70181176de43", "value": "196608:jaZk+w/0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8t:Dn/04RT9R4PkE7Ap84p29qIT0Z6rXr8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772466987, "uuid": "fac2b44e-cec0-4cd6-9a92-6bb5d973d3dd", "value": 11055728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772466987, "uuid": "e6c9975d-6f61-4160-be3c-d9cf342f0b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466987, "uuid": "1abc18af-b81a-425c-9655-bdca99f59589", "value": "RSVP_E-CARD_INVITE_2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d46f49-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772444533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444533, "uuid": "a55c9390-8695-4bff-8ca8-c8d6112f392d", "comment": "Malware payload (AsyncRAT)", "value": "3be7d8115257735e4cb4773af2f5408c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444533, "uuid": "18883b60-76dd-46f0-b1dc-a5ef1aac7529", "comment": "Malware payload (AsyncRAT)", "value": "586671d2c8263999999dfd05ebab5afe6d21a480215c9155eeb1e95db6f51aa4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444533, "uuid": "04854a3b-1e33-4aa0-9a52-36f87a464db9", "comment": "Malware payload (AsyncRAT)", "value": "730514b1e2e214cefe6f76e0c3a1559da611bd87", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444533, "uuid": "6f396da4-3057-437e-8a81-4ad20a6c8fed", "comment": "Malware payload (AsyncRAT)", "value": "de670b72a0ea60388b7cbe15d45c658b85a1fe0b9cfe49ce1a7e4693622c43bee2ffd0e0e14988aa6c176b1627b4f22a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444533, "uuid": "1807a6d8-e7a4-4d13-932b-b796df8fbeac", "value": "T1A8D47B0AD59033351A18F26E1D96008ED1E3EAD87F3AE64D87D4CDA67A157EF290312F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444533, "uuid": "44d431ea-3341-4e23-a03c-a8df8c34b44a", "value": "3072:dj07S7Wb80555nLqJiwCIGMQPdi4EDYouZTE8JC+VJdztDafdMSqLduGxy8NLOXJ:iSCuJiwCIp+vYH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444533, "uuid": "e6ea2147-a1e6-484a-a607-083dfe53fd52", "value": 629176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444533, "uuid": "a8232b84-73f9-4db4-bf0b-9233864ba229", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444533, "uuid": "a5a7bd2e-a9d6-473a-bb02-0469494e912c", "value": "inst_{96E56D2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895e3837-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433987, "uuid": "c15669db-9ff9-4f6c-9d58-8d4ac6801dfd", "comment": "Malware payload (SocGholish)", "value": "0b967eacd6640c1703d9b0b5bd098744", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433987, "uuid": "b4b3b4f4-f07b-4e02-afe9-07216d9dc628", "comment": "Malware payload (SocGholish)", "value": "5a7ff0894f181c4eaca9d57db0cec1d043eaf5ae3696240120653d9ed8774191", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433987, "uuid": "ac0f2ad4-6d29-4c19-9675-55de036b9184", "comment": "Malware payload (SocGholish)", "value": "0a3d4b1db13decf5ba6423b29d8c8de6e41738d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433987, "uuid": "4a6ec7f4-8ce1-4dd8-a750-4575b462d8b9", "comment": "Malware payload (SocGholish)", "value": "4857f51250a2e0834ed735910b6f0c0f2623bf6dff0954506653997a6a81c63d886aec597bd33370281da5b7d7d26a64", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433987, "uuid": "e9257710-b905-4367-8c14-cfdacc965a51", "value": "T18BD097661C4A747D37A8206A31328B0D23422258FCDA08328CB649110204B904C1EB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433987, "uuid": "1bcfa493-92f9-410f-a2c7-d71ac8a025e5", "value": "6:q7XnE9/y3AgO9lcRW5E5OGId1BLWwayutbkgIzm:I3oa34cRWQO99Ww5kbkgIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433987, "uuid": "c7cf00a6-aee7-4533-b83e-767f247941b4", "value": 246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433987, "uuid": "78d4c506-b680-4e41-a244-9d7bcd0835d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433987, "uuid": "b72c1edf-1230-4951-b2f2-48920c6b385e", "value": "5a7ff0894f181c4eaca9d57db0cec1d043eaf5ae3696240120653d9ed8774191.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7557970d-1646-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772462729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462729, "uuid": "73cedbeb-945c-4ca4-a5ab-5a29aa3188ea", "comment": "Malware payload", "value": "5a74de4a9967d3d9e17e2ef31cf34194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462729, "uuid": "d1144cca-667f-4a97-b8db-aa54ab5f696c", "comment": "Malware payload", "value": "5aa13142847f815a239f9519f23b5f355d4cc10807bc397a02bd6641b8792ba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462729, "uuid": "c0cebaba-aaac-4872-aba5-d772f3516eb1", "comment": "Malware payload", "value": "909e9080bbbbe47b2bd4b817aadaa82788f72676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462729, "uuid": "2570369c-9017-4336-900b-585b2d899bd1", "comment": "Malware payload", "value": "a20e5aa52345a892da0e963148217767bc7858cae035f8ba8fa65ba4c898ddd24293c547870c0b689c4264bc1ce5c79e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462729, "uuid": "d1ae14d3-e11c-4be2-b615-3f98c3e3f122", "value": "T14AE633810BE7CD2BC90A5778047CCDEFE55EA334C26C22CEF395B8AB916C6075A52D94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462729, "uuid": "8a3eece6-c48d-47e1-ac19-e56709b0f814", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462729, "uuid": "3e416da7-4a65-4681-a57c-7932298fc323", "value": "393216:4zZE2oK2S2HvFytPfgypNpPWkhvu0jS4yz1:IZE2KHvgtPflgkhvukS/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772462729, "uuid": "803e78b0-a117-492f-aa6b-c74cc37d0661", "value": 15213224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772462729, "uuid": "b07d14ce-57c8-4bb0-887f-28bd8c68f646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462729, "uuid": "db513f6e-b029-4ce7-b97e-46672a5b09e3", "value": "SecuriteInfo.com.Trojan.Wacatac.18363.3582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9556c1ad-168a-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1772491989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491989, "uuid": "6f7f21d3-8d1f-473e-9c6c-e2d2d6548c16", "comment": "Malware payload (Meterpreter)", "value": "7b91ea2dcb57dfd3829ee5ca75698957", "object_relation": "md5", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491989, "uuid": "9e115765-0ff6-48f0-bd45-e3fa8839234c", "comment": "Malware payload (Meterpreter)", "value": "5ad5865b4fbfd641322ad9a81feef73dd5595c1a2581ddc597e2e59ef39264ff", "object_relation": "sha256", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491989, "uuid": "b091e0ed-71fb-465f-b02a-a6e1e1cecd1d", "comment": "Malware payload (Meterpreter)", "value": "c335d2305631273e77949e0a00b58b06922fe47a", "object_relation": "sha1", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491989, "uuid": "32ed8638-287e-4cf2-83a8-3715c78a55e5", "comment": "Malware payload (Meterpreter)", "value": "8aaa509c3b05a7b23bc37c2f7f1444733b71e523a20e9b9db2107b79c14a27fba8cf31acfbc99ba997ff6098e825bfc7", "object_relation": "sha3-384", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491989, "uuid": "e41d5e9c-a7d0-4a18-a418-ad1bf43ab1e8", "value": "T19BD4A4978A1159D1CC01A0B964F17A814B1CB8F641CAC58DA73DCAC6EF0B767CD9AF2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491989, "uuid": "be6a8474-264a-4fd5-bd99-af932b7774bc", "value": "ba782605aac629a26bc1fecb2cf3b2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491989, "uuid": "1c812d8c-50ee-4887-9157-f99972b0763c", "value": "12288:bHLSiDbiLiOJBQmGDjj9iJTsLERQlYekzyErkHErnJV2+0tUgie6UXur:HS8s/uBtnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772491989, "uuid": "e88ffd4a-e6a2-443e-9504-d087fe282d09", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772491989, "uuid": "742ba8ee-0e15-464c-a1a7-2dacfa6ec416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491989, "uuid": "2a629e89-7e9a-406a-a81f-8ccdc1d0984a", "value": "hfsSer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa855de6-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433747, "uuid": "bcc6b8ab-760c-4ac8-aeeb-6163908dd1ea", "comment": "Malware payload (SocGholish)", "value": "f14338561386ac9a465bb30b005598b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433747, "uuid": "fcdbb662-1b77-46e7-be28-67d893429fe3", "comment": "Malware payload (SocGholish)", "value": "5adeedf5145f5f6fe7adb3f5b6eaa31c2fbff80dee087a80918e5f0e0e1f6034", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433747, "uuid": "d08ebf2f-62d3-454a-a9e5-295320b5e9eb", "comment": "Malware payload (SocGholish)", "value": "54f80f464f93919f36c661e5669e11c83853bb91", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433747, "uuid": "09495162-713c-4260-a179-206bccf940d6", "comment": "Malware payload (SocGholish)", "value": "a534e8c526af610707d89733781c7fa3c7be53102622464671aab163570f0b8f01f0bd46f9808fce945d8205e3da5b6c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433747, "uuid": "3c10d567-7e08-4734-ba58-431563e987dc", "value": "T168D0A7DA3808517D0FE519725333E70AB046613928566452896B9DF09068EB6485A9DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433747, "uuid": "dcb07aa8-a7ed-4176-9b42-209d3b229a7f", "value": "6:S8KGgO9lRnvRWL/tNAWNjsl6pdz0TmCf9MoQDkbQt6:KOVvRWztNAWBsl6EdfiJob26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433747, "uuid": "7f0a96f3-0b0b-4ab9-9c54-8176eed838f3", "value": 235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433747, "uuid": "dcc3391a-53d7-4453-9515-e7b92a02fe12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433747, "uuid": "606ded02-ed67-4c92-b2bb-689404da0692", "value": "5adeedf5145f5f6fe7adb3f5b6eaa31c2fbff80dee087a80918e5f0e0e1f6034.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165e0305-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476314, "uuid": "13f94422-84e0-4f0b-a5c4-a923fbd8cbf0", "comment": "Malware payload (Mirai)", "value": "b6a33d4cdb22fa067ef6d3d50b88ecb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476314, "uuid": "e574e6b1-bab1-49c7-ad75-1ae89b1b1be5", "comment": "Malware payload (Mirai)", "value": "5b315a1fe133916b5a01612f22278cdbec98d579d97774f6a10518f9ccb54cbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476314, "uuid": "d1eeee33-305d-4e55-8d9d-2c7add13699e", "comment": "Malware payload (Mirai)", "value": "a0c4e71b6cdb0b101078446054ff3eeb3336d60b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476314, "uuid": "d1aae865-0c64-49cc-a880-cf4be97f10b4", "comment": "Malware payload (Mirai)", "value": "1b5ee0ca8806dd7c8a8748bea00d0c421fcfe3976f7e10c47f9a3386eeb3024ae8c34d4fbebfcca43f70395f672924f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476314, "uuid": "9aff8b09-6dfb-4f88-bf16-84681a73338f", "value": "T1AE433923E9264F17C00355F065E99E325F22BDEA4E571EBAA171EAF84043DCDB405BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476314, "uuid": "178d8dfe-2f48-422e-b9e6-34a9dbcebdc3", "value": "768:jRvmK8DU5EN2AuuoQv2t84OtHX/I5E7K+uF3aDuoxnf/TACG+I:jRvTicLxQG8NXvK+uFKDrMCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476314, "uuid": "fb1e6ee8-158a-44e0-9947-b74eaa636b03", "value": 57680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476314, "uuid": "c386e89d-d306-4bc4-b208-28a0f87901a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476314, "uuid": "bcd833c0-2e91-4245-a6a1-a5f472d83cf7", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f568a095-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772465521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465521, "uuid": "cbb7ed75-a606-4c00-a485-a5d505d70961", "comment": "Malware payload (MassLogger)", "value": "876dd5f98068d6bf2ed66a30f38d32db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465521, "uuid": "2620b92d-c623-49a3-98b7-8b67e4f971cc", "comment": "Malware payload (MassLogger)", "value": "5d8629c84b9308abeaf0ae4b3bd27b16d792c40d3c28ce3dae71aa262c1532f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465521, "uuid": "3c211219-8963-4ba0-a654-eadd061fc8a7", "comment": "Malware payload (MassLogger)", "value": "9b9d3b79e1bbcf3b91f0ff9561450d9b75ca20e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465521, "uuid": "87e92ecc-19ae-47f8-81c2-deb125ba0581", "comment": "Malware payload (MassLogger)", "value": "498d4c4e050c3bbfb3c10a934c1fba2f8cfe301000bd35166a367ba2d005a007c7c6bbad5fb2c52a8022f56e483e1eea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465521, "uuid": "4e60978a-43cd-4502-a8e1-4105d1d186f9", "value": "T114353A41F2261BAD71D230C6CF5FBD9B24D8E6BBA37862524BC25D206144FF2133E95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465521, "uuid": "56e8299e-12e1-422b-bbe2-28944acc3c5b", "value": "24576:uoGVZesnZbapudB72+0HdjMpxTgkWkMgngHroyirRMcx67V:mbapurA41gkdn6WMcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465521, "uuid": "fd8569d5-7a7a-4609-b45e-4ed59c3520d3", "value": 1110554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465521, "uuid": "38c30830-f873-47ee-9d79-d5b4a2284875", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465521, "uuid": "cb371c89-ecea-4026-a8e4-15ad0aeb0612", "value": "SECURE.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e230a1-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475701, "uuid": "5389fe50-e737-40d6-a1c4-2d7d5f2a93ce", "comment": "Malware payload (Mirai)", "value": "7949482a68617479f102217caa766127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475701, "uuid": "034dbced-ad30-4e76-8382-72e38b8ce063", "comment": "Malware payload (Mirai)", "value": "5e529073c1d8adb8640aab40eb65cb12079803f351aa15069cb61e41c1461bad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475701, "uuid": "61bc668f-9930-4fce-956d-bf6f5d354dfa", "comment": "Malware payload (Mirai)", "value": "0d8ff8516bbce5b054c2a9993de8a00b7c87cc1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475701, "uuid": "372f19e1-b482-40b0-90d9-1371a74d6762", "comment": "Malware payload (Mirai)", "value": "10c823344e078d5e0490aa97e4b58eee1e831a2043844c57663cfc63c8771794ab98c70a98a0ef8f8ca01a7f181e1647", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475701, "uuid": "84e3e0e5-0880-4671-a3e4-70ad56414435", "value": "T1C203F1B5E126CF77DE4EA834CE00E39127B2CBDA52632594934A7F810B5766DE080A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475701, "uuid": "1532b65a-01e8-454e-8817-6e8643777a19", "value": "768:jJinu0ArfdDt5GsdY0aKc9vK2VpfeRi3QxFnH6exxm2glF0X/ONsoRLm23G84uV7:jknbArfdDt55EKc9tpGU+hHLMOX7o/3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475701, "uuid": "953791fb-6e19-4597-b7f7-1abf6e106ad8", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475701, "uuid": "8d7f50eb-a435-4dbb-acfb-59e004e80d2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475701, "uuid": "df37c4bd-24da-42ce-8927-9ae0a89bf201", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa21b8c6-163a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772457664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457664, "uuid": "5b99fb5c-164d-4b3e-b4f5-83646e958e59", "comment": "Malware payload (SalatStealer)", "value": "2254de9eb5eca18ffdb5c9c498afdf47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457664, "uuid": "face8848-ff42-4fec-9cb3-6d29210f12a2", "comment": "Malware payload (SalatStealer)", "value": "5ef720015690514822dc0ece9ce11e486e2cb8399dd447968d7ca69afaaae41c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457664, "uuid": "8111eb19-ff1d-454e-a38e-295c0ae1fbbd", "comment": "Malware payload (SalatStealer)", "value": "6847ce70da53ff18d4f46a8957740026014e8f3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457664, "uuid": "adf4cb5f-c3e9-4faf-8ddb-f8c1036f0710", "comment": "Malware payload (SalatStealer)", "value": "aa5947da91424677ec3ae9ad83a93865316a3152750c35c81feefc809fd67f1130210d3149bc62df1237fbf7905494b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457664, "uuid": "0fe765b2-caea-4f2d-b61f-74ad4c8406a7", "value": "T18F6733EFEE36AD73E0A61AF96C37017899190053D22F9857C610C3AC9F46D619DBD20E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457664, "uuid": "89330f00-597e-4e4c-9a38-9ddae98dfc74", "value": "fc648d00fda0b8c1f218b9e9e89292fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457664, "uuid": "be7e46ed-1c16-42d1-be9e-16fe531db445", "value": "393216:YLf+w6QcaFlsPbdHX4dHX4dHX4dHX4dHX4dHX4dHX4dHX4dHX4dHX4dHX4dHX4dY:xQ1YN++++++++++++++++++++++++++E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457664, "uuid": "a8a52a28-e732-493b-9bc3-79d5efede5d4", "value": 32085240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457664, "uuid": "12f2efb7-9f3c-4640-9132-4cbf3eab9535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457664, "uuid": "af1eb02a-ee80-4c84-b6f0-0a7f89e08faa", "value": "Anticheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ccbbc5-1667-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772476877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476877, "uuid": "8845787e-947d-423b-9e7d-cf7caaa023ee", "comment": "Malware payload", "value": "d28a0ba347b26cf5a4051918ff94f482", "object_relation": "md5", "Tag": [ { "name": "37-221-66-164", "colour": "#44E489", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476877, "uuid": "986b60fa-f4df-41d5-b3e8-e2dafcb1ca6b", "comment": "Malware payload", "value": "5f24edd66b3d3d956016c8172546e0186b0008bb16a338290a9e0aaf11fd3cff", "object_relation": "sha256", "Tag": [ { "name": "37-221-66-164", "colour": "#44E489", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476877, "uuid": "a0e543a8-c086-41b4-a0a8-25c85a3a79ee", "comment": "Malware payload", "value": "9f90f541e2b46deb317297bc569ce39ef00a5999", "object_relation": "sha1", "Tag": [ { "name": "37-221-66-164", "colour": "#44E489", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476877, "uuid": "a40469d9-6584-454a-8da8-1e71b6d5567a", "comment": "Malware payload", "value": "888e30bef70462cb588be1e1873a73a9215e97600df80d6cb940943feb3ac5ca11ba97e234a8bdddb18613e1a4abebbb", "object_relation": "sha3-384", "Tag": [ { "name": "37-221-66-164", "colour": "#44E489", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476877, "uuid": "3e9befd4-354c-4795-8703-b6c8f29f0d65", "value": "T17B77CF17B7E840A5D0BB9234897B9756E675BC210B3092CF2250B76D2F73BD05E3A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476877, "uuid": "ad1b5e7c-82ec-41dc-8581-9762d4884326", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476877, "uuid": "13657313-22bd-49d3-8f93-02cfa462da6d", "value": "393216:j4vj0E42t+tOtmgklM+cH8EzOKAGpxtBElucKRy1q6w:jkon2yoaM5hAGptEloY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476877, "uuid": "f612e04b-5d3c-4259-833f-0bdb30aae2f2", "value": 34375168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476877, "uuid": "07eba6d3-f69a-4dfc-9fed-bcd104ec22f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476877, "uuid": "72f1e08b-89d9-4159-8204-165dcf520a17", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afc882c-160c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772437721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437721, "uuid": "71b1d1c3-4bff-4637-8234-e849a5b051e9", "comment": "Malware payload", "value": "d9bcd8897b57326633ae35ca4beb91cc", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437721, "uuid": "6350179d-18d4-4322-8b48-5ce6bc660850", "comment": "Malware payload", "value": "5f294ad4a2af3e41efda6819a503fe9b66f906be11c76bee865a5bc6869fc3c7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437721, "uuid": "0144ce2c-9c7c-4fda-8730-29bcbcf3fe21", "comment": "Malware payload", "value": "a51b9e15632da714d8cb8b5009665d2ff2ffd44f", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437721, "uuid": "313333bf-ffb5-4149-a9f3-e9fe714669a3", "comment": "Malware payload", "value": "8e53566ac6f17cd97265688fa75d35add37a75c137f10ca608d475fa22cf16ee19aa3da8d2b44ce7661427805654a34b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437721, "uuid": "ab891362-3508-4188-ace0-db4626c9c4ac", "value": "T1D5B4E036AD8399D7428A6BDBD6C3A9D9EC3C221B56735C4DB06E1080314E53A73DC86F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437721, "uuid": "e4a76999-a1c3-4357-9182-d8686e744371", "value": "6144:4uMJIXKouDALa6VQhJQwVc1LqDuEUpsjStQ0IlPSmQoz0bdlbSDpRpdpEA4NvdQq:o25m5mESEq9fIlKlzrSbpEnX8uTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772437721, "uuid": "1649d6d8-8c38-4fa4-8863-10a5cae3dcbd", "value": 542051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772437721, "uuid": "d5928ba4-f984-4ac1-9a2b-fdf92a60565f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437721, "uuid": "ad01dfdc-3723-4006-8569-6f1d9cbc8f75", "value": "5f294ad4a2af3e41efda6819a503fe9b66f906be11c76bee865a5bc6869fc3c7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db64afe2-163a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772457746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457746, "uuid": "df7414bb-bffa-4833-a511-7dd6934ade4f", "comment": "Malware payload (SalatStealer)", "value": "47d019b2eae581abef205674a0ee0c70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457746, "uuid": "dc237d22-6ac2-4782-bd4d-bed990f554e2", "comment": "Malware payload (SalatStealer)", "value": "5f3f7ab6aae614ad84047abeafc626bac658319b4d276489c4c4784e99fab53a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457746, "uuid": "6c1f9aaa-532e-458b-af20-b65ea33671ec", "comment": "Malware payload (SalatStealer)", "value": "1475ba48cc6cb6edf75581ba61f9cee5a907111e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457746, "uuid": "32c11a9c-5518-49be-bc57-9dc85ba91699", "comment": "Malware payload (SalatStealer)", "value": "4c8ee55d03a44edd41aca5d24ac9b810d6d19c9c6c81b001992df608c4ae8bd02bb28275e92dbbaa99cd4950a4c9fb4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457746, "uuid": "fe98038b-c3ad-4f18-bb88-22cb5a032a51", "value": "T183F63345E3F005F6E9E7443CC652C820B7BAF8925F61C69F076996E13F636E28D28724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457746, "uuid": "dff0a085-07ed-4175-8d1c-3088894abc4d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457746, "uuid": "82caf43c-cb8d-43e4-b5a3-a015e35c6e2a", "value": "393216:zuUgKYFxVHFF9W+tHjdO15Ly5QvKHeFeIBZatd:TYFrHFF9W+NjImQS+FeIBwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457746, "uuid": "69360265-eb3d-48b5-a94f-5318d8630977", "value": 15571123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457746, "uuid": "1949dd09-4241-4481-a593-1925dc4336e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457746, "uuid": "0ad5a6b3-5249-43cb-a054-dcadb40ab6fd", "value": "start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b11a29-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487533, "uuid": "e9f3a24a-a281-4a65-8ac8-c6254904cc3d", "comment": "Malware payload (Mirai)", "value": "46ff1cb3c062a6c5aee786187241cdd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487533, "uuid": "b5b5d156-ceb5-4a58-a37d-bce34f7d8504", "comment": "Malware payload (Mirai)", "value": "5f52b1bd08e5c144f079e4229f5a7a2cb07125337293387451bd252a086879b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487533, "uuid": "832d8fc2-5a64-4d18-b9b7-f77a68b54d85", "comment": "Malware payload (Mirai)", "value": "f3f9ffea2a7ffaa8fe62356df6bcfe776b4aefad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487533, "uuid": "3ee7997a-50cf-4dd1-92a7-826ac99f5b4e", "comment": "Malware payload (Mirai)", "value": "1a525084b808468fa57dc2e510758ead2f4106197f3a9778686e96477b764ccee29ebe4a4d43a233987353c9f19331b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487533, "uuid": "7584f74a-4431-43cd-a602-3f0c2b70ecd4", "value": "T167D35C0373180E17C5A34AB02A3E1BE087FED5D121F4BB89691F9B6A4672D371582FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487533, "uuid": "62476ea1-adb9-487a-a79d-83aee7ff1b51", "value": "3072:UTWOofV3sYvBJ1Uc0b7yLAUWb6oMMdxg9b1o+C:IWJt3scLmuLAUW2oMM8ha+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487533, "uuid": "becd31f8-aad9-48b2-9b77-df97b5997c38", "value": 134832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487533, "uuid": "b4680193-37ab-4075-a152-ee5f1102dd1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487533, "uuid": "18c7a157-5135-49a1-9ed7-e1af11e1309f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af85e4fb-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475712, "uuid": "fd4faa38-e211-4ecf-a1e8-31ac02dc049a", "comment": "Malware payload (Mirai)", "value": "bf88a750d0d11caa72f4859ab507dec2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475712, "uuid": "8b7fbf35-b09a-4282-997b-1e690da9df57", "comment": "Malware payload (Mirai)", "value": "5f75b1e4ebb2b686befe2664644c2d5383f47e75b719ecf2c5ccbc9562039bee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475712, "uuid": "ce4ecaf2-2900-4eca-a3c3-866aaf65b3df", "comment": "Malware payload (Mirai)", "value": "4bcfc0f995d3e063fec2c53c7b7ae88f1047be28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475712, "uuid": "5d8617df-fab9-4bc8-9c69-25c0ceb87a47", "comment": "Malware payload (Mirai)", "value": "643d281cb7030c042b322abf00dfa33d847a00a2f6f4deb46c0c1e5cd3b3fa1c3277794e213aa85ff443a5a737793370", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475712, "uuid": "5de1822e-4fab-4673-af47-862f11565b3c", "value": "T12C13E09024166C69C1707A3A8C3145C355BA0FED822075FBE9281B09B6CDD9B6FED1EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475712, "uuid": "b5b1a6d5-ef23-462e-901d-f33245d193ea", "value": "768:G+7dvHHaNaCXO99K43xZbqcEGeGAvxpj2O2SmEioycvpcrwh/sV9q3UELfI:G+5vnVIO/K4bbq3nB2rSmEiY9h/BLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475712, "uuid": "abd3b53d-ab5c-4868-8d8d-88ec8e1d37a0", "value": 43712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475712, "uuid": "05640d1b-8216-4923-8998-aa337edf59d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475712, "uuid": "98f4cbca-11b9-4d58-8058-f8035448e421", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad573b39-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475708, "uuid": "8cf23640-4acb-4ba6-8064-598074bbf6f9", "comment": "Malware payload (Mirai)", "value": "48f98a84f195bc882d9a9c694da774c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475708, "uuid": "a791f3c6-9a43-4ada-a413-56702c22c8e2", "comment": "Malware payload (Mirai)", "value": "5fe7ec8cbfa436891542b23715ee298a305821bce1de59d679b8b1d3861b0616", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475708, "uuid": "31ff7666-48da-4092-a839-4df690bcda5b", "comment": "Malware payload (Mirai)", "value": "1925a40b3db734ad0876e9fec299232dd0c38570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475708, "uuid": "fe3f3567-350f-492e-aeb7-2ce1c420e41a", "comment": "Malware payload (Mirai)", "value": "78d89f1f789bf2dab73140d5305ee36840eff4d8e929aff2933acbb13bc9df2cc9366680a31d137447eb6bd64bb89c43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475708, "uuid": "eebe59cc-f3ba-4bad-9e58-379b49ae50cf", "value": "T1A703F1CEF4ADEB9DE6CE113098BB3B5D2951D0AEA45CB4455FF2A142090DF613C4878B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475708, "uuid": "398c4384-c741-4132-9144-c484cadc95aa", "value": "768:AZfd4q3fu4bLq84zx+igAQMEJ52GW5O04md2YiInpb4qIw6nbcuyD7UtQRjs:YdhnbLPmPE2Ddtn6nouy8tyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475708, "uuid": "e29e3fbf-892d-49f0-b24c-ff12d46d2e71", "value": 40320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475708, "uuid": "f7a1124d-2dff-4225-b870-ac0483a66e55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475708, "uuid": "d344a07e-2efb-4ca2-bb64-e5d7236093f7", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ca8e0e-163c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772458594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458594, "uuid": "9a671b92-513e-41c7-8735-ca71e32c80fe", "comment": "Malware payload", "value": "8905d2632d3625defc7d96e9d58d214d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458594, "uuid": "221f8a36-e2a8-40b4-8c59-965ad3def675", "comment": "Malware payload", "value": "61a833f40ecae1f084727ca26a12185066b4fabe6e5db64e50066f751bd05af8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458594, "uuid": "91d48c35-f3b8-45c8-8678-e32651ee16f0", "comment": "Malware payload", "value": "d61e4137ad0a6a0417a062993b882d93c71a59b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458594, "uuid": "9acd6d36-c395-4ca0-9a6f-2e436b23b1d3", "comment": "Malware payload", "value": "6354b93c181a7ea322e39dfebadbd9d500921c6d4bbacc9695f6b2f58862ff132be325ea0e3e690b3467f1ef83da6f76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458594, "uuid": "a995de0d-f5c0-4644-94b6-04a6610eb581", "value": "T1B9742339D1C60C26146E0EFD4792B365AA99FFC2C151B742630EF5AA0E8012D637E5BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458594, "uuid": "8d6ab98b-f38a-4c0d-bd12-b93115ccd8d5", "value": "6144:urBRcNGGJ7hhmPP9WoetzAKl0A0iyM9fuWRJj/7hwf1njH3yl81Caxcj1Kz:1TJ7ePVOtbMPMxTF8nD3f1CyQ1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458594, "uuid": "354f780c-6de0-47a8-bd67-4f66cbb246ea", "value": 343804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458594, "uuid": "0602a82a-3503-4904-b0d6-05864780d4f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458594, "uuid": "61bf8a69-e380-4af5-9406-a9ae3556c8e7", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be101df5-161d-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772445242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445242, "uuid": "c0e1f135-bc63-4fad-82b5-b177963011fc", "comment": "Malware payload (CryptOne)", "value": "8422ceab7fed57b916e4b2c7feb8ab1e", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445242, "uuid": "e4735a42-305f-4559-b61b-6031f67c1bc8", "comment": "Malware payload (CryptOne)", "value": "628c36cbda21a4cd43d9f57c3702ab43d507c2fd27cd12f214a146f8d48ff410", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445242, "uuid": "a56ff574-3b7b-431d-989b-d2a3d08a0be9", "comment": "Malware payload (CryptOne)", "value": "cf82402b1019dd7096408340d141162c92fb6e74", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445242, "uuid": "7eac38ca-89a8-4452-9426-85d141ed71c9", "comment": "Malware payload (CryptOne)", "value": "350aca9c61b5e70575efe76f0be42eeb773cc23c50e2af54f1523ca24e18270d5ae728bbbc45605a0ca9a0e71a58d11c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445242, "uuid": "aa986e2e-82d4-4cbb-9a82-2001e15d9d3e", "value": "T1E946F2216166B7FEE592AB70CE265C2B5936F6EC3E54740AED6CE5C08F37105242E383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445242, "uuid": "6a94a619-37a9-4bd3-8aeb-fc61b371835f", "value": "c49145fa1609ea5c9df8ad5668221f7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445242, "uuid": "20bef588-ca34-437b-aafd-7f39d33008e5", "value": "98304:m6o8+ynfbSDjrD9ikKgS4DI6+4/uwBYeeUDTGTHHEa:VOynfbYjaPNMzTGbEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445242, "uuid": "316acbe2-2716-435d-a7d4-b8621a61c962", "value": 5413376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445242, "uuid": "29cd4021-ce89-46fc-8cd4-f8c6145c33b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445242, "uuid": "6bad07ac-47f8-47c9-8469-f7d52281f8cd", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767b1ff3-1646-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772462731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462731, "uuid": "ddb13585-e7b7-462a-b011-cddb21d4a117", "comment": "Malware payload", "value": "259ba6444e98cb67801f32d5f48c33b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462731, "uuid": "6dd3e2a0-1bb5-4ea1-956c-80208ff8c86e", "comment": "Malware payload", "value": "63dc55b3b9693479922584b93b42989cec7d609be401fddf9d55c1ef178b3351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462731, "uuid": "c9d55b54-ab6e-45a7-a90f-98c7995a721b", "comment": "Malware payload", "value": "8235931f92ec3bc37eaa25a8e241acf127018331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462731, "uuid": "5c9ffbe6-149b-47af-871b-6fabf5a62d77", "comment": "Malware payload", "value": "095445f3f722ff798153896c5652494a2dc72738f32878c2870266ea723018076f934914c691b21fe4a72e56155c5baf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462731, "uuid": "00e8c25a-98d2-4f96-9524-b410b702627d", "value": "T12BE633500FC38CABCD2593365894DD72EE6D673CD3A8338EAB6D7C374A692418B92C51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462731, "uuid": "f3df47ea-b7ac-4a91-be0b-1367331b0fd3", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462731, "uuid": "8825d827-c440-427b-9195-21a5a79a2f43", "value": "196608:JuzbMEEHbBLGyqVo6jf28N2HEqrh/hQtPzs:4zZE2oK2S2HvFytP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772462731, "uuid": "03bed3c6-1685-44d0-8ca4-b3895aeb00ae", "value": 15213224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772462731, "uuid": "b7eaa53c-b013-4993-9965-d6ec932eb7b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462731, "uuid": "bdfcfc7c-6e37-4884-b21f-3e374d948295", "value": "SecuriteInfo.com.Trojan.Wacatac.15353.15590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a652820-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433854, "uuid": "61929913-6f31-42fc-803a-4da7d40fcefa", "comment": "Malware payload (SocGholish)", "value": "9439e368fa4d34cd56ad4cf1cbdbce0d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433854, "uuid": "5e29231e-5dd5-4375-96bc-29a3188c4cee", "comment": "Malware payload (SocGholish)", "value": "6416f7b03438bc55ace26745cf5274525467747a2449e5dfe2eb516c76c543da", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433854, "uuid": "0a27d06e-9940-47bf-9102-fc14de5f43bd", "comment": "Malware payload (SocGholish)", "value": "ac42ff77f91dcd6adb6d6312b6651a02172ad0a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433854, "uuid": "534697b3-ffee-487d-a69f-a9ff110854a4", "comment": "Malware payload (SocGholish)", "value": "24559482edcaf550f6b023271415560996377d7b7c470a93d9f8c1f415953d018794fdf89eceb01f55ded24faa133da1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433854, "uuid": "b3f45bac-e26a-4c7a-b8d8-60230c7d6fb3", "value": "T15CD023AD3C8E2055B37A3830137B8E09305130152181EA52CCF684D0B0346DB451EAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433854, "uuid": "88eb2927-6a32-414b-ab30-0513a1f050e8", "value": "6:SNoPb9RRAgO9lFvWRWf/tiG6CsAk6pdtMOq405Lm:Q8CZWRW3tPFo61MF5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433854, "uuid": "7647465c-7511-4dc4-ac58-a49774243fbd", "value": 229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433854, "uuid": "83439684-54a1-4b7d-beb1-5a92bacda7ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433854, "uuid": "4d57d3d4-0e39-4c7e-93e4-2b64fe8160c6", "value": "6416f7b03438bc55ace26745cf5274525467747a2449e5dfe2eb516c76c543da.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e70be2-167e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772486784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772486784, "uuid": "7f26af29-6c9c-4297-9077-1d1bf4bf1dae", "comment": "Malware payload", "value": "838c8fd4ae7e3c4972adc8800db44929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772486784, "uuid": "00942f92-a297-410d-8f42-9f5481a96985", "comment": "Malware payload", "value": "64263640a6fdeb2388bca2e9094a17065308cf8dcb0032454c0a71d9b78327eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772486784, "uuid": "fd7a47d3-cc6c-4f09-b9ab-49f780a2275b", "comment": "Malware payload", "value": "2b781b3a352db44db67ad56e8477e6a1016b2597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772486784, "uuid": "ac4034b3-0a50-4fc2-9b42-a2d32f2d8c6b", "comment": "Malware payload", "value": "add16421d3950bf80caafc5a55fbc92e6891e29ebe8d031eac5960030cc86f32aeb7434bbfe55dd9fe68379fd295f164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772486784, "uuid": "04625eb6-fb2d-4bd2-8e79-4fbd00a369d7", "value": "T1B418338055F99F2CE44B4E36F46A08B9405F9F6F8F825968A43126C3385BE422CBFDD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772486784, "uuid": "783e0b5c-bb53-43dd-905f-9ad80d11dae6", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772486784, "uuid": "3ba9587e-ad7e-4a83-afbb-e9102e0d09b4", "value": "1572864:pwKJPDvHypeHbTLgt8WOw+7JPQ4+hC3N1Fq5FGHMR8UVHML+9m6/nZ/9UjAJB:pwKNvypccaFlD+c3DaGHOsL+9m6/Z/95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772486784, "uuid": "e7b188dd-2691-48ee-9558-d30650d261b4", "value": 86800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772486784, "uuid": "f8dc4766-68d5-4c94-96d5-6b990837eccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772486784, "uuid": "8d7732b6-d41a-4d8f-84c6-55eba871a3cd", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac963a13-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475707, "uuid": "3e4bde03-2279-40f8-b03f-661318566bf5", "comment": "Malware payload (Mirai)", "value": "e017a5bac19711703815c284da5a69bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475707, "uuid": "91405070-acf7-44ef-b3dd-0aee0c7eebf4", "comment": "Malware payload (Mirai)", "value": "649a70f0613aa8e397bc50a13e8411cd557fb60e70187bedfc62ba728a3f500b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475707, "uuid": "4b285b59-fdd8-43c3-89bf-393200343374", "comment": "Malware payload (Mirai)", "value": "b85d0c34786af9e2511f7dea19250c2e160a7e40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475707, "uuid": "58da21ec-64fa-40f1-8746-9d50bb1a0878", "comment": "Malware payload (Mirai)", "value": "74e5c01baf2e86938bac6a2f350ceb30940e0ec15d246f34db0b0976a639569651439d4c5b3d26516216128a60983b48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475707, "uuid": "4c59de29-dabc-4171-8f27-9292e9adb3e3", "value": "T14703E04B9CDD8F44D962A3354DEAEFAD0418E0064DD89873B4C4B80759DABDE3C297A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475707, "uuid": "6a29edd7-e1cd-4e1f-ab5d-0d1bc5b23cc8", "value": "768:Z2mC2QJ/9tQZFkt8wxWIcZ97ZbEhgEx41+F8K0p8z2aX/8+NpnbcuyD7UtQRjO:uJFyDkt5QIcZOgEG1i8Kw8FX/xnouy83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475707, "uuid": "7972090b-9ec3-4c8b-b706-3ccb16047f2e", "value": 39348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475707, "uuid": "07fe359f-6117-434c-9d41-a4b1b306d1cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475707, "uuid": "dd4561ad-3317-413e-99c0-0b7d1ac2aaf4", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498849df-1644-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772461797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461797, "uuid": "54861635-a5e7-4b16-9085-c86802f2a9d0", "comment": "Malware payload (Vidar)", "value": "5f29cef9c599b41deba18802539d0916", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461797, "uuid": "3e7bcc04-bd30-497f-b21c-433b05117a72", "comment": "Malware payload (Vidar)", "value": "64a29ecae85948eaf53cd1ca2e82788bc63e4b947ac770c47a894ed27d31eff4", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461797, "uuid": "fdce6006-6835-4f59-a222-177e35995612", "comment": "Malware payload (Vidar)", "value": "20ff8a4e1bb052953bfa206b103d58c076038c38", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461797, "uuid": "3c8f51b3-fe2c-4e91-94c7-079a4787fa58", "comment": "Malware payload (Vidar)", "value": "0c2d14a24f2ad7b1dc8aa47a4d3530e0383d5ad98dc0a830f1084b0146424d89431ff7b78b111f55de1b3f782fafe37b", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461797, "uuid": "24194e04-adf9-46e8-840d-c837e429048a", "value": "T19146334DE05F46D1A8BB19BA83D7EE442BAC1DC35A783951A4BA13B9CF10CDB01DC58E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461797, "uuid": "6d5d33a9-eb35-4ded-85ce-511174f8239d", "value": "98304:70HMVd69/lpgHb9h2gLh2YM5GSNZqG58tG07U/h0o8P4m87mm7Nod5QFohHEUZX5:70HMVc4LMY+NZqG5r07UJM4miuQFBUZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772461797, "uuid": "793f989f-a9c0-4238-9cf2-d9a66a33f06d", "value": 5619281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772461797, "uuid": "be550c23-6f7b-458b-bb71-a612f0f86595", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461797, "uuid": "c49cabfd-1bc5-4c3e-aae1-86fb6650dbdc", "value": "V\u043el\u0435cit\u0443 UI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a382f4f8-1632-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772454217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454217, "uuid": "e0635f6f-713c-40fe-ac5d-c585a97d85ad", "comment": "Malware payload", "value": "76c59282e44a461105dc5739a6ba7c33", "object_relation": "md5", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454217, "uuid": "baee956a-d84a-4cf0-8ebf-fcbf55378e51", "comment": "Malware payload", "value": "64cf334716f15da1db7981fad6c81a640d94aa1d65391ef879f4b7b6edf6e7f1", "object_relation": "sha256", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454217, "uuid": "b518a5b5-a71b-42b6-8932-aca835398322", "comment": "Malware payload", "value": "7a8963d123918ca86727649492cd1ff4e020cb72", "object_relation": "sha1", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454217, "uuid": "42134a2c-3a03-4700-a245-e8b7ee7343d1", "comment": "Malware payload", "value": "632ba0433a334d604678b730f6397819d84916ee95173f00d8e3cd6eb879fad8cde89021c3fcb2e68d685c545f9814aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454217, "uuid": "1da273d2-0c6c-4bda-8007-df3ec0887b91", "value": "T175183323E09583F4E0924FB0DD1DA1664E8AA8DC51852E0D4F9EA1FC6E878DDC5F1AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454217, "uuid": "68ad1f1e-20c2-4a63-89ec-3cf11365abb2", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454217, "uuid": "e36c5e45-418d-4539-9fac-e898327dadbe", "value": "1572864:S6sZA+TMMdh0OWzeRxhsyw1CvawblHmTJGGrxLPXBNGA72PWDt+wzN7RX:S6smSjdhbWzKxhsh1CvaeGNGGrxjXBNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772454217, "uuid": "19fee966-02d8-41e2-a4cc-cb2db97ada51", "value": 87211504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772454217, "uuid": "f7fd2c29-68bf-4cb4-8a96-68c480ed4663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454217, "uuid": "fd5ba945-0cfe-4675-8b60-c17b5b13b1db", "value": "64cf334716f15da1db7981fad6c81a640d94aa1d65391ef879f4b7b6edf6e7f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a359bfa-1626-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772448806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448806, "uuid": "3b291754-5a94-4dc8-a0d5-01e04f192f5a", "comment": "Malware payload (Mirai)", "value": "538f48a8c4cf0289f185efc64c383df1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448806, "uuid": "b3e6026d-936e-46b6-995c-4b4089510b7c", "comment": "Malware payload (Mirai)", "value": "667f72e7d0bf5565febecc66907b438534796163d4c20872162688512e84e6c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448806, "uuid": "405edf2b-4708-4adb-b862-59f3190fdc9f", "comment": "Malware payload (Mirai)", "value": "472a3e5e33eea56ca4114cbb34358dbf1febec44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448806, "uuid": "eee37eb5-c64a-488e-be44-cacc06e7a07e", "comment": "Malware payload (Mirai)", "value": "5e0e0c1ed0393aa6479b2939a2eb48a30bc6caa368aca34f9dc2b7d70b749412dd386d0606fd557fd09aa15c11c34db5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448806, "uuid": "a7e32522-02f4-40fa-b526-697c563b59bb", "value": "T18EB31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448806, "uuid": "97ca9b84-4241-444a-af89-72f8562bdc05", "value": "3072:pC/4rdZHsXsZwwR9zNk5mm/QcuLmHniPNb:pCwrvHwsZwY9zOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448806, "uuid": "af6049fc-153d-45b5-93b1-dafccd4076db", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448806, "uuid": "fdff72ae-af8c-45a2-b70a-0e68d784ac7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448806, "uuid": "3bc4e962-2530-4928-942a-818e69e2323f", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4f8c9c-166c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772478871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772478871, "uuid": "4ab34112-ce09-4567-bf74-202d42b6dcdd", "comment": "Malware payload", "value": "983612c54fe097aa39535261f5b71efe", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772478871, "uuid": "fd5c20c9-e9eb-4ed1-abd0-60add1b63493", "comment": "Malware payload", "value": "66f3506f77ddd2da7ac2f253e8d5944e67e9fc1e289c5d37f1bead2d62d9974b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772478871, "uuid": "7e0f05db-8c82-4c0f-8925-e189aebe51c9", "comment": "Malware payload", "value": "8cacb828c668bcf7445730848ce8b9bd4d90484e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772478871, "uuid": "516aaf60-5d21-4c51-a0f7-0ae5032a8dcb", "comment": "Malware payload", "value": "553f635c5374fefca2215b8cfd8a4170b9a1acafc11e61e7e19afc5cbae3aa34ad70c7d4361af5a59aee58ed4ef39749", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772478871, "uuid": "afbe7b47-0e09-4cf6-aa5b-70135fa9adc2", "value": "T19431C1202BF6071DD3F38B3D5CB663129275B945FE668FDE125041488C64221EC65F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772478871, "uuid": "7f3f8b29-3031-4c6f-b185-03d7f6b5b650", "value": "24:8dY5n5yJY5D6KceW2tuAnWkp+/CWP2+/CxC6xVfu+GC3+IJ6EZwr5oRmC:8d2nMY5OXSLePC3j61tS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772478871, "uuid": "e5c589b8-b28c-4297-8d77-784dc7f820ea", "value": 1631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772478871, "uuid": "d3b9dd80-50e1-4142-bb24-52a357f350e6", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772478871, "uuid": "f73ff4ec-489f-4b4a-b657-86d46bca7e59", "value": "Document2.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abeb9f58-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475706, "uuid": "85065210-1997-43e0-9c96-c5999cc181c7", "comment": "Malware payload (Mirai)", "value": "d135f4e216152da99d7d1fc4b26197f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475706, "uuid": "eaf1f69b-6066-4975-bfcc-dd6a83fe4d3d", "comment": "Malware payload (Mirai)", "value": "670c9a342810a0489d1aa79e3de71d35297e8301c10ce8e845ae72c0199f23b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475706, "uuid": "222a6ed1-4068-4f16-aec0-755b7c25d30c", "comment": "Malware payload (Mirai)", "value": "9ea558ffa1245883733956bb29c44f435837d6ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475706, "uuid": "b9594677-4673-411f-86f8-b8b1dd466a9f", "comment": "Malware payload (Mirai)", "value": "4a297da092e45f334a6fd5826810e9817e4045715875fa22ae252047c08338672482a1a5baf349e4d948aba5d9b017b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475706, "uuid": "718b6b60-4ffb-4b14-ade1-76733acea4fe", "value": "T1A5A349D7B801DDBDF80EDB7744530506F272E3A219831F36626BB967ED351A81822EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475706, "uuid": "10f4b921-081b-492a-9ce5-5f2ba1da0e2d", "value": "1536:Unkppk4+ehabR4mCcY17w/Mlm8IxTrKm+lXcmhbfeLEoWCa1ACozE:TJa1V47w/Mlu4XNhLua1ACuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475706, "uuid": "98134d5c-e6fd-4ba4-9bd8-55dc96939191", "value": 98680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475706, "uuid": "329e89d8-0647-4c9d-be47-d3e78798403d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475706, "uuid": "ecddaaff-c236-4154-9824-32d844b6dce7", "value": "nwfaiehg4ewijfgriehgirehaughrarg.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d09822d-1670-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772480808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480808, "uuid": "e662a55e-9339-404e-817f-7a8fdf6e2ad7", "comment": "Malware payload", "value": "25adfb98d5b893f1f0d550d1ad9600f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480808, "uuid": "4f4a7509-d1e3-4378-9c5f-4e3220f7a6a2", "comment": "Malware payload", "value": "680381365164063d14a0626cdab49cc44e211041619f44061fae3349c60490d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480808, "uuid": "e4e27a88-71d4-47c7-8ca1-7c41e42cfdeb", "comment": "Malware payload", "value": "a0450ab2077e8a262f8f266888d604070ee2823d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480808, "uuid": "b58007cd-f5ee-40fb-a705-c9bab26e60c8", "comment": "Malware payload", "value": "175891c0e70f0f1ab269c1f6d6b29af1fd8b2eb6f539f943665db2b98340a281ba40b7bd3880fc4267a9fe632163d699", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480808, "uuid": "a49b4728-10de-45af-ad5b-8fa714ab0605", "value": "T15E330749F891DA52D6D42B79FB5E42C9330313B8C5DEB212DD155F2836DF88A0B2B983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480808, "uuid": "b43b828a-e975-4d96-baec-198892a26dec", "value": "1536:hQhGNicdA+i+8UKwloRMxbnw8cUJSmKME:+hpc6+pzl+TME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772480808, "uuid": "35549f19-32e6-4d02-bb0d-8112ef9108de", "value": 54252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772480808, "uuid": "eea7c554-0bfe-4143-8e1d-d3bdfc77b2bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480808, "uuid": "83e9d722-8869-42a8-9bf0-65c80af3d15a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a45013-1673-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772481869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481869, "uuid": "22c0cf74-ff6a-4af1-9c8e-94ec4a048d4f", "comment": "Malware payload", "value": "b19add5ccaa17a1308993e6f3f786b06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481869, "uuid": "4e748f62-c41a-436e-b60a-e3052db18d6a", "comment": "Malware payload", "value": "69294ad90aeb7f05e501e7191c95beb14e23da5587dd75557c867e2944a57fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481869, "uuid": "aa30636b-1121-4268-811e-1e62b98bdfc2", "comment": "Malware payload", "value": "51a746c85bd486f223130173b7e674379a51b694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481869, "uuid": "97c8b59f-285f-49df-a9bb-ec54c35f8ce0", "comment": "Malware payload", "value": "89c7efd07d9e186b16c8250f26fd1cab383f8afdd8d824d5e379c3e571636d0fd96e9156c747a5fd316194ba2afb9a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481869, "uuid": "768ef8cb-9dd4-40c9-b307-36ca79a7a9a8", "value": "T15344B2832904CADDC83D5179E9C792AE15240D3CE4E48CA37EEEF7FA40B64745935CAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481869, "uuid": "5bd84247-6390-4a4e-9c39-0148a51241dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481869, "uuid": "4b68f0f2-008e-48e4-828d-36679586083d", "value": "1536:ABIp45Aje/Jij+zHRJQC5bffBffHfffazx2M:rpOi9ARJQC5bffBffHfff0x2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772481869, "uuid": "db028cc7-1c56-4452-b57e-a5d8ad681ec5", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772481869, "uuid": "701a654e-523e-4caa-87ec-27f028a31fe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481869, "uuid": "21d7fff8-243d-4c72-98f7-dd4e3ff3e208", "value": "RiroDiog.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21c3c15-1647-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772463341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463341, "uuid": "80dcadb3-b59e-4025-98ef-1ade5e91533b", "comment": "Malware payload (Mirai)", "value": "e1abba99442d3385053939c94ac693e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463341, "uuid": "23cae714-323f-40ef-8bbf-522f24baa9b5", "comment": "Malware payload (Mirai)", "value": "6941c019f9adad48ebf1f6f0da6d84d57fc0e36ae26d3b975d022da965924164", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463341, "uuid": "1894d11a-3b9b-48d1-9778-837ffd1b515f", "comment": "Malware payload (Mirai)", "value": "ce655beedd4904734de85adf32cb79f3f0104f15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463341, "uuid": "110c4f5f-d17c-4c79-8033-6ff200af319e", "comment": "Malware payload (Mirai)", "value": "e3b5140ceb37823ee41f99206ac17a96c7f860feb6e65484a50b52981d46880d719c3003a1e7659454bdbe40a814293c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772463341, "uuid": "387e86c4-b837-4061-a95b-c02fc4986791", "value": "T1FA241946BA418F13C0D627B9BA9F42453323A754D7E77306B528ABBC3F8779E4E22501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772463341, "uuid": "3870170f-700d-40a7-b6e6-76c26216ea9c", "value": "6144:sWNOjvyvu8aYWsNWYAQykiAnRYXTAxM/RT3V:soMym8atsNWYAxVmQA6/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772463341, "uuid": "1e14640e-3083-4955-80d7-c1fda92f9916", "value": 214762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772463341, "uuid": "3152a2b3-eb3c-4f44-85a6-ad52bd64930b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772463341, "uuid": "9158ff16-2cc8-4b62-9f47-ced29994e318", "value": "csk_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89dee8fd-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444725, "uuid": "5209d6fd-dcee-48ad-a072-62d4ac3ac68d", "comment": "Malware payload (SantaStealer)", "value": "109564eb0b49aae60a64379c8143145f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444725, "uuid": "78e8dd09-a073-4be9-b71f-7f22ee4e9d5e", "comment": "Malware payload (SantaStealer)", "value": "6ab0cfd9a29448e84b404f28bf6646dcc3804128e895c08f35a9ef6e6545148c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444725, "uuid": "19c51ab1-6fc0-4b47-ba7d-c1d160fe03e1", "comment": "Malware payload (SantaStealer)", "value": "51232def888ccc5a2c48d820ca3fcb854ec07a2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444725, "uuid": "c64acb65-1e0e-4e4f-b2f1-01d42a6ab0c4", "comment": "Malware payload (SantaStealer)", "value": "ba8b2509c954cfeb7741a2a5d65a9078a7c5b294be5557ac4afb26318e6212b6ac739512c34a684157b7a13a5d4dc55c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444725, "uuid": "c94269fd-bcd3-4d09-af58-f53dc0cd8478", "value": "T12DC59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444725, "uuid": "5e12485e-f71a-4605-a030-4be8a7b2b459", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444725, "uuid": "8f4f96f3-9a25-4593-8edd-ffcbaae6a87e", "value": "49152:TavY1Sn5eVNohWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCMsdGU:SY1a5Uevc+9sdBg4x4DPPnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444725, "uuid": "9aa4ac3f-142f-4948-8042-864625bbb48e", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444725, "uuid": "9dfdb30a-1422-46c0-98ab-4e17ee599a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444725, "uuid": "e3a48808-f5a6-4dc4-9ce4-a427a3aeb86c", "value": "20260301_210107_20260302_000106_1Y4U460547CC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ce2a61-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433705, "uuid": "7c08d53a-7f4b-409a-991a-5634e64a7627", "comment": "Malware payload (SocGholish)", "value": "7d812ac997263c08fa89ef3b12ea8e41", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433705, "uuid": "5a1b831d-ef50-41d5-ba07-b70b3b4d15a3", "comment": "Malware payload (SocGholish)", "value": "6ad650db4572ea0b48796f2c90de816b2650cfbf1e0e80ad506d5e797e0d15af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433705, "uuid": "ad289881-2539-4a2b-8032-c122fce8577e", "comment": "Malware payload (SocGholish)", "value": "d362a278e0ff61daaf8e618361e44ae1540924ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433705, "uuid": "a0edc215-de1c-4a20-bd10-fc13907ad720", "comment": "Malware payload (SocGholish)", "value": "8c6e91d3b4382b505f8ebac4f1c021c3380babd92b52acc33dabc52e35bd500b2e323118936914a65e6e86e5ee9ffb48", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433705, "uuid": "0344bd79-bd35-4484-82e6-d72bc7445770", "value": "T159D0971E601808181FA060E250B387497092236E3020864ACC78C60CC020AF2082A14C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433705, "uuid": "603549ed-3d27-4169-96ca-38a3f8882eb3", "value": "6:ShOAgO9lNAxRWuAWa9sWN8GId8I2JQ/a/rVWIRe:0VSxRWuAWa9sBr2JQ/azVB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433705, "uuid": "fcb60f9d-adc6-4e42-8989-ce44364743a6", "value": 224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433705, "uuid": "2202bcf6-3db0-4934-9cbe-da6b21279384", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433705, "uuid": "f8c855a4-a9a3-4d20-b5c3-e2e8e00e1d9f", "value": "6ad650db4572ea0b48796f2c90de816b2650cfbf1e0e80ad506d5e797e0d15af.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf13649-160f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772439334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439334, "uuid": "52a96b90-cb5f-4773-b41d-735b346644d2", "comment": "Malware payload (Formbook)", "value": "03abe839756e2c8d162461d89acef9fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439334, "uuid": "88128105-9b42-4691-98b9-22c9b07ba08d", "comment": "Malware payload (Formbook)", "value": "6ada3dbbc2aa231410d0771ed257416992f1f20efec7609940a080464f6e6ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439334, "uuid": "29483f34-71b6-4c9e-98b5-d3607c40d581", "comment": "Malware payload (Formbook)", "value": "5293a455e9a956e152a476d2c8d21b548785347b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439334, "uuid": "ce14fdb6-4929-495c-a308-69fabc8a78f0", "comment": "Malware payload (Formbook)", "value": "2451a4fd98a91066473c95577f8ff93af32e1c17db12da548318b927acaebb4da31c68295bd5ce343d3b18b3167a4aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439334, "uuid": "6843a07c-aebd-45c3-95d5-9c58052254b9", "value": "T1112512285B96D906CAE6437E69B1F2B8077DAEDA7500D3278FD8BCEB7D127111904383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439334, "uuid": "5aeda8a3-bf00-4996-8de3-2a4ce9a539df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439334, "uuid": "6587c1d2-8f9b-48db-9e82-d95a3a968f10", "value": "24576:GpI5aO1GAdt6vNL/H0+pONG/jcb4ebFSHYA:nU4SFLM+puDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772439334, "uuid": "b3d012c7-0d11-428f-84a2-512ac20f52a1", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772439334, "uuid": "d3e2b82f-c0cb-4e29-8662-f04131a80daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439334, "uuid": "f7e67803-8676-4dbe-850d-c0652d961963", "value": "2RIPMrVRCmrUvfR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927ccab0-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444739, "uuid": "48c143f5-922f-4b27-a406-c7fa8da161bd", "comment": "Malware payload (SantaStealer)", "value": "d0723c7b2e35c35098d14dc9176e30a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444739, "uuid": "11741907-7d67-4bd0-8e77-d1e6d789203f", "comment": "Malware payload (SantaStealer)", "value": "6b55fe560006f9b174dc79050626ec6fd93fd108f8144468f06d3b041ce7ad4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444739, "uuid": "367a8708-d62a-4f30-b075-1a61e4415ab7", "comment": "Malware payload (SantaStealer)", "value": "bd527cf708b5680f82d21a12bcd1c15f594af62b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444739, "uuid": "4521a993-f12b-40f2-9352-53e3d0069c5b", "comment": "Malware payload (SantaStealer)", "value": "760c590a9d032c46ec7e3eb77a7a45160b54d09bfec0d8d3c655ba9db1b6bcde261ea2fcec73f50626987f4516d72699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444739, "uuid": "d206a421-0173-4ea4-8ac3-e21714f7b0ae", "value": "T1BEC59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444739, "uuid": "0ef7abfa-bd9a-4dc4-aab6-aa659a7a816f", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444739, "uuid": "cdb05ae4-74fd-4f62-8b91-f323968f328b", "value": "49152:NavY1Sn5eVNoqWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCVsdGq:kY1aCUevc+9sdBg4x4DPPn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444739, "uuid": "92035d2e-33fa-46a2-a9c4-1800f89d6ee6", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444739, "uuid": "8b369ea9-9aaf-45e1-b80e-812fb9cfcf0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444739, "uuid": "50d84f83-a8df-425a-a133-fb10fce21722", "value": "20260301_213435_20260302_003434_0X184H8TF22O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb2982a-1672-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772481802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481802, "uuid": "7e088e82-3c5e-4d31-bf71-354049d1d4e0", "comment": "Malware payload", "value": "78275f3fc7e209b85bff6a6f99acc68a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPLITDROP", "colour": "#DD5677", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481802, "uuid": "5c19de48-bf56-4dca-ac30-b13a2f51aeb8", "comment": "Malware payload", "value": "6bb0d45799076b3f2d7f602b978a0779868fc72a1188374f6919fbbfba23efce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPLITDROP", "colour": "#DD5677", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481802, "uuid": "706b1782-81a0-458a-bc74-ad3bf8b46f53", "comment": "Malware payload", "value": "fc08f8403849c6233978a363f4cdc58cd7041823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPLITDROP", "colour": "#DD5677", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481802, "uuid": "12aafc59-dcd3-453d-be4c-36eb0adc357e", "comment": "Malware payload", "value": "d21b1399e614892bd74e1cfa83d6978f2c5c3426ffae884d82e47317057f80c91ca7ff1e5bb3a30cfd6789d4dfcefe7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPLITDROP", "colour": "#DD5677", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481802, "uuid": "be653d86-72e9-4d6a-becf-2d76c3c00097", "value": "T162E533CB06982CE3FA8B9EF9B3F517939225DA62C100FB994D6DAA6F3C1F314854D441", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481802, "uuid": "cf8a42ab-d38b-4b65-a241-bf44ee6e91cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481802, "uuid": "1e45a09d-3d3c-4352-b6d1-03377398079d", "value": "49152:YQ/WarzVvO5K5u+KO+nuov4YxRI5KNA2mDTpM1xnbgszgJeq:lfvOrnuB4NaTpGlbgJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772481802, "uuid": "b8178759-233e-44fc-98cb-4b213e2a4a73", "value": 3181056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772481802, "uuid": "7d0b9c44-3a51-49cb-9cfc-38abaf1cd1ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481802, "uuid": "489ac864-15ac-4107-ad01-86be49ba16fd", "value": "CheckFopil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8dd240-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475819, "uuid": "7e1a1c28-1a69-434a-99cc-5be6d93444c6", "comment": "Malware payload (Mirai)", "value": "f2fcee285dd8734a414973b3a0806e08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475819, "uuid": "dc830db2-3ba3-49a7-bdac-8461eb891f14", "comment": "Malware payload (Mirai)", "value": "6bbc45592f5d2033fbd59ac876a2f022fb75a4fba2e57c6c9fae91ebc750303b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475819, "uuid": "cacf1ba5-dc2b-4a71-8f0c-49bf67af38bb", "comment": "Malware payload (Mirai)", "value": "b0135ebfa9560dd56fc1f170642be0e93cf8933f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475819, "uuid": "1576cb67-4455-4635-8589-4a9d745e803e", "comment": "Malware payload (Mirai)", "value": "e3ec58f53225706edc98e35ec3a321d53d8935794a3758aaa372933fe137198f48471b039333c0596c7ef572c6c63f9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475819, "uuid": "f2d7ba53-333b-4ecf-8ebb-798de04c54f2", "value": "T15503F1B5B1C7A8BAABBC3C31EAE8930406054FB7894E3BD24B414EDC12891CB533D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475819, "uuid": "c3f6fc4d-6936-494b-94e7-2bad62adfb50", "value": "768:/NNp/xeePLU7f5x8OmZga3d31OvK6UaE7VyqVSCqAYYEuWPAs3UozTo:Xp/Uej2f5x8OjaFx6UakSC1YAWP1zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475819, "uuid": "24ad83ad-70a2-4f87-b25f-8cdfaf3a8107", "value": 40932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475819, "uuid": "d47b483d-7d5a-46d7-bb29-32e0370ca4e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475819, "uuid": "e70c2b51-f6b4-4ad4-a61d-322008fcaddc", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1704f905-1667-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772476744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476744, "uuid": "0d3363d5-265c-4584-83ea-8e3a2058f1cd", "comment": "Malware payload", "value": "863ffc747376d27f01d6f70d163a0fcf", "object_relation": "md5", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476744, "uuid": "6ced845f-0348-4c04-adef-ea1c2c5cffaa", "comment": "Malware payload", "value": "6bf89294ab89a23cea8915ce9146048e3f758a39cfabd9b664bd187021f8f992", "object_relation": "sha256", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476744, "uuid": "22d99d29-148a-47bb-bf22-db92b95020f9", "comment": "Malware payload", "value": "fe4d5b54db57f14ad4adf0437741eb3d3243d094", "object_relation": "sha1", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476744, "uuid": "a99aec04-c4f3-4dca-bacb-ca1a2d621bea", "comment": "Malware payload", "value": "b3ca21a45953de51ec9b33a55578e3039d74c653b0bff07ae0001db598d61ea3b48a42bb798c1a013e18919e82b74f25", "object_relation": "sha3-384", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476744, "uuid": "ec89907a-4777-4ff9-9fb6-68db63131c8f", "value": "T13FC5239C313A02F8E7EC8CB93659070717A25F2ACF8953251E7D45AEBE296464D8DC0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476744, "uuid": "c0e02c01-2d6f-4fe6-addb-7a2334264cd3", "value": "49152:EDLefV0MVFsNd/2pQ9iKB+x42oA0Sq4Hg71mDHr7IqFS:ueN0MHsN5QQMKsx4t9s/Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476744, "uuid": "a079f538-83fc-4aee-85bd-e7c70f536d90", "value": 2508478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476744, "uuid": "983ab22d-a8c1-4dd3-8077-2df0bccf1b2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476744, "uuid": "f048f663-8e8b-4ffd-ba94-c4e5165e2ad6", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7315a26f-1640-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772460148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460148, "uuid": "2e7dd359-8f33-49fe-a12f-e54085fed060", "comment": "Malware payload (Mirai)", "value": "2609eacf892bf3f52f3146a051a8bc4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460148, "uuid": "2a62db58-969d-4c84-be9b-cc6db11cba65", "comment": "Malware payload (Mirai)", "value": "6ca87d4db53cc90af5c1039252ce35366ec411ea8d2a95db4f47d531dff6b1ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460148, "uuid": "aab0e9d6-03ee-465b-88e8-82a1e5cbc82d", "comment": "Malware payload (Mirai)", "value": "b6faec91d5c91851fc6c764a9e0024c7f4402b40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460148, "uuid": "5909e02e-682d-4bf2-9dd8-df1e84413d32", "comment": "Malware payload (Mirai)", "value": "7c379df321f59aebd54bea5d2ee0462c68d1d19e81554b16bef755ff457343178d5f60a26ed6fa7049f0543ef26bb67f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460148, "uuid": "f83512c5-c0fa-4856-ba9a-51e3ace4c985", "value": "T1C6831B02770C0E43D1960EF4263F57E0E3EAA9D121F8FA49650AEA46C6B5E33554BECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460148, "uuid": "6993255e-6c5f-472a-9fa6-985a88b9744a", "value": "1536:Yr6Dna9UdQXw695GWaPC6wqFz/N7j1kw7Oj1nu15JrV20FLSVowbZnyD:kGWGWX5qhhKw7OFuTJrNpwbZnyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460148, "uuid": "e23dab99-bcd3-4c30-97c5-e97d6b3052f9", "value": 87468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460148, "uuid": "2f0cc2e1-1a5f-466b-9ec9-d472c7b67271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460148, "uuid": "4c0cfe9c-8eb7-43bf-8030-da8311ca4505", "value": "440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609c3733-1650-11f1-a769-42010a9c0008", "comment": "Malware payload (AteraAgent)", "timestamp": 1772466989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466989, "uuid": "d90b6b9a-64fd-43d0-842e-f4b82e425c23", "comment": "Malware payload (AteraAgent)", "value": "11b242a19eb8cfc88922b3fe7e6fd047", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466989, "uuid": "cdc4fa7c-ba7f-45f6-8172-f5609cc3f942", "comment": "Malware payload (AteraAgent)", "value": "6d0aec10cf309fac28f1e180a1f19e371db95ac9b4fcf294d3f7a2208119589d", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466989, "uuid": "a8f97705-b397-478a-8a8c-31fbf41f87fe", "comment": "Malware payload (AteraAgent)", "value": "9b38f307529703bba896848c7f0b43f2922f8a08", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466989, "uuid": "ff7ced6a-1f92-46d2-92b1-8dacc1adc061", "comment": "Malware payload (AteraAgent)", "value": "f015381ad561c6c438343a7c108bd94c26b40c1e06d8ddbff47d5107abddcab7682f72bd97d293f64080f7dbc951e148", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466989, "uuid": "7a86dd1e-bae7-4416-b457-eda4930614d5", "value": "T16D862318FBE009AEE5778276C56A8520EA327C8D3720C54F47A4B6295F3B7A075BF701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466989, "uuid": "529deaed-10b4-4b4b-939d-2bac49825b74", "value": "196608:NW/FpmnGYLnWgziirlb4/ieF3GrAfedpvCs3md8r:UpqGYLpZreF3G82yc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772466989, "uuid": "ac9a38c9-e5bf-4ffb-8ca2-04cbb9074fd3", "value": 8601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772466989, "uuid": "ed7a650b-7a4f-4820-8a59-7629af7270ae", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466989, "uuid": "f64ed172-e290-4a40-93b5-b3698338263d", "value": "agreement03022026.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221e927e-15d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772415774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772415774, "uuid": "f6b8efd0-fbdc-403d-8d7c-44a65e7bb3cc", "comment": "Malware payload", "value": "2792ebaa3af5f94bf1358475be978404", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772415774, "uuid": "1f3503c8-bf66-404c-97e5-49cb5dd087cc", "comment": "Malware payload", "value": "6d46b70196cf60bbee569dc6558e9277ccc7cf06cd774a911495b1ad79aed0f9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772415774, "uuid": "dceade3c-1ba9-4930-abcb-9f612a91cdea", "comment": "Malware payload", "value": "1f817b6349c61bc99de9997ce15407e94d8894a7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772415774, "uuid": "61a94a33-6630-41c8-876f-9173dda51ab6", "comment": "Malware payload", "value": "9b1d237be7e26d1034fcea77bfc976326e4e6799a05c12a02b7e4b03f101b94b15406fa94c2396f0fc496890510a9d80", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772415774, "uuid": "9d5ada2c-6fd2-4db2-82bd-22abf0d9bff5", "value": "T131F0A241BF453D555335DD1E83E0B20953301BF1B949951A92F699D71F78CC33A4E660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772415774, "uuid": "be5e3ffe-1308-4fbb-a23a-ce5d71190eef", "value": "12:8q0HsOt1Vvhs520az2WT8d9mGwgl6kYV0VyVIVs6X:8RHsOt1xhEDWgmbJmYCS6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772415774, "uuid": "bbfe7557-db87-4f5d-9446-a62424a0ce77", "value": 609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772415774, "uuid": "5ac487ed-7216-4c22-8aa6-7e37b7d306bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772415774, "uuid": "1f94aee2-a520-4df6-ba5e-8d1a65af02ea", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bc3441-1618-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772442926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442926, "uuid": "fd2b6c79-f0e1-4997-92f3-7699a3f0d36b", "comment": "Malware payload (Mirai)", "value": "91c3080f041395515c3e68ecadb10b73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442926, "uuid": "98829e95-6cc0-42fb-bb4a-2ae9227e1e36", "comment": "Malware payload (Mirai)", "value": "6eb82d6e32729afb9082925120b1c8eba108d1f12ea899b6fbecf1642af69288", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442926, "uuid": "e5b8623f-9647-4c0c-8650-a1c184ecfd10", "comment": "Malware payload (Mirai)", "value": "ec5bc74207937aaadf4b3fceda2dd26ea509661b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442926, "uuid": "40903161-8aee-4a5a-afd9-ce00540607d2", "comment": "Malware payload (Mirai)", "value": "3cb0602dd1eafd4d9617849002557da14e5fe8d373b960ca47164964673be3082a5ec0b67c44caee930fea3ffb51d50e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442926, "uuid": "2a9e0de4-851b-4fc4-8bf8-f4f37e043083", "value": "T163B3C80E6E218FBCF7A9C23047B75E21B69833D637E1C585E19CE6015E6034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442926, "uuid": "bcf32776-4f71-4fbc-98ff-e9071836698c", "value": "3072:4FmXB5hRv+tkyNkPkRAM34ZJTFcEqLp+5IwbZnEM:gmRPRmtkyOPkRnURcEqLSIwREM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772442926, "uuid": "ad9ca4a0-919b-4703-a5ee-b1f131652dda", "value": 117624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772442926, "uuid": "86f41545-44f1-4cb8-8413-3ad8b597448e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442926, "uuid": "bdd22993-641e-4b5e-80ce-f302927189ff", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d9e0a3-1619-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772443428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443428, "uuid": "23f78afb-1f7b-45ab-8389-f0c80e08fff0", "comment": "Malware payload (SantaStealer)", "value": "940db3653ca58fc487418998d3177483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443428, "uuid": "8bdfada6-4060-49ae-82ac-2845506e5db2", "comment": "Malware payload (SantaStealer)", "value": "6ee5148da4a0573cf483b96f06d859fe3c2b8e2060a86bb2ca925b52425f1ba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443428, "uuid": "0158b296-5417-4a62-90e0-a14037d25923", "comment": "Malware payload (SantaStealer)", "value": "fab4573e7264f7bd96653e7f908f0c90388be204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443428, "uuid": "3a03cc50-f788-458f-8ac9-9f6786657721", "comment": "Malware payload (SantaStealer)", "value": "201d9c1c6db57cf9f6890255d9e2909c3fd7c852cc6b2ba34ec907bc05faa5749ab04c1b1c50b174a938b2f288a00f54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443428, "uuid": "e34de78c-5612-4d66-815a-8181adefe1de", "value": "T170C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443428, "uuid": "be11619a-4c78-4325-9e1e-0b7f11887cf8", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443428, "uuid": "c778fcca-76a6-46b7-976e-4ec775f22e65", "value": "49152:HavY1Sn5eVNolWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCBsdG/:eY1adUevc+9sdBg4x4DPPnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443428, "uuid": "07ea525c-107d-4557-8fb6-0c687cbecd5e", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443428, "uuid": "22f345e1-e59e-4514-ace1-3a4c8a47562f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443428, "uuid": "0cca8fcc-e4b7-4506-923a-530560d44d04", "value": "20260301_211250_20260302_001250_1L27D11M9XG3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d3fbb5-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487532, "uuid": "c7c67601-dd26-4005-834f-f39d4b914812", "comment": "Malware payload (Mirai)", "value": "09bad3b3149802d08a050f09f3c15b26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487532, "uuid": "6893edaa-8281-4d41-adaf-b52fab888567", "comment": "Malware payload (Mirai)", "value": "70346368925059cb939aaf0b80eaade08c9af52533c2fc9db0e07f900b2dff85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487532, "uuid": "05fa096a-7ac6-45c2-b132-62b093d63fd4", "comment": "Malware payload (Mirai)", "value": "fbd40f03cb9523cc04f3094ead4e0c275ff16310", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487532, "uuid": "3cd747c8-378e-433c-8411-cba2a1030469", "comment": "Malware payload (Mirai)", "value": "12dc067fa446f0ec617ec29b2b2a4c514ee3e84339f4735d2a8ff97a96559546e83f21d25752f82f967a489fb9086394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487532, "uuid": "95b4b13d-bf98-45bf-a132-9baee81641c4", "value": "T15804B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487532, "uuid": "abaef66d-9a78-48df-bf43-fcf501f62180", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2k:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487532, "uuid": "4a721579-5645-41f7-b216-ef26a7ddc444", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487532, "uuid": "60686d51-156d-460c-9e87-6399d8b1711f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487532, "uuid": "fac12495-49e7-45a8-be78-a6942988c5dc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c51523-1648-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772463782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463782, "uuid": "78bd22a0-e9f5-4f42-a839-23345761407b", "comment": "Malware payload (Mirai)", "value": "775a058386e11fac2fc8f80b124ba1dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463782, "uuid": "b5b3ebcc-bcfb-4149-980e-ca10eee571d1", "comment": "Malware payload (Mirai)", "value": "70705c6c7d568a7d73499601fb9e31f3cf52b854df18a91c2864c3ce17baaed2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463782, "uuid": "33682495-bce2-44e7-8b3a-a48a68ed1aed", "comment": "Malware payload (Mirai)", "value": "3b2609e0365c43cd3ec5413e3c519858947495b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463782, "uuid": "a84a56c1-734a-4208-872c-f0c26bda9bc0", "comment": "Malware payload (Mirai)", "value": "4f4bb3df3096f19d9d792241dbd7ee3783d3ffe0740f7096821f24be754fbe299dec4a67b75af6be417a243a8e1d7010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772463782, "uuid": "16e10b4e-adf7-43e4-a201-f14884c08f02", "value": "T170045C46EA414A13C4D627B6BA9F02493333A7A4D3EB73069D147FB43F8679E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772463782, "uuid": "65528047-ed1a-442c-ac33-5d3b520caa47", "value": "3072:hcuhH7XAR9Ehhovraz11dOQ+P2Vr21mQOysv3C0qwbZnaKSDveM/90q3Rw:hcwH7wR9Eheraz11dL++Vr2VORfwwRa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772463782, "uuid": "1e5853a7-f08c-4560-88cf-f7417b612c46", "value": 178926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772463782, "uuid": "c2552128-b613-47af-9784-1f7c20aa3a20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772463782, "uuid": "7dcc5331-5334-496f-918c-aa72024ba4a1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82804a8b-163c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772458456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458456, "uuid": "e29c5847-fba3-4b8d-9e1a-67aa527934fd", "comment": "Malware payload", "value": "c1b9c80aa4f007c38078e48420b69c47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458456, "uuid": "5e4012f6-1743-43a6-8ccb-719c9af9fdde", "comment": "Malware payload", "value": "72a557ad156a04469b740996d3e96e9cb21a1adf9000c110c21bbe0871c23fa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458456, "uuid": "73a256e5-a266-4620-b92f-0f93ed34a23f", "comment": "Malware payload", "value": "168003af06a07b5aa832a926b48cda49007bedc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458456, "uuid": "e6f01803-c2f3-4639-b407-3f6d50c81090", "comment": "Malware payload", "value": "5f28363d2d506c94f06924a1b29d7a30c5320577d5bea7246fd8c8f8785610da9be218a02e647e8c7dbd36c9d751e354", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458456, "uuid": "da5a7ecc-9502-4823-963a-155309eff559", "value": "T139F733F11AB299EDE644E47AE5119979970D4BC353E9F070201FA0D0B4A1C3C7B6AF3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458456, "uuid": "97985b93-9061-47f0-b9fa-b2789b7ef909", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458456, "uuid": "0f82a8af-f0c9-45d1-a35d-7e0f5ed11b29", "value": "1572864:0UUejOYfBwFOXoNcKLJZv914fHmj4kuXdrrwN5IvQfP7:0UU4oPNcKL374fHU4pXdvwN6vy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458456, "uuid": "0fd22e63-814f-4ad4-9972-ae690776c64c", "value": 76585422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458456, "uuid": "801420f6-39be-4320-84d6-efe9d2719e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458456, "uuid": "7eeb2e3e-4957-4343-8d1d-55a3a6f7c8bf", "value": "VOID-DAY-6F4FCBD0639E-Installer-Wizard-1.4.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf27d71-1616-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772441965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441965, "uuid": "266bd75e-88ce-46ed-9a00-afc6a6ab703e", "comment": "Malware payload (XWorm)", "value": "560b991ff65018baf089c3970da1048c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441965, "uuid": "580a8ff1-df02-4721-9a80-e3c1a8ed50cb", "comment": "Malware payload (XWorm)", "value": "72bad4a8cb4d33f841be01cace44a17978b34609830012d08bfe904cec8ae0b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441965, "uuid": "13221b34-c5df-41eb-8a3c-856fc83ed5d9", "comment": "Malware payload (XWorm)", "value": "4ead7150289e102b970787629c8b66c459891c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441965, "uuid": "7f20a1a2-0726-4d35-97e5-731f7e2538b4", "comment": "Malware payload (XWorm)", "value": "cf0002269ddc65abb9646c2127e45ced9143723fa131ef4c4ecfd02c5edd1b5c25ffe309b42f5b06b28dd1353b071885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441965, "uuid": "a95ccc10-36f3-4415-8968-79ba65793fc8", "value": "T127E39D01B1D1A475E972197A89F8DDE98A3CF9700B015EEFF7C805AA4F304D0A935D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441965, "uuid": "4f7c5c3c-37f2-4fb1-87cf-521b3cd7bd66", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441965, "uuid": "09c0ae98-5fc8-4da0-b32d-50734dc92522", "value": "3072:+3AlCua6Ty3XctCkh3jBzBueU9audXzWcXaw3aRHZvOQXw4Rnk8jPd:blHWct/jKdXf3aRHZvOWRnkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772441965, "uuid": "49b50f24-e614-4b64-8bcb-a1e6944eb13f", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772441965, "uuid": "82aa5405-12a2-449d-9fac-4d67274fcc0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441965, "uuid": "6b690eac-1ba5-465d-86b5-a06f25bf99a9", "value": "560b991ff65018baf089c3970da1048c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed16eb0d-162e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772452622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452622, "uuid": "9b314ac7-cc83-49a1-bc1d-638a5293c27c", "comment": "Malware payload", "value": "0094f0f148181d723b887233a083bbd7", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452622, "uuid": "a41ef1f2-c511-4074-9cdf-0b43f4a9cee0", "comment": "Malware payload", "value": "735e92a4804faf370fb0cba4cb7eec278f2263bb2bafb1e9edb0cb95033aa5b2", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452622, "uuid": "708c667a-22b0-4fc2-9b03-a560134ad277", "comment": "Malware payload", "value": "ac6c59dbb4910cfd459334d6b654699c6bbf791e", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452622, "uuid": "cf70f256-391b-49f0-b472-66cdb6057230", "comment": "Malware payload", "value": "defd7274f8b613a0904362aa5184b70e2cc71bb772823ba96e6bc1d2747a7abfa1f6698bd448a759c2465f83bc7cc9df", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452622, "uuid": "c0080ad3-9f54-4582-a65f-b7a6c7374649", "value": "T1B76533EFB44984159F3A0FF322895A42C57D8EE4D507A5BFE1DBA9365109FC90183B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452622, "uuid": "9ae9c3e3-7887-43ba-9391-cf24d6124f1b", "value": "24576:5KqJrOg9oEvbo1uEmXGsISwQeloeC3MudqLforGNOLuEMB335tu8/LMjg8N3kuq8:5KqJqEvc1uEm8SGyyQq35335s8/LEVNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452622, "uuid": "16cfd178-b617-4d79-a6df-d2fec58b8123", "value": 1539591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452622, "uuid": "0cb5341d-0f12-468a-ba8e-39a8d5795f8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452622, "uuid": "c6a31dc3-ed23-44d3-b57a-671db5313dfc", "value": "3f4c3c16f63fb90d1fd64b031d8a9803035f3cb18332e198850896881fb42fe5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedeb68f-160b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772437539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437539, "uuid": "f4143d9e-d9f3-47cf-b141-3f93fbb40d41", "comment": "Malware payload (Mirai)", "value": "032b7dc386bb7340000b8c8d3c693618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437539, "uuid": "4c99599c-11fc-452a-9d4b-c3f4ad51b727", "comment": "Malware payload (Mirai)", "value": "739601d50512c0ab46351aa3c8f63c17b2e938c942d22e27e135c59fdb457209", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437539, "uuid": "be1354c5-f340-432e-a8df-db1fb7340a07", "comment": "Malware payload (Mirai)", "value": "9f5ff5f58ab22bf438911eed6b0fad57e5fefa38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437539, "uuid": "522e39d0-2a70-4292-a00b-0456a3afefc2", "comment": "Malware payload (Mirai)", "value": "3f33b432383bee336032fa7cac8670e347183d4dc24bfe91b9b8225b0d36be434c2c04de9f715263fec81081714390dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437539, "uuid": "b423bd93-b77e-49f6-a496-398bc68208b1", "value": "T13A834B85FB43F4F0D94A0AB0016FE73AB6319D325124DE7BDB94BD67ED61A02D09622C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437539, "uuid": "a78c2a98-a62f-467c-9f07-9d4c31142259", "value": "1536:11+9DfUf4i3OkSElGjxSa1YMobtEUW31k33zC8n3c4wbZn1r:G7Uwk9UjIK26WzCe5wbZnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772437539, "uuid": "9c5f3fb0-cc7e-41f6-b425-775478f8e6ce", "value": 86668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772437539, "uuid": "ec1ff981-0c87-4097-8ebe-d99c49641af2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437539, "uuid": "e7ee7432-307f-4418-a54f-3e0619ccb998", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e86b9ae-161d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772445162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445162, "uuid": "acab2ed4-8f68-4ac0-8f15-fa6b482d7ae5", "comment": "Malware payload (Mirai)", "value": "163a4a8585f7ce397babbcdd1a7822a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445162, "uuid": "f28d0fc1-4452-4a6a-925a-3a8f01ea8ca0", "comment": "Malware payload (Mirai)", "value": "73cbf8597fe47ba3e3e228577ad296266c4b684b81f7786f4785227b4fd8ae5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445162, "uuid": "fe746753-4000-4c75-9eaa-7cc54c6b456d", "comment": "Malware payload (Mirai)", "value": "b94227e5e923d33e1a4fd1e23eea41426d85ab9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445162, "uuid": "00f46f9f-24a8-48d6-a269-6c8e6262c37d", "comment": "Malware payload (Mirai)", "value": "80bcde6fc897d0e0de8ac422915f71f35223ee95acd3b5a0807c4dddf21003a66363f09d8062bd7021660a20f150d998", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445162, "uuid": "e6dfe08f-fc41-4918-8807-113335a6bf3d", "value": "T118934A41FD825A12C6C523B7FB6E028D371613E8D2EE7213DE116F21B7CA91B0EA7552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445162, "uuid": "e05d8e5b-6a85-4035-a5ae-ef1745ae718b", "value": "1536:it58nJvvhhvx6frLKFc7igd71GHtCoP5AmIhja75LeSIQynoQnmvOmwbZne:it58JXhhLJgB1ytCoeRja0no1XwbZne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445162, "uuid": "fc25bd89-febd-4fb5-bf8a-ef961dd5c96d", "value": 91984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445162, "uuid": "64862353-8e63-4bff-a657-141799523621", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445162, "uuid": "946c8177-03f5-4428-bc16-b557882a401c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eab8d0d-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433969, "uuid": "14b4c7a3-6d06-459a-bb3c-3fe41ba6a962", "comment": "Malware payload (SocGholish)", "value": "b6af34aac389eac7cf8ef38a4eb952ca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433969, "uuid": "a9d987b4-e109-40ad-b0ad-62d47a7f64d4", "comment": "Malware payload (SocGholish)", "value": "74967e1466662a2b521048cd6d78f5d0c9fe23cdf0690a228942d3c077eb9303", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433969, "uuid": "494457d4-bd80-4f25-89cd-d18c4ffc8c3c", "comment": "Malware payload (SocGholish)", "value": "d8198341e7ed0962ac6f2e6ef9dc3a3c6c3babd1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433969, "uuid": "29f1152b-d7c3-441d-9e66-bd97185d1e6c", "comment": "Malware payload (SocGholish)", "value": "3235d5176725de93ea787ce5e3ff55558e2a59cc0b569abb72f13587a32bb4bee612cd92bd48d122b27e2303e155ecaa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433969, "uuid": "c6bf8bae-6307-49f0-9001-651c72666e51", "value": "T1A5D097A73A0811681BE727362273E70F3001A20818280819C80BC92070249B7A81E2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433969, "uuid": "30c980bf-5510-48e2-b7fe-e6d817cb3143", "value": "6:S8KGgO9lRnvRWL/tNAWNjsl6pdPu8X2RAF1aLsyV8f:KOVvRWztNAWBsl63uG2RA7aLsyVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433969, "uuid": "268e7a4d-11bb-48ab-8317-e0feab3fd1c2", "value": 239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433969, "uuid": "b92f4eb4-814d-44e0-a400-f5edaa57e9e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433969, "uuid": "cc0987ca-9cda-46ca-83b7-60ec0bbe488d", "value": "74967e1466662a2b521048cd6d78f5d0c9fe23cdf0690a228942d3c077eb9303.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcb206d-1630-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772453399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772453399, "uuid": "d815a65e-fd46-467e-9e86-e3461f33be0e", "comment": "Malware payload", "value": "e2bcc41ddea5cf9d759380701d14f258", "object_relation": "md5", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772453399, "uuid": "b979a9b1-96cd-42c5-a037-b6780d06d023", "comment": "Malware payload", "value": "74db1f653da6de134bdc526412a517a30b6856de9c3e5d0c742cb5fe9959ad0d", "object_relation": "sha256", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772453399, "uuid": "e81fc19f-5fbf-4a2a-8873-2d0c153af867", "comment": "Malware payload", "value": "a42b4914b0c8dc47a3a5f8114d0fcbef02d84e0a", "object_relation": "sha1", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772453399, "uuid": "d0b2d2d6-f4ed-47f3-808a-967285de430d", "comment": "Malware payload", "value": "db3d80ca23ebd80164faeac8148a67884881e0cc0675a6f6ab5f4725af57682727ad1e3ea14c7c8b2ee711f5ef8a9ef2", "object_relation": "sha3-384", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772453399, "uuid": "98880e7e-7496-4313-ba6e-b190a6c6c2f2", "value": "T1441833A97C381CAFD0A04D7566D798D4E9FBB5926C11026F8F76B897048D340FA0A6F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772453399, "uuid": "b8a21f7d-7544-4828-aa32-c25e2a533c59", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772453399, "uuid": "e06e1071-742e-4a6f-b0b0-3fffa2ca0ee0", "value": "1572864:+IKIeltfvHDKox83cPm8Jyvd0eLGxH9pZbgjiQYp7Mrs/whah9NwExmbP0Hy:+IKIe7HjXO8Mvd0eLG59pGj+Eof2Exof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772453399, "uuid": "1b3f6881-495d-4bdf-af0a-bdc96ce2dd64", "value": 86805232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772453399, "uuid": "6370f636-dea1-4312-82cb-1f78b8061db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772453399, "uuid": "b8957bb2-dca7-465c-a6e7-6b843cd47f19", "value": "74db1f653da6de134bdc526412a517a30b6856de9c3e5d0c742cb5fe9959ad0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cda9ce1-15d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772412061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412061, "uuid": "bc396add-5fee-4564-888e-015eb2bef606", "comment": "Malware payload", "value": "9580d32ae20bda3a4087b8099e10735a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412061, "uuid": "b83c004c-4ba4-4a4f-88ee-e76b78ac8a2d", "comment": "Malware payload", "value": "76809dc179d305def836b115d84ba77c9f44520b270975438160d46e8b2bd35a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412061, "uuid": "9392a2e5-0ae7-4cfa-9d86-48d5842d9a06", "comment": "Malware payload", "value": "5b24848d4e381aa141f4154cdf338a3d4793d4c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772412061, "uuid": "8d7832cb-679b-4391-aec7-4607f94fd4f4", "comment": "Malware payload", "value": "4235705b149b641067b9fca9f578563c3eb6a14b500a496beec4699fa1231a40411d0726f608ecfafae9410d585c74ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412061, "uuid": "7c601e23-7dba-4ef9-a57d-8e8ebab88000", "value": "T165E21B3CD2C1FCD0C75F22F1B86EEBD5019ECF1369662B2AF5D9585A0E20264AE7548C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412061, "uuid": "69708186-31b6-4541-94b8-bac4f6842e38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412061, "uuid": "5cec3c0c-e7a3-4de8-a270-764bb842a41e", "value": "768:thxbKyNTi0WFzYwN2+wJZ/MZew/ig4Rob:Bb5Ti0WFfN2+w1w/Z4Rob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772412061, "uuid": "bd375e74-493d-4b7b-8675-96ab7166a632", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772412061, "uuid": "a6ede995-3dc6-4738-8301-75f63c684ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772412061, "uuid": "244aa212-0f21-4adb-8bc7-e67548ad844d", "value": "SecuriteInfo.com.Trojan.MulDrop36.5041.16933.5686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b08dcb-161d-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772445120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445120, "uuid": "1bfdc6fa-3a30-4e99-a764-7ca5ef405f77", "comment": "Malware payload (CryptOne)", "value": "7239babec4ed4f88af101430b8916684", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445120, "uuid": "f394ab85-4e99-45c1-8beb-d9db2efc2824", "comment": "Malware payload (CryptOne)", "value": "77a39034f2d5a2f577f32423f9c7f06db1b959354afe0a0f1cba4e8289431f3e", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445120, "uuid": "f88501b0-d8b6-48db-b7ab-09f901c94924", "comment": "Malware payload (CryptOne)", "value": "d7257dc000e74fbd573f2f453a68adb4b8726a17", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445120, "uuid": "cc431453-1b30-40f8-9e88-ab08cc2dec56", "comment": "Malware payload (CryptOne)", "value": "30e3b06735a589173957960c98d800613d03f1d29570166cc9ce2d0b28a1792b814583c7b135ababd3d9067cf719de9a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445120, "uuid": "36381fdd-52dc-4ae5-9ddc-b0d00c6e3999", "value": "T15C56F1EA20E2F07BD2F2357EBE0A61D6DD267B516A4C04CC78F147C053A9E9EDD04662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445120, "uuid": "b1b1e973-cbe9-4e35-81b6-f1281d4be1fd", "value": "f1f576d3ef3824aade0a784c627eef2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445120, "uuid": "fa95db86-fa60-4d48-8ee8-8df4df77e2ff", "value": "98304:Hwxq+LP3HpHClMaeJIA1H3N22O8OX6RpMIqLgD:HwxbXNCl0IAF3NJO80T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445120, "uuid": "eaa83b0b-6c60-4fa7-9a1f-7228ec706b10", "value": 6244352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445120, "uuid": "82ebeae5-f84b-40ab-a4bc-cd597ef947ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445120, "uuid": "bcc2dda0-0f2f-4667-8637-b25e7dd32b67", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38ccad0-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772434057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434057, "uuid": "bb7a9b3c-62e2-481f-96c5-3afb7d035047", "comment": "Malware payload (SocGholish)", "value": "f3ee929efd197e62d04cba85efd8fcb5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434057, "uuid": "9ce703f6-1482-4b00-ae26-b3bad5a8e1b6", "comment": "Malware payload (SocGholish)", "value": "77ba87f9af5738061a9e5b8b8ad3119c2896188928283112dfd0d1882a6a347d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434057, "uuid": "61bda863-c162-444a-b2fb-c852bfec7f2a", "comment": "Malware payload (SocGholish)", "value": "f2c14cf6b19c7294d496827c1bd5f1e8bb5a1246", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434057, "uuid": "0d6d2327-cf66-4598-b892-c416e1557598", "comment": "Malware payload (SocGholish)", "value": "967e316aed19a8c3e214014d816e6c23b05f3b1985d5957b143391b01a33c4fe79c26381bf6ae0bd2d93ed90b901ef5b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434057, "uuid": "dfbd4342-8a5d-42f0-8984-12b4b0c05767", "value": "T11DD0954E9448153C166A08D42EB7CD0D7057351C5523382CC9AF44040150F91042A12E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434057, "uuid": "dd6c50e8-b0ba-419b-8e95-142ce68e8728", "value": "6:q7XnAgO9lBqRWbvcW9eZwGvGIdnvYk3wpa66AQQZIiJ:I340RWTcW9owGvfL6a661Q/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772434057, "uuid": "40d032c2-97d0-4418-8c97-366232fff1bf", "value": 248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772434057, "uuid": "cae4b982-0a62-4d0e-9cdb-2f88a9b2d7f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434057, "uuid": "d28b3e3d-b24b-4503-9aeb-30d9731b205b", "value": "77ba87f9af5738061a9e5b8b8ad3119c2896188928283112dfd0d1882a6a347d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d119c44f-1614-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772441408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441408, "uuid": "5761d257-f1b5-4bde-9ee9-99700927a775", "comment": "Malware payload (LummaStealer)", "value": "5919823ea3df532a762387bc9b45adab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441408, "uuid": "0d526343-2d9a-424b-97fa-449e7e529c46", "comment": "Malware payload (LummaStealer)", "value": "77e0358291d20c70762cc755eec4ceaff7e3ea8ef8fa088da37fc1f6180d74c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441408, "uuid": "a97aff5f-0179-4c35-b6bf-2eb63e4dab27", "comment": "Malware payload (LummaStealer)", "value": "7942e61b25ad4913a5f62f8b346475c7530bf361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441408, "uuid": "47ce4337-c4ef-4af3-b511-b80d6d8a424a", "comment": "Malware payload (LummaStealer)", "value": "bec445915e25534159e5ef3bee152a70e44e0d825b8c355017fe66791e3d714bb0ec556a015f2c38d14686223753ce8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441408, "uuid": "575edc07-4ef2-400f-ad39-0c33dbf0d93f", "value": "T1F5656B2BB264613DC86E47FD5773822057FF6A29EC174C5AE3F8458ECF2A4601E2A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441408, "uuid": "4c5d874e-ba6a-4605-aa9d-a713c1128125", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441408, "uuid": "99ba866e-cf96-41c3-9143-049467454cf4", "value": "24576:E7FUDowAyrTVE3U5Ei991RB1enmebioq/c7hn:EBuZrEUz991R6ntio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772441408, "uuid": "9279005d-a52b-4b9c-87d3-1c97ded425c3", "value": 1520128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772441408, "uuid": "48a6c34b-0f5f-41ea-9e37-ed943604cc68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441408, "uuid": "5296bcf8-e09c-42a7-8d6d-b3b5246f1c00", "value": "5919823EA3DF532A762387BC9B45ADAB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06aeedfe-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452665, "uuid": "b1865c48-3e4b-42b9-abe7-104854ae256c", "comment": "Malware payload (Mirai)", "value": "14fd2ec6cfbec19b495f5d5bacc458ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452665, "uuid": "c3868279-41a0-4dee-b076-9b049e5aa5d6", "comment": "Malware payload (Mirai)", "value": "782a54aa98a544d6559e75f038eae99b22d97e8175c53caf32d1863039a9fd6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452665, "uuid": "e46d62be-d7f4-4ec7-9a4d-2a3a6e69e95c", "comment": "Malware payload (Mirai)", "value": "7913f3ee941a5286ac4530574503a5d878fcc608", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452665, "uuid": "177bb34e-eaf4-4e1e-8da3-4d2c22b98817", "comment": "Malware payload (Mirai)", "value": "0a9ca66406de42a46cd7c5872437627e718ae7bb357f12eb02e105ece6c0783ed2abc4e3cb7e6970b736eb24f7c6c694", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452665, "uuid": "9329662a-0b15-4783-b6f0-06f64d6be660", "value": "T138733AC9B5C3F8F4EC040A392177EF319E77E13BA129DD8BE7D96623A941342941229D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452665, "uuid": "6fec56e1-0bb7-41d4-9471-28193484019c", "value": "1536:9QC/3umbutmUl9i1WIo27ozS9Lo/b2+gJymeMlitPWmM18HR5D4WRouZbqeqVr5j:9Qu3umbutmUl9lIlkeJoT2hJymeMlite", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452665, "uuid": "f5ea612a-27c1-4fba-8cea-ef95879d3f99", "value": 79600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452665, "uuid": "1b4062d8-32aa-474b-a0b8-9dbfa2c790cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452665, "uuid": "d97b1879-32a8-43c4-b06e-01ef103b9645", "value": "MMaaRRiiOisecTanee.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4953baa2-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433879, "uuid": "3d46ed5d-5ff1-4641-a8ea-3bbb51e8b5f3", "comment": "Malware payload (SocGholish)", "value": "677492a4c4e0c6457a7cc207f67c575b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433879, "uuid": "78d202e5-bfc7-4142-bdf6-c7a86c279169", "comment": "Malware payload (SocGholish)", "value": "789d560be25de17f684efd46f81cefe7189085104952e64132187fc3bfdd6187", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433879, "uuid": "b9a5c1ca-0262-48ae-a24c-7d56ed3622dd", "comment": "Malware payload (SocGholish)", "value": "0b6fbedccb853f69068a7b16f30650451a2b2644", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433879, "uuid": "2c7c9953-7615-423f-8c93-ee2b8842f8d5", "comment": "Malware payload (SocGholish)", "value": "b5fbbe5a75125f16879f5b7f88b66df6810cdbecf30c612dc74eb7053820be9848b0d40cef3c624721694638e7cbf43d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433879, "uuid": "2667084a-e065-4a61-8754-b90996a5bdd1", "value": "T103D09787308A081C39FA113983B3A3083552230C202486F6CCEAC93D0320BFB14572AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433879, "uuid": "d064f3a9-1065-4f06-81ea-4b1fe3b4b2d4", "value": "6:SgSSAgO9lZYkCoRWn9YMHMv6pdvrRfAJOIDdcg4YAso6AmBJn:aS4ZYkCoRW9lMv6Yurs9AmBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433879, "uuid": "ec91907a-2610-414d-85da-899a0f7bc8d3", "value": 244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433879, "uuid": "dcfc6fef-ec3b-451e-9747-f17d09b44c19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433879, "uuid": "e8d590d4-4821-4944-925e-b0da58e6eea2", "value": "789d560be25de17f684efd46f81cefe7189085104952e64132187fc3bfdd6187.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04372f4-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475820, "uuid": "f2adfb90-1e91-41a3-bbde-5cfac551aaa3", "comment": "Malware payload (Mirai)", "value": "9d312438fc2519be3a77b865f881ac00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475820, "uuid": "60939cb3-5ae2-48dd-8044-ae858fb84412", "comment": "Malware payload (Mirai)", "value": "78b248d5d81b00b7e3e9d9df173f106a81d6a6bd0f7a84694d37fd42329c3d98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475820, "uuid": "f63a0bb7-e522-4822-aaa3-9a8bdc40d2cf", "comment": "Malware payload (Mirai)", "value": "378a6da7a1ec20a10fa4b3e42978935215cbee66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475820, "uuid": "e220fc27-9d92-4098-84f4-30f8083992cb", "comment": "Malware payload (Mirai)", "value": "56af3f4ce79c062545c29b80c07436aac5377142674acd69a238069d5855bb6192927efec316a257231cff9bfb9f2d46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475820, "uuid": "278b2a3a-b2dc-4c1f-8f83-314172487eb6", "value": "T1ED13F2D7A3A7F474D8B7E0B2641F96A0EF70706F4E41572D04A6927E6CAA1C83752AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475820, "uuid": "e4ecb013-248b-46a6-90a9-3a6475c95884", "value": "768:ISq8ZtA8oC0ncTxSv6lAZWYY8PSpoKb13Stt8GMQ+u6gRzHpFRx09g:g8ZKRCMcTo6lApYUgCXDMS6gDcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475820, "uuid": "edc7b290-129c-4027-a384-e8be71d5848d", "value": 41880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475820, "uuid": "ff2b2962-f6af-48eb-a7b9-1ff6d6cafab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475820, "uuid": "849188aa-9e1b-41aa-9475-2274f35d2088", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f598afa1-1672-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772481842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481842, "uuid": "129f110d-ec64-472e-bef2-ed9166bb43bc", "comment": "Malware payload", "value": "d5ddf40ba2506c57d3087d032d733e08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481842, "uuid": "e1c6953d-9fc9-40ab-8d0c-4314cbff59c9", "comment": "Malware payload", "value": "797325b3c8a9356dcace75d93cb5cfb7847d2049c66772d4cc2cee821618cb96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481842, "uuid": "9e670b8a-58e1-4bfd-a7ee-dd02f66d930d", "comment": "Malware payload", "value": "682c043443cb81b6c2fde8c5df43333f5d1fec53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481842, "uuid": "b777b6c4-78eb-47eb-b3de-757555f4c866", "comment": "Malware payload", "value": "bccc90ecf863327426aa48b453136cc297eb2d7c89d7819763f44f98f2090576c97a9dc27c005b4eb2c4cce33e5e514a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481842, "uuid": "425fca41-ba00-4fff-8acb-7f8f9e970373", "value": "T1ABB49E0437ED4B57E1EF5B75D0B2A592C3B1B422693EEB8F6D4024EE2817394C911BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481842, "uuid": "245163ec-2be6-4376-b4d0-47f187d9d7db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481842, "uuid": "9fd1fa5c-6f3e-4422-b90d-a9ca3ee73ffc", "value": "6144:fg2uCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/W:fgEQL32ikCaUS4csRBse6sfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772481842, "uuid": "810e210e-fdce-42d4-a480-c7f85fcad574", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772481842, "uuid": "d0141492-681a-45b3-8f1a-310412f93ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481842, "uuid": "6526ee3a-4ce3-4a50-a54e-940edc2e949b", "value": "lecGen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10151fe-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444764, "uuid": "14d09738-86d8-46ca-a7b2-6ff26c28a6fd", "comment": "Malware payload (SantaStealer)", "value": "554a7526bb27643fafeb412fa6634a2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444764, "uuid": "db1f4326-f48f-4af7-86bd-6444853dfd24", "comment": "Malware payload (SantaStealer)", "value": "7a3569860de12b6f75de9b2b17df1030e68a9c41e2e95c4d6b3feb66761bf3d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444764, "uuid": "54f713bf-77eb-426a-8cb4-8ff7e72e439e", "comment": "Malware payload (SantaStealer)", "value": "a5b93972708bbd6e2f9fdfe7a70b3b4b549c1f0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444764, "uuid": "4a10ae20-d1b0-4623-9994-317b0afe53a9", "comment": "Malware payload (SantaStealer)", "value": "fce06c3b921ab90fa022e862e96f7052349e50764458c9f5049dbc832cad534ec4b551af31a62c6ce4443a9afe2d3d98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444764, "uuid": "33919712-312e-43a2-a156-f73189afafca", "value": "T1B6C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444764, "uuid": "a4ae9a89-440f-4b27-aeb0-da0f8924d878", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444764, "uuid": "c8f8f7bb-a789-4d95-a831-dbcee691d79c", "value": "49152:navY1Sn5eVNoBWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCCsdG2:+Y1aJUevc+9sdBg4x4DPPnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444764, "uuid": "2b3d2d1d-9345-4688-85d0-6d99d1673332", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444764, "uuid": "0fa9cf8e-722e-41eb-ac56-aae6058a31e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444764, "uuid": "8f6e43b6-4765-4d65-90bb-3f1ab30a9bbb", "value": "20260302_043438_20260302_073437_6831C3YYXI68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9649e454-1648-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772463644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463644, "uuid": "1365bc6b-00f2-4783-9066-c6c7c034f65a", "comment": "Malware payload (Mirai)", "value": "b788670b1a3111d69a8b95dcc44a48b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463644, "uuid": "98bd3e03-ebba-4372-a1f0-dd64dcea4e01", "comment": "Malware payload (Mirai)", "value": "7a362ac503cebfd6be07a8473e56931e6c70b7b6773345c85a669cc0be050e45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463644, "uuid": "951375fc-ab44-4c38-b34e-e9a0a0770732", "comment": "Malware payload (Mirai)", "value": "2c851098c2b4b00d2750cb0579985f2c508ec398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772463644, "uuid": "3871f4c4-8b4b-45bb-84fa-2172c2aa3975", "comment": "Malware payload (Mirai)", "value": "079827aff2707450cadcecfef35988d751f11c5c426bf5bcffc291899eeebfa801f754c3696976f538f99c69c4f287dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772463644, "uuid": "1bb4eb3e-e177-4e25-89d2-5446b28c703f", "value": "T10C933B85F783E4F0D94A0AB0115FF73A7631DD322124DD7ADBD4BE63EC22A029456A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772463644, "uuid": "61f973e1-0726-4cf3-a0d5-7881cd677a1c", "value": "1536:mKU21lf+ATENHQUlfp8UgbSHUOUO31krKo7UurpiHW9n/wbZnzr:Pr1ZfgjlR8U+wyrYyphh/wbZn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772463644, "uuid": "d4ce2304-6775-49b5-b88b-10ee7e465fd4", "value": 91640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772463644, "uuid": "57e10cec-b203-48ed-9b3c-e5de0631f7a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772463644, "uuid": "0db0d9ad-62c4-4aea-a5c0-6d01becaa5fd", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2f1cfa-1666-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772476615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476615, "uuid": "322cafea-c65f-4871-bbad-3f90cc5bdb7d", "comment": "Malware payload", "value": "f3b9177572e58b9e9728051bc720d14d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476615, "uuid": "10f892e7-5ec9-4ce5-8645-475f71acc3c6", "comment": "Malware payload", "value": "7aa0283f48d2dbd405611cb22567d9f168b781824e09533c92902099938d4f2b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476615, "uuid": "2872c3c6-2950-4a3d-9359-8c5316abfdb1", "comment": "Malware payload", "value": "ab4506d13075eae1be429b99886f0dc6abf82bfd", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476615, "uuid": "cfa6c256-ddcd-4e75-825b-c3b3d21d7856", "comment": "Malware payload", "value": "e20b41c4eb4538375c78e3db5b7a660192bfa8ff93abe05b123eb474ef86aa22ac508fefadaef0d749afc6848fe51884", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476615, "uuid": "7e24faf1-0287-499f-b322-76cbdbcb4a0c", "value": "T139052311FDE21E2BCA7F183149E99A82612DFC479EA2E71F2644335B0E7D7A5548330E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476615, "uuid": "5af39499-ab2b-4929-a1d5-7ac4bd845189", "value": "24576:poTj9l6Wtze+czPwTmhsUC/bUniYQET/wArpO:qTj91tze++Pqmt+miTET/Br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476615, "uuid": "2966c868-0c02-414f-b13f-d78b678f94ec", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476615, "uuid": "b2e2d2cb-c0f3-48ff-8a9b-5d52ef2182b5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476615, "uuid": "21088b35-443e-4378-beb8-b7088c43c2b8", "value": "SecuriteInfo.com.X97M.DownLoader.2343.14813.22977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515d7728-164d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772465675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465675, "uuid": "79838172-19f7-4b75-8959-2cc0e6a7f30b", "comment": "Malware payload (Mirai)", "value": "c261bfd2ddf4fbf40797478fc1064898", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465675, "uuid": "7fdb4b9a-1454-4d85-b0ca-42f2b6b6f80d", "comment": "Malware payload (Mirai)", "value": "7aa3e5a9334845fd124ad7f2d89bcf8538c78a24a19f526ad1fe18e0027e1ef8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465675, "uuid": "4d2b3a27-66fa-4ed7-880e-3cdbd0e1e1c4", "comment": "Malware payload (Mirai)", "value": "d13a829dfca030c2e4e7c75ee012fc26c49fed5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465675, "uuid": "3c45458b-3a15-4f8a-affa-0575b9e4032b", "comment": "Malware payload (Mirai)", "value": "92ebebcd6fcfffbeedf6b9b23321d7418da18ac3ec61bb2a156511e6faa500c8d5e335779e98485c35e72c3a2a87e5c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465675, "uuid": "a3bd9ec5-6081-4d4c-b979-fafe19d1d443", "value": "T175738D73C92A6D80D4484276B9B48F3977A3B840C6571FB64A96C97AC087EDCF1053F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465675, "uuid": "9049e393-504e-4ddf-b17c-7529552f4097", "value": "1536:ia3/9Vys4aNhWoDEmuRDIYFvEBKmJ4VPpJ0CYmG+9IAwbZne:iqlUK0oDEFfvEImapJ0WTpwbZne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465675, "uuid": "7b351bc0-51aa-4abd-8609-47d814e47722", "value": 79628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465675, "uuid": "9ba4b9fa-0ef9-49e4-a952-0f1c300178ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465675, "uuid": "8ee63945-43bf-4a0c-889c-b30e989a1c75", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15af5b2d-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476313, "uuid": "9dbd6060-2cf6-4c0f-8b1b-2362937ad2ca", "comment": "Malware payload (Mirai)", "value": "f48809a3cbca5fbb362d97617e3967e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476313, "uuid": "c79116bf-d0d7-4840-b527-bc9e45574921", "comment": "Malware payload (Mirai)", "value": "7aba71a2a0246c795162f83f4f059cb7fbfe5e6b78f321801848cba4c00a98d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476313, "uuid": "ffdb0068-dabe-40be-87b8-0b9335bea804", "comment": "Malware payload (Mirai)", "value": "aba9ec71e2e12cf801fad4ee8331001438df8493", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476313, "uuid": "25a91b52-f45e-4578-a0d5-341cf2cb3f10", "comment": "Malware payload (Mirai)", "value": "77aeb682005d6f4d786630d3e7a768b91df306fca934c4eeec0b425a6abf0d55b9992181636133f439874e3652cb85a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476313, "uuid": "e02e6c16-db21-4294-99a7-b11951777318", "value": "T1E3732A47F952CF12C1C31176BB9E9A493B136BFCE3DE72129930AFA027834D70966916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476313, "uuid": "841946ef-1745-40cb-a212-bc1881c3d47c", "value": "1536:zwn6N6CONSYKMs3izO2mnc3mwZvPrap2yF5XYFoG:/N6COYJ2mnc2wdDaUyFpuoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476313, "uuid": "d683d1a7-c44d-4b87-9356-b7dee30b1a43", "value": 78404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476313, "uuid": "89537292-b82f-4e01-962b-e6135fa17986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476313, "uuid": "08700149-9963-4f91-bcef-56c26a6e7dc4", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9fcf16-161f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772445988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445988, "uuid": "14d22696-7da5-4a2d-a1a9-390c12fdaed8", "comment": "Malware payload (Mirai)", "value": "0789cacb69c50587f9843d62dcb5a92f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445988, "uuid": "6b4ac783-80dc-431f-b599-bc0c09596b80", "comment": "Malware payload (Mirai)", "value": "7aedf10b004f5334a0536ea90722c88d3442f1f592496461d6022d1c3c0583e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445988, "uuid": "1054cc9b-962d-449e-9a96-a599d35493ef", "comment": "Malware payload (Mirai)", "value": "4f5dfe72ec3ee1b7069cbbf9a9707fb72481bac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445988, "uuid": "f9b0b1f5-98a0-482e-a430-5ba17588f978", "comment": "Malware payload (Mirai)", "value": "2f0331632667d23bfcafd1355b74647854768008687ae2b2a624ae8cc5cbaa87e5c755d714324bbbd3e69f5985e6037e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445988, "uuid": "3b8ef4ab-42ca-4a8f-8209-afbd2b49f762", "value": "T182043B46EA414A13C0D627B6FADF42493323A764D3EB33069914BFB43F8679E0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445988, "uuid": "9bcf347e-205e-4693-b4a8-2819ac488fdc", "value": "3072:TkucezsTrp2ih9Aa2VWdOQ+uoAE0WvS7pYLvKlFiwbZnavXdPvM/95MlCRbn:TkNezsfp2ijAa2VWdL+v70WcpWvKlMwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445988, "uuid": "52fef635-d4c2-461e-b3f1-8afc0288b939", "value": 178336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445988, "uuid": "e85ae191-56b9-4f3f-b4fe-579a7d560c43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445988, "uuid": "9741702e-a7a3-4870-b745-8346cc9bd763", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d84f843-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772465186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465186, "uuid": "9cfb660c-04f8-4dfa-8f93-7fea7129d129", "comment": "Malware payload (SalatStealer)", "value": "76524d0e74cda8ef938a900139f65fbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465186, "uuid": "691086f6-f0ef-404d-b160-97ec9f678d18", "comment": "Malware payload (SalatStealer)", "value": "7b12f1eebcc0f5f4fd2a4ecb0a00269eecb254fd098e6e7569a3dd2980d2df1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465186, "uuid": "1619dad1-6abc-4d31-9f06-c4b217640406", "comment": "Malware payload (SalatStealer)", "value": "76a9bf9b61e0248111dbefa9d3b86ec75842f927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465186, "uuid": "db8c52bc-6e20-439d-b6f3-8cd7f33495fd", "comment": "Malware payload (SalatStealer)", "value": "c7fe3abb08e6edca5b88f883f2f96d35789bade66b8620e688493c2a6f253d645502ca4d21702ed9a05291e7c702122d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465186, "uuid": "2343d780-41f1-4f3f-b309-26e364d26143", "value": "T191C65A01FA8B98F5E9031835416BB23F63355D049B28DBDBFB543FAAFC7B6811926205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465186, "uuid": "22b9e1bb-ab6d-4279-b369-1ae9351c8410", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465186, "uuid": "0c5eb4b3-0bd9-4710-9862-5740ae3be4a0", "value": "49152:DHsMJ55Q36bKKGpw3F+0hN+pYgcSp1iPylE5iJ/nPNFax3BQ9rMEak+SqpmWACDp:z7J55AKSi8J/DaxWhV+DZ6bCkcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465186, "uuid": "7b8e0ca1-4a46-4795-b6b8-f78c035dff46", "value": 11674112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465186, "uuid": "df2277ae-acf6-45af-ab60-09453c963ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465186, "uuid": "557a443f-cb87-41ec-b206-16d0a5f941e1", "value": "antivm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890f5302-1639-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772457179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457179, "uuid": "0290a9a4-7b03-4c40-9a05-bb3c631ffc82", "comment": "Malware payload", "value": "94ec51516e111471fa4dac2e173e6ff2", "object_relation": "md5", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457179, "uuid": "cdaed766-a568-4e11-88f5-85ae79027268", "comment": "Malware payload", "value": "7bf8f264be5e11ef7c646a52c99758f3248f204856111843d3a7e73ead658126", "object_relation": "sha256", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457179, "uuid": "2b185065-4548-4406-a6ff-ef859eeb5ef9", "comment": "Malware payload", "value": "045eb12adbdafed38a338e735397426c20b09787", "object_relation": "sha1", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457179, "uuid": "8c4a05b3-0413-421c-a945-9dc8d395b33e", "comment": "Malware payload", "value": "d73b8913c8fb6ce6d1bdfb6f3d2341d7c2ab495ef7c817ed367ea323d4b9820e7504254ce87e6c7bfe72bf1d3bbcacdb", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457179, "uuid": "4afdd77d-935b-42f7-bc98-eaa4b560c159", "value": "T1BEF095A9C777EC9141893C7C5915264EB3B9991241508D51F4201DF59804B5DED2D378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457179, "uuid": "c4b95e06-2f13-4f35-ba88-e847a3fb0585", "value": "12:IXjjInEp4X6WZZuClkdfKhRzbOEn/De1dv8XG:0WECXH8fc5D/SPkXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457179, "uuid": "1c080a2b-dfc4-4ff6-9dcf-493f91ace2f7", "value": 510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457179, "uuid": "eaaf55ff-a634-4c47-a469-364e6b65541b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457179, "uuid": "14a17bcc-9021-46b1-b625-1f77ce2c3812", "value": "ps2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb8513f-1665-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475866, "uuid": "d2caa671-1805-40a9-b98e-13d48368fde9", "comment": "Malware payload (Mirai)", "value": "621729194b18dc9fc23dc799ffb11de4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475866, "uuid": "9b9469e5-b758-43fe-bfb0-91aa6db50280", "comment": "Malware payload (Mirai)", "value": "7eae73a46861258f605b55b3663ae543fa9ac32055f8dc27eaf7f6c7d695f7c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475866, "uuid": "4d64e622-353e-45c4-afa2-2cbf08f6b65c", "comment": "Malware payload (Mirai)", "value": "bef0ef8818f9a6286401c96296dddb62c534450c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475866, "uuid": "d321882f-59ee-4e86-941a-ea963be79861", "comment": "Malware payload (Mirai)", "value": "b16900765c86d332355adf1f0bf77541e1223503b0c98144a22be3126d154db0ae05e8e4d36dcf83ddac1bbde78d558c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475866, "uuid": "6b799fd0-378e-4816-9e57-651830ee4b8a", "value": "T1DD835A0375C080FCC899C13557AFB636C873F07E1279B15A67D8EE16BD89E502E6AAC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475866, "uuid": "7d38abba-7b0e-46e7-9b28-9565edad29f1", "value": "1536:FBX/VOUj2Fkc/TQg22Ffg8f4u21ZYy3zTeNNzkbx4ETYD3NO:TXhj2R/TQgdxZ21Gy3zQzkbxtk3NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475866, "uuid": "a8d872f9-252b-4956-97b3-798eec141dab", "value": 85760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475866, "uuid": "469c0c2c-feec-4243-aef1-f9d972bd49f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475866, "uuid": "d9432ee2-7346-4e06-b211-5b3929065085", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c4dbe8-1619-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyLoan)", "timestamp": 1772443450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443450, "uuid": "d199f288-d227-4c24-8cbe-44e02883745d", "comment": "Malware payload (SpyLoan)", "value": "91d2b6f18b178de65149006da8585cbd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443450, "uuid": "53e16a35-6023-4cf5-acf8-2f21b9efcddc", "comment": "Malware payload (SpyLoan)", "value": "7ec1cbd8c767a3d87a62fa7da3574da2ba56df753511609bd8d179bc1d2d635e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443450, "uuid": "a232e377-0e60-4e23-9df9-769a6e0e5781", "comment": "Malware payload (SpyLoan)", "value": "1fc3cf1a47a06c5a2eaf848b43585cfdf6168d1e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443450, "uuid": "11b3ed99-7bff-4f14-9ecd-6d5024796ae7", "comment": "Malware payload (SpyLoan)", "value": "ab5ce99672957a4a35362e9c7e3ed91c9d16fda10e63aeaba1017a93273aa665cc1489249cc5502ff7d8f07a76277833", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443450, "uuid": "396ab20e-1b1a-4a9b-8e01-636aa02bfb98", "value": "T102573397FB28883FC5FA12B39D6A113277729E0486926B173984772C2D3365D4F89BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443450, "uuid": "c43fe36b-fa33-4c28-b28b-cc275b91ec98", "value": "786432:FBS1GPzROtfXyvY9Txn8jz7vAMmMyqCG6C6zY81wptWP:FUQUNyA9TxnuwMmMyqCG5JgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443450, "uuid": "47e62a6a-3eb2-47c3-85e2-f938038cdc02", "value": 27984623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443450, "uuid": "90a497e9-9ad3-4fb7-9c49-2be54f4e0dc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443450, "uuid": "9502aced-8707-4bf6-9753-5a287ea91306", "value": "aaseoy_2.2.6_82375752.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b868020f-1649-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772464130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464130, "uuid": "6423cbad-dd65-4a3a-9962-848054fbec55", "comment": "Malware payload (Mirai)", "value": "2c7f0475c6d784153acd19cc709350b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464130, "uuid": "5a54dc3b-ce73-4052-8b67-c62f0a0b1fcb", "comment": "Malware payload (Mirai)", "value": "7ef6565d9cf069a12118a8d4e2e9ed70dec53335b0dd35612cd1586dead9693e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464130, "uuid": "bd6c34b3-e78e-4e39-a755-08ec4e9ab3de", "comment": "Malware payload (Mirai)", "value": "7ab84808ef851755bf6d19e1bbdb4f9eb690702d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464130, "uuid": "fef56b82-3d13-4df4-b1f8-11856d90bf7e", "comment": "Malware payload (Mirai)", "value": "ace669dc42914189ee110a4348856422c82b18f15d8d192c4a55ae89cf5c69b6876c99020aeda74d737d6d7875e16cd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464130, "uuid": "bed1e3c0-002f-4937-ab75-34a403bd549e", "value": "T1B8734BC5AB43D8F4E8560A71127BFB2277B2F53A0038DAA6C7947833DC56A01D6573AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464130, "uuid": "a4ee1229-e039-4b4f-b8e5-ce56a6ca4857", "value": "1536:2Lqx+GBIt+da7hicTrmULk3ENXWMTaRl0Ga3AT288LcBzMDxYCHwbZnL8:F+GBIt+d0hicTiULk3ENXf2IGa3i8YBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772464130, "uuid": "64a9af5b-7128-4958-aae3-a71e1f7e893f", "value": 78928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772464130, "uuid": "b0b049b2-5e1f-4283-9f1f-f38fd1e45ef9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464130, "uuid": "748b093a-0ab9-4c60-877c-ce9482085352", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341ffa17-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487531, "uuid": "f9a8ea83-f5d3-4acb-94e0-7e54d0d8cf2a", "comment": "Malware payload (Mirai)", "value": "71c8c982bb839a7c9453dba9549e9ea5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487531, "uuid": "2c4384a7-c948-4aa8-9b35-ba2450b8550a", "comment": "Malware payload (Mirai)", "value": "800ef7486015d40a4d51309af904ea13d2d971df2af87e276dc6daeab3f823ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487531, "uuid": "f040e774-c111-48e0-9555-d6c6f12c5b5e", "comment": "Malware payload (Mirai)", "value": "b8bb6f421b65fb8d1754201037e7f3cd96ea97b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487531, "uuid": "51aee518-7eab-4304-bddd-982c86924f1a", "comment": "Malware payload (Mirai)", "value": "6f52488fc974827d6052fbb4b6c2c6015f524beb415debd76a2f13a382b29f49634332e78e35bd03991fdcaffd33b839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487531, "uuid": "46f76014-903e-4824-90f4-7fc10f43fca6", "value": "T16B344B45FA418A13C4D117BAF9AF414A3332A795D3DB730699286FB43B837AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487531, "uuid": "e8fa880b-5f41-4d41-b436-7a048438346f", "value": "6144:W8tTPA8yhHaHKacEe1don1d7KvfdfM/9hqWAU:W8RAphHaHKacEuG1Q90/vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487531, "uuid": "8d6fb792-07df-4af1-83dd-94bb555b41f5", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487531, "uuid": "b1040132-55ba-4fef-9dec-ea6209a4c810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487531, "uuid": "54ced9bd-5399-4355-bda9-3a6110949991", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632a4142-168b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772492334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772492334, "uuid": "5fafa736-95c7-4c88-8f7e-71f58a8daa48", "comment": "Malware payload", "value": "9494fbaf4434a98a6c7586401f353d2b", "object_relation": "md5", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772492334, "uuid": "96e3a6c3-6033-4dd0-b51e-7b413fd2083c", "comment": "Malware payload", "value": "80b18e4ea12101e482f9a9b0b880c2364a9f8879b9c0dd07939b841aa946ca24", "object_relation": "sha256", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772492334, "uuid": "11630926-c83e-434d-842b-8400e19ef846", "comment": "Malware payload", "value": "ef618327f09e86b101e7aa38eb99f3ac8a9a1519", "object_relation": "sha1", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772492334, "uuid": "4b78bbef-5e28-4dc4-9c5f-36268e28c8a0", "comment": "Malware payload", "value": "074693ecc1d2921ebe686dfda638794668a9359d4fc9160e4c61c4fcfc9a128099f01c5341a0144addf1073a27cd3002", "object_relation": "sha3-384", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772492334, "uuid": "72be4df1-9fe8-45bf-a9eb-16d3a914be61", "value": "T162D080330B0A40DADBD4063F7574595CD77B9976574D73350C50DD010C09A445F52C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772492334, "uuid": "10580635-cdfb-4f1d-8a98-9e1cb75024a3", "value": "6:BnX//In8/r1uBxHocmTH4Q3RQdygg5XJYD:BvwncrAH3mt532D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772492334, "uuid": "e509dc9f-557c-4758-855c-2608d54840f4", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772492334, "uuid": "ef783b85-86a5-4fbf-90e6-8807cc872ded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772492334, "uuid": "5944d507-6df4-4d5d-81de-24a839be22c8", "value": "reverse.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda689b2-1617-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772442718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442718, "uuid": "2ea713ae-e24d-4ad0-a920-44a97ffe76da", "comment": "Malware payload (Mirai)", "value": "240356ff93e33e956289449fdeef4883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442718, "uuid": "95022d72-e1c3-4dcb-af81-9554b7852d95", "comment": "Malware payload (Mirai)", "value": "8181037f0fb0648e9faecdfde8ba2966a343be10d20aee7a6be3cbb024a293c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442718, "uuid": "87938771-489a-4e22-b29d-908b23a435e4", "comment": "Malware payload (Mirai)", "value": "73bd029cec2e00c9ec72e28ac20a201b0badccba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442718, "uuid": "7498fd3c-8aa6-4f9e-a785-f26a8309de7b", "comment": "Malware payload (Mirai)", "value": "01e2e3a58f75c3e8ab925ce5dfabbccd5d5d8b255e35e80befdaf9a31567fbeefe5ecaa491a4c64144cc7ce456d45d98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442718, "uuid": "007e86cb-d740-4ee6-8613-1a00a4afd5c6", "value": "T1D8365B98FC1DB562D9D87AB43F2541D87235FC49AF4183237614FBAEA9F23548F22260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442718, "uuid": "40af9c1e-8c6e-41dc-a0a8-57144e4db7b0", "value": "49152:Nb8aS3ek1JQLRPbf4rld6dUx/g6RM5ElvkKnqkxPV:NwaS3N1+PbQrlQdUx/gERqg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772442718, "uuid": "212e1114-83c9-4c28-9855-17a2099b7242", "value": 4915352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772442718, "uuid": "96a61726-a6f7-459a-bd2a-3811de8ea67f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442718, "uuid": "810a260b-d5b5-403b-9aa9-522dee61434c", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e01fe0-1649-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772464017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464017, "uuid": "43743d64-68a1-42df-987f-74a1efb8b3dd", "comment": "Malware payload (Mirai)", "value": "1faa331d4abe34acc103251c2c7f7362", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464017, "uuid": "f6323bcd-354f-400e-bb5d-957ac311f433", "comment": "Malware payload (Mirai)", "value": "82a5dabffb0bbcdb4595407acdf543c662570511f1abfc60cf0fd5bb054dbc8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464017, "uuid": "fb9f787b-5f83-4aad-9151-a86ade515185", "comment": "Malware payload (Mirai)", "value": "633a87fcd73c42b082eb09bc78e952d76b3466f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464017, "uuid": "a3ef36cc-4894-4e4a-a890-c6306c3b0bda", "comment": "Malware payload (Mirai)", "value": "799a0b349ee36f5d71b562bd811a8a994981f77368160169bb8436d93ad69a777431708e379484b9fa6d8561c4e45817", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464017, "uuid": "8fd25831-fffc-4ea0-9666-d8e3113bb5fc", "value": "T183F33906B5C1C4FDC4DAC1744FAEE536E932F09C1638B26B37D4AB2E1E4DE205A2DA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464017, "uuid": "d6188654-1baf-41d4-a7e7-b8e6b3e50b0b", "value": "3072:D9K8NpKS5NIRJ2VlXHe2IFH4U8Fpsz7N2rTKcnhP+kOHiiiYAiiiiiii:5K8Npr5NWg//kWn5bO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772464017, "uuid": "d0cccbbc-0a70-4e8e-8106-c00db53fb3ca", "value": 165128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772464017, "uuid": "84919c45-b175-4ec4-8177-e1adcb793749", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464017, "uuid": "018c2fbc-a255-42f8-b283-6b5184ae6039", "value": "csk_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcba9e54-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433697, "uuid": "532a2b55-3e75-4c24-8ef8-40f5590bb69f", "comment": "Malware payload (SocGholish)", "value": "ed1792536195656e48e59cda832fca7f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433697, "uuid": "ca132771-f483-444a-9e6e-9af4ba9ee33f", "comment": "Malware payload (SocGholish)", "value": "83431fb48ce5e14a505bb3c106086967219038526cd14871b5ab7346aa51ce22", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433697, "uuid": "37deb08b-e295-4555-97ff-d9287077dc8b", "comment": "Malware payload (SocGholish)", "value": "de42d8bd63870afdda54543f0c9cc5a6a024d653", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433697, "uuid": "54cfe1b2-3c69-4d2a-83ee-9bd8d71d5a69", "comment": "Malware payload (SocGholish)", "value": "8775c244de5d3a05166dbd268d75fd1fe7996f9c3da3c5f1b5f78f8a5f9ff193292b150bb348f67e13a7ee407d66704a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433697, "uuid": "1e53dbae-eb5e-499b-8fc7-68747093f086", "value": "T19FD097D62C0028546FAE30FA78FFEF1A3023613C2F108835D8B5C4282D18B90285186C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433697, "uuid": "d1cf6046-b189-4cb6-a82f-58135efd4395", "value": "6:qSs3AgO9lmUOjUTxRW4VFcGIdBlJvMWqd0M28n:g34mx49RWacHJvcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433697, "uuid": "c64b9809-bf10-4492-930e-c7355b729952", "value": 252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433697, "uuid": "e5596fc0-f4ec-4b3e-8357-efb9c0d6b1d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433697, "uuid": "f99e5d77-b013-40c1-a3e6-15518ed01354", "value": "83431fb48ce5e14a505bb3c106086967219038526cd14871b5ab7346aa51ce22.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076be77b-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452666, "uuid": "d8552bb8-6916-41a4-8521-547363eef42b", "comment": "Malware payload (Mirai)", "value": "43e326c0e77c4d7784bd342093ab46b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452666, "uuid": "270e422b-d219-4c2a-8790-6da2ed100150", "comment": "Malware payload (Mirai)", "value": "83c2f3782637a2d5661598b8da7622958b46524412b2a3a038a4e9de3b759d6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452666, "uuid": "bb56704e-1708-4e16-aed3-bf2fc83f9364", "comment": "Malware payload (Mirai)", "value": "81a72d638ad67a31dc333be6dc5938f85d01aab6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452666, "uuid": "e9703b1a-7e71-4951-9626-7047fc6e6160", "comment": "Malware payload (Mirai)", "value": "471d2f0f24975c31e0bd3be86ac3a2fd9129897e6994dd6e989dee2f61733c554b32b40aabec3b43bb4eed8688ffa289", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452666, "uuid": "3b982ffa-9419-4be7-b68a-eeef7629e8a6", "value": "T198932A781985F62CEAE65075F44329E6291206083FCDD2E369C344BAFF74B88B52DD1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452666, "uuid": "e68ba099-2f0d-419b-8f6b-64905675f6d4", "value": "1536:v/TRXUWheYdS3OQ8QsFE3SlbBFtUBs2FCDcVBIVCCfy0K9K+5:a2eYdasFHBFosSCWu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452666, "uuid": "f021571e-7f13-4f32-b098-cf5fd44a91d9", "value": 91524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452666, "uuid": "2d789f94-b165-42c9-ad81-897375f2983c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452666, "uuid": "63e95fa0-664c-4956-949d-4ae79fe66b0f", "value": "MMaaRRiiOisecTanee.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a26ebe3-1656-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772469609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469609, "uuid": "a20a05f6-0861-4f39-bc40-f1e69a4b0556", "comment": "Malware payload (Formbook)", "value": "4ef033bc6262a87752a2c4fa9af179d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469609, "uuid": "5265e152-fc74-486f-9889-ce75ed5cfbf4", "comment": "Malware payload (Formbook)", "value": "8406e19b242c41f5556732b329901830c70d46840daa2f499b19aea02bc42f58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469609, "uuid": "523afbc2-115d-4457-b884-c8a5e7195319", "comment": "Malware payload (Formbook)", "value": "73cf80e53a072e9a2aadf20883c5a4e98f92ecb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469609, "uuid": "ef57f087-982a-44d4-9e72-cc62b177fb54", "comment": "Malware payload (Formbook)", "value": "4c312f867635b7b1145779f831a7be204838bc930406d0a484c45c39c3af899284e0794dee7385fa0ed474482d2db3b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469609, "uuid": "25699a27-b6dd-4d51-b77b-621dd24a2ebf", "value": "T11935F12067A6DC06C629423209A5F5788775CE86F015D25ABFED3DDB7B6BF110E82343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469609, "uuid": "f80df3d3-7c71-4eea-be01-a74bc0bcbb7a", "value": "24576:86Ku1TJ4c59sm5DmyuacJ0KRfg/ZIC2H6Ras2nY/ySvnQI5aO:86Z1l4ms4mAqRfg/ZILaRGYjPBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772469609, "uuid": "44fda8e6-c004-4329-b640-3d4d6a665e74", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772469609, "uuid": "66872d5b-cec3-440a-a6ad-5d0f5895cb09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469609, "uuid": "0884f2fb-b692-4ad5-b1eb-b30f3751ab22", "value": "PO978600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084610f8-1620-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772446225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772446225, "uuid": "bf6aca38-c6c9-4e87-9d4f-080b59636119", "comment": "Malware payload", "value": "7f20f162eb9adc38052fe72f11be4b19", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772446225, "uuid": "dad8119d-d6a1-4743-b9df-8af9a2ee5951", "comment": "Malware payload", "value": "844d5de03f5d2b6490b25fa965b6a8cf70b611e73f20697fb1faeebc2794558b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772446225, "uuid": "8edc2df1-55f3-4a2d-8245-0f9291454eb0", "comment": "Malware payload", "value": "db36f179b2dbda9e2b1016d3734d1f47b489573d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772446225, "uuid": "15cedfe6-c09a-4827-8ee7-f3dbedd426b2", "comment": "Malware payload", "value": "6d5693925d27903098a362b9a2ebc3036f55a863280ec5026ffaf41b566f95e4d2e762459450fd32a79b07ac9854d73c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772446225, "uuid": "6f279b45-aff6-4910-816a-d902cb515bd1", "value": "T199636BF40BDE59FB23FCD4327369E03E9520676DADD3AB0925A27D7266C050839B418B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772446225, "uuid": "431f8e43-50c5-4f51-ad3c-b3e20615f510", "value": "1536:ZpXOBExpv88888888888888888888888888888888888888888888+wwwwwwwwwo:Zp6QpSwwwwwwwwwwwwwwwwwwwwwwylle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772446225, "uuid": "a8761ef8-069b-4d5e-843e-75bd0d98f18a", "value": 70352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772446225, "uuid": "18391e17-2838-4441-88e8-c0fd5860fb1d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772446225, "uuid": "76040fea-7ab0-44ff-8305-4db82511beea", "value": "\u041b\u0438\u0441\u0442_1_16_2_1062_02.03.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a028382d-161b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772444333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444333, "uuid": "be1d133b-5dd5-4fe3-995c-efffb888fe1a", "comment": "Malware payload", "value": "07c5859f89c5020eafd0dc7d8a2f551a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444333, "uuid": "3fda1261-9a70-4e93-ab6d-fa627034baba", "comment": "Malware payload", "value": "8544f3c7e08106e01327c86d7625c4fbd0cd97ce3b7d1822a0d6624ed76a086e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444333, "uuid": "234327cd-e2f0-4edd-9388-2ba6203501f0", "comment": "Malware payload", "value": "47afe6be13d293a052ca79b59a1505ad314d2307", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444333, "uuid": "10f1cfcd-0130-411a-80fb-468113d89c6d", "comment": "Malware payload", "value": "9b713427ea2295d3895004b5dac9694fa414a2b70dd55e563b2280e0ff88190aa59bc31863b3761e27a626502fc0b137", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444333, "uuid": "4f92ef50-b749-4760-9247-48ebd93a6801", "value": "T1A0F7232BB70AEF69D3EC2DB5D38458A1054D8C621A116EDB8B07719F35FBBBB4081712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444333, "uuid": "ef48ffea-4b38-49fd-8b3c-2a3b63fdad54", "value": "1572864:3PF9dYuTYnL0BMWRO8qIf6cbDtXu5L2u2aSaZRjmIo/Sf1://dYuM6O8qIfzbVupS2RjmIoqf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444333, "uuid": "d3eef877-7472-4ce6-8a9c-4371acc9045c", "value": 71123121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444333, "uuid": "e5d8d55a-f2c2-4f20-acae-34d467292be2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444333, "uuid": "1fe12657-d702-485c-b136-8f79f3872177", "value": "Phone-A.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291383bf-15f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772425665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772425665, "uuid": "675a2c66-46cf-4750-bf0a-25df3022011e", "comment": "Malware payload", "value": "4ad3e559c20a7d3fdff1a6b0bbfd0cdb", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772425665, "uuid": "f3e968ca-3613-49e1-88cf-49abb393a296", "comment": "Malware payload", "value": "8554ead8d75d4bfa279c74847379cb60653f0ffb0289ba0e95dcef2007d13ece", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772425665, "uuid": "d703efe5-41b4-4a5d-a079-94ab9f5e7b68", "comment": "Malware payload", "value": "d47afe2117e957854d0290b78eac9c96939fdfb3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772425665, "uuid": "6dc4c830-2f3c-49aa-863d-02d2c51ac09e", "comment": "Malware payload", "value": "57ffcd9738177aa4086eed0b2aa35c9b299e33454f82f44f13d7986661fb654818d6a530d68b9748cd52b3b59dfe95c9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772425665, "uuid": "adad94f3-8a7f-4028-9186-150efbcadcb3", "value": "T1E80230BCC1E1FCC4475B22D4789AF6C3118B9B136EB71A6CD7C814924EA0119DBBA18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772425665, "uuid": "96de8147-9d71-4166-b3c3-8cb9914c80c1", "value": "192:+LukkMsOSJYCsw9SZAbWwY1N3DrWTEz2TKgmbYDRi0W:+fsOC9E4sj38EuWYU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772425665, "uuid": "144f0e3a-3253-4a7b-a117-e8fe10bc849a", "value": 8590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772425665, "uuid": "c1955947-e5e9-420a-a570-b6977097e093", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772425665, "uuid": "fb8898d7-77ba-47f9-bf53-cd2384fea850", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c07d67-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444748, "uuid": "fb82ebde-506d-4aa3-b7e4-b49362a6bd00", "comment": "Malware payload (SantaStealer)", "value": "4341635b9867110f0d1353e05dad6bb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444748, "uuid": "3f3cd023-c7d3-4a95-9eed-8ca05c5663af", "comment": "Malware payload (SantaStealer)", "value": "85c43c93261558bd045bf770e5f209b415861dfd49435aee36073aa5de4abe0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444748, "uuid": "01197546-5ecc-4595-9063-2f594f365617", "comment": "Malware payload (SantaStealer)", "value": "2e9e7cb35513c02a992caa3cb9d3279509e2ced2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444748, "uuid": "73818a5c-7524-4e0d-ba95-82ed113bc690", "comment": "Malware payload (SantaStealer)", "value": "ae2c07e434185a3b7796e1672cdf8f8e3609b3647bd0c5d3592220886209fdf3cf929880cb1b1d106aa0513814269778", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444748, "uuid": "5c59f5d2-d913-49c9-9ea7-7b87a9102bc1", "value": "T162C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444748, "uuid": "41fd5148-8755-4244-88d6-b065e8d8ed3d", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444748, "uuid": "50211a67-ca18-4027-ba97-21e093c43cd0", "value": "49152:tavY1Sn5eVNoMWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCfsdGF:EY1a0Uevc+9sdBg4x4DPPnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444748, "uuid": "34a5cd7a-0fd7-49ec-9d49-14b460da161e", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444748, "uuid": "61f30f8b-0a5f-4ec1-b449-59f4ec877602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444748, "uuid": "698ff8b3-2773-41b9-99cb-747920bc991b", "value": "20260301_215304_20260302_005303_9NI9Y5TKX1CK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d13d1b7-1619-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772443442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443442, "uuid": "ad104ada-57b6-4ec8-ba70-674d1a727a8e", "comment": "Malware payload", "value": "eda8015f3d9c7c462b2018e72aba89f6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443442, "uuid": "78ee8968-1f56-4633-a11b-0f9f93bc2daa", "comment": "Malware payload", "value": "8613f7b6df514d53aa419355b0a3e8d032b8448bd45296d4158b848998015e3d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443442, "uuid": "e0ba05e7-be60-474b-8bf5-b8678f7c65a8", "comment": "Malware payload", "value": "1ceeaf339a2f0b083eb8c0f2beeede1db5ec0ec8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443442, "uuid": "065c563d-05b6-4028-9b3b-22b365a9fd2e", "comment": "Malware payload", "value": "a63aeccdf2ea7bcb29ccc367120ea126908ba7c49b90bda0faaf7dcda14f80988a28cd18fa807f9914f6fbcb211afa23", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443442, "uuid": "c02fbe1c-0857-45c8-8b72-49836ba5b0da", "value": "T1E6A62245EF59DD2EC47740370D5A5335620AAE2FC7828343DAEC361978BB6E40ED4AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443442, "uuid": "8bce143d-bf1b-4cbc-a72f-5782e66d64fc", "value": "196608:OLFSGeYf+YOeW52TvfFiE8i1UWUf+5vMFFtYbgF6Bqm:OR8Yf+/eQ2THDj1fE+obn6Bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443442, "uuid": "a80fab9f-d04e-4ac9-94bf-24b210b400a6", "value": 10165611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443442, "uuid": "cd0ef47f-ae8a-4686-b848-892748d96a52", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443442, "uuid": "3509617c-d188-467a-92a9-5e6a5b13e862", "value": "Live Chat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baab1f9c-163a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772457692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457692, "uuid": "4f165cf1-cce9-4a8e-b203-53b23fd34538", "comment": "Malware payload (SalatStealer)", "value": "042cc1d7b3932dc29152c99e18e11e3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457692, "uuid": "e401b4cf-15f6-42e7-bc4c-ca1ffc4d093e", "comment": "Malware payload (SalatStealer)", "value": "864dd2720e801c4f91e51b7d0d6e34e780656e220fc53725be58759c25970723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457692, "uuid": "8a42a36a-44fc-4eef-888f-70dea3ee64c4", "comment": "Malware payload (SalatStealer)", "value": "b7562169ae3120a1e5e671ffc3865879b8f0429c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457692, "uuid": "39840029-a351-47a7-ad6b-3ed2b256dd6a", "comment": "Malware payload (SalatStealer)", "value": "6d77321e3c955a06197069adb5b0f2bcad09df6911132e0cccc3469000be2461eb02ca588f9f52c12feff3d669df3396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457692, "uuid": "f25677bf-9fbf-4b29-83f5-2b26ffa12fcc", "value": "T12CC65B41FACB98F6E9071831405BA23F63319D05CB28CB97EF543B6AFC7BA911976604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457692, "uuid": "a927e9a8-8512-4a3f-b9a1-b98fc3402b11", "value": "98304:xtrOp9tf/Z6csN88gRByQ8AJpzu1Va4R:c0i8q4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457692, "uuid": "7b0b2119-7c29-4097-b2df-c9863edd85ac", "value": 12108800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457692, "uuid": "ed642d7f-fa10-4dd4-bb36-1e051e836585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457692, "uuid": "3c6e2182-a195-4141-9a2c-6233ea42f782", "value": "aybsi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261c49b9-1615-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772441551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441551, "uuid": "137349c6-5f2a-402d-80f5-bc6b72c13049", "comment": "Malware payload (PureLogsStealer)", "value": "34ecbfff8dcbd851b3c800902914b9cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441551, "uuid": "91356439-4328-49a8-b95a-a100a98873d8", "comment": "Malware payload (PureLogsStealer)", "value": "88ea679f7b2fedc50ef63ab1ad8ab9b215c69627e61bd528076dfca7425354ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441551, "uuid": "ea598520-9c1c-40f4-9144-5e150929d1c7", "comment": "Malware payload (PureLogsStealer)", "value": "c23763a7039a118f24705c240f7abac185b462be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441551, "uuid": "260154ec-225d-4cef-b793-4066970ac327", "comment": "Malware payload (PureLogsStealer)", "value": "b91eda2cadd6cb0ab9e1fd0614a556e88ff139baa7366d9efa961303ecb6d8cb7a30705a0ac936b4f26d71812314648d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441551, "uuid": "21969553-0578-4a92-b3d5-994c11057027", "value": "T12DF40202B4D6E432D6F717324B9AE8940FBDFAB05F5496D7B3C0455A0D73BC0AA7A062", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441551, "uuid": "fba364d4-dcee-4d62-85f1-ba2aef292203", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441551, "uuid": "a687b770-572a-436b-9c7a-6a3203eb6f18", "value": "12288:ZHztGhqRHiNV4BQVih32K2jDvMs1wtRu57qqYyj54MAO3Bm+ZAx04dEoTLiYP:HuKk4BQVih32K2jD71uRu57q854xOJKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772441551, "uuid": "f93a1ca4-7074-4c29-9c25-fa96e013d7c3", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772441551, "uuid": "2a86c1cd-af1c-4a47-8f4a-903c7a52965e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441551, "uuid": "41014509-8f11-4763-a56c-d39906b5d18e", "value": "34ecbfff8dcbd851b3c800902914b9cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528bcc7e-160c-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1772437760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437760, "uuid": "6284370d-f317-4239-911e-bac53af864e8", "comment": "Malware payload (PureHVNC)", "value": "0fc070feb892f20681c359b8334ffb3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437760, "uuid": "0fc263d3-8644-42cd-a8da-e92c9c585e97", "comment": "Malware payload (PureHVNC)", "value": "89295ba81f3008c6ab03fdd77dc4a75a0920f708fb4e09c156c077b4dfedd0ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437760, "uuid": "45cd7d26-1af1-4d46-bbe6-e68b495c9717", "comment": "Malware payload (PureHVNC)", "value": "284975f362b2c79da10d97a07117aa6edb675deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437760, "uuid": "b8d97f5f-674e-4afe-a889-ddc167dd03cc", "comment": "Malware payload (PureHVNC)", "value": "5ba69dcb0b3b5245030f2e508d39f67349fada523f18f610e18781dd3fc97312ee8d01ab351713cb602e36efd6beaaf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437760, "uuid": "090daa85-8c2e-49f0-9956-fee550b1a6e6", "value": "T1E8A79D23B800C039E9E641F2E6FD7A7D552C8E25132D60D767D86C456B709E33B3AB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437760, "uuid": "3d540f4b-098e-4423-87d9-5de11f1f24a2", "value": "cc685686a640c4b3ca01c7b1908800cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437760, "uuid": "5b4adf93-74d4-4bb3-a54a-4be9ae546bb2", "value": "786432:zMdG8pjFcBosy6d6JmAwUg6V36VNNN7jffzbDlYtwXlD:KfjFcBosPgJmARg6V6bNN7jffPBY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772437760, "uuid": "d4744669-0a17-4626-bc78-28d567f39469", "value": 46823656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772437760, "uuid": "6baeb7f9-4688-4c81-a39d-24c09154d8eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437760, "uuid": "d5454457-8c4e-43a6-99a0-197ebafef917", "value": "0fc070feb892f20681c359b8334ffb3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f74e06-1650-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772466993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466993, "uuid": "2a3e892f-8339-4c35-b131-05a0df8d4815", "comment": "Malware payload (GoToResolve)", "value": "a420a4dacec047707f4ee609f4853ce6", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466993, "uuid": "cbd32d0a-fd4e-4da9-8ff1-6cc8da163c36", "comment": "Malware payload (GoToResolve)", "value": "89484b25ffa35ad606e8f834021c143682bf58300d2d53e439ae87f474278b41", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466993, "uuid": "036c0adc-4d22-4bbd-989c-5f3c8adb6e68", "comment": "Malware payload (GoToResolve)", "value": "c37b101cafce04c445957e826b8199aaacfd4a81", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466993, "uuid": "4db4de4f-8aaa-4136-aed0-49b78357cde6", "comment": "Malware payload (GoToResolve)", "value": "5596e4d3f436f5acfceb83b253151546fbbe118a78d1eea40cb4f4f928653b150147bddb59fa01d27f85c36fea3b6bd5", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466993, "uuid": "920d8fcf-764d-4f11-baaa-5732cfd63da5", "value": "T1C1373352B188C136E55E1272442CAFFA25BE8C210B7095D777ECFA695F302C127727AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466993, "uuid": "b4d516fa-f143-449f-8c6f-ef486f1ee0a2", "value": "393216:djzfzgZNbTlEg1k752bJeRrjMPrhY/cpEzVSHH/VbXi+1alFZNHQYWhQmcpOABY:JzsZN3ygbyiho8fVLicaDyhQmcpOAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772466993, "uuid": "df2ed55b-bdc8-4523-9624-92befb4842a8", "value": 24379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772466993, "uuid": "84b56ebd-713c-492f-ac5c-4d5132dae19e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466993, "uuid": "6602cf25-e001-4dba-9fa2-478df8a8ac5e", "value": "EXCLUSIVE INVITATION.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f7ff87-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476311, "uuid": "75588682-eef1-4e01-8dc5-621df4c8ef52", "comment": "Malware payload (Mirai)", "value": "01f1c576d6c6fe5c09ec24dec236a8ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476311, "uuid": "c3d5b951-3c45-4e5a-83b5-a2516f58294b", "comment": "Malware payload (Mirai)", "value": "8969075ed74594cf2537fa1c28bb0d499422b01317830c70c0e5d5cd8c065bef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476311, "uuid": "8c20cd51-ab78-41cd-9d4f-dab5378ed024", "comment": "Malware payload (Mirai)", "value": "f1f680f4c5ce9d005e24dcbe72d01160613a4b3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476311, "uuid": "c1a3190d-e613-4aef-ae23-0c85631026fd", "comment": "Malware payload (Mirai)", "value": "834991a759a6126652f8698f6c80075b42af24a510090dcdadd4dbe9edddeb3e057ebef8f59e30cb256014f6069bd2a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476311, "uuid": "4368d071-509f-41e9-aa8f-5fd163fe19e8", "value": "T114631793F901DF77F40BE3B604D748127530BBE60E925A72722378AAEE760D51922F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476311, "uuid": "f68176a5-9765-4cf8-9339-50d41cf83513", "value": "1536:ksCsDpDpqqRUw/AGeEe9C8XA9fwxynZF1UdcOzX2FwoZN:39VBUwdeR9GfwxynZFydc3ZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476311, "uuid": "8724f6ea-e2d4-4438-bc8d-beb78c500b92", "value": 73188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476311, "uuid": "e2820f32-33a8-4da6-8b31-54f50d21cf81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476311, "uuid": "ea3217bc-8327-4f6d-9168-562c0ae8e231", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c000e0-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772465223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465223, "uuid": "3af386b5-09ad-4db1-8f61-867d1cd8371f", "comment": "Malware payload (SalatStealer)", "value": "8002487f18f6ce81aeeb60dca42c16d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465223, "uuid": "c8aa337b-6fdc-46ad-aa62-e4e7a80e6a96", "comment": "Malware payload (SalatStealer)", "value": "8ad7198a04c3358a140801663b0fd4f2fa882a6a70158ddd28d7b9e9174553e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465223, "uuid": "ee2155f9-80bb-439e-8f70-0186475f75c7", "comment": "Malware payload (SalatStealer)", "value": "8a286a2383c3536837a16d0462b2ba78b5898d63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465223, "uuid": "b6c2df5a-4f37-4dae-a320-7b7b3c196a53", "comment": "Malware payload (SalatStealer)", "value": "c7078843168a2748f4adc1f4c55be7f9a2aaa1873daae7fbd08ec057e4df62026c041ba6fb360f433f067647d814fa05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465223, "uuid": "6f5d3b4c-40b6-45f9-accb-66bf8b5db6b1", "value": "T160E533DDFF656DE6DA2D64BE89882C5517F1803BCF3B0750398BB9B858460F40A8F588", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465223, "uuid": "c7debf3b-e0dd-4d67-913d-d44af90084b5", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465223, "uuid": "4b390643-75b9-456e-a5ef-e28ba352244c", "value": "98304:XhUdfSoLe5enpse9Iw1bun8iGtyZi8CiWsX7mqTbH+:XSdf5eQue9IwoOSCkTj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465223, "uuid": "b64761cd-f4f3-42e0-9e28-5dd8b4c8c204", "value": 3299328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465223, "uuid": "5f868bc3-1db4-46bd-92c1-96443356c01a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465223, "uuid": "64fa89c1-c0f8-4f10-a50a-d4c846a293e4", "value": "vmnormal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be849b7-1606-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772435091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772435091, "uuid": "d5be63ba-0913-46fa-b311-06065fa16d4f", "comment": "Malware payload", "value": "f340080a151dd2f13cf274264a651a98", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772435091, "uuid": "febf19ae-dbbc-4cfd-83e6-02999715377c", "comment": "Malware payload", "value": "8ba826acdad537f41c411e3fd448ebb54b3a5d6e9f2325068e87e8e13bc7b44e", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772435091, "uuid": "df17043d-5c51-428a-ab3b-10d2d4bb7bc6", "comment": "Malware payload", "value": "c2fbe77e992eb3e7b987caef0e4727c2d73d668b", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772435091, "uuid": "4c6f8804-c9ad-4211-9a84-5f3c7a1629d5", "comment": "Malware payload", "value": "fa8ed853bc12667d8d756c4412c53de6ed71d6cdbbe9fb692d913511e177c88ca4f703e8bf3d8a5bef0e7245d84e33a0", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772435091, "uuid": "a46a829f-f7f6-4637-9d44-bbcfd1a3afde", "value": "T160978C0773E50199E177D1388AAB9103EBB2B8161734D7DB32AC03652F67AE09D7BB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772435091, "uuid": "d5e4322c-10e1-45f5-be04-5b7bbac74727", "value": "174435db180feb9caa3b336186ee6a8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772435091, "uuid": "85fc4b13-a48e-4c0e-b90c-0c09b7f51017", "value": "393216:AzBd4IcVUnN7qg+21j++sHV1KX6RSF32YhQSI8w5SvDazn1d5VR/6Lgc/icMOQMW:AaW1JhQlR7TtKeagPV1Qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772435091, "uuid": "711b97c4-9087-4f57-bac6-3da77b8f247e", "value": 42790400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772435091, "uuid": "1e414aca-67a7-4674-a6eb-58dd5ab6c541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772435091, "uuid": "c55686b1-9ff1-4353-b36d-fb40cfa984b7", "value": "consolelofy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c991b675-1625-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772448697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448697, "uuid": "b65038f9-40fc-4f73-813e-4c135c43c8c9", "comment": "Malware payload (Gafgyt)", "value": "0fd0c71db16a2072586a87ba7343b6d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448697, "uuid": "62a82a4e-0890-44be-b48f-5a9c74ebbbb1", "comment": "Malware payload (Gafgyt)", "value": "8d16dbec28b0eac707f683fa3bafed35884d4af7dd36db842afc84c196b39a71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448697, "uuid": "e24f1f2f-0257-4753-9ccc-5522d7cf86f0", "comment": "Malware payload (Gafgyt)", "value": "417f2c098177fd1ff7474828c41bff45cba8a16a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448697, "uuid": "82fdccbd-e208-410d-9360-ec5e11ff9352", "comment": "Malware payload (Gafgyt)", "value": "fb281e133af73b4e6cfd1ad563fd202c67c32bb6d3c042eaeac5536bee90900aed55cd58d3284bb2e1e7c2e96da336b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448697, "uuid": "8ee80707-6b93-418b-9665-31762b95b984", "value": "T147C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448697, "uuid": "38712570-8bf1-482c-a0a9-78b5fb9b092c", "value": "3072:4jDy/+mh1vtbPIKavbpcUPium7/L7QsvmGfIiNb:mOJ1vxfavbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448697, "uuid": "0fcaa0c4-7e76-4e62-8563-12cce2ee78d1", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448697, "uuid": "5fdbfd9f-b3bf-4914-aac8-2e3393b2f951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448697, "uuid": "b7e825e9-efd0-4cca-9a66-f7bc60d26c15", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d0c121-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433977, "uuid": "48a9f75a-9342-4fcf-acf0-2c00faf5c8cc", "comment": "Malware payload (SocGholish)", "value": "3f1d67b3922fc5b7a46a810640cd67b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433977, "uuid": "2742d357-7780-4abb-b2fd-d6dd2f443d19", "comment": "Malware payload (SocGholish)", "value": "8d4ffd799b650965fd4cb13d89692f3dd156faa03ba5401c420a2e0e68168837", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433977, "uuid": "540656ab-c050-4fd5-9677-50d8033d2ea5", "comment": "Malware payload (SocGholish)", "value": "681e688fdb9eedecc22754b092a632adca5a7763", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433977, "uuid": "ca773bf7-f47d-44ab-bb76-fa442b79fec1", "comment": "Malware payload (SocGholish)", "value": "ae416212260267f997db0ba41610a7c7eeb58693f4cba6437012e38494cb928a671481042847c9e0689dd1fedba46465", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433977, "uuid": "9332d60b-cadf-47a1-8601-5bd783eb1d78", "value": "T142D0978E3C0402182B872A3962B7F60A7442631814290519C84DC94A72141BBEC2B6DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433977, "uuid": "e6ab0fb2-01d3-4478-9e8b-5df576d85d57", "value": "6:SbOhgAHAgO9lP9IRWV/trjZ6pdPu8X2RAF1aLsyV8f:rgVP9IRWV/djZ63uG2RA7aLsyVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433977, "uuid": "267423be-b34e-413d-85fd-9a41e5251333", "value": 239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433977, "uuid": "b39b05d7-8d6d-4533-959f-35128248821f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433977, "uuid": "28ab83e8-f372-4cae-a464-46f0311ad3d6", "value": "8d4ffd799b650965fd4cb13d89692f3dd156faa03ba5401c420a2e0e68168837.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a52d63e-160c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772437746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437746, "uuid": "eb4929d6-6a20-4a24-a06a-7af43eee6c82", "comment": "Malware payload (Mirai)", "value": "80664bb579b844213c79b8689eb9ab31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437746, "uuid": "f7570795-d9b4-4765-a6ad-2a702f322b65", "comment": "Malware payload (Mirai)", "value": "8dc5f2b1d67bce38bb56c80fc3f23c6262b2c74158dcd1fd3a60beb3c5224bc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437746, "uuid": "dc859a02-3ce6-4b32-88ae-0fd785c58ff6", "comment": "Malware payload (Mirai)", "value": "4714115f60c6839490b6d35efa199b4e3aca8760", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437746, "uuid": "59be0ee4-39d4-47cc-88e5-23814163baa6", "comment": "Malware payload (Mirai)", "value": "abe39bcd006dba43d250ee063394dead15181fbaebdd2f50e89b823663f65a99dfa28218e4f15cd6bd5509869f996848", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437746, "uuid": "afdf763f-fbdd-40ba-80b8-972fd62d3ee3", "value": "T1A0734A036A8184FCC489C27547BB753AF872747D0238B2E96BC8FE13AD48E115EAD8D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437746, "uuid": "bb83ab80-5f96-42a2-9eea-e5c2c5f19d8c", "value": "1536:ns+x+fBi3bxt3IF1RfJ12re8OWUOWZoFgVPKbP0XA4sIC99dkNOKwbZn9:s+MfobzYFLfJWe8zUboFOKbh4sIC992o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772437746, "uuid": "e7c6d7eb-3138-45cc-b234-6b5e0e3d35df", "value": 79696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772437746, "uuid": "5d5290c0-45c8-4773-9542-602579ecde38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437746, "uuid": "deb00b74-4eaf-4216-bbaf-0fe54f1cd9a7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cec173-163a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772457605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457605, "uuid": "cd241173-a130-4a28-b9c8-77c909073ef0", "comment": "Malware payload (SalatStealer)", "value": "7244464ce0b63e98dcabef8584ae8a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457605, "uuid": "025fea14-804c-4f6e-85ca-b2c6eba30703", "comment": "Malware payload (SalatStealer)", "value": "8df6fd72c346ac68c81ff06e73ebe7de6c8ef82ef75ced83cb860ecb8c0a3e47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457605, "uuid": "490cf82d-ce2a-4ed1-8409-98dd01f44088", "comment": "Malware payload (SalatStealer)", "value": "bbaa07d51197b05c80eebb24490186c8e076442d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457605, "uuid": "9ab03677-924b-458d-a11e-a258803b4daf", "comment": "Malware payload (SalatStealer)", "value": "75bdbd234e6f58c5164a784bf77fdedf9f9e1cc7c92896d85eb19979a308d9843bfe48d40e15507a05e14385b2a36f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457605, "uuid": "723b1dfc-e90f-4804-b2ea-7e9c4b42ac93", "value": "T1EBC65A11FACB54F5E9035831406BE23F63316D058B38DB9BEB54BE2AFC77692187A604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457605, "uuid": "ad9bc5e9-7c60-468d-9796-c07f310b43f9", "value": "98304:SN+YXkXrBNG2QHG13qHpDVCEOk2PvpXUj0Lcx9/AvHlXd2oLw53TE:3Xnwxxo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457605, "uuid": "8a64d7a5-031c-4532-99d8-dc236f75b2df", "value": 11862016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457605, "uuid": "03b25b88-45da-4589-aea5-6c3df3bf2fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457605, "uuid": "7ec41906-4ede-46bd-8ce6-63e504b869fd", "value": "34t1t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59e1ad7-1614-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1772441389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441389, "uuid": "3c6f94c3-a6f8-40b9-a460-a95ea0386549", "comment": "Malware payload (AdaptixC2)", "value": "7d415e090821fb4a93269f4836740a4e", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441389, "uuid": "aa708064-b8f7-4cb8-a859-11e6ba0f28fc", "comment": "Malware payload (AdaptixC2)", "value": "8e7049f09985c7138137cbe83ee1bcdd639805527a7969e5a4cd0b87094a7028", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441389, "uuid": "66db4565-6240-4a9f-990c-746e6f57b231", "comment": "Malware payload (AdaptixC2)", "value": "3117f948c4b2cd459435274363e64cc82cf14ec1", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441389, "uuid": "04e59e29-bbbe-4cc3-991d-425361abf75e", "comment": "Malware payload (AdaptixC2)", "value": "7a04a005a6ecb02c554681a6fb76759b5859c70b39eca7bdf5746d988645e67ae72990250f20be30581514fd1dde370a", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441389, "uuid": "d7990bc1-0f92-4442-84a3-6ab8f20334a2", "value": "T1A3E52396F9C0D4D9FD7640F5195AE43221532DAC79BB0101ABF26FABB4822735C1BB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441389, "uuid": "ba0b2545-de17-49b5-a91c-89c77f901fdf", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441389, "uuid": "e9c30096-3f35-4398-bf61-164f24d7e4b1", "value": "98304:e9WUSTIKZcb7smcWPiA/RHd4J9/bcDMGV:e9irLmBi2RHd4fDozV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772441389, "uuid": "1b22a908-6a6a-4352-9f88-d4a36902b935", "value": 3205064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772441389, "uuid": "6cda5679-0386-4150-9ff5-e1fc8eff8991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441389, "uuid": "9b147f07-120f-47f5-a5b3-9e7134ba1c49", "value": "8e7049f09985c7138137cbe83ee1bcdd639805527a7969e5a4cd0b87094a7028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03b345d-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772434105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434105, "uuid": "e8fd5411-178a-4b15-9c20-76ffb4cdeb1e", "comment": "Malware payload (SocGholish)", "value": "27965f46c2d16af746efeb8e1fc30025", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434105, "uuid": "0c8b799a-c428-4ac4-86d4-aec975f82157", "comment": "Malware payload (SocGholish)", "value": "8f896f3f0b5f33413217e9350dba6d4958cc9bdf568902a08d739b43db6f993b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434105, "uuid": "f63c7fc5-0064-44ec-b5a5-627b7ebc2e68", "comment": "Malware payload (SocGholish)", "value": "fa7d631ee3e2a405c9618d7d70e1c546a5dec0f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434105, "uuid": "f4518ddc-fc31-46b3-81fe-b0396c5bec3f", "comment": "Malware payload (SocGholish)", "value": "a5bcb703a53fa17072e51cd334feba5000901a40fa2bdcfb9b7d9d204b8d0a7782bf69bea9ae3bb29b4812b3bfb05661", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434105, "uuid": "829d12c1-817b-47db-9ff9-f4bd39f14d57", "value": "T1FDD02BDA3D4541250EA7147545B7EA1C70251218DC112653D8AEC9611A20BD6649AE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434105, "uuid": "5ae5f97e-58da-4d60-9be5-28072e8df9ac", "value": "6:q7X75hOEKZmgO9lDyCoRWZ/EQhj0b6pd7g6MeTbnUikUe:INhkZuD+RWZ8Qhj0b6jg43UiFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772434105, "uuid": "a07f3b91-5b10-4540-8263-b991110fb2f1", "value": 262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772434105, "uuid": "4eb09f4a-7b20-4805-86b2-c12eb63055f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434105, "uuid": "8bab1f3b-cd8c-4b30-81cd-8afce0e77995", "value": "8f896f3f0b5f33413217e9350dba6d4958cc9bdf568902a08d739b43db6f993b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdfe520-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452674, "uuid": "7e059f92-69da-4020-886e-535172650e65", "comment": "Malware payload (Mirai)", "value": "39aea33b083d8a2103e609a1fe67d3b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452674, "uuid": "353eb8d2-9b3a-412f-91d0-c5ae928964b2", "comment": "Malware payload (Mirai)", "value": "8fc52603b2c6cea4ca67008eb84d07849098178dc13a9dc8f0954e8dd87b2365", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452674, "uuid": "e70796c2-f571-47e9-ba12-b79a75415c1e", "comment": "Malware payload (Mirai)", "value": "ae6542dd353f1d6fa1978ec8f59caefb3b03c115", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452674, "uuid": "dfdea197-002c-4a3b-9fb2-953ee05918c9", "comment": "Malware payload (Mirai)", "value": "4702d3ba0adc3f2b12d5f42ae361a841dd4c510afb6ccefb4fc026309f2e13ab13ec761744913c114b9f882f13d9c97e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452674, "uuid": "7906c996-5b12-45fc-88a4-d886f4f3ce4b", "value": "T1FEB3910A7F600EF7EC9BDC374AAA1B4924DD241A25A87B75BD30D818F24B25F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452674, "uuid": "c8469889-651b-4ad6-bada-c865d7fcab59", "value": "1536:VTUAnPWQ+tbHc2cAd88LZAJb7zEUX1p70wZsaD2A2j6Z3ktkprSu:1UAnPWQ+tbHc2FhNw1pYdj6j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452674, "uuid": "7635288d-eec6-4772-a786-d8e4018bf4a5", "value": 116916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452674, "uuid": "01a243f8-f36a-42f4-90ad-c17f2412f8aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452674, "uuid": "72010423-728e-4190-ad76-56d544ba9c35", "value": "MMaaRRiiOisecTanee.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ba670a-1614-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772441393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441393, "uuid": "560a69ea-2dd6-43b5-9944-9b8272a845dd", "comment": "Malware payload", "value": "e0a2e7d3904bf17510fbf260512c8ec8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441393, "uuid": "a264da6a-d389-4e0f-a271-c696410aa617", "comment": "Malware payload", "value": "9005deed14fb0fa861a3ae3cc1d23f35131a6f809d18640f21a64097f178697a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441393, "uuid": "05dd1871-233d-4adc-aa4c-33da09d75d84", "comment": "Malware payload", "value": "b0af6005b3e383189a29fe9f96b5950d37f42042", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441393, "uuid": "f2d31872-708c-4265-acc9-08e493935ca1", "comment": "Malware payload", "value": "ac621b7bbf2cf76c6d66d9eeea8c259ce97b2cf08f39a353d4cbee365b05e8166ca773936237d0cfba2a276bed990451", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441393, "uuid": "36cdef13-aae5-426b-b733-2a53f5db014e", "value": "T10445E737F6D2AAB1D1441733E3DB4D600BA0E5C26767DA4BB6CA335A58437BB8E01217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441393, "uuid": "6058a81c-72b7-443f-a9d9-902c562116b3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441393, "uuid": "408400c0-56ad-4392-9658-567928d36340", "value": "12288:AqEY/x5pK0jguEkzWBfwzliwDsM2GbLobs8TNAxoleU8vPbpi3r:Aozg4LoPTco383b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772441393, "uuid": "8048a91c-e56f-4585-a774-4ce354ad125e", "value": 1206784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772441393, "uuid": "a04d53bb-1667-4d78-bd6a-38633dcf34cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441393, "uuid": "7a86fcc3-80be-421b-9632-e350cb1bb90d", "value": "9005deed14fb0fa861a3ae3cc1d23f35131a6f809d18640f21a64097f178697a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046ffb4e-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433764, "uuid": "117b0967-ca38-46ff-8b3b-b2525d831c90", "comment": "Malware payload (SocGholish)", "value": "d071f99612d72a109f0720a9eef31084", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433764, "uuid": "ad26c6e5-370b-48ed-9523-745ffcecfea1", "comment": "Malware payload (SocGholish)", "value": "90aaa694b589e559bedaddd6c2466bc7f337d0507f25cb91ebaa81303aeedb97", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433764, "uuid": "e5b4bd6a-b37e-4575-933a-6cbfd3539657", "comment": "Malware payload (SocGholish)", "value": "afae7ff3f4e3d9c07aa6212540e7757d49b63f6e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433764, "uuid": "b325f151-56b8-4812-871f-1856c0f94e1a", "comment": "Malware payload (SocGholish)", "value": "67636c0eec1dd8f7de588ae290a23c635219f17195705ce7545caf61510eca712fb497d1f4b3d14c7a7b23faffd3871a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433764, "uuid": "2082cb7c-0f16-41de-a80c-b9520910dd92", "value": "T1D2D0979F320C211D6BF7143B427F97097093069A34864B43EC3A8CA561ACAFB882628C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433764, "uuid": "5f42fa74-ce9c-4edd-87e1-ef92789c1d36", "value": "6:qHiXJOhKsRAgO9lF2oRW6AW1jsf6pdHEsoqX1cHwqf:TLLRW6AW1jsf6cs/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433764, "uuid": "9488ac9f-dae9-4603-bb47-79cefc61c74a", "value": 244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433764, "uuid": "b0120538-062c-4751-9ad8-fb886bd3a84f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433764, "uuid": "9753b9d4-667e-4f3a-9a0b-40e3c18be4ab", "value": "90aaa694b589e559bedaddd6c2466bc7f337d0507f25cb91ebaa81303aeedb97.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d032cb49-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475767, "uuid": "ebfd4dba-f27d-4671-ba28-7d9c764d3970", "comment": "Malware payload (Mirai)", "value": "c73ab286d364b5b30b0e5c79cfde87cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475767, "uuid": "b5a85958-a19a-431b-9ed6-8d937b24db15", "comment": "Malware payload (Mirai)", "value": "90d75d2217d77aea5a2273c91a37df42c4ccb7cda48260428b6632599530cd9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475767, "uuid": "3301fbcf-8cad-42ed-8561-cca2623bab97", "comment": "Malware payload (Mirai)", "value": "2835ab1bd514f4ac23f6f7b7c17c43e4aa6426b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475767, "uuid": "a90e85df-57c9-4dcb-adcb-d73a8a4a1005", "comment": "Malware payload (Mirai)", "value": "e67886d4ca9c38642f50a0e4b27f3c51b257bf89b68ca3873f51b76489d148f3165978f25312f9fc330214ab7caa2b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475767, "uuid": "b1d16a76-95ce-4583-b7c6-ea7c6cc74968", "value": "T1EA736CC2AB47C4F4EC2605716077E7328773E13E1029EE43D769AD36ED52A41A62A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475767, "uuid": "b99640f3-f87b-4d99-9bba-cc46b30ef8a4", "value": "1536:dbwcQ0p+cLBZFkKT/Nmv23PkP98U755e+Kj+l:K0VZOKT/cv238PO0PX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475767, "uuid": "3d35c31a-7a08-4ac5-9ede-88e7c546de7d", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475767, "uuid": "7f96e158-7988-4379-9cd1-1b8e8c215a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475767, "uuid": "1d7a8f53-25d2-4250-b950-8b7a762be633", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86654c83-1619-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772443430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443430, "uuid": "2596f5f6-4ca1-43f9-bf49-5a1c28b2107a", "comment": "Malware payload (SantaStealer)", "value": "9df29c3e083dc3e585c8d58a22e596ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443430, "uuid": "7145a6fc-5a06-45ee-9574-af545ba35130", "comment": "Malware payload (SantaStealer)", "value": "91021ef9c160a8ed04d5fd5b981dc54f0ea61ddaefe108d329f03278748579f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443430, "uuid": "e719f2b7-f801-4be0-a753-440daded4351", "comment": "Malware payload (SantaStealer)", "value": "6caf58c1255ea04c7c0dea3540eeb9d44e7f9f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443430, "uuid": "fdbd8ffd-f4a0-431d-84d3-4a4f009cfd66", "comment": "Malware payload (SantaStealer)", "value": "dcade96979aebe33771f4aed6ecbc9681c087cb3d6d4f53a079ba61a517910da9dcca9eadc00f58af98941f4d9a1fad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443430, "uuid": "e6ec0389-5cf4-428f-878d-37e8dce3b079", "value": "T1FDC59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443430, "uuid": "6cf15044-8f69-4413-80b1-5643ad3b1b6a", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443430, "uuid": "676f45bf-68a1-42df-81da-04717f8e8cec", "value": "49152:7avY1Sn5eVNoqWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlC7sdG8:6Y1aiUevc+9sdBg4x4DPPnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443430, "uuid": "45b3fb4d-d4cd-4bbd-9ab6-b8c695db4507", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443430, "uuid": "0d34f62a-9ac7-49b5-8b7b-519b85a3d253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443430, "uuid": "e9f9225a-66ae-49db-982d-709187338f95", "value": "20260301_212249_20260302_002248_V855Y0CW3LA8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9613aa7f-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444745, "uuid": "9247637c-f665-421b-bf10-a1e03053091b", "comment": "Malware payload (SantaStealer)", "value": "e5e3b3bfff655fec7025dd0b8d4b750a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444745, "uuid": "f6eb782d-7faf-4fe0-be61-10fa23cff12a", "comment": "Malware payload (SantaStealer)", "value": "920c14eda01cf12ea3cc4d22a783f3f93af7143c4e3002d5d8f29af6bec5977e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444745, "uuid": "53078074-6953-404f-9348-fa6613ad323a", "comment": "Malware payload (SantaStealer)", "value": "6c664638e9364f7ddef4377e7d5ef3af4460b0f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444745, "uuid": "10aa7558-f01a-47d3-b241-cf65056f713e", "comment": "Malware payload (SantaStealer)", "value": "75a736e245ace49273db3927ad7180dfd701d9f36c5de397c53a789a3958a3aa5f6cc67b88f61354d4cf3273d2e68e5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444745, "uuid": "7b0e7705-0351-49ed-91db-d8b3a6dad006", "value": "T195C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444745, "uuid": "8397c177-d67b-4179-b216-59513ad59bbd", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444745, "uuid": "812236b5-5f65-4e1f-bdf6-6cda67429f5a", "value": "49152:2avY1Sn5eVNoaWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCTsdGK:xY1aiUevc+9sdBg4x4DPPn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444745, "uuid": "246e0c1f-d777-44cb-9474-1f7d32e1dbbe", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444745, "uuid": "5d706038-2724-4e27-9133-c27cb75578c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444745, "uuid": "ed712413-5819-43ec-b7a7-9de6dd362b60", "value": "20260301_215034_20260302_005033_6307898K735P.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0007812b-161f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772445782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445782, "uuid": "dfb6d4df-c7a2-4c4a-8f18-4c809bdb117f", "comment": "Malware payload (AsyncRAT)", "value": "9a15ac71026432e1a8ed61db3a1a5281", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Enigma", "colour": "#C59CE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Phonzy.A!ml", "colour": "#5EFA99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445782, "uuid": "f91418ac-0c21-4bca-81e8-8a8f5d362f31", "comment": "Malware payload (AsyncRAT)", "value": "9270444c315379d8a84f5519bcd16ab76b05fb5abc83dbc3268c0c27765bbf23", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Enigma", "colour": "#C59CE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Phonzy.A!ml", "colour": "#5EFA99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445782, "uuid": "e854b9c9-758e-475d-a70f-5eff4699f1e5", "comment": "Malware payload (AsyncRAT)", "value": "ea7f41916d25db7de567f1bfd614042af432bd51", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Enigma", "colour": "#C59CE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Phonzy.A!ml", "colour": "#5EFA99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445782, "uuid": "6e7d973a-e26a-49d0-8c5e-52064e84d6d3", "comment": "Malware payload (AsyncRAT)", "value": "2b6b15a75f9c2ddbe65cf9bc329a27b25372d32cc550bb672e754d46a8a5b250338cda97a0b6d1d64fe731a0c4615b07", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Enigma", "colour": "#C59CE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Phonzy.A!ml", "colour": "#5EFA99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445782, "uuid": "a2a29cd4-a30f-4c03-8251-8ac103813255", "value": "T141462314A94C568EE2A76EBC73A4E27087732EF1B54B0705ED7EF52F1A36C826D01D12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445782, "uuid": "6563c44a-7108-4510-9aef-e0d49c111193", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445782, "uuid": "fc581f65-b4ef-47bc-ab4f-eee823b65719", "value": "98304:mteBNq/4SMkRtd30UNFYazugJjjIRHAf:mteBJlS9DJX+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445782, "uuid": "49f9cf03-34a0-4858-8969-0a7ec4d51e80", "value": 5760000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445782, "uuid": "8f0ed9ea-3949-42ac-911e-462b1d23a5a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445782, "uuid": "1369d7b9-30b8-4236-a7b5-2d85bd012c95", "value": "\u279c\u70b9\u6211\u542f\u52a8PCL2\uff01\u5f00\u542f\u6a31\u68a6\u6e90\u4e4b\u65c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2d282e-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452673, "uuid": "76642a7d-d232-4113-8b53-bc12bf68f294", "comment": "Malware payload (Mirai)", "value": "f2d8c9b493b1e411edd398128191d7b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452673, "uuid": "93e95690-ffa7-49f8-937b-b09ae6867e05", "comment": "Malware payload (Mirai)", "value": "9365e14013802f162a48894dc265819e74f58a9e873fd9d60dba99ef087444fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452673, "uuid": "b0b2dce3-a867-42e9-ba36-f4aa7023492c", "comment": "Malware payload (Mirai)", "value": "aacf49cb7bf745b87db1f84eeb0b642ec2521246", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452673, "uuid": "04927d6b-3663-4c9a-9213-48e51c05278d", "comment": "Malware payload (Mirai)", "value": "772c2692e7ff370e98249fc6321e90f52ac6c878be065a80fbcc922011b97d4140b3b5c50d82e957add7ff8d751fe7c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452673, "uuid": "372cb4e3-66f5-4fcb-8634-0edf5b7ed008", "value": "T1BC931A81F8C745F6C807493450A7F33FCE32E47A813196ADEF99AF36DA77601911229A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452673, "uuid": "c7c9cebf-e87b-4172-a66b-5c81644e0ae2", "value": "1536:8qut0gR4/HEI2E1pMphR66rAm1XJmdfptWxix9FMWY+KDYV9Q4geDgn:8quugR4H2E1pMrR66rAmJQ0UxwfDe9Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452673, "uuid": "d6177a5d-8a26-4446-9995-626d63c7a447", "value": 90896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452673, "uuid": "2f37884d-b64a-4a3c-8f9b-8b4e089b0ae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452673, "uuid": "c3fddd6e-acc0-4835-94a0-2a6ac7dce3b1", "value": "MMaaRRiiOisecTanee.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac5ba43-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772465127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465127, "uuid": "a8680c05-2db7-4356-94b0-45b6e1bef908", "comment": "Malware payload (SalatStealer)", "value": "1fd8259434113d45891b4dfd6e28a46e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465127, "uuid": "c6638241-b3a0-45a2-a384-dd6070f6e348", "comment": "Malware payload (SalatStealer)", "value": "958e38bb484e6692fed626182dde76c56d0db9a2f15bd886791ba478840e101c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465127, "uuid": "b321433b-58e5-4b79-87c9-16f156a05f2a", "comment": "Malware payload (SalatStealer)", "value": "ef16ca69a36401e6eceafda08a34b2ba7e3a8b6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465127, "uuid": "cf0833ed-8f9e-4487-937a-395fabba7153", "comment": "Malware payload (SalatStealer)", "value": "f069b65de1a8e5423f7106e82fd5d9ecd6811d9ab6165231389a00ca5d8a429122e86523f93292411b5dd2a2c6747987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465127, "uuid": "7da67ec5-c9e0-4c1a-8931-6fb5f8b55a60", "value": "T145E533231290741ED289FA7273966080E370DADFDB9DDB4643B6A31F9BB7C562241837", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465127, "uuid": "fa880007-948a-4137-b463-3f35923e60be", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465127, "uuid": "92a6bc58-a07e-413a-bb2e-4700c3d75de7", "value": "98304:Y0kjSq0SVCbhtRdl5bk/sk+TfjV6LmqBUTm/:YNSqt6tPl5Vzl6CqB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465127, "uuid": "f6fb05b1-ddf1-4453-8901-2bfaad498170", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465127, "uuid": "30cebe07-2ff6-40c4-821e-124f5e01860f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465127, "uuid": "2c73acbe-088f-4a2a-acd3-e73082329493", "value": "antivm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f206d0a-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452679, "uuid": "fafc5c3e-d55e-41ef-8adc-8ce556ad17d6", "comment": "Malware payload (Mirai)", "value": "4522196e77ad987e17e05f150c32597c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452679, "uuid": "01a549ca-c143-4722-a3af-095af6abe33f", "comment": "Malware payload (Mirai)", "value": "959b70affe83d501ce0e054d080ac35035825ce1aa01ee3342ac9546bfb05b68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452679, "uuid": "f837cd0d-166e-481e-8fdc-f5bd036057d7", "comment": "Malware payload (Mirai)", "value": "b50ff81656294efc41f20114a39cbabfa650f10e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452679, "uuid": "ada316b4-b3ee-40cd-8b6b-d12128ec2e79", "comment": "Malware payload (Mirai)", "value": "bfda32e2a37e81b006ebc7cc8a819176cd772b0803fa2357a639fb18e017381d942b9015bbf4be145854f991e86bde2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452679, "uuid": "5f0e1018-2ffe-4f3c-bffd-d60947f51487", "value": "T17B831982BC41A629C7D01377EAAF508E3311B7DDD1DA3242DC254FA47ACA91F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452679, "uuid": "c39ddcc3-69e4-48d4-bbf7-b73d8e2080c2", "value": "1536:yPjwUUaianjKST+TegqUkyKNXECsvkUEwYCB8t46zG1nef:yPUUUazKeCIyELy84MG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452679, "uuid": "e7c7507a-64e3-4221-8842-d8af99b8a79a", "value": 81564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452679, "uuid": "05c45230-a6b5-40ff-84f2-8ca108a2743c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452679, "uuid": "c16224ad-6fb5-40aa-b0ff-0cad95e694bb", "value": "MMaaRRiiOisecTanee.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c302b563-15db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772416903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772416903, "uuid": "b46f0cf6-413c-48f7-b276-cbee3589c163", "comment": "Malware payload", "value": "d519acc046eaca1c7c08cc9762022ffb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772416903, "uuid": "34f60ccc-cb3c-498f-bada-4fff6f13696d", "comment": "Malware payload", "value": "95ad7e3d5c15a7062147fe6f45848ad1cf7cd39e5de90ce0fbd6e0abad86217e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772416903, "uuid": "7e90800e-c2a1-4174-bb2d-97b6c67ddea4", "comment": "Malware payload", "value": "20d5642f40e1d0bd4e777983fd14251b4a62e3e3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772416903, "uuid": "75919bba-52c4-4074-aa72-c233c5d393fc", "comment": "Malware payload", "value": "0220505686e3406fd10ce0a122f73efc133eeafb006f6ebff91092838c84bc68ce2d434f4d4439081dffc2f929d48751", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772416903, "uuid": "66ce2641-562f-460e-9f17-007f888168ae", "value": "T1E7F72356E2F900E8D5BBC0B8C6575517EBB1345913309BEF66A48A692F33BE06E3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772416903, "uuid": "1b5ec28b-65df-4e9a-80a9-f97347720da5", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772416903, "uuid": "a02cc122-70a7-46b2-9597-30f5e3e37e77", "value": "1572864:7dWJo/Q6fhXUqH23Vxczp/FwWcMzFBbLCpRIv0T:7OohuRlSzptbcMTbLCpRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772416903, "uuid": "77ab5b75-e424-4739-aa88-2aa62909b8d5", "value": 73437442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772416903, "uuid": "2158eb34-d196-4260-8017-1720a7bdd47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772416903, "uuid": "003fbb57-f528-4915-b25d-73e3c20f4582", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0976a92c-1626-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772448804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448804, "uuid": "529fbf8b-2733-44d5-9da3-bf35624159f4", "comment": "Malware payload (Mirai)", "value": "df430287b84049aaa691fdf0e710799f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448804, "uuid": "5c99ecd7-16f1-4756-9c3f-6f4826eb9543", "comment": "Malware payload (Mirai)", "value": "96edc54691cdf5f3a16b54871583e3a0ba134b92c12ae1ef7332db3dc6b7b189", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448804, "uuid": "abe7d23d-7c12-49fe-8881-2b085388949a", "comment": "Malware payload (Mirai)", "value": "a74a56cd9af6f82b831be2e77ca350d7ac5fdce9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448804, "uuid": "a0aa6997-699e-4f3b-9aeb-9903f43aad1f", "comment": "Malware payload (Mirai)", "value": "bc088de671603278cbfe9d00e4aff26dfa2b93fc8d17accfefdd2b7fece09ab69b3294ab4ae2ab1a5a6bcb3920b07be1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448804, "uuid": "1532a9ba-210f-46c0-9cfb-72adb5cf4524", "value": "T1F9B33B376251C97AC08356F426EBC5729D13BCBB0B32319A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448804, "uuid": "af7e97b3-c55d-4f4d-8ef3-82b699361c5f", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAJ+TRCm7FnVqfJXFWbNb:T9a2aLqkrMUsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448804, "uuid": "d9242e45-63a0-4114-96bb-95a609268df5", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448804, "uuid": "91e4dff8-3485-4994-a11b-1e64af100447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448804, "uuid": "9f321110-d15c-4fb8-83e9-47db19cc6823", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d86ba8e-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444731, "uuid": "032374b3-52d7-4783-9c5a-cdbf934299eb", "comment": "Malware payload (SantaStealer)", "value": "8ca4e9984a3072769b380484b6d8ec46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444731, "uuid": "72a177dc-ca3e-48db-b9b6-41fe9a741772", "comment": "Malware payload (SantaStealer)", "value": "971716d5e4ffe417036b5c64e75beab44c295c5f9b49005b60d37f2ae79972a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444731, "uuid": "2bceeba2-c3b3-4947-82d1-e5b77ed2aa07", "comment": "Malware payload (SantaStealer)", "value": "fa28ab39c70722b9f709e8bc024f580b2608d0ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444731, "uuid": "72941f4a-c702-4178-9af5-b1ac63829a1b", "comment": "Malware payload (SantaStealer)", "value": "efe23d325d0b7e4838b3d80c48382fab3c4d07ffd6c652eaf49fecab814ba138bbce15ca44de4ee79be77f982df4f319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444731, "uuid": "e96a5ee6-8305-419b-b036-24ca0097243d", "value": "T1DDC59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444731, "uuid": "54f7cb32-4e31-4f37-b21e-62b4e016baec", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444731, "uuid": "2caa13be-d986-4547-9359-b2ddcf9ee1f5", "value": "49152:tavY1Sn5eVNojWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlC1sdGW:EY1abUevc+9sdBg4x4DPPnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444731, "uuid": "03811d55-8f31-4403-9fac-15f671338fc2", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444731, "uuid": "9f4e8191-d47f-4197-8672-b9ab0afea067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444731, "uuid": "24bab18e-4738-4a5a-8cc7-6b98407676b9", "value": "20260301_211045_20260302_001044_W5544DL511V7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a84090-1656-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772469629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469629, "uuid": "9e40abe2-ccad-400e-ab88-43589bc4a73e", "comment": "Malware payload", "value": "f0e55c6cfca5923f99dad7f5418f719a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469629, "uuid": "a72f7c7b-3473-48c2-a8f8-8fffcf00aa9a", "comment": "Malware payload", "value": "974d7434fbf494eb71655f0b7b0140a8f4e9805c0f413a1318724dd2ea9bb734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469629, "uuid": "9b8de91a-9290-4181-bc1c-a3272c72a263", "comment": "Malware payload", "value": "c357d31ec84b83e9957aa7b4f7a43b22649c5f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469629, "uuid": "94d36811-e6a8-4bcb-a605-c41957c7d1d8", "comment": "Malware payload", "value": "39ec5fc31aa8b5949dad00c412e3199deb72e5f8fb4ec2ca2c858d16ab8874f3d5d3eae0d9ddfa81dcba6ab337f022eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469629, "uuid": "7352c4fa-6bb8-456b-9947-dc127287bc18", "value": "T1E2459E56A7A440F9D1AFC178CA56460BE7B2B445137097CF13E08AA62F23AE25F3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469629, "uuid": "0901909d-39b5-4db3-8eb1-b12e8af89e4a", "value": "a21161adda12d436de4ed9210ace2276", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469629, "uuid": "46a13c8c-affd-4d40-9a06-1f8957b52f46", "value": "24576:Qcdw5m4Jwg8CIAmwT7ignhwQzuo7N/nY7ObLJCRPN0Jbh0lhSMXl:y44JBiwTevQzuo7N/nY7OAR6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772469629, "uuid": "94f36a46-61b6-494f-8dba-ca5f771bff3b", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772469629, "uuid": "20a928f9-211f-49ce-b538-01fab1786e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469629, "uuid": "12043e82-e22d-4cf9-9eff-dab972d571ed", "value": "974d7434fbf494eb71655f0b7b0140a8f4e9805c0f413a1318724dd2ea9bb734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d1c7ab-1667-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772476846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476846, "uuid": "3afa299b-a101-492c-9cd6-816064ca5dd9", "comment": "Malware payload", "value": "f9644a9b7c2969eec93f9814d2147bbf", "object_relation": "md5", "Tag": [ { "name": "37-221-66-164", "colour": "#44E489", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7496", "colour": "#6E624B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476846, "uuid": "b684b929-366a-4c35-9142-2669b20ea138", "comment": "Malware payload", "value": "98125e882cae951603de80953b2906ffc5342e38751e8a7c7eafbc4516402897", "object_relation": "sha256", "Tag": [ { "name": "37-221-66-164", "colour": "#44E489", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7496", "colour": "#6E624B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476846, "uuid": "4af1b43d-a10e-476e-8462-7a2c398d76a1", "comment": "Malware payload", "value": "5b4acb8253ce774c8783e542a3352d70249fd0fb", "object_relation": "sha1", "Tag": [ { "name": "37-221-66-164", "colour": "#44E489", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7496", "colour": "#6E624B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476846, "uuid": "750382e8-1891-46ef-93fa-0160380ad94f", "comment": "Malware payload", "value": "1df44d34b605d533b2382c9aeccb3ee211f6d1b84b18bedf9693436df594dbd7cf9e981e31046252c6bd47e70b91e213", "object_relation": "sha3-384", "Tag": [ { "name": "37-221-66-164", "colour": "#44E489", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7496", "colour": "#6E624B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476846, "uuid": "839886e6-84c5-4b51-a11d-284e66fb1d8e", "value": "T111E63314C1279E872EF4488F9DA5319278400C51A72456F8333E7EDA490BE9E5EF8FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476846, "uuid": "9cc24182-db86-4cda-8aba-84be57949518", "value": "393216:5YW/TDfwDIfDQ4/Y1zypPusA5EG+9VgMd5FaOqI49vCZBbu:5JfcNRdGG+Lg6Ox0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476846, "uuid": "16d3c92b-4c4c-475f-be92-773c297b1c84", "value": 14615283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476846, "uuid": "a3651b4f-baf5-4681-af84-ed62642871b8", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476846, "uuid": "4ea3c7f4-99d1-4886-903e-a8b6569f6f99", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71858661-1642-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772461005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461005, "uuid": "b9d8e76f-f099-4816-b672-4f068e780afc", "comment": "Malware payload (Mirai)", "value": "15f9186f059fc3674482613fe83914fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461005, "uuid": "03079fd4-b116-4b9a-afe1-4b9f7adc5766", "comment": "Malware payload (Mirai)", "value": "98bdd7caa7c6e010b0f6df0ceb2c470f8e64cd3e69fb5ccfec262cf396f055c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461005, "uuid": "836be116-ce1a-4288-9f7a-7cf547b1711f", "comment": "Malware payload (Mirai)", "value": "c054523a6468ccac0edb7ee8a945fe31f83f5466", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461005, "uuid": "b42d1d0b-a6a8-4480-aaa7-4803844d52fb", "comment": "Malware payload (Mirai)", "value": "2a27d9c3f569b7154c3a3912ec895cffa34aaacf9127ed86ca379132d310df0dd728419037164bfe4200f45a95280abe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461005, "uuid": "b38c4f18-38d4-4401-aa70-6586e4c62483", "value": "T12D831B02B70C0D43C1A65AF02A3F17D1F3EE99D121F4FA88255EAB46D175E33518AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461005, "uuid": "6f7e31de-38d7-4440-b21d-c23ca4af1f91", "value": "1536:hwU2ssc7Hzx1xm7DrIMz6I+Cus75xPtVXd4C7JGSSuJIZ/6+Um4qwbZny/:+Unxu+Ioupt4C7ASNJFOwbZny/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772461005, "uuid": "fcf15e72-2c4a-442b-a0bf-eb70a7c7a323", "value": 87468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772461005, "uuid": "08e4b124-04a5-4876-ac13-a11f39699da1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461005, "uuid": "5ce04215-007f-435e-a1fd-ce71269fe7ab", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d5cd34-1615-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772441608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441608, "uuid": "7186777c-6f1b-4db6-94f6-60012d859286", "comment": "Malware payload (ConnectWise)", "value": "ef52fc7ffac756e37bc71c09f9f8c6c4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441608, "uuid": "a324bbd2-ec82-499c-aba7-c1c103261772", "comment": "Malware payload (ConnectWise)", "value": "99020d587049ce3bcec5d07e636bd47a30f552cb3d1ceaa2aded7e01583dae13", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441608, "uuid": "b78d066b-69cd-4069-bc93-b62ac7c47f51", "comment": "Malware payload (ConnectWise)", "value": "1bdd72da3ee2012fb92501aac3952684f1539701", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441608, "uuid": "4d561662-b75d-4ab6-965d-341d8609d40c", "comment": "Malware payload (ConnectWise)", "value": "87aee86ccbaa6c7bbf7da576e748486648fe7669da55fe78762c68ebd6921cf0e785a27b283851f6c60df55ba0e24bee", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441608, "uuid": "10bbacb6-b0c9-4e58-b779-89a304c1fdaa", "value": "T10A646D11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441608, "uuid": "5ef779d2-3b3b-4d9b-95ed-91743df8bb7b", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441608, "uuid": "eacacb17-7066-4017-922e-35e18903a967", "value": "6144:lmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:Q1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772441608, "uuid": "a5caed14-1cb6-4158-8373-70f94c031c8a", "value": 312592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772441608, "uuid": "28592818-5307-4a67-ae14-c872c3e788e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441608, "uuid": "56f739e1-613f-42c7-a7a7-009178550434", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8305395b-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444713, "uuid": "66069147-2c62-41f8-a5d6-33220fd5bb00", "comment": "Malware payload (SantaStealer)", "value": "cd99e8551c24c38f9829ba1a03497b20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444713, "uuid": "57a6473d-d067-4231-b345-648dfa2bfad8", "comment": "Malware payload (SantaStealer)", "value": "9937ec0f4fdca2630d4519e54d638a677057574c9f80c37182d205f2bcde09ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444713, "uuid": "2ca0d45a-79a0-40fc-91cd-4c91f7e30497", "comment": "Malware payload (SantaStealer)", "value": "d41f004a19437a1d2530e51fd8fbcd19592ffd35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444713, "uuid": "28f419f2-4cd8-4a1e-9cfb-cf34ab02d68b", "comment": "Malware payload (SantaStealer)", "value": "b5b0c580e0fd808127d9d3b792272a28e6b67b7f9771594ac92ba6860bc2bddab02de04f2b96393d862c8ab72d9150d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444713, "uuid": "23c1d5a6-5700-4cd8-8297-2983e01bd088", "value": "T195C5AE0AF1534AD5CC9BC0BC839B7131EA357D79CE282E9B17918B613E45B807725F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444713, "uuid": "f5f1a029-f7dd-431b-9555-97f221d2e5be", "value": "aa756d232dc6341b93de4ea08c5fa368", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444713, "uuid": "fd8279dc-5060-44d0-b0c2-e6ff630242be", "value": "49152:oKVxKbdjNu40J41RC/oKCQOydhYMJucKK6q3MqCc/9kcOlf:oBbIMC/oFQOyrYMkcKzjw9k3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444713, "uuid": "ae1a7849-d7fc-47aa-8a24-e290dc9de09b", "value": 2636288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444713, "uuid": "4eaf2824-42b4-464d-b9c6-21ea35be9883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444713, "uuid": "cf28560e-94da-433c-a111-cd1fb8046fca", "value": "20260301_190144_20260301_220011_602S70WU84QT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719c7830-163e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772459287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459287, "uuid": "d27d4119-3916-4d59-bbe1-2c482b04eadc", "comment": "Malware payload (DarkTortilla)", "value": "7891aefebce1f5647ac2d9f82f8772e9", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459287, "uuid": "20d07cf4-fd6e-4054-9322-220757b116a9", "comment": "Malware payload (DarkTortilla)", "value": "9992e4177343a1227f6a60f77f6556f5df92b30ce35b5521ee4156bb4fabb844", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459287, "uuid": "5053ed2b-f508-4ece-a6e8-70e445e4ffa0", "comment": "Malware payload (DarkTortilla)", "value": "e8990eddd0fb0a9fab0790991d62353351d56671", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459287, "uuid": "bbc6b231-f0c2-4607-bc30-3eb7a4c090dc", "comment": "Malware payload (DarkTortilla)", "value": "5dd504a301071e3019e1d64e30f59f30066de2dabe48b33d27f71f8566d39e6c85836243a7400d897aed666c330d90df", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772459287, "uuid": "fa478f64-aac3-4aa1-ae25-1860da9acd04", "value": "T15335E00A5EC32B94D5994F3CC2A600A867F0D65B4211F76F6FED12F4DEA3F4ACA06452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772459287, "uuid": "cbf16193-85c4-41fd-b112-6d1f6cdc547a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772459287, "uuid": "20e6f1d4-9db8-4665-b27c-39efeb3013bf", "value": "24576:H7UqTPoNOYwMWuHmQL23LUnCEFvl1U/lugn:HdTPoPWuHmQL2bUCETUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772459287, "uuid": "00d14dd2-7f61-4df3-9ff1-66122db32517", "value": 1157632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772459287, "uuid": "0a54466b-dd96-46ef-bcc3-dde3f370999d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772459287, "uuid": "6736a6ff-979c-4722-a221-1e3bc247f54b", "value": "Adjunto Informacion de Pago De Grupo Financiero Banorte.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308f45be-1626-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772448870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448870, "uuid": "2248e15a-393e-4dc4-8d3a-b3e91ff1d480", "comment": "Malware payload (AgentTesla)", "value": "f9d2151992f2dfced5669d243bcb13fb", "object_relation": "md5", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448870, "uuid": "00ccfc5b-cf08-4bc7-9660-a62314fe3e15", "comment": "Malware payload (AgentTesla)", "value": "99c6f209e4e4adf3502472112f7172ede1a5dbf829c59d593449605ca2698d49", "object_relation": "sha256", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448870, "uuid": "3bd97c5b-9016-4971-842e-7738674b57a8", "comment": "Malware payload (AgentTesla)", "value": "91166b7a660a54f63385eae811e93e28f66c0263", "object_relation": "sha1", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448870, "uuid": "eaec3da2-b51e-4e92-923a-48e4aabed98a", "comment": "Malware payload (AgentTesla)", "value": "362b6939a01731aaeb28846718a17a848e2ba3064917faebaa1c945eb199748d156abd3b91ee97a2b1ecd697aab9db84", "object_relation": "sha3-384", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448870, "uuid": "11e4acde-380b-44e2-b13b-ef97890b7ddc", "value": "T12B13C738CB91CE484FBB55CE2C6E9961542F4AE75A27522CB1ED20D18B14FDE241BB83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448870, "uuid": "b58130f3-571e-4788-ba12-b050f0e25c65", "value": "192:yXRucRuJXFXxCXRXTX+XtXsX/Ru9XUXQBYPeg1TUU:Au0u8utBieg1T/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448870, "uuid": "7c17610b-ebdc-4e9a-9703-eec83fcabb56", "value": 43532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448870, "uuid": "c313a34e-bdc3-4f74-b36c-4bb3329d2161", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448870, "uuid": "b4b38ca0-ad46-41c3-ba6d-62576824a37f", "value": "ec.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122805fb-1666-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772476307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476307, "uuid": "27ea5190-0ae8-4c53-aee4-ad6f550f1b98", "comment": "Malware payload", "value": "8e9a75a9f8e1bc5d30f45d33eabae6bc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476307, "uuid": "b83188b9-ed2f-40c7-8963-19b36d2f2293", "comment": "Malware payload", "value": "9a7caebf876aa6addee9de8a1acfb274bed980759e124dc48896891aad612093", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476307, "uuid": "b2c9065a-0b83-4881-8814-c6e7e01a6210", "comment": "Malware payload", "value": "78d4e965d9b5e5264157bd6f80cac5fb3f8efea0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476307, "uuid": "298fa3f7-03ff-46f0-87d7-74abaf34085c", "comment": "Malware payload", "value": "8097f99908423a7bedbec39ef6f95adb9e5e4c7b80624a067661b0ea01ef291b040d7245cfba076d9158a843b75c4b4a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476307, "uuid": "297dfdec-5f14-426e-9b29-d65020789e43", "value": "T1C341AF9B016407F79F839A34B77152C0E3DC0094A4E69E27B548CE129E7B8FC6DD9744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476307, "uuid": "ea61659c-e1ce-480a-b7f3-da056d9a3d70", "value": "24:Qci1vd8jOMkO51rOzOtiO5OcOeXEI2rxkshIW/yUgIVLj4fcnWn3LbT1VhPPPV5D:Q5d8y0iittQ/4gTV2CULPhnbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476307, "uuid": "8af093be-0f82-478a-a287-9551cf2e6035", "value": 2269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476307, "uuid": "46352941-51a7-46f3-8225-52da09912db8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476307, "uuid": "61ca1c5e-e635-4e3a-a39e-2d4a489c8596", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c6def3-1641-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772460770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460770, "uuid": "c112c581-1ef9-4dd3-8c73-f05c46968119", "comment": "Malware payload (Mirai)", "value": "3848495dd954ec5db9376f7f00c4db63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460770, "uuid": "741611e0-dd7f-46e5-9b7e-ab549d0928ce", "comment": "Malware payload (Mirai)", "value": "9add9e647a926c68bb82c2e922c206d788702a706f4cfb63651541bff8ed3e4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460770, "uuid": "850829e3-79fa-4404-bc14-f06c3f2e8251", "comment": "Malware payload (Mirai)", "value": "f4f268a4ab404edc4fd8b7d853cc561446c83423", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460770, "uuid": "1a519274-e1ba-4334-b39e-6755d231a729", "comment": "Malware payload (Mirai)", "value": "ccb1902423c97fe2a86f43fcf9ca4952187fbc220581afc5d21293dfa7ce15b4201c341f238e5228b6052a23b8388896", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460770, "uuid": "aa8519b9-4613-44cd-92e0-deb24ba343f4", "value": "T13A46D914AC842BE7C06C8F7490EACE5662745D144AF14A3626A4FFACBC762787F47C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460770, "uuid": "793650e7-f3e7-4aa0-83e4-0b77a5c960aa", "value": "24576:riFzXCcnUFNLQqAe+sTb1YFo4sU1jknGcf7/RjNHkxjMJcL7I4p0fX21k/RjNHk3:It+Ms17oyejgKQf8t6D4Z6zKLAzZBO2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460770, "uuid": "c9e1cd13-b239-4e9f-a8a2-5df0a0130ab3", "value": 5636279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460770, "uuid": "de1a2ee8-e8e8-4bcd-83ee-69c30ad46deb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460770, "uuid": "bb50c7c3-960a-498e-b845-97c2320d34f9", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a289e6b9-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444766, "uuid": "f4edbe49-0d8b-4177-9351-27f57712cb26", "comment": "Malware payload (SantaStealer)", "value": "289cca05ba4a0a66dd24348d9a4a7a36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444766, "uuid": "5b138d98-702a-4373-b8e7-c7a161009eff", "comment": "Malware payload (SantaStealer)", "value": "9c4b11ae65026fcc0484a885f8efb6e87f156d53b3ac01f7bd72bad58cf4d08e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444766, "uuid": "8aecc20d-d75d-4b0b-8722-a010800ffeab", "comment": "Malware payload (SantaStealer)", "value": "17340195c82744855e4b0ed87adec4bd711db729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444766, "uuid": "dd2e2e59-f736-45a8-9fe3-9669fc8a02af", "comment": "Malware payload (SantaStealer)", "value": "1bc82d872b21d047c7bf4e4ffdd5fc43f2825011e6c71320863a82bbca62973b2a1328fcb71f44b324147d5a7991172f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444766, "uuid": "b280cb8c-12f2-4017-a48b-96c46dda5ad4", "value": "T17EC59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444766, "uuid": "b8a35b0a-2142-4d27-a234-5dbc9fc8c203", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444766, "uuid": "c7e1da68-7d6e-45b3-bc30-55affabcd631", "value": "49152:BavY1Sn5eVNo6WFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCUsdGx:QY1ayUevc+9sdBg4x4DPPnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444766, "uuid": "c83fbf0f-82af-4fb4-90fd-5678adac2254", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444766, "uuid": "3370cb88-29a0-480f-b690-3e053922e3bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444766, "uuid": "1f9c5e3a-970a-4ee9-85ad-8278793d25ca", "value": "20260302_084145_20260302_114144_9EZN7733W1Z3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229e2cbe-1688-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772490937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490937, "uuid": "42158589-d6b7-4301-868f-d3a7bd348fc2", "comment": "Malware payload", "value": "1eec060e3c6c74be84c0eb8333db0cbf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490937, "uuid": "7fc99898-6cbf-46a2-87a1-21eed06fc9ba", "comment": "Malware payload", "value": "9e05cb338fa166545e05a3ddedcf99bdfe3b14825310f46d785bcf9cd477c867", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490937, "uuid": "eb532119-c929-419f-bb32-db04f7ba78c8", "comment": "Malware payload", "value": "1fb2c9aff42126e888f7b5e9762cde5da3ab1c62", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490937, "uuid": "06bff2d3-7994-4173-bc6c-c362e29ba7a8", "comment": "Malware payload", "value": "dd5b22275c87fdaa3819e9999162629a8af5f56eea5fcdac719671d866b812df1479333ae4deb789f44d54648b48b91c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772490937, "uuid": "073bcb8a-3ebe-4599-9fd2-6678df0782b7", "value": "T1ADF72356E2F900E8D5BBC0B8C6575517EBB1341913309BEF66A48A692F37BE06E3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772490937, "uuid": "0f35ea2b-31c4-4677-858f-467e5ea5aeda", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772490937, "uuid": "06a2a111-aa4b-4d7b-9658-0ac09bf18da7", "value": "1572864:GNWJo/Q6fhXUqH23Vxczp/FwWcMzFBbLCpRIv0Q:GeohuRlSzptbcMTbLCpRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772490937, "uuid": "33871e87-5023-492c-81f5-f7656add47a8", "value": 73469171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772490937, "uuid": "3c961e09-0b34-4a96-ab57-c53146810ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772490937, "uuid": "7494e257-6db8-47c1-a5c2-a2f718757b6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11724bbd-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476306, "uuid": "0c9ccd68-b420-4ba2-ad7b-8925776a6a52", "comment": "Malware payload (Mirai)", "value": "b7602561ab169a58172a3d8a0b3fc7c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476306, "uuid": "c6174aaf-424c-4e26-a6ca-b05544f95189", "comment": "Malware payload (Mirai)", "value": "9e0c49d81c9b5e13aee1b6d294651473e96b0c876ffc1552d10ce5cf017a509f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476306, "uuid": "bd8a5998-4f43-4c25-9adf-5b590da55de0", "comment": "Malware payload (Mirai)", "value": "945bb3761009cb6fba06ebb67bbb815309c00b0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476306, "uuid": "7da8b10a-8de1-41bf-8541-577ca963680a", "comment": "Malware payload (Mirai)", "value": "913e496893f97052ed583284830e3c4fb6234509320dd00a666df7c88a3a58add565f2e0d5885b421dfcf9242a1bb44a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476306, "uuid": "8f6030c7-e822-45de-98c9-c28762502b38", "value": "T136530A56FD52CF03C1C311B6BB9E4A453B166BE8E6EA3203A534BFA137874C70D26A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476306, "uuid": "7e278695-61a2-40f0-a837-6721115ce18b", "value": "768:oZlUnRdD5AbrZ4StEv9z2PYaWLw/3KMDu1vrC6nUDv0CdGOJ6YWyn7CMllNmhdVr:JnoyuYaUoaR47dGOJBnbNsdVmBhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476306, "uuid": "42f0c1ef-1bc7-4196-a4f3-ee8a6522dc0e", "value": 62208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476306, "uuid": "c36306f1-f0d6-4799-8545-daa957bd5678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476306, "uuid": "44638d8f-86b5-406c-aaa4-280ccc50b954", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36561c0-163a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772457706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457706, "uuid": "bb612484-9cbe-4821-b8e4-2b30bac75811", "comment": "Malware payload (SalatStealer)", "value": "37683bd1e8f8026e212856f4cfec6722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457706, "uuid": "e4728fe6-e67b-4040-94c6-75e024d1fe39", "comment": "Malware payload (SalatStealer)", "value": "9f0baafa4537b9f18e3c12a1999607ba217b2359e6646cc84920466f4c5aead7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457706, "uuid": "20a06b02-f482-404c-bda0-4664eb118a9f", "comment": "Malware payload (SalatStealer)", "value": "2350fbd86a427c000e6b56c0facbb38bdedc790c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457706, "uuid": "33ab0b9c-d3b9-4875-b4ad-1d36f49878f7", "comment": "Malware payload (SalatStealer)", "value": "abcba4785d74535223b0a32141bb1e2b336d51c0a6883c512e72a29545ef9e60703416786eb394c82fddf689828292d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457706, "uuid": "62597ab8-c93b-454c-a71b-a456340c4aff", "value": "T18AC64B41FA8B54F5E9035D32405BA23F23315D048B38DBD7EB547B2AF87B6922E76209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457706, "uuid": "c493107f-f913-4c80-a6de-1188a4c4ade7", "value": "49152:cb24HuRh3BIkDjAzg64hlZx69+FDHe5UwC/RXf3QNkesw42o/ik/PBh8nvac3/vX:SdHuR31juK/Xf1esLR8vHP37u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457706, "uuid": "b550a4f1-d378-4840-a58c-71059cbdc97f", "value": 12108288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457706, "uuid": "d3ed4497-5913-4695-b3ca-adbde4ebd95a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457706, "uuid": "4f37caf9-a6c8-42db-84dd-c0d1c50815c1", "value": "j6ay3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905e54bc-160c-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772437864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437864, "uuid": "69e65773-971b-48f3-b27c-87548d58f716", "comment": "Malware payload (AmateraStealer)", "value": "035e25971db208a8c714dfa46efad11a", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437864, "uuid": "d692b0ea-4f43-494c-9bc2-abf2dbbdeeb2", "comment": "Malware payload (AmateraStealer)", "value": "a01ef6d6015536fad1fbeb22c0c170c479265de002f5df06c0b7cfa9996673a8", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437864, "uuid": "d15b899f-18f4-4713-8880-b25324458fb5", "comment": "Malware payload (AmateraStealer)", "value": "cc2a31e4675e6172eaae60c57b7d135b5831ae1d", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437864, "uuid": "1beb4945-f9ee-448a-8450-2e94cbdaac9b", "comment": "Malware payload (AmateraStealer)", "value": "0fe7e9a9d82c205087454240bb90a7c3d0f54e3c3ea1bc3e3cc9b0b06ec87a8b693df55d4b2a8868052c7816785598c1", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437864, "uuid": "4fb54686-4134-4943-9e53-3e5329769c62", "value": "T18D955B10FDC754B2E5021A3669A762AF2334A8050F3AABD7DA447A7EFD772C51C27309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437864, "uuid": "292f3c35-7abc-4109-ade6-efd123fbd9b8", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437864, "uuid": "7c2d356e-cb6a-440a-a56d-7b8d6cc88012", "value": "24576:5S1ElmX2/n6wNFhy/ZV7eW4VPPiQbr1ca07/1T4+5Mk/fgVGkllO1bA/OJ8yX:5SsmenVDg4syKmG8GklJOeyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772437864, "uuid": "781b665c-7431-4b9f-a860-46b8cf6c4ac8", "value": 1934848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772437864, "uuid": "935836e4-c77e-4d49-8364-045eac4104e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437864, "uuid": "d8e27333-344a-4005-b4c1-ce988ca762cc", "value": "035e25971db208a8c714dfa46efad11a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f643254-160a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772436815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436815, "uuid": "2674dc43-23ce-4a76-a99c-8934ed21ad8f", "comment": "Malware payload", "value": "258ddaeaf074c7346dba33e94fc99768", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436815, "uuid": "28cd6c7e-24bc-4926-bc56-759be7b1816b", "comment": "Malware payload", "value": "a05a7a08c02674205af706505ab6f85e2092e9b2034e61c9c394cb2a5ac0975d", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436815, "uuid": "e736e1cd-d291-4f2f-b86d-f949b56110b7", "comment": "Malware payload", "value": "791f618ad5e5138df39abc9497d6c1606a91f43a", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436815, "uuid": "05fffb42-f1bf-48f6-b727-6243927c6c56", "comment": "Malware payload", "value": "7ec2abe9fdf16d3ee6db5e72493cb51d2199fd569be82ec49c27eb6e769c32fe8325ea946a5dde62bd32c2ee4d96ac15", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436815, "uuid": "ee8dceb4-7bdd-4f70-8e88-0a9b671b79e1", "value": "T1D2F633D75BA078BEDF366373A05846B2A83356C0C8793B488356417F14AB7C9A1F1F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436815, "uuid": "cb6c203b-d9f3-4778-92f1-c9d38f9d8858", "value": "393216:pglebvTJ9LRsPZEeTo37bs5LL56/9hDrB:pdLRGvc3Ps9V6/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772436815, "uuid": "e1eea9d4-e861-4f3a-bfbc-27d8d9ae039c", "value": 15443157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772436815, "uuid": "94f6a60a-89ce-44b9-961c-322d0bd1cc44", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436815, "uuid": "f5ebae49-1852-492c-b942-588e3056ceb6", "value": "a05a7a08c02674205af706505ab6f85e2092e9b2034e61c9c394cb2a5ac0975d.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e581d33-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452678, "uuid": "1d8b6d17-edc4-47e1-9d69-a9f4e74985ae", "comment": "Malware payload (Mirai)", "value": "2b145376cea0409dd76c322c02c4900e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452678, "uuid": "591bc312-b321-4b9c-967b-4829f0f38e65", "comment": "Malware payload (Mirai)", "value": "a0697f7a921fc61fca27c386b5425c669fdd4ecedbd801e33adc14b4f19eceac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452678, "uuid": "2b2043d3-c9f7-4f1e-bfdb-ea44c12b7057", "comment": "Malware payload (Mirai)", "value": "da6d80e5db3f5ce11e84177ccbb2c95a182a92b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452678, "uuid": "f6958d1d-7ba9-4689-a704-eb14b765ee1b", "comment": "Malware payload (Mirai)", "value": "796dac1a9fa3254135fa737f313ea026185c087c854feb1956cfc9c7bb904f21d0bfd344294b187b74e4a861ffa8020c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452678, "uuid": "d9cbed9f-f53e-4033-9be5-be207c04ebc3", "value": "T119835B46EAD7F9F0CD4609B4106BFB31D53668323121DFF7EBC8B967A9A1601A05326C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452678, "uuid": "75442b34-d905-4da1-99c5-dbe194e48b8f", "value": "1536:2PfGfiOz1mKjfs2ajfYsyGsxuWIF9sdOWvd7/UL4iSbmNgIN:We7saL4sxwOCkpbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452678, "uuid": "804ab7cb-948d-4b29-a1e0-3b65fe3422a2", "value": 86616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452678, "uuid": "ce0d5072-0a2f-452f-99ab-6163230a35d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452678, "uuid": "784916d6-50c6-4fc5-a794-59ea4cf2d20e", "value": "MMaaRRiiOisecTanee.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc2dbff-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772434021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434021, "uuid": "08bfd365-ea90-4cc7-a412-5704516ab5bd", "comment": "Malware payload (SocGholish)", "value": "2e7ab628a4465e21da618eedd59bcd14", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434021, "uuid": "c0605fab-c8d8-4f1f-9a67-9a9979525dec", "comment": "Malware payload (SocGholish)", "value": "a06b40943b4e4d4057756a456e7016b3eae69eeb2c4b1311ce53f5fd9dd7cefa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434021, "uuid": "a019456a-161d-498f-ab2a-359c57aaea08", "comment": "Malware payload (SocGholish)", "value": "6203858998fe0a78bec3fd8504bf76b0963dcc89", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434021, "uuid": "fd1417a0-db74-4015-8731-f5c4c169ad79", "comment": "Malware payload (SocGholish)", "value": "2a5fd1a28b625d9021c0362182ec05e2128db25166cce69e6cfaac1f88f17bb7ec12524140ff69ccf0fff25451319583", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434021, "uuid": "5cade698-8152-442a-8f7d-f47dde45356d", "value": "T104D097DF181C3A186BB6112CA3B3CF2CB08F340A149A4613C45ADA582432AC20C2D1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434021, "uuid": "7c747417-ca8e-49ff-8b0d-f8b373d1ffb5", "value": "6:SpgO9lBxoRWb3euUMHMN8GIdLRDWsEhfGlGAqcY:IHoRW7euUwMGzMNVPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772434021, "uuid": "63c9583b-1413-4052-ab95-35a6ccee2635", "value": 239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772434021, "uuid": "abafccf5-b49f-4751-b40e-e18cf149d362", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434021, "uuid": "4f06a504-fb53-4c2d-ae31-eb5171fa3e82", "value": "a06b40943b4e4d4057756a456e7016b3eae69eeb2c4b1311ce53f5fd9dd7cefa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea75282-1663-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772475308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475308, "uuid": "0a6f5d25-47d0-4f41-9ca7-70e8946b2711", "comment": "Malware payload", "value": "7028757385be9eb686d08809b06cbe2e", "object_relation": "md5", "Tag": [ { "name": "172-205-172-243", "colour": "#286BE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475308, "uuid": "817c7b33-a81e-4790-a1dc-4a51c1e2db60", "comment": "Malware payload", "value": "a0a8bceadf1ec015ab3fb5c18df580438b51195eda05ef8fabf07401029ca81e", "object_relation": "sha256", "Tag": [ { "name": "172-205-172-243", "colour": "#286BE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475308, "uuid": "b7b02846-9a53-40c2-9a5c-04b878aaf8bf", "comment": "Malware payload", "value": "ee9e53bfec3c91d9c8f8facceaa12644c2b600da", "object_relation": "sha1", "Tag": [ { "name": "172-205-172-243", "colour": "#286BE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475308, "uuid": "7b4c9c2c-d7e8-4c5b-b80f-0b7a6ec7e56e", "comment": "Malware payload", "value": "cd27caced50e1ae8c66483573f3954ac307bd0c44debe1bbf93e19dd19d1385983d304f3097e00b6f1111076b1c6e53e", "object_relation": "sha3-384", "Tag": [ { "name": "172-205-172-243", "colour": "#286BE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475308, "uuid": "0d8dcf69-ba15-4dff-abd2-1d96eb84514b", "value": "T11E083390A05A1891C2C1EC3F355D159F43D8E332AAF3BA5CCF7E637EB2D39649A94042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475308, "uuid": "bac956cb-0e77-441f-8eb0-0b1b93678486", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475308, "uuid": "c04b947e-d08a-4cfb-89be-1222bf37e221", "value": "1572864:Hj2um4Ndc2us9uIg5CFZtJttVyt7UQnhoDO2wGuMqtlPw2VjtvdBnmKOo:HjTm4PJuRCH1yVN6DATMN6jFnmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475308, "uuid": "811822d2-e3c2-4c4d-9f4a-841fe92c5779", "value": 79677421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475308, "uuid": "286b8283-6d50-4bfc-aa38-9729f558d5d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475308, "uuid": "ec0ccdd8-6095-4179-a935-7b0bb41bc92b", "value": "CutieCraft Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff79768-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452681, "uuid": "005d9ce5-e095-47af-bd5d-9455abf90ed5", "comment": "Malware payload (Mirai)", "value": "2be7df94c9b9cfc151e7c93444dcbf4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452681, "uuid": "216ff04b-e623-4b58-9e51-aee1caa10599", "comment": "Malware payload (Mirai)", "value": "a114f2d263f633bfc4e4cd531bdad05f903354b108af3b63aaadbd5506feed41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452681, "uuid": "dfe1cde9-46e1-4ce9-85f0-a04d55f43d3b", "comment": "Malware payload (Mirai)", "value": "89565916db5d167ac461180f20ca59f967a47166", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452681, "uuid": "4d22a917-bde9-4223-b6ca-8f89c5ea0a8f", "comment": "Malware payload (Mirai)", "value": "0f37c75482f058aa3695a7bbd9e1b99366f2caebfbf225b9fc90dfd74159143dcf8efbd44e44dd5c4539f552fb18a401", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452681, "uuid": "9bc8b0b3-8bc0-416a-92e9-e69cb3a656dd", "value": "T190B3950E6E319F7DFBAC823957B78B219208379626E1D584D09CED025E7038E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452681, "uuid": "5ddac1ab-ada4-470d-87ce-75e22922ed7e", "value": "3072:er3x+xpNAsh+JySL/BjtfLdkPlx8eNElwR:ex+xpCshOyS/LdkPlx8/wR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452681, "uuid": "6cddc2ba-801c-4f9b-a9b7-067bc43fa691", "value": 112980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452681, "uuid": "1c677177-f116-4472-b408-e3b9339a016c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452681, "uuid": "1afb0284-f417-4395-883c-2d1c44b55da0", "value": "MMaaRRiiOisecTanee.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7e7801-1656-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772469690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469690, "uuid": "06aede8e-8eea-49aa-851e-ff42189b1d28", "comment": "Malware payload", "value": "7640d7b92e831a0731213e1ec19f5b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469690, "uuid": "624e2e90-bf7b-42f5-8ecd-7ddf13de50f5", "comment": "Malware payload", "value": "a26baa817a812fd0cd0a1118c1aea4ce380cc88fa1a762feb644a6263f10d7b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469690, "uuid": "4d3c408d-323d-41fb-bc3a-02ed48f49074", "comment": "Malware payload", "value": "0561e28daba6cb6cb855812d0b4d4771fd1dd2a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469690, "uuid": "cc5e6730-0eab-4254-852e-16fdad680cb6", "comment": "Malware payload", "value": "78ca25099d304c432eb818a1c4ba106b17be2671b4d9078afbee106b294bdc8cb4e3b24eaff47478acaf0a1964d5949d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469690, "uuid": "5c5e0a30-568e-46ed-bafa-bfbfdf59876e", "value": "T1BF459D66A7A840F9D0AFC178C9564607EBB2B415137097CF03E48AA62F23AE15F3F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469690, "uuid": "41a388b8-5fff-44de-8fb1-1bcceb96a371", "value": "a21161adda12d436de4ed9210ace2276", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469690, "uuid": "122ccc5e-00f1-4215-a40c-0fb89e5e3429", "value": "24576:VLOnSKGveLTvCSkYBLSHVOjbDtVRZVpGObDUcYAO/BdWh0lhSMXl4Cn9:85GW+SkAqOjbDtVRZVpGOUzA0xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772469690, "uuid": "a771e6c5-9470-40e8-aeeb-9c7e0c48c492", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772469690, "uuid": "bd6dbfbb-cafe-48f0-804b-bfdef50ae146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469690, "uuid": "23909451-70f8-4819-b6cc-6fd7685ab0cd", "value": "a26baa817a812fd0cd0a1118c1aea4ce380cc88fa1a762feb644a6263f10d7b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1470b89c-1673-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772481894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481894, "uuid": "340af5d7-3f59-45ea-868d-48f1eff6ee89", "comment": "Malware payload", "value": "70a9b537b9b7e1b410576d798e6c5043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481894, "uuid": "170361e4-6d72-48b3-b5ba-06df25d90cb9", "comment": "Malware payload", "value": "a27d53608ab05b5c7cb86bcf4a273435238beeb7e7efd7845375b2aa765f51e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481894, "uuid": "728c2903-23d3-44fe-b654-51d0be9487b5", "comment": "Malware payload", "value": "cb1760c90fb6c399e0125c7aa793efe37c4ce533", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481894, "uuid": "4e1cfe3c-e93c-4171-b8a6-d439d7933bd2", "comment": "Malware payload", "value": "7f443709b75dac95095473aa4ac704dcb4fbb1d9abebf930de4ea916f98b0da5517dade7d18f7f31d03dfc83dad41433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GHOSTFORM", "colour": "#52F6AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481894, "uuid": "97c01a8a-54e1-4065-8a90-f86d96321366", "value": "T1F6F45C422A88C7DED47E4739E4D3919A42702C38A4A8CF576DDDB3FE04773609931AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481894, "uuid": "e88ad98d-e720-4832-9857-c629b748eb18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481894, "uuid": "2f7d233d-3895-459d-ac26-ab9f49843131", "value": "6144:BuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/W:JQL32ikCaUS4csRBse6sfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772481894, "uuid": "807d7f27-bd21-4716-ac73-82e1b31b0ea8", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772481894, "uuid": "4f52abeb-e4f6-4317-928e-5303c82bff7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481894, "uuid": "e91f140b-9b7e-4467-a771-5932063e3101", "value": "webInfo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a16c4cb-163a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772457637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457637, "uuid": "cc355f9d-5875-4d1a-9713-c0420cfe3cdb", "comment": "Malware payload (SalatStealer)", "value": "aa71a12a7619e570ff31f5df1b3415a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457637, "uuid": "d56f0e9d-0301-458b-b31a-dae7a7bb8e85", "comment": "Malware payload (SalatStealer)", "value": "a2bfeb07b0e945e49b374f11c0c27de09a15f4829a9a0781a07e2a6b04f198c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457637, "uuid": "99942739-402d-4086-9daf-ca97f27149a9", "comment": "Malware payload (SalatStealer)", "value": "51231eddf94d16de57cd4c59c72aba1692da02b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457637, "uuid": "d708d263-4c3d-41d1-a720-fb55dd017a20", "comment": "Malware payload (SalatStealer)", "value": "4a621ce1cca76db1003058dbc571eb6286565fcfc23e9d4d5a4d1858d0424d4c9b01d06f8c31208c3410ca66e25e50e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457637, "uuid": "f3a9a400-9369-4a80-bbaa-abd66aca5cd3", "value": "T19CC66C41FACB56F6E9035932416BA23B63315D008B38DB9BEB447B3AFC776C21976604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457637, "uuid": "34a14dc8-3701-4067-b359-4100c44fbc95", "value": "49152:kRvPzfsGuwmenGhv0aG8G3tkLSy1gyLVGW41M10itN8fN+CkSRANv4WkNdik5/EE:w7fsGBGcFo10TfNbLWQgBejQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457637, "uuid": "2183ed02-6db4-4607-9ed5-9dadeb245119", "value": 12108288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457637, "uuid": "a5cceff7-2194-4440-b099-f4c4471f36b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457637, "uuid": "347e65d5-d212-4d3b-a1bf-c92cba90403f", "value": "7uc1wu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67d5a6c-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475697, "uuid": "34b15eed-53f3-4e78-bec6-4949256c98e7", "comment": "Malware payload (Mirai)", "value": "3e09bac130a23b18bdb7b116fc0cab3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475697, "uuid": "c2b7f6ec-9d61-411d-bcee-91fc9c16a186", "comment": "Malware payload (Mirai)", "value": "a338834f2c2dd7ef6fad4b9463f8bd4c8c733c15c36baf595b4841b9b2226816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475697, "uuid": "98f2dccb-aad4-436d-b90c-8bd4e4f3de1c", "comment": "Malware payload (Mirai)", "value": "bb28d0a0690d808e289a11489231258999805d3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475697, "uuid": "0bc53665-5f1d-4ae8-a649-01985547cc3b", "comment": "Malware payload (Mirai)", "value": "f2494975ebfd37cccf6e4901708ae159c0e6773ed40af9211af5d997bd9d5630c0f3674da4dacfd967bd1b57ba1a04d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475697, "uuid": "e1646d8e-64d9-442b-9e16-1d36f5efdcac", "value": "T16213F170E6114592E23C863E5BB3BB6A7FF1037116CEDD126152B8FB5C8E5B8580389E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475697, "uuid": "a7a42478-d15e-49cd-8ed1-11538a1e026d", "value": "768:Y+b19XkdGcvsLV7lYuAXgPliB+8f166AV7dwrDLXtVbTMtr1qVvJgGlzDpbuR1JP:jHdTBloXgQ+8lAldyDJx81qVtVJut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475697, "uuid": "a8640d0a-ef8c-4f20-b495-6cb124c607f4", "value": 43168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475697, "uuid": "036dd1dd-f772-421b-b12a-a11ae6b7b323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475697, "uuid": "91f5e9e1-5f26-4d43-9f26-63fd45b03e13", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588bfa0e-1616-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772442065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442065, "uuid": "72542859-83f0-436c-935f-f1f4104d56d0", "comment": "Malware payload (AsyncRAT)", "value": "53f390b11ed2c77cfa07de9a435edec9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442065, "uuid": "1a47e8be-d4a3-4336-ad1a-58fe0fe42fc0", "comment": "Malware payload (AsyncRAT)", "value": "a3ac6d1646d4afeac978f429073ad7ed91c9cde7199d9b1facf6a84afc6835b5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442065, "uuid": "f05359a4-66d7-4701-9237-8d0b47fcdf7e", "comment": "Malware payload (AsyncRAT)", "value": "e1c091750d2b19121b7f7341467b1889a3afabf8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442065, "uuid": "95a2cc4f-271b-4b82-b0f5-ddbcd42a71ec", "comment": "Malware payload (AsyncRAT)", "value": "101d4491b42ad24642be478a45c817987089ce84aec1828b076ee17cede0ae56bc9c2a79afaa8cb47c59441306186cee", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442065, "uuid": "b7add30d-ca08-4a1a-95a1-4c464061e353", "value": "T16D149E00F193C135F5F315B6C9B68869992CFA111B5999EBB3C819AE8F306E1B931C73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442065, "uuid": "f2efed5b-952b-4cda-9fdd-a4daf221963d", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442065, "uuid": "9a42a3aa-d443-4c05-b4d1-fac375dd582d", "value": "3072:qiIhjzfTofb5F8pzTYci1u51X+uOqB0Xaw8aRHTWmretKADc6YCUxriUtG:Ah7o9F8tT61t8aRHTWm4KQyJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772442065, "uuid": "7f3c726a-d019-4859-bb5f-73b0fc36747d", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772442065, "uuid": "f4b23c12-a782-49ad-912b-ecdc60a20cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442065, "uuid": "32dc098c-0b3e-4740-ba4e-01c1ff3663ae", "value": "53f390b11ed2c77cfa07de9a435edec9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d425ff0d-1616-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772442272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442272, "uuid": "99b803db-aa11-4300-a802-df58235e847b", "comment": "Malware payload (Mirai)", "value": "ed5fd797b333c4805599089710d02743", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442272, "uuid": "b50a6792-4ba7-4ace-9d71-746873d11eca", "comment": "Malware payload (Mirai)", "value": "a40e1720588f474a72a15fd8c7af98eef0f45127976a5a865badb7689882b6eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442272, "uuid": "7f53407c-b8f8-42a4-9d1c-5fd91a6b8b89", "comment": "Malware payload (Mirai)", "value": "097330a634fc3d67ee0f35394bf71ebe6f07dc67", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442272, "uuid": "25efa937-c544-40eb-9bf2-440691106858", "comment": "Malware payload (Mirai)", "value": "933e795573701b42974deeb3b0eef59470c606dfc30055523e8f8f7d120b5e173d5c8c695e251c882961ce3074f40198", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442272, "uuid": "2dc9782d-1e10-4b70-a28a-bf782f94f77f", "value": "T115810A9A71420BA42E29EE23977DCB195F8194CED4DA1FC5F3EA5AB18D8CCC83D50192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442272, "uuid": "7b337662-ad57-426a-b240-1b98d3f2dc7f", "value": "48:vIdjUIa3UIf/flUIB3UIQ0EUIFVUICfUI2/UIXNUIqfUIvLUI7/UIAHUIE7UIWvn:vgUvUmUcUSEUUUnU5UuUtUOUCUlUlUTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772442272, "uuid": "e18d73a4-2e19-4a46-b574-28ee9deff2d8", "value": 4110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772442272, "uuid": "6bb68c18-0370-46d1-b878-33ab18a7e0a5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442272, "uuid": "8165d536-2d07-4892-8c52-a5e045dbe49f", "value": "cache", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42a094d-1632-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772454245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454245, "uuid": "08501eeb-558a-4494-859a-eaacc7556d9e", "comment": "Malware payload", "value": "7a4119e116ecdefe0a1017110e250e61", "object_relation": "md5", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454245, "uuid": "736cf2eb-2ce9-4f27-8500-35bb7dd161d8", "comment": "Malware payload", "value": "a4bd1371fe644d7e6898045cc8e7b5e1562bdfd0e4871d46034e29a22dec6377", "object_relation": "sha256", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454245, "uuid": "b829d61c-4856-45d7-9e17-30b7816bf795", "comment": "Malware payload", "value": "be3c8f93e9d7f42ec1133ab36f555b104b23fe1b", "object_relation": "sha1", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454245, "uuid": "4908af66-d3dc-4e45-a00f-4ff1d1aeb1aa", "comment": "Malware payload", "value": "89be02f24e441039b44a3e0872c6e5cb731cc60778f4f4528e41a297f74aafc87e3701481192cb3994c922e6ba548a2f", "object_relation": "sha3-384", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454245, "uuid": "248784ee-54da-4531-80a8-65420421880a", "value": "T144F7337F69340DA1F8A745F0F65BE0BAC8112C494A3410A177B56A7B3EFA51E812DF38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454245, "uuid": "41d98664-87c5-4e8e-8f22-b60daffe9939", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454245, "uuid": "477fef1b-048d-4a3b-b6e6-d7dcd622e91c", "value": "1572864:SpQL+rJ/Lu+bSBscfv7pGHe/zA6wa8iV/dU0pk39/kHE+au0brozD/N0in1OUWjr:SpQCrJ/Lu8DcnFG+/h8KdXk9/kHxaumh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772454245, "uuid": "ec551b40-4f9e-4701-966d-ff26536c675e", "value": 75387624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772454245, "uuid": "2294b809-3f71-445e-ba76-2068a160594f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454245, "uuid": "7b747cfc-d5db-4da1-b590-4405c2ebe7e9", "value": "a4bd1371fe644d7e6898045cc8e7b5e1562bdfd0e4871d46034e29a22dec6377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e360e2-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444772, "uuid": "e290dc8b-721a-48fb-972e-0253f7468f5c", "comment": "Malware payload (SantaStealer)", "value": "b4df1ffb28c29db3affeb15728ce219c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444772, "uuid": "3f5aa0d6-1a9e-423d-b327-6b0f30fd876a", "comment": "Malware payload (SantaStealer)", "value": "a50250475017194a3be2c5b2b4865ccf2989cce181e1694c0c908d30fac39fe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444772, "uuid": "b249e296-144d-43b3-90db-cba4a02f30e0", "comment": "Malware payload (SantaStealer)", "value": "924c1ed9d8d0e03f854c92249bd3f6da5df9b09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444772, "uuid": "e8b4e7e1-c11c-4706-ad56-0253a50884a0", "comment": "Malware payload (SantaStealer)", "value": "d53f9e3afaa5417d60b3787acee3c9c6e66315102b98cd0d97cf0eee95d5cc3077f394fffef5015117cfac3e3dfbf292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444772, "uuid": "81ffac0f-f0bf-47a8-a407-afdcc3c571a4", "value": "T183C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444772, "uuid": "d3e88712-1616-4cbd-8fe3-07becd2fe598", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444772, "uuid": "1f899780-c8de-463b-96b5-374d08aada5d", "value": "49152:XavY1Sn5eVNonWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlC5sdGw:uY1avUevc+9sdBg4x4DPPnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444772, "uuid": "01f64e28-fba9-419f-85c7-687bba637e5d", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444772, "uuid": "633152cd-5f24-4647-b0a9-2e5a87752ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444772, "uuid": "9454b173-77b6-4e19-9250-4b8bba20951e", "value": "20260302_084943_20260302_114940_VZS565083201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a390cbf-1616-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1772442175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442175, "uuid": "037e40dc-e97e-4418-adec-3155798592b3", "comment": "Malware payload (PureHVNC)", "value": "0317ae338a1d9cb4fbb294762298040d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442175, "uuid": "9e83f9a3-0550-4b32-a1e4-af54a040ecd8", "comment": "Malware payload (PureHVNC)", "value": "a5c7ba82a0b1722b02a7b54387bc1fac9dcf32a916dd8e6e34e9b987b8f04167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442175, "uuid": "bf922653-fb7f-4dd8-92cf-3c52e9846379", "comment": "Malware payload (PureHVNC)", "value": "a55d1da77bffaaa0049b940e8e9e1b9e78eedd51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772442175, "uuid": "3bf0e97b-135c-434c-9149-31ae61ca7a7e", "comment": "Malware payload (PureHVNC)", "value": "0cda82557f786b1d5bbc17c0c6a46228eedd5f257c347570d4b58b7eb05739675fce1bc97041a3f91c00147df6973ba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442175, "uuid": "0c3c73ec-a901-40ec-8d9b-dcb36fc0b19f", "value": "T100F4028072E28BB9E9D225328D532DA48F75ED6057241EF7E74808AECB709D16B3507F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442175, "uuid": "18600a15-0182-4753-9b81-e688dcb1fabd", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442175, "uuid": "d6e6527f-c217-42b4-96b3-e5ac9a70b189", "value": "12288:GHztGhqRHh3qCpcdu0k2FgreyoPnnrI4cDuwmHi4O9IhPoYkszJmtEz6APCAlJwR:yuKMCp2u0XnyoPnnr99OehPXoAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772442175, "uuid": "a2c6c0d7-2c3b-42bf-9835-9e1a58cd98f7", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772442175, "uuid": "599e4ff1-ed89-4684-992a-77f0234fcebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772442175, "uuid": "17d8f544-883e-432a-a47b-13be9f1c0251", "value": "0317ae338a1d9cb4fbb294762298040d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad30b63-163b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772458014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458014, "uuid": "7f2d6d0f-a925-49f6-bbbd-6d5f1c6d1f5c", "comment": "Malware payload (NetSupport)", "value": "3f7685686bb5020820b721c5ee4a8883", "object_relation": "md5", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458014, "uuid": "fbb1f577-8562-4d88-ae06-eaa75796ee29", "comment": "Malware payload (NetSupport)", "value": "a653dab3b7cb6cd033da39bf005a4f1f1e7f4070b3960aad128baa38fe5d9077", "object_relation": "sha256", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458014, "uuid": "93967744-2d88-4ca4-98ee-4141cdba67cc", "comment": "Malware payload (NetSupport)", "value": "3eb613f947b3365e2193540a7dd7abfa289aec2f", "object_relation": "sha1", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458014, "uuid": "9e5d6c9e-0ce0-4526-bcd5-0d638016493a", "comment": "Malware payload (NetSupport)", "value": "ddd36c9257c4a0ab6bebaaca0e42826b23f700b74011e3584c31033e59a33795f82816da65ba27b67f72fae15f6c1823", "object_relation": "sha3-384", "Tag": [ { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458014, "uuid": "64b184f1-aaa8-40b3-a333-0cbdb7f657b5", "value": "T190E0A316690E1221A2FE8A77BED11241F796D43BC10526003C7DC80C3F710AB5FA3944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458014, "uuid": "20de9c54-68c8-46ab-8c94-6ed224c9c281", "value": "12:xylDUuEQDhoL1MhA9ngCMxgEFFy2W5FUJito3pMse:xyllvDyqhAl5Eq2W3UJitQJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458014, "uuid": "2e435d53-ca42-4be2-810a-e9f1a2a2feb5", "value": 437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458014, "uuid": "3e3a11c0-4a4b-4c7f-ac57-f7275c97ba44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458014, "uuid": "915c2cb0-ec30-467f-b0c6-79d02c7a14a0", "value": "a653dab3b7cb6cd033da39bf005a4f1f1e7f4070b3960aad128baa38fe5d9077.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca678362-1625-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772448699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448699, "uuid": "5991d5ba-24a0-476f-9394-0ece6f52c710", "comment": "Malware payload (Mirai)", "value": "8a6a55095990875bc695bc8a29c21175", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448699, "uuid": "bda0089e-7f0c-44b1-b62a-bdf5ba81a5fa", "comment": "Malware payload (Mirai)", "value": "a72ab10dbb8aede27fd43841e001cdcc4a3f9585bbcee192074ba9b3785d24a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448699, "uuid": "ad71ded4-de82-48fd-9911-b9f2980251a8", "comment": "Malware payload (Mirai)", "value": "2967b1f7c6df1c64c480f85d1155f30ac87cafed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448699, "uuid": "a94630a4-a284-423c-bd63-5b803ce78c1a", "comment": "Malware payload (Mirai)", "value": "683a571b1cba5435ee46ec9286ce599a5005c8a1999cd053e8d77bc04685fc6d5db5c9326fdc239f790e43500a209897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448699, "uuid": "757ebadb-f1ae-45a9-b0ba-302625188756", "value": "T1C3B31977A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04B3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448699, "uuid": "bc5ac55d-2caa-4ae4-a123-4c8173cb14eb", "value": "3072:MDVLSItJP+Xsp4JlN3HBjmH1cuEgvniuN/:MDV+ItJH2l3HBjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448699, "uuid": "92bd57da-8a8d-46c0-b730-16b4ef73a46f", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448699, "uuid": "c5b81a11-44a4-42f0-b518-bfe60cb2a7f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448699, "uuid": "128af7d3-9e78-439e-8c2a-bd68c3273b08", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7ce555-163b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772457995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457995, "uuid": "4c263986-11a4-48f9-bb6e-39f481d2a166", "comment": "Malware payload (NetSupport)", "value": "26ad2e35ca11b82a642c74b41bee0b56", "object_relation": "md5", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457995, "uuid": "f5d2d36e-2741-408c-ad05-70bc7e19770b", "comment": "Malware payload (NetSupport)", "value": "a74c90a94fb23324ec055ffe1e2fc626ebd7f4187190871d0ab1209442a61cd3", "object_relation": "sha256", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457995, "uuid": "f17a4601-7b22-4eca-9a5a-82c3674d34a9", "comment": "Malware payload (NetSupport)", "value": "c951691c5a49340056a5acc58da90ecfbfdd5e42", "object_relation": "sha1", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457995, "uuid": "85f75a0e-d4b4-4b10-9696-a6349d521455", "comment": "Malware payload (NetSupport)", "value": "2e9d7cfb06591bbffc11a9d13ca2e69200ca14b8a621f160c4d15f85500fd4ff905e7e5edc2fe3798e9c0dd99d756fd2", "object_relation": "sha3-384", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457995, "uuid": "9687febe-212d-4553-b108-8de8c3c91757", "value": "T1F8F04141CB199FAFD02FC23085E42192A542E128CC73E58A6D4232ADB820B720F0329A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457995, "uuid": "dd625195-d482-425f-8b66-b6342ccc879b", "value": "12:5jkAMK5xS7CV9HV8aiReSSkdwRwuQorLSbFAwYsq0y6JzPOyEMKFltavX:9kcvug9ia+eSSkdwRDQoyhfYsqn6Jt4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457995, "uuid": "71e29381-a86f-4ab0-8f38-2c2de1058a8c", "value": 596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457995, "uuid": "4941336f-21c6-42f3-a35f-38ca9374909b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457995, "uuid": "4d32c838-2bbf-4173-89d2-35bf79a9cad4", "value": "client32.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5512f8eb-163b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772457951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457951, "uuid": "20bcdcdb-d644-40f8-8f56-cffcf90fa762", "comment": "Malware payload", "value": "03b8c301ee1fefb53e0e061ad2307b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457951, "uuid": "f312b058-f758-4645-b15e-9b21e060304a", "comment": "Malware payload", "value": "a797a00cac19c9d330828789f006e85faa7a4ee06d2d30673bb0b07281d69d04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457951, "uuid": "e983993d-8827-479a-b934-2e74d109584e", "comment": "Malware payload", "value": "2de5dcde9eb8dc76a771b13a321808b39b0e40df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457951, "uuid": "72d368f6-76a2-47d0-9fcb-a4d8047d1b16", "comment": "Malware payload", "value": "87f7aee07bcc6f02f73d1cc767ed5d072f469432eaf1dfbf98eef74dce435e67eb8f106d26bf27b3e5eb60f6aad64aea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457951, "uuid": "9be495f3-2440-4159-ba56-cee700b8dac7", "value": "T12994F712EA60B025F99345B12D7AD246382D3D3A2691EC0BB78D9F463771A87B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457951, "uuid": "2ef8da1c-2067-4ed6-8b3e-6e24c4ff0984", "value": "bbbf9713d66a9f4279503d2b3f1d22f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457951, "uuid": "1976a171-cd96-4f79-b87a-03d5d6f470fa", "value": "6144:LwIhnhDEVRq1jxrrnCiE4uU1WkXwADekZuHlcp0UuhPO/QJ/Uod5i0+B5TImud:0IhnZtrrnCiE4uU1vkBGQNbd5i01mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457951, "uuid": "48d601a6-a4a7-4f4d-9872-fb780d9029a9", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457951, "uuid": "add9da31-768f-4e9b-be0f-5c1874639671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457951, "uuid": "40e0aaa7-c707-4a4c-9b23-1c9b66f73b93", "value": "Copia de Pago de Factura a trav\u00e9s de BBVA-Bancomer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b660ece-1611-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772439815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439815, "uuid": "e3bb6b6d-eedb-488d-a0e7-d473db7219b7", "comment": "Malware payload (Mirai)", "value": "70cef399a5fd8e34ce1f7baa24bbdbb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439815, "uuid": "9de4fa8d-38a9-41a8-b30c-7c3b46599997", "comment": "Malware payload (Mirai)", "value": "a8637beaaa6ffe1530e0ac209595b0a1769a56411cb983eb669226ab5a416ce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439815, "uuid": "848b2d7e-87ab-4247-a52b-85ec94a937ad", "comment": "Malware payload (Mirai)", "value": "704d74e63f24c648d1f9d225264bc68137e4879e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439815, "uuid": "41813b1f-8c24-46e8-a88e-3d06d303517c", "comment": "Malware payload (Mirai)", "value": "15f57324981276c08c466d80d1adbe0d1ca6243ed18198e3efb530811c5c2274222a2766b4ddb168a8375b64931f03c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439815, "uuid": "5802b923-1e6f-424d-aa72-125d0c413c25", "value": "T1B136F797B8824A43C4E43676BCBD81C833A74EB99B9713666D04FE3C3ABE5990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439815, "uuid": "2dd37a7f-15ea-40cf-80f2-6e405a1db2aa", "value": "24576:4mH90gf3e85EouaVamgXW/1ep/CAAJopdrAGVinVXHC0VRV4ChOzIs+7zY9PJgcM:pZeSCHOEyIW9BK1wwquumOANdIck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772439815, "uuid": "8e5d9862-14fd-4224-9e02-fecc07bf3bf9", "value": 4915352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772439815, "uuid": "f6f6fbe1-37ff-433a-ab42-61ec148fcd3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439815, "uuid": "4a532151-58a6-4ce2-a054-6afb93e5e49d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd755d1-166b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772478444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772478444, "uuid": "478784cc-64f7-4fd1-ba13-95f44f9bf311", "comment": "Malware payload", "value": "ed22eea89ee3207e18847b0110e9c124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772478444, "uuid": "1fcefa44-3c38-4b46-aeea-feb5412dd9b1", "comment": "Malware payload", "value": "a874812d5f6518587a09b679236e71a2555702fb99458400613626651dc83f3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772478444, "uuid": "9b2db51c-cf4a-44a9-910b-7713e5beb450", "comment": "Malware payload", "value": "351774e894c603bd12e23791d626cb11b522d215", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772478444, "uuid": "1ee6545c-19b4-48bf-a3a0-87c4ec5f2b73", "comment": "Malware payload", "value": "070c01b96f861a0bf30ed5925b73a317548d505d456cc8618eaf45104aa72a2c93a2f3e63a663d878225f28ef33e0a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772478444, "uuid": "eca17dfd-9108-416d-b323-463efa39d0c3", "value": "T15E55332DAF97F4B5D2FFCABE2911D593927D1324EF941B2248A563EC3C43A358215C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772478444, "uuid": "e0980967-55a8-45c2-80ff-75e2f8edcd12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772478444, "uuid": "fb69ad3e-76d1-45d1-b083-e262e3c95f74", "value": "24576:+rrja8tRItqUgF+lqQ3ly0hr7opz7TEXUPvQX0xJETK4T:+rrja8AtBgElqQ3kS7UnCUHQXOED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772478444, "uuid": "dd830b89-c02e-44b1-ba18-c31db3943c85", "value": 1380864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772478444, "uuid": "4af88d00-9ff4-4b5b-bea3-d672d88594e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772478444, "uuid": "e00eeaf4-0cbf-442d-884d-89113c0e8d88", "value": "tool bypass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684b15c8-162a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772450681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450681, "uuid": "58774f5c-4820-448c-8183-a2ad4caede1c", "comment": "Malware payload", "value": "f02463bb05b85da1ed7d0f166174ef9c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Donald-Gay", "colour": "#118411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450681, "uuid": "85768c6f-9812-4498-990e-495270c5b6cd", "comment": "Malware payload", "value": "a8c380b57cb7c381ca6ba845bd7af7333f52ee4dc4e935e98b48bb81facad72b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Donald-Gay", "colour": "#118411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450681, "uuid": "7d9d88b3-666b-4ed6-bd66-d2252fc3ecea", "comment": "Malware payload", "value": "c2825f992911c8596411575e77b56c69722b7f4c", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Donald-Gay", "colour": "#118411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772450681, "uuid": "91d14586-89d1-4d65-96f8-7b70890cb6af", "comment": "Malware payload", "value": "c51153b95daf9203372ee804551e2c261835dae4b341993771e506dff28dd92fa2e13978b1b44be10247e89e3d178f15", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Donald-Gay", "colour": "#118411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakaerindahouse-info", "colour": "#5C05B8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450681, "uuid": "6568f93a-613f-4c04-88ef-c1b51d4bf62d", "value": "T1DD18338055F99F2CE44B4E36F46A08A9405F9F6F8F825D68A43126C3385BE422CBFDD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450681, "uuid": "9bc1ca3a-3097-447e-bec7-85fec7ebad6e", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450681, "uuid": "adb25be9-6371-472a-bf37-13f4623cc44b", "value": "1572864:awKJPDvHypeHbTLgt8WOw+7JPQ4+hC3N1Fq5FGHMR8UVHML+9m6/nZ/9UjAJo:awKNvypccaFlD+c3DaGHOsL+9m6/Z/9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772450681, "uuid": "6611e190-dd9d-42d1-9d36-cad676eeaf6a", "value": 86799392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772450681, "uuid": "ace7f187-3720-4210-86d9-0e7837bd83cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772450681, "uuid": "07143097-79ca-40d4-ad47-3f28d6d9396d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd55e62-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475763, "uuid": "ad65a4b5-a0fc-4a2e-8838-69cac7fa696e", "comment": "Malware payload (Mirai)", "value": "2b41bdd130611062d8708312df1cd25c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475763, "uuid": "7c0c2987-578c-4663-b544-26efb96353a3", "comment": "Malware payload (Mirai)", "value": "a9e70a9931c3f4ee2635084d6750a783ee1a51bd6c418268efd01004decc8206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475763, "uuid": "509d1740-419a-41d9-bafc-0fce003ef56b", "comment": "Malware payload (Mirai)", "value": "723f81ecc055e0778e9f032d3c3889719dcb026a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475763, "uuid": "5134637a-f29a-4f77-9d15-ff3dca113631", "comment": "Malware payload (Mirai)", "value": "4aec82ffeb4d6e6c146d0892dbd7c97e0dd1d115715e85d36ac7487cfbc5ac1c07c7718ee9bfbad97f99ca842ef5de89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475763, "uuid": "300e92a8-7a68-4603-9812-b42710655586", "value": "T1E1042B46EB414A13C4D227B6BA9F424533239B64D3EB730699287FF43F86B9E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475763, "uuid": "00017d9a-e76d-4662-be57-b7f6973ff658", "value": "3072:cZx9seatptos4aePaeQJuPJsrLM7Dr1cQkpXPw3FTStbqM/9j0TOU:ix9sHF4vPaHJuPJss7Drypfw1TSt2M/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475763, "uuid": "b427475a-2800-4fe7-8be2-34384cc1ee62", "value": 177891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475763, "uuid": "ec1aac9d-e05a-4331-8da3-1268a6111a19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475763, "uuid": "9c8b8839-9597-48e3-9149-ec65b3b70d6e", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff659ad-1637-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772456197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772456197, "uuid": "58e451c0-6e76-4cd5-ae09-f7489cdf5bbb", "comment": "Malware payload", "value": "c92ccd7cc5851963434733a368117099", "object_relation": "md5", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772456197, "uuid": "a7e747e2-b2ce-4337-905f-03bb7adb010d", "comment": "Malware payload", "value": "aa74de7b5580c27f52467d75dddd567ee3a65dfbff474f2766af08f842370eae", "object_relation": "sha256", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772456197, "uuid": "2ab74fe9-52b5-423a-997c-32d67b3e6627", "comment": "Malware payload", "value": "a1a4f50d286995f878575cec5a1a095cda576f83", "object_relation": "sha1", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772456197, "uuid": "0a775bad-0167-4cc7-8514-3574a447699c", "comment": "Malware payload", "value": "95819fc3d177f8d814a05913c3cbd026da98b51f68967c0f6a166df7d83c9911c58af250165dc11b02681e34cf562613", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-help-center-com", "colour": "#22F4D2", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772456197, "uuid": "a733ca81-a8c9-4048-8cdc-a98542d83690", "value": "T13BD02B74EFCF75CEA961347D705515C4D2349E51E0544B12F460187ED064C2DE91D47C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772456197, "uuid": "7bea1ac2-76f7-4036-b213-ef189845348f", "value": "6:sny/P4sMAlLcBSMe/mcS5s2APCIKsMuvWRB6Xxs:snW4XtSMe/mzbIKXAjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772456197, "uuid": "c51156dc-c37b-4688-83b8-60a642259fb8", "value": 282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772456197, "uuid": "cd5dab96-805e-43b5-b46e-0455dc242da7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772456197, "uuid": "58701e6c-91f3-492b-a3d4-5bb040c65148", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9fcc7b-1611-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772440171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440171, "uuid": "fa52ac3d-7b59-439e-929a-79d0b86d4f12", "comment": "Malware payload (Mirai)", "value": "8f62ac71a2188bea11a9b0684415a49a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440171, "uuid": "e12c0e41-b5a4-4514-8213-48e9e53d684b", "comment": "Malware payload (Mirai)", "value": "aaab93e4c7c17f8056763b0b4b8a5e92cca1351a14ae7c905cf0ee4ab4360472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440171, "uuid": "6e3c82bb-0077-45f6-8f5f-9705315d8263", "comment": "Malware payload (Mirai)", "value": "ad33ef4f40fb525104114635dd1a837a137e4c7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440171, "uuid": "7b515424-4d90-4184-a7fe-bf26de0d865e", "comment": "Malware payload (Mirai)", "value": "fee3eee52d3062a1aaaf3cc641bf17bcf97d7cc7308af616f6cd9c3428fe2992fc1d44498c6041c4e93a0a86fe096990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440171, "uuid": "80272c59-480e-472c-aa22-530b7ce8ccb8", "value": "T1C5B39E9BBB471890C86147F50BDB4FDD3A6332118E27E4F76D0E397A89395CA050A7E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440171, "uuid": "46a305ba-85d5-4e6d-8318-b7c126f2a19a", "value": "1536:Fa/Ew1Ww8LaTXoWjlRKiTVMIuy3z54WxWXc/gnGwbZnH/LWL:FWEw1Ww8mTXomHTTuIpz5ZgGwbZnHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772440171, "uuid": "ef6e0e4c-2232-4720-a7d8-da9f1af02d31", "value": 116000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772440171, "uuid": "d8d01ebb-6664-41f8-bfa3-bd1f7fc33f8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440171, "uuid": "f1f43823-f692-4b87-a735-51331f4302a4", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd1926b-1614-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1772441295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441295, "uuid": "9b175640-d2e1-45cf-9dd1-f70fb7525ada", "comment": "Malware payload (RatonRAT)", "value": "e3be0e04e34dddc5052c76b445924ffb", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441295, "uuid": "f30f8325-12f0-451d-99a7-d1cad1640243", "comment": "Malware payload (RatonRAT)", "value": "aad9e1ff8094df5b6e2cbbd4ba4df2c751b9046ac093ab8b72e2ac4a4b4518ac", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441295, "uuid": "c15bac2f-ab4b-4ad5-8e7c-133a3de2bf85", "comment": "Malware payload (RatonRAT)", "value": "5dac53ef5c623c6c9d40129789624e73846e909b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772441295, "uuid": "58c0e54c-51a7-4007-a8f2-34cba02d7100", "comment": "Malware payload (RatonRAT)", "value": "b3bf7658822dcb03b4391349eb3906fcbb60f1dc6da162244693ad7a584ebb0716a977f0962941bd1e6d2e6d69493248", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441295, "uuid": "2c5b8d0e-8a56-4a70-b1bd-e2fc56f3e6ff", "value": "T1F476E3313B2EADA7D632AACEDDF4558A3CCE2903031AAD54F9CE903590753C06F5D866", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441295, "uuid": "a97d07e6-77c7-4743-b040-cbff74ad29d8", "value": "49152:eq8VIJqUrxsDIQ9FUTvBM7bbDkfSvJXnia7CNi3YI:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772441295, "uuid": "24c6e39b-6e1e-4c6c-b498-52dd4d034eb8", "value": 7349779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772441295, "uuid": "56eb9679-7623-4187-91cf-5e5cabf4bad1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772441295, "uuid": "45069646-5937-4f33-8b6d-29d0a236ca13", "value": "platz-optimizer.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bc609f-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452670, "uuid": "c072ed32-0d41-4915-8f1a-698cec41dbac", "comment": "Malware payload (Mirai)", "value": "89c2355d1c688099cc30822fac24c685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452670, "uuid": "2658156c-4626-45af-a6f2-ee7ebcda959b", "comment": "Malware payload (Mirai)", "value": "ab0ac7b424f2cd956939b6eda405a8f216a7df0a4849887f71130365100c3bc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452670, "uuid": "c3385a43-9fdb-484d-86e0-7b1f95832863", "comment": "Malware payload (Mirai)", "value": "a51261f179892c19eefc6525823aecde74901cea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452670, "uuid": "11b8671d-29d0-4750-847a-08b12327289e", "comment": "Malware payload (Mirai)", "value": "8e366d44437cf7fc22e21d0ff084b4ae0b3a0a07dd7f3273b0753bb3d9f20510701ec377cb747617475b72232257b1a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452670, "uuid": "e9e0bd86-d403-4f0e-be32-316192182560", "value": "T174930782BC81EA16C7D0137BFA6F108E331567D8E1DA3242DD251FA47BCA81F0D6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452670, "uuid": "8884622f-0ec7-4470-acfb-444ed25dfc23", "value": "1536:tBywrO+bV2LkKsZCPgtAURwaxmXzsk0gDmvzdJq9xB8t46bZp67WJJwfw:tBg+bVqkAxJVQJgz84wZzJJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452670, "uuid": "91f4ca84-4ac4-4b1f-a95a-aad75cad2bba", "value": 91132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452670, "uuid": "aeed8ed9-9f58-4ec2-8503-47fe49af5042", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452670, "uuid": "896de69b-d3cf-4a9a-8f9f-fcd0f5f04105", "value": "MMaaRRiiOisecTanee.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b32928-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433685, "uuid": "a603b10c-8963-4a26-a59a-5dcb825fbaf6", "comment": "Malware payload (SocGholish)", "value": "48d0609e371e0c8e55b69c389abb6fab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433685, "uuid": "b9e0386e-ac1e-4cfd-9808-955e7cf09120", "comment": "Malware payload (SocGholish)", "value": "abcfdbdae84faa41990fe442f71ed45fa15243018f1a100c591ab64ad1bbad4a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433685, "uuid": "693498cf-6fdd-4264-82ec-d602a976d236", "comment": "Malware payload (SocGholish)", "value": "4e3ce115d85a8730f938d9e23c379f5b3efa1ef5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433685, "uuid": "3c7d6dde-a747-4aff-b251-b03ec0b4720a", "comment": "Malware payload (SocGholish)", "value": "9e462340e731bb1e65d728a649d4dd69422e65979a3fde350d76ddd903ee4b7435eac6712b84106b178b4a7fad90bc50", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433685, "uuid": "0dbff204-d3d2-4cfc-beb5-a80b471e1486", "value": "T186D0A7C9200C751417BE1021617AAB6D7052348462111755DD6ECC685820BF50A577AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433685, "uuid": "63814c6e-cc22-40e1-9e8d-1aedcd6faaa2", "value": "6:SSFchEByRRAgO9lZcixRWcVa9iK8GId7itHHJ4ymRycN:RFlZcwRW79qDCHTXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433685, "uuid": "28f5b940-9731-4fd9-806a-afae93cc2ca7", "value": 216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433685, "uuid": "377a8cfa-1f0b-4e2b-ae44-fd3cbe5895b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433685, "uuid": "8c8e10eb-b932-4904-96dd-1da7a75b85ea", "value": "abcfdbdae84faa41990fe442f71ed45fa15243018f1a100c591ab64ad1bbad4a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764a98a2-163b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772458006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458006, "uuid": "d09c2742-3fe3-4557-bcbc-76c37028c51b", "comment": "Malware payload (NetSupport)", "value": "adb14fdfbb89ee120b60c0d075712d0d", "object_relation": "md5", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458006, "uuid": "1c02dcbc-8671-4d2f-aa7f-ccc5889e6ab2", "comment": "Malware payload (NetSupport)", "value": "ac40994568f4ac3b27d5b6ca8b7b1e9b9afc99b624f430290bbad5c61a70a7fe", "object_relation": "sha256", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458006, "uuid": "8eb33e90-08b2-4135-adfb-2d8cdd899d55", "comment": "Malware payload (NetSupport)", "value": "8ad85af220e57797c70d93711011e7596bc6ec2b", "object_relation": "sha1", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458006, "uuid": "81190f3f-6c00-48b7-8531-d28226e767b2", "comment": "Malware payload (NetSupport)", "value": "c748dff79c8d5ba3d940625ad30e14c92be431bfdfa673d8bae7fa4fdbdb0264f206d4c3a985bbbfd6723672f6a06017", "object_relation": "sha3-384", "Tag": [ { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stayonbokablesol-com", "colour": "#48CE93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458006, "uuid": "543eb156-6f41-474c-96bc-04ab5aec8baa", "value": "T106616709E5A1983041939B9E88DE6C08A15B48CF811B5D64F98D8E4D1F33E389F7E65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458006, "uuid": "05b5b90d-5bcf-4bd0-ae9d-f400742d84ad", "value": "96:ZnQ8eCrOJ1NQDvZg8YRaxKiUTzgqxaybIwooedb1qJAMrenR:ZQ8eCrOPNQzZg8Ycsi+z1cybIwooIb1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458006, "uuid": "d7e7ac02-2d52-4238-85c9-3b737ef170de", "value": 3466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458006, "uuid": "e8db3573-ea1c-42a7-9721-482b911ac887", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458006, "uuid": "48ba912f-7856-4dd7-ad56-4ef9bfa43ecd", "value": "ac40994568f4ac3b27d5b6ca8b7b1e9b9afc99b624f430290bbad5c61a70a7fe.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cb955f-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444736, "uuid": "f1748c3f-06e3-42eb-9d0d-adecef0f95ab", "comment": "Malware payload (SantaStealer)", "value": "52e2d52b575447b1f552e3c92e003991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444736, "uuid": "da4817f1-cc07-47d0-a902-b855aece41ed", "comment": "Malware payload (SantaStealer)", "value": "ac89459d5638c8f480c4e799c0e919b8b8dafc0d9c5e0fa8708e696f46a45697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444736, "uuid": "f2002048-eaa1-4b96-b165-62c279fe4a06", "comment": "Malware payload (SantaStealer)", "value": "19538579f77a31f9788df02679de1da810e5950c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444736, "uuid": "35197f12-4f9b-41f0-a2cb-186d86f90b85", "comment": "Malware payload (SantaStealer)", "value": "4a1da0d28f1a057ded52e5b1532e58d5987f6bd7d9f04c7054a6cd0f710daf62ae7b8560d11f1ee20f282e1e761fca00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444736, "uuid": "d82504ee-c585-4ed7-814c-05a9252f54e9", "value": "T1A9C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444736, "uuid": "a92a4940-cbc7-49db-b701-b616ee2d0287", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444736, "uuid": "f283a920-f839-4948-baa1-4142aa9fa570", "value": "49152:GavY1Sn5eVNoJWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlC2sdGZ:BY1ahUevc+9sdBg4x4DPPn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444736, "uuid": "45508ca2-8b3a-494e-8b88-f8e856a2d746", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444736, "uuid": "8800d10a-cdec-4e49-9a89-31083a43a89f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444736, "uuid": "55a9c98a-9c03-43fb-a994-48f883508fb8", "value": "20260301_211859_20260302_001848_84ZGXUXTQ768.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6052d32c-161e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772445514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445514, "uuid": "fd6c685b-c67b-4d51-ac8c-da1dc1a6d500", "comment": "Malware payload (Mirai)", "value": "e8bf57567d86907854ff300af577d55b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445514, "uuid": "e566ee69-fdb8-4a3c-894e-3fd5218c07f2", "comment": "Malware payload (Mirai)", "value": "aeeef340e8a41cff0a5f23be68f50918024e2b992586482e6cec5017b8a6df42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445514, "uuid": "f9de188b-14ff-4131-add1-cb674f865ca9", "comment": "Malware payload (Mirai)", "value": "fc792968dd7e1d3a17a2c6d21af15fd451105283", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445514, "uuid": "57e4b0c0-f4f9-46cf-a930-ec182529b15a", "comment": "Malware payload (Mirai)", "value": "5f45c01ef08756511a646bee7bba1a457cdb2a95206c51ebcc2a5fe53c23a63e9e426af9f7886d987391e387cbbbaeff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445514, "uuid": "dae1888e-9db4-4417-b158-9c2219c178ad", "value": "T15EC39D87BB4718A1C86207F107DB0F9D3AA321518E2BD8F76D1E753B983D5CB094A392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445514, "uuid": "ad8cf5a7-3b1f-490d-9724-e2e027e96fde", "value": "1536:g3zoUubgPAK1SvceWb2LeDs7tCZwlNzh7t+BBxTn2goswbZno/LW+:g1ubgPAvvFC2isZCZw55+BugbwbZnoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445514, "uuid": "b2a0d2f6-0f61-43ca-b9e2-32327b971c9c", "value": 124192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445514, "uuid": "9b742f76-31be-48a6-bbcc-0d2a0a38a5a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445514, "uuid": "365a4581-8a1b-422d-883c-4b094fa18b19", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2913e51-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433680, "uuid": "922b7bf8-b2af-4ba2-b7e3-bb3c9865ce4d", "comment": "Malware payload (SocGholish)", "value": "2c5d7edb985724d39b7a8f5880327777", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433680, "uuid": "4a7591e6-fc39-4b92-9e6e-4dab95b895c1", "comment": "Malware payload (SocGholish)", "value": "af177e5a19240c4ba4df2bc8342f0c2f163da7d74bb7559e9ac3be0295fa3e44", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433680, "uuid": "d2a6ea14-2d7c-47e7-9e25-ed32f64bb44c", "comment": "Malware payload (SocGholish)", "value": "0a88a85cd4dc41b5b1b9970184e54dae7faeaa94", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433680, "uuid": "a6c8c6be-cfac-4037-900e-65772aee9527", "comment": "Malware payload (SocGholish)", "value": "af71d3cc7be56b8abc0605bb3829296980f07bd8289c6a7a52f25048efc350f4db1d080123f263ed97ec7f77e4d7629f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433680, "uuid": "6cf2d8a0-5bcb-4b58-b098-0e720a48cad7", "value": "T190D0974D34052818278E00FB13F3820E7022A54839280AA0E80480184728FDD920605C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433680, "uuid": "7d7c9068-560e-4d92-81f1-e499eaaf0eab", "value": "3:tggTZA7gO9lNIfXiXGx2EW6liaYRWAruNpJSKGIRXGX0PLGMTMCLSLbCT5kUG65d:NUgO9lRgWVtRW75GIdLLGk9GWi65am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433680, "uuid": "5667db3f-29e6-4669-9b20-93e0437b753d", "value": 222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433680, "uuid": "496ee65f-69ae-421c-9762-0e139be6df02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433680, "uuid": "dd14577f-c5e8-4001-8174-29fc1f6b302d", "value": "af177e5a19240c4ba4df2bc8342f0c2f163da7d74bb7559e9ac3be0295fa3e44.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdcb94f-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487523, "uuid": "a19935a2-8613-499d-a01f-533df1ffc9e4", "comment": "Malware payload (Mirai)", "value": "60bd0a4bdbb7ab5123aca93fe3cf1dee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487523, "uuid": "9fe8dac5-33a0-4ebd-b3fa-3dce139ce410", "comment": "Malware payload (Mirai)", "value": "af78a250e8c69581db094daf8c6435073bfef749930724792b5883ce42a71c98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487523, "uuid": "dad7997f-80d9-4831-86b4-036334f5d5f8", "comment": "Malware payload (Mirai)", "value": "8b6fe9a4b684c5d7646850356ff0a146411c7601", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487523, "uuid": "523cf833-d39f-4b3e-b039-fb7610d87718", "comment": "Malware payload (Mirai)", "value": "854860f24d461c9d4a7f83339559cae286a64f95fefdd651e5468f04b24d3fafa2309dc1fd281f34446a7e47846f2798", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487523, "uuid": "16f48d87-c327-4d61-83e4-ef6574246984", "value": "T10AD33851B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487523, "uuid": "143737e7-c52b-4f0c-b1d7-2b2e358995ef", "value": "3072:BuVeGJFWOgt9ctajH1I7s84hIuv/mDz/gvf:BuVwt9cUH1I7s8Qd/Wzgvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487523, "uuid": "7c96bb9c-1718-43f2-a5c6-60d62dccd307", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487523, "uuid": "9deaca65-41a1-4e46-827e-7a785a861462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487523, "uuid": "fa6c5627-6acd-4954-af0f-1489ccf2a5a0", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e6a9bb-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475756, "uuid": "0d0ff96a-9643-4772-86ca-f71265984e2c", "comment": "Malware payload (Mirai)", "value": "147292c365add8ba2825400a9ac77501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475756, "uuid": "cd163231-57c7-4920-96a5-b7ef82119beb", "comment": "Malware payload (Mirai)", "value": "b0f15e92e2fe78070f46cb124440c0f5924bb331a9e2f12e3b5fee67fd4df78f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475756, "uuid": "cba4f149-d5ff-44c8-9719-995924822d40", "comment": "Malware payload (Mirai)", "value": "e6c72aeb14afcd2df9a674144e462ad95820b972", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475756, "uuid": "af90640a-8e5c-4316-9eb9-97eedd66699b", "comment": "Malware payload (Mirai)", "value": "b8beb3dbb431ce53b1d2bacb2ccb8d9178cbc1b27c16db9a7357064726d0b951b79a6a636102d8a377b9f23cd8766015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475756, "uuid": "6715b9f9-4473-4aa9-8887-952c91c8d79d", "value": "T14CB3C95E7E218F7DF768873047B34B21A35923D627E1D685E2ACD9041F6034E285FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475756, "uuid": "787fdb63-62c4-430f-8b3c-542ddb0ed191", "value": "1536:jTkwHlCS4RqbYLajrSdBiVgT1KGdrRCNWmM+QWTaIegrFHDabABdT:XH8ebpjGT1KGdrRCVM+nfebYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475756, "uuid": "ea86cba4-e6c4-42f5-8ea7-8e77c8623270", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475756, "uuid": "296263b5-0a34-4c7d-8ae1-6f93015a9719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475756, "uuid": "349e4001-c7df-4ce9-a218-98fae1912426", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a43230-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772434083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434083, "uuid": "f79cfc82-e7ce-4dfa-8fb5-17415eaa7185", "comment": "Malware payload (SocGholish)", "value": "737fc3173073fea6d9d12ec586253f1f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434083, "uuid": "6329061a-8495-4c97-8b6d-814049db7978", "comment": "Malware payload (SocGholish)", "value": "b151cd35a8aa986bd6bd6f2148fd9ca37e2953e823d658c088923b49e87b4035", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434083, "uuid": "4fbf0f1c-2e66-45a3-8290-9cb4994471cc", "comment": "Malware payload (SocGholish)", "value": "53c13b9adbe6291fef968796c77b6911e6fb52c9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434083, "uuid": "ce3fb7fa-5765-43da-9851-cce58c2b4ee3", "comment": "Malware payload (SocGholish)", "value": "f10994fb530c07c69d8865ec13651b1cffd52a909f008e1db42f4d3cb5f199d2725ef2d697a3d5cb0683c73e6e233500", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434083, "uuid": "e8267f79-25b3-4480-8be1-08cd0d04e50d", "value": "T17FD095B7184731B8355950AA3033C20D31463268F4D51475CCFD4C410514ED1095F51C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434083, "uuid": "cd78980a-17bb-4709-9265-a42adcea2497", "value": "6:NFf3E9/y3AgO9lcRW5E5OGIdnvYk3wgyutbkgIzm:Xga34cRWQOfL4kbkgIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772434083, "uuid": "800251d4-700c-43dd-b918-8df217582025", "value": 259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772434083, "uuid": "d8bba955-846f-4af8-9e28-e4f4213d2629", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434083, "uuid": "df3760f8-c5c2-436a-a22c-5283b64a1ae3", "value": "b151cd35a8aa986bd6bd6f2148fd9ca37e2953e823d658c088923b49e87b4035.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99c5b5d-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475702, "uuid": "9d22b014-9178-48b7-8f9e-91adb39cb98d", "comment": "Malware payload (Mirai)", "value": "05e0d8b43d190abf44ff8fd027033941", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475702, "uuid": "64f278fc-f4d0-4585-af2f-6f05587f2c4a", "comment": "Malware payload (Mirai)", "value": "b1875efd4743a4cb477d2f9b65c9aac7bf55403cbd372368c268d386a0bba0b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475702, "uuid": "6f725175-087f-47d9-87e1-21ae47f3d5cf", "comment": "Malware payload (Mirai)", "value": "12e40fc53ab3afa07a65d284583f557f61803020", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475702, "uuid": "c5d93c2c-5ddc-45d2-8d09-a327534e92fe", "comment": "Malware payload (Mirai)", "value": "fd0ad5707c086a6b4bb4760a73c2d8a3f9ffd8627315016cac7312b1593f5db6aad3b64d478f362913f0ebc108919251", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475702, "uuid": "e36131df-a085-4df2-86ac-afa5cfdda04b", "value": "T15463024AEE2B15FEE24804333D2E8C4D67598A74F0187D6B4A13153E25B0CA67FD4ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475702, "uuid": "e0d1129f-2e2c-4b4e-a4e7-84375c8a8285", "value": "1536:hM+3oF/e5MMnjILFs2emKt+xJLGA65T6GUML/VIb:aPe2wgFsBmtfLGb5T6DMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475702, "uuid": "860e6d73-c65a-426c-a7ab-694a645c990e", "value": 66940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475702, "uuid": "5e68fcf8-63e6-4276-82d0-bac63af80912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475702, "uuid": "5cae632b-c027-49bc-b6ae-9a243554cd3d", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd91372-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444758, "uuid": "60d3f4c7-c023-4ab6-bc0c-68854ca86834", "comment": "Malware payload (SantaStealer)", "value": "9a8a9c7738ccb86a8d41628fdd07d0f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444758, "uuid": "c4cb340e-30ba-4a61-ba5b-d109076023ff", "comment": "Malware payload (SantaStealer)", "value": "b197fac28916e5973337213c9d2076fe0ca02e9327f92e8a33411c88dac3235c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444758, "uuid": "9f4863d4-bb54-4836-b6b8-9391530cbbbe", "comment": "Malware payload (SantaStealer)", "value": "f459f4d609796b32b2cdb55eda956baa439f107e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444758, "uuid": "d57e4739-baec-499b-9549-ab7ffbd43591", "comment": "Malware payload (SantaStealer)", "value": "7520a65048171930eb9e16d51a3fd37e9857a061411f759a312a863e31c95184dcff1a3a0cd8dd6eab3f0ff5235c7707", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444758, "uuid": "80aa7539-ff06-425e-bb36-7e1c3a24271e", "value": "T158C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444758, "uuid": "812123c4-890e-4a82-96f7-fe19d1b028ac", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444758, "uuid": "7759ca8d-f17e-4f04-9cc4-9f0aeac684c7", "value": "49152:wavY1Sn5eVNotWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCCsdGi:jY1aVUevc+9sdBg4x4DPPnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444758, "uuid": "21e50dfc-001b-4835-8ede-e9da487e4f2c", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444758, "uuid": "f093a0a4-42cc-45e1-ad0b-d6f95eb0726b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444758, "uuid": "6c7e59b6-213a-4281-b685-28f67e7c4265", "value": "20260301_222925_20260302_012925_A0BJWCC0D0OJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe3a0f6-15fc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772431038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772431038, "uuid": "f954e966-ef4c-4cd4-b6a6-ce0c6b65bac3", "comment": "Malware payload (ConnectWise)", "value": "60bb141e91abf95c3cd762e77ec9ce2c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772431038, "uuid": "7f8e01e5-a71e-445a-a2a1-ed3a7d03b2f8", "comment": "Malware payload (ConnectWise)", "value": "b1c3070882a71893fbdc044e885861cf13301506d70205ec2a15f2b0ec4dd03a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772431038, "uuid": "52035421-719a-473a-a24f-07ea8b7e7e82", "comment": "Malware payload (ConnectWise)", "value": "8317b881ba07f08d152963c0570f742e7c6370e6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772431038, "uuid": "81f336fc-b5ea-4315-af57-f92bc2a6635d", "comment": "Malware payload (ConnectWise)", "value": "7b1b3081ad3186b002760acae92ee0e98e6610dd0ff037c041b85f9134b27a633f673278e65530cc05d433130bcc241c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772431038, "uuid": "37b58c97-e49a-45b9-87c3-3e8573d1f2dd", "value": "T14C46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772431038, "uuid": "32d756cc-aa68-485d-a10a-0be5dc2ebfab", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772431038, "uuid": "2faf7db9-3328-4f7d-af59-25f00f5cbeaf", "value": "98304:izIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ihfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772431038, "uuid": "42b9be96-68e2-41c7-bb2d-de7f0016e6ea", "value": 5641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772431038, "uuid": "01a8b01d-f813-4367-b6d5-cce36defbd1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772431038, "uuid": "1824f7f4-5da2-4ad3-b51e-314bc4587e07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4f347b-168a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772491947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491947, "uuid": "ff132d56-fb61-4ad5-8b87-8854f4ddb38f", "comment": "Malware payload", "value": "809e156be9744f233b184c83cb61b02e", "object_relation": "md5", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491947, "uuid": "abbef4f1-17c8-4d76-ae6c-3e9057b24646", "comment": "Malware payload", "value": "b1e7e3f50e10a731bd145b6d6e1ee38641ce30a4a2c73e8b54582de5926b3059", "object_relation": "sha256", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491947, "uuid": "47aa0783-5523-4cca-9a03-ee40a353695f", "comment": "Malware payload", "value": "d6065d9e16106fb6099b36162b7948ab71ae8629", "object_relation": "sha1", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491947, "uuid": "770b4519-70fc-4952-b54f-baf62efde985", "comment": "Malware payload", "value": "c7fe31b9fdaf239686b2f6be0072f5e4bd2b310ff3fe983a0bb580b65bdd551e5c8f808d9edeeb0c2bf7fe5b078ac7c7", "object_relation": "sha3-384", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491947, "uuid": "ff6de164-4763-4114-85e8-c7fe25b7019b", "value": "T1C78219C57B06D8CDC5B68179C4322D2A9129F36453324BEF67B4482A0DA3BB07D2DF94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491947, "uuid": "90b9b5bb-b193-40b4-9879-c430ab5bdcd3", "value": "ba782605aac629a26bc1fecb2cf3b2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491947, "uuid": "090f5680-7e09-4bc1-ab4e-b50aa63dad28", "value": "192:AFuOW7Lam/qxNvZzgUuzjm+xatsJlNf6gr2PxsMKup7xofn6qwL9dzu6Go+HFcIw:AceV4P6gr2u2x2nnwL9M6G7WI/c+To", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772491947, "uuid": "af07a7dc-3540-4918-94f0-ef315e2c6adb", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772491947, "uuid": "a175cbf1-cd4d-4173-afef-8ec65c825b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491947, "uuid": "c9b5c688-12b8-4dfa-9567-c044d6901a81", "value": "TCity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b152fb7-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772465155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465155, "uuid": "bcb5487f-d01a-4780-bff5-84b0c376ac1d", "comment": "Malware payload (SalatStealer)", "value": "8bb5282e1de9722240504be983c17d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465155, "uuid": "108bd754-ce00-425e-bff1-60c3d8c748c9", "comment": "Malware payload (SalatStealer)", "value": "b1efcf093a00d2e9825209352465b546a3882f799a1b9d959181875d4ff93c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465155, "uuid": "c42b025a-62d0-4d0f-b709-9e9ba71b8156", "comment": "Malware payload (SalatStealer)", "value": "2c6b33c9c255d1084f63ae00633b4ed7a4c58825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465155, "uuid": "176690ec-cd9e-4045-a3ac-fc1b48ac1469", "comment": "Malware payload (SalatStealer)", "value": "0fa6a1ffa7eead353a73bcc87de662f06c06dce4c6a4ec69584d83c3c5ef40694c7eaf19a8fc7153e47283254c2f1002", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465155, "uuid": "a6e1b020-4654-4ae3-b2c8-fe61616622c1", "value": "T132C67C11FACB56F5E9035936405BB23F63315D048B28DBD7EB087B2AFC776921D6A208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465155, "uuid": "32c6e2d4-8a16-4aa2-b48e-2f405c7cde99", "value": "49152:9/olDiUc5VA2lcXAtgzoOjSvyCAia0gqROo5+x0roFuNgABQ6gX7QgqXvwvUjrCK:puDiUQl1teR0RLroVAB0LqvriRva8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465155, "uuid": "5ce9232e-80be-4500-9781-1978cb38708b", "value": 12108800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465155, "uuid": "c119c30a-d4a3-48fe-8368-4673411556e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465155, "uuid": "f4006f41-0a06-4d3b-bee5-8e185a8dec2b", "value": "bwcj6yfia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949b7049-1619-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772443454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443454, "uuid": "d80b29fa-8993-4f88-a975-641346a0fef4", "comment": "Malware payload", "value": "08f0dbb5d881cd3258a7abb14835fceb", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443454, "uuid": "a874c5c3-565f-48ef-9aaf-7cb8ff5eddb5", "comment": "Malware payload", "value": "b5a9f57f709c8361366bb4b03633e0859749056bac916dc5907c01b00e78b8b2", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443454, "uuid": "e5f46d4e-aed5-42d6-a611-107816306841", "comment": "Malware payload", "value": "16003a057cc5b62aaba78dba156ed39097cf0c78", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443454, "uuid": "14c45202-81ef-4914-bc62-4ceb50dcfb8e", "comment": "Malware payload", "value": "d938e5fcd47f63087cdced7a02bcb137ea0e87f8bbfaba6b0ee6bdb6d86172234ff9be54509040243b02fd3c02589c67", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443454, "uuid": "4a3cc2e4-42a1-4efd-ac24-43f44970b5aa", "value": "T1051633A4F811576710BA379A782F16DE48E31F722FF167639298C39A18F87424F1436E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443454, "uuid": "5aa5e6de-de14-438c-a3e5-5f8bf8149ed8", "value": "98304:Dgyg/dnjml2wtVtSeLpBZwDVSSMvRyhP4bkOll/FK2KFprOZm5a:DgymjmlXVtSelBq4b585Os5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443454, "uuid": "3d7b5b07-8145-492a-b8cc-4aa4a841e4c9", "value": 4028749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443454, "uuid": "fa82e8b9-4d6e-439f-bf6a-c9d514ca2651", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443454, "uuid": "fe0e1ef2-89e1-454f-a03d-3e2b63c10ba0", "value": "\u70df\u96e8\u6c5f\u5357.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83807e8-166f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772480558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480558, "uuid": "d9156065-8c83-4960-b361-a60848c1fe72", "comment": "Malware payload (Mirai)", "value": "9c0015897bf108d6974f88556b39b093", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480558, "uuid": "fecf9d8d-b6df-40ed-aee6-ab9ad8c75eb6", "comment": "Malware payload (Mirai)", "value": "b5eba4e324041caef08c61ea2c021a91c80957838bd2334f2381d45a5a801a07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480558, "uuid": "3fc504e2-1e89-4d20-9038-6bd17d1aa912", "comment": "Malware payload (Mirai)", "value": "1bd7f6cba18067323930f74fcee89ef128846b41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480558, "uuid": "911b83b2-e3aa-4039-b2b0-442c3b6c0161", "comment": "Malware payload (Mirai)", "value": "f859823ec82d53c00ee0931a8613dde45d3d5ac1a9f473a45e334f993ba9cc19cfdbc8a2af3355b1613c260b8f6adc37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480558, "uuid": "80671964-44a4-4105-9e76-e6d66bac06c7", "value": "T1AB0439D7F801DDBAF80AE3360C534906B130BBE518825B3332577B6EED3A1951967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480558, "uuid": "fb3d2a82-77db-468b-8041-49b64bebd005", "value": "3072:+/BYDQSHaP3WdMpayTvh+ai5N3dCirdtyNVwjbiTLlvbl+TzNZOB+q:FDMMyTJ+acNNRty5Llv+ID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772480558, "uuid": "c485dd45-3c52-410f-bd08-4f9a1e208404", "value": 178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772480558, "uuid": "25fcb871-fff8-4de5-a8a5-2c26e9d91715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480558, "uuid": "29fb937f-f94e-427c-8dce-13c599c3f2c6", "value": "csk_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6760ac4b-1650-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772467001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772467001, "uuid": "4b6e1da7-48b9-4ef2-8a5a-8fe0ae50a5dd", "comment": "Malware payload (GoToResolve)", "value": "0cd383e616530d86434f76ffe931b5be", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772467001, "uuid": "1fbc3d27-9180-4734-8264-54b5a4fa3782", "comment": "Malware payload (GoToResolve)", "value": "b6058200e2b4f66ac270e3e74dd1791eff64e1b337b8cc7689ca96daaa3fa114", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772467001, "uuid": "087b028c-5cdc-4e94-962b-0961b0534137", "comment": "Malware payload (GoToResolve)", "value": "3e83a0154ddd0bb5fcb54ea464f583a891cddddd", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772467001, "uuid": "b0955a1d-1a32-4029-aafe-bce06671ff21", "comment": "Malware payload (GoToResolve)", "value": "0f77e09e220772cafbae510de74494e9ea4d81b6275506fb3af7d3c9cbc3b40c24943f3a8faa86bf9b1a21b81a2898ef", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772467001, "uuid": "0765dc44-030a-41f5-ad07-4c66c9151414", "value": "T1C83733207649C171F53E10B289286BBF427D6D320F6580DBB3DCFE9A5B312C16B36A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772467001, "uuid": "d83bbbe0-f9d7-4c42-b4b9-48c18fc28f70", "value": "393216:ru0G/h3+M0v1UuQHRTRGH6JHfTF7UY+/kqFj4eFSmJlVvKneUdPlZQnl2H7gOnhI:S0GF+Mm1UuQ3H/T1uThFJll+eUdEnwHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772467001, "uuid": "ff5847b4-2953-4dbf-99bb-0ae185901e4f", "value": 24530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772467001, "uuid": "debb8a2a-18bb-49ab-a525-e5489412de3e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772467001, "uuid": "929f1b43-1874-4770-8833-a6a8ab39c056", "value": "PartyCard.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874a8c5d-164b-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772464907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464907, "uuid": "9d340c70-c980-4e3c-b611-8a0e2e0518ad", "comment": "Malware payload (SantaStealer)", "value": "84bbbffddb0d73fe5d5da0e218442e07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464907, "uuid": "76ed97eb-dff1-4b50-bce2-adb3b4c9d5e2", "comment": "Malware payload (SantaStealer)", "value": "b654563bfd461bbb4d897a4eb49b0076737a90a3b03e0532a015c35b85191e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464907, "uuid": "723eee11-a1ab-4aba-9747-2b49aade4109", "comment": "Malware payload (SantaStealer)", "value": "95d4cc6c291573f5620b1a216f0f6d9cb52ec4ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464907, "uuid": "172ffbd7-dfa8-4311-9815-003f50c47383", "comment": "Malware payload (SantaStealer)", "value": "c5740fddb600d6c3c23b75e42d85a21e34645b571a2f3db3190af7ece5bf681f8cdf3f0d7eb89e379c589b3d687ff178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464907, "uuid": "8d9c1319-328e-4d2f-b546-0495df78e04e", "value": "T1ADF6171014D96607FD3EEFBD85DCB6440F7AB2953723FA389B5109EA0BD1B08C9429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464907, "uuid": "9e456f12-1ede-4524-b3cc-96ba6a5d50b0", "value": "196608:I0c1Toqfvn7qOiv4qFOgo/CYIsCjGKE6uL91K51PsLxss5ME:Ixd3n7qOs4qFOgPYI1GKE6up4DPsD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772464907, "uuid": "c1877d1b-27ad-4ed2-8344-5833751f7af2", "value": 15386112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772464907, "uuid": "6e3373f6-6772-4983-9d4d-ad13ddd0d726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464907, "uuid": "64c945b3-22ad-4540-b154-144b14e6ae3a", "value": "Vertex Lab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca53e4fb-160b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772437532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437532, "uuid": "0aec9587-1314-4723-ac21-d2507a7201df", "comment": "Malware payload", "value": "19e48d999062d4be674faa9d804f41ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437532, "uuid": "2ed862b8-7784-4e9f-bf4a-ea0784a749a8", "comment": "Malware payload", "value": "b67ce37ca4460f4a07da94a76df94c6e6c1c5138c217beeaa48a353437a85554", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437532, "uuid": "9165b0ad-1c9a-472e-a88f-636b0d74c6ec", "comment": "Malware payload", "value": "7a8429d45ae51480f9db1fe097548eed8cd6f1fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437532, "uuid": "03067ab0-2446-4593-8bcc-ae8e220dcead", "comment": "Malware payload", "value": "d8c7314e2b996603a3b49d2056d99e6a9f90e7d917383cb1547b85e79b0610b410de00ea2e357a2dac84a17624b44481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437532, "uuid": "f33e5024-a68e-47cb-ac73-fe2111a9d00c", "value": "T10E649D1237E0CC3BD5A722334D57C719B6B2FE609D32860727D03B0EAE35552DA29B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437532, "uuid": "8775d48f-7ced-463a-9099-7327932c7eaf", "value": "29a0cb21ea1f718bc6a4593689133f28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437532, "uuid": "58842cd0-d552-479b-a2c5-d28fa92f92f9", "value": "6144:oVOjtKp0AFidr9VpXuJtd6LbrgJJp5qBOfooFEP:YFidtu96LPMIR0EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772437532, "uuid": "93fc0c55-5aef-4e9f-a74f-5b9cf9e7573a", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772437532, "uuid": "49c456fe-44b4-40ce-b64b-40ad224a48fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437532, "uuid": "dc500ae1-a5a1-47ec-9b84-8244480a1d2c", "value": "19e48d999062d4be674faa9d804f41ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebeb85c-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475710, "uuid": "fb4c91da-cabe-43fb-a2f6-1e96b0167425", "comment": "Malware payload (Mirai)", "value": "d2cdd339b6e758a2d18db7bb1776e57d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475710, "uuid": "cecb2d3d-a091-486d-881b-1a7f55c6045f", "comment": "Malware payload (Mirai)", "value": "b6e45dc06528dd32144971dd91992b76ea0ec576977de10056124f1131091b2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475710, "uuid": "ccc3614d-cb00-413c-94d0-de5cf9a16c41", "comment": "Malware payload (Mirai)", "value": "3b03d884fefa754b9879a2694473dd253553304b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475710, "uuid": "d4c38b15-1af7-4e7f-8bd7-fc4a98169cc5", "comment": "Malware payload (Mirai)", "value": "9f5f8476adbb5d2a919d8ed73193cbcc627fcf868a7526adbd8d28401265f031ad26791c4cc0e9d372e7f9e3eb47d76d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475710, "uuid": "08cc8be0-fe7d-4c2b-a221-b38405194f7c", "value": "T18403E107D194D757D0EE00F239FAD9272258C40E36D86AFE6FE8A7361561BD92C0A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475710, "uuid": "baff6e12-b9c7-4b79-ae8f-580084b971e1", "value": "768:s1CgdkrWLnCkUyZjRLieKaaMdfEcLu+ZKE0OUfKMnnbcuyD7UHQRjW:+gCncsBG+Vu+MSUiMnnouy8HyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475710, "uuid": "9e500822-50ad-488b-a7f2-47d1a51b4e79", "value": 40548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475710, "uuid": "218b076b-680c-4d8b-b73c-8277f912dcae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475710, "uuid": "4e6c542b-658f-4214-922a-b625a25e20e2", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300a38ad-1667-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772476786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476786, "uuid": "307efb75-0070-4bc4-a81c-64304af7cbcb", "comment": "Malware payload", "value": "16f325fb9ba51287f83f893ff0638a7d", "object_relation": "md5", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476786, "uuid": "4d7c3ff6-a9e5-4a51-b079-251d89d5e570", "comment": "Malware payload", "value": "b75dc565e8102e579c1a6f8272280e9727347666f98f6d163c68d5a714131bbc", "object_relation": "sha256", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476786, "uuid": "a7d82b34-3928-45df-9a27-f39778d8f956", "comment": "Malware payload", "value": "6a3f294368bfd6ffd2c3a83fe5296b99d22ff465", "object_relation": "sha1", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476786, "uuid": "2ee236d2-bbe7-47c4-94b5-e297470f7df9", "comment": "Malware payload", "value": "b6b7871517d50e92f981e35da470ba2192d17ec9cc41ee180dcbcfbae533785b5b174b57c2a14bee766fd94d88bfa600", "object_relation": "sha3-384", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476786, "uuid": "379757a5-740d-4849-90f3-77da5847eebe", "value": "T118E512CD81D943A4CD7A9B32C3615A6185FB7CBE826C562F0CC8727A5B3368355BDA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476786, "uuid": "569bfee4-e6b2-4517-aa32-09d483c5de84", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476786, "uuid": "e4bc144d-30ba-421c-9b6e-f9eacb5d18d8", "value": "49152:5ipTo01X2zH/2dK9wqnmx8c20+wQ4Vg5tkRX19YaLN:io0F2zfuKiqmx8LRmz3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476786, "uuid": "32e00fed-7e1e-43d2-9648-56d390bc2638", "value": 3126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476786, "uuid": "4e294654-20da-4980-a1da-ba1466fa99bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476786, "uuid": "8e78a284-cda2-47d8-9662-78901dcf29ee", "value": "Setup_Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312e3cf6-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487526, "uuid": "f1d75d09-d8d4-49d0-a099-c91eb4f64c65", "comment": "Malware payload (Mirai)", "value": "679b9f18a8a28f4bb59bc113e0f28e68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487526, "uuid": "573b792f-4c6d-4b54-8cc8-f666e83ff524", "comment": "Malware payload (Mirai)", "value": "b7dd4bb7ebf8d09e6e56295086e08bb19bd384381db07b643d4c91fb5af4def4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487526, "uuid": "075c552b-de83-4882-a661-e7dde97fba6e", "comment": "Malware payload (Mirai)", "value": "8df6e3d61355c6ce6a39c72d4bc53e58127170c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487526, "uuid": "3dcec602-023a-465a-b5cb-217e72e72cd5", "comment": "Malware payload (Mirai)", "value": "2bb27a19fe51e0522e379d52d9b1a9941f439e50c0659a8d947c649f64969c7898efc0b14cd3f895e6e64a3cbf926caf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487526, "uuid": "63577ebd-a262-4c71-8179-8b03b3329c80", "value": "T1F4C3AF73D42A7EC4D1514034B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487526, "uuid": "2cf9da23-4cac-4b16-b599-ba7fe46899c0", "value": "3072:BfpZykqkt436I+9eIH4mNaMSUPr6WIKnHE:BRZ0F3BczNaMXl1nHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487526, "uuid": "68bcd909-19d6-4e77-931b-452a81945fe8", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487526, "uuid": "7490dc54-d62c-423c-bb69-645b8356daec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487526, "uuid": "4c5f8673-336d-47f5-a3fa-157ed3c4b50a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68fbb69-1641-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772460772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460772, "uuid": "5a37003d-1e6e-47f3-819c-8aec2f305686", "comment": "Malware payload (Mirai)", "value": "bba8e9b1635fef7a2ed2fdb901971219", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460772, "uuid": "eb3b7ec7-e9a4-4bcd-b79d-5385e7fd47bb", "comment": "Malware payload (Mirai)", "value": "b7e0c98637f616cc01804b34ab1d8cdc004f7356400e4e613c4cbc609694fc4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460772, "uuid": "2af9806a-b988-4ed3-b324-e5df9fbf0f85", "comment": "Malware payload (Mirai)", "value": "b3d5e746efd4c3421c7204b9124753b3235b5824", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460772, "uuid": "94ad7f4f-e988-414c-b5a1-863e4f962804", "comment": "Malware payload (Mirai)", "value": "d4230d512f1dc790075937ea4d8aec6f7be8a6e719700a90f0631c4235369a623dde13902357b23629f39f3cbf637b4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460772, "uuid": "20d49ed9-7f15-43e6-be69-ac117dd23515", "value": "T13AF30845FC518F12C6D612BBFF5E828D3B2627A8D2EE3103B9255F2C378695B0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460772, "uuid": "ea4969e7-b7c0-4dc9-b121-ee55a2514790", "value": "1536:rbCZGrqjPwUUUYE4kJ0X+oTQgcBsAial4VxLAJTe79GUlMboOYPL3PjojvlAATw0:rbaGTkE+6QdBsq4z6y79GUyQM6U18Tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460772, "uuid": "451b2bd2-4d5d-4036-84da-093515be215e", "value": 158336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460772, "uuid": "b1632f60-d7af-4c30-9fc2-9e9162de9157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460772, "uuid": "4d3cf2c0-1e90-4f7a-8ee7-4075c2367687", "value": "csk_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a765be86-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475698, "uuid": "0f4f36d0-0b67-448b-af2e-54937da814c1", "comment": "Malware payload (Mirai)", "value": "182274283ec00501c02b892c51e0b87b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475698, "uuid": "73641039-ff87-489b-a634-1f50faf1a997", "comment": "Malware payload (Mirai)", "value": "b7e7ddc4b125d0669d47ffb755b3d1991665fab995ba2a37e9d3cd88cae75909", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475698, "uuid": "a91ed184-1e4f-4bd8-a81c-d47c9ba5ca07", "comment": "Malware payload (Mirai)", "value": "cb96682e42957b14e22e9968480825b60de93549", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475698, "uuid": "2ee1efc1-5625-4c23-bc24-722033f2ed01", "comment": "Malware payload (Mirai)", "value": "47f19511b2352d41dc8f931591749ee98f38df4fe15a919b95a878c1572d5a1a8ca35dfd351d7b5e5254ba2894cb1285", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475698, "uuid": "52660eef-510d-4fdd-a769-20a357e74ad9", "value": "T16DB2C0A0609E7E31CA341C7AAD75869F7702463CE4F9392229D126EC7CED421497E37B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475698, "uuid": "348e9bb3-7ea8-4d6b-8906-193c732abec3", "value": "384:YJUYGaFySa4ptElzMAtDsAnuTdmzOenuJ6hMyK8YU6ClFMn/2RhgxhymdGUop5hq:o46elosQssYOeU/yK8YU9MuRCxs3UozY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475698, "uuid": "1abc1ad9-46b9-45aa-bf97-3e8351505f2e", "value": 24032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475698, "uuid": "bcd15eac-922b-4ded-aad1-13f38281837c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475698, "uuid": "bc7f3fdf-3175-461b-9ef4-a5454891227f", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f4ad00-160a-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772436913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436913, "uuid": "b5f69f01-c2c4-41fc-97ff-f43f92704dab", "comment": "Malware payload (AmateraStealer)", "value": "fddb9102d298d53447498fc146cab0e2", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436913, "uuid": "e3fd8b83-e128-49f9-bf4a-906609b21ffb", "comment": "Malware payload (AmateraStealer)", "value": "b860a6f104957545780d0a684dc08d6594dfa6c1e54f83384c4d7eb1acbf4f70", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436913, "uuid": "535c9615-12ad-4a3f-a4a8-32ea028eaca8", "comment": "Malware payload (AmateraStealer)", "value": "6ab819344ba2baa4aadca55c0409aa12117f3ad9", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436913, "uuid": "1d6de9e2-7714-448b-9729-9693a8767743", "comment": "Malware payload (AmateraStealer)", "value": "58d242e490366a190d084c4cd4ddde7b20387d36299b37e84a6d41d00673414740e9e0184d405653295cfab04ec2f9a4", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436913, "uuid": "c32faaae-f7c3-4bfa-a413-2cd05a67d64b", "value": "T1E3D68E239DD08274F5C651FE86FD3B6AC96D8A05033991C399C83C945B319E63A3EB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436913, "uuid": "df25b17d-bb3c-4461-96fb-0a1f02c8b5f8", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436913, "uuid": "9c7c6d54-012e-4281-956d-b3f723fad6ef", "value": "196608:fQke5A05AXFN3delxDtPAFGfcn+hr7oW:fYA0aFsDXcn+B77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772436913, "uuid": "6c3e27d3-5e4e-4a16-b111-86d3f3a9d914", "value": 12654592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772436913, "uuid": "dc5871a3-0949-45c1-9e9d-3761913e62ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436913, "uuid": "4da4259b-0253-4da3-873b-637091982b01", "value": "wke.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7d5f41-1677-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772483865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483865, "uuid": "c5c8051e-f779-44f0-b4b6-f42eaad5a8ef", "comment": "Malware payload", "value": "ccf19155edfc5d27e84d1c7c20b5c021", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483865, "uuid": "ce742f78-cff5-454c-a555-bcc82167ee91", "comment": "Malware payload", "value": "b8c10d4de6e924d320ca57133c6f3eee321994c5ffba56fc86a6baaa4a39b614", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483865, "uuid": "bee8036d-ff08-4078-a7ae-9032f9ab65da", "comment": "Malware payload", "value": "163429decc912f78cfb90926c18ebc0fc7bd0f4c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483865, "uuid": "d4955177-727a-4f01-b592-ed679158becc", "comment": "Malware payload", "value": "1c7f1881429b3853ef8dfbc595825d25d8e80ea99f625e591aa1d8b8b434d5d299235130c2034261e9a3999e7f32f6a6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772483865, "uuid": "a4c011a9-b111-473a-9313-8558b94f74a0", "value": "T1EA941216B361FD8BE80B83762CD80596A117BCB24B5D482B2986B35F1C7F3D2D5A325C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772483865, "uuid": "fc540773-530d-43c7-9479-53c78a0c8696", "value": "6144:7OY+3HGjhFLsqbHottq4JqG60MsFTWhT+jYpnE/VGnfffP6jD9ngTW+HX5Vded3A:43GhxItgZGlFA+jxg33UiiSVdww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772483865, "uuid": "75f3411e-f2bc-423f-a208-49b82d87afe1", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772483865, "uuid": "6e709f68-65b7-4287-a1e6-fb9ffa23c3e2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772483865, "uuid": "a1196148-6d62-4610-9858-d94ff569fb55", "value": "SecuriteInfo.com.X97M.DownLoader.2343.9658.29041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3d7aaa-1626-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772449210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449210, "uuid": "f0337eaa-b697-413a-a754-009e949d3ade", "comment": "Malware payload (AgentTesla)", "value": "401f2e1e4e6d5ac8ffe99a47cf1ffbdc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8581062014", "colour": "#B55AC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449210, "uuid": "3623405c-67ca-411d-8558-edb201b3d24c", "comment": "Malware payload (AgentTesla)", "value": "b982ee3dcfa99661be67b9b5b610398f3dd95538f7d97f754803be16b8117002", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8581062014", "colour": "#B55AC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449210, "uuid": "b1a68ac8-2989-4707-8d2b-c8fb9446932c", "comment": "Malware payload (AgentTesla)", "value": "0ded4f0353d6ba81cd022357ef8fea3f427cc3c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8581062014", "colour": "#B55AC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449210, "uuid": "9d5a2de9-70a6-45df-81d8-ac159ae0aed3", "comment": "Malware payload (AgentTesla)", "value": "b108e2a59ff1febb7d0d97a7a7e567711507dab66aa098d9a5b04ed1d9aea9c111ce5fdc1bde67dc03982714ded644f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8581062014", "colour": "#B55AC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449210, "uuid": "56dd6733-0966-4143-96af-6c4cc67dd4c4", "value": "T180340F037E88EB15E1A87E3782EF2D2413B2B0C71733D60B6F49AAA514517825D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449210, "uuid": "9d2f6faa-bfdb-4000-bfb6-c900d7ec0e6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449210, "uuid": "675598e6-06c8-4d22-9e69-e4a18c123c66", "value": "3072:r3ul7h+CuSWCWz/vgn2EITYU5+QqXc3xgPPfCU57lUqI8oH1d:bul7UCuSWCY/vgn2EITYU5U5PaKUqTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772449210, "uuid": "eab36665-6c94-417b-9925-9576dfb014db", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772449210, "uuid": "10d05df0-02c5-496e-be82-560d628af706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449210, "uuid": "2adba15d-28f3-4bd0-b748-e2dfb48524c2", "value": "z2santi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d46720-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476316, "uuid": "ffaa880d-8247-41a5-a652-a36daf67818b", "comment": "Malware payload (Mirai)", "value": "3a48ce69768eea42c531d2dbd81cb26d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476316, "uuid": "a8f3b30d-c95b-4c6b-9976-79a02b5e65b1", "comment": "Malware payload (Mirai)", "value": "baafa477327da9b272dac56da68fa9bd3efeea45bf02751ab7ef940561a23582", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476316, "uuid": "4f879815-6a3b-4734-80fc-e7346100d19a", "comment": "Malware payload (Mirai)", "value": "78ad1f82df6b9b6697a877b055ada2723500edfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476316, "uuid": "f9473419-6b73-4758-b74e-3e20f4a8eb11", "comment": "Malware payload (Mirai)", "value": "bb87e30cec69aa7007a9567f564bb8d8faa58a6f5c568e1843dc3d72c17556cb4ec441f4da4098df5808b20d1a2602a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476316, "uuid": "1eb7a882-3c55-4070-b931-a4de58113c12", "value": "T1CF532B02B7090F03D1532AF026BF2FF19B59FDE126B5A584752DBEC592719F12182EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476316, "uuid": "9c8abead-5c3b-40e3-b132-343517515de4", "value": "768:V5dITn+vaoMbLNfJ0GFXKcLQlyCpS5b2fwXI9YNp4PIvyRmjIew:V5dIz+CoMbBfeGMc8ACpSaY/4PDRerw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476316, "uuid": "3bd52925-c4f7-4833-a33b-1aa2c4d6b739", "value": 65808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476316, "uuid": "3c0d3f3e-5c01-4f20-96af-4eb1a4bb4b96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476316, "uuid": "79d7ee2f-f32b-40be-b724-0c7c9b044843", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa522f40-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475703, "uuid": "98a89a00-6edb-41e1-8fcb-d91fc9dc895c", "comment": "Malware payload (Mirai)", "value": "ff4699bd07710c62a551d65a710d070a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475703, "uuid": "02e16703-e3d4-46fa-b706-4a4ebd28c36e", "comment": "Malware payload (Mirai)", "value": "bae4d160ce1d7482c0a922703bbbe32ce623995d020505293c6875fc740f8770", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475703, "uuid": "5b36d5a1-4ae5-49c0-87e9-a3cf973a2571", "comment": "Malware payload (Mirai)", "value": "f2dcb022c8a83a8404e6c6eb9966e1006f7b47d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475703, "uuid": "c27c7e5f-dbf2-4e9f-b960-29512289f15b", "comment": "Malware payload (Mirai)", "value": "b7b27de6112d221a9ac9b5c6072f65759b68cee304d6c54be0e2448b40f0dbe549cae4c68fc7c4547292b688e0d73bd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475703, "uuid": "3ee69069-0e27-4c35-b46b-3aaadefeb51c", "value": "T160C39E87FB8B10A0C8124AF013C71F9D6B57A211CE5FE8E3BC1E663B5A7A4DB1516781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475703, "uuid": "62981d2c-4de0-45ed-af2e-ef5929e83764", "value": "1536:ut+2mPrGbK8njCC5nRW6ySerf52T+7C7tFdil9/XqgQYnxP/kgEvEf/LW7:utQryKojC6c6ySeL5cYGfdiPqvYGgXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475703, "uuid": "93a9ced8-e7c7-416c-809b-9335af435414", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475703, "uuid": "ee67bed3-57db-4594-8c59-c3da4a59d62e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475703, "uuid": "f9b97627-f2f0-41c9-a725-e8c467dbb8e0", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7207d514-1640-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772460147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460147, "uuid": "3bdee50e-3457-46c0-96ef-96df0519f8fc", "comment": "Malware payload (Mirai)", "value": "77213434a8a7b42200ffa93fc65ea428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460147, "uuid": "e1b432db-5233-417b-a833-6a2947e9fa0e", "comment": "Malware payload (Mirai)", "value": "bb1c4dc48cb125d18a174c04da311e1c7b119df240fd46aa96f8503219a472e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460147, "uuid": "f98ee950-b2c1-4c12-9434-530affd8425a", "comment": "Malware payload (Mirai)", "value": "9efc75ddc8b95e9c28f34fa00b8f56ec1167ab41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460147, "uuid": "ab1f24bf-c002-4608-b356-27522bc6fe5a", "comment": "Malware payload (Mirai)", "value": "e8005f49be4a32b816ba28df0fd3e40c00e4ef6bc92f004bb3e414eb5cf488acc7a7c3b4fc14f537c71abcde31b77bac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460147, "uuid": "b9701e72-f9a6-4365-bbb8-45c59ea14a5b", "value": "T164933A41BD815A22C6C813B7FB6E028D372663A8D2FE72179E116F21B3C692B0D77552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460147, "uuid": "5776dd3a-41d4-4af5-9a01-492153287c3c", "value": "1536:Hy7xBVhGuHRG5IN0QHCJjgrJhiTYGBo3pFPXW8ptDgXYYqEdM0JgwbZne:Hy7xBVhGXdtJMJh2Yb7fW80kEq5wbZne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460147, "uuid": "f24d3998-e4ee-493f-a51e-e8757bcaf98c", "value": 89212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460147, "uuid": "d2c50bf1-bb9b-40c3-8a6e-75203ede6e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460147, "uuid": "12a476f1-17a3-48a9-a92a-3a1ef8438ed0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f79927-1611-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772439813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439813, "uuid": "61e9fd08-f2a5-4c93-bdfe-ff6ec764297b", "comment": "Malware payload (Mirai)", "value": "ddd4cfa7c67b1a584916f33fa7d61f8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439813, "uuid": "ad5bab14-715f-4dae-b356-7932bf90b941", "comment": "Malware payload (Mirai)", "value": "bd3138237e743a1796b0f647a3f3fa0c4bb20bc1e43e31793a9deca6b5b0735b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439813, "uuid": "48f097f8-adc5-4506-972b-255d1fdd7994", "comment": "Malware payload (Mirai)", "value": "7c1e6de5b76200a13920547bc449a8ae5873fcde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439813, "uuid": "4bdb052e-53e8-483e-9d79-438e6d6c862d", "comment": "Malware payload (Mirai)", "value": "3eed9dc2e87996bdcf9c13278b08ff9d31007e317289714f1aaa69c99f91f685aa5cbb131f15b2c2a8cc30b8bc9528d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439813, "uuid": "5e13958f-f5e9-4c7d-89e8-184e96aa1601", "value": "T15B933C46BD824E11C5C503BAFE2E118D3313577CE2EE72229D106F21B7CA96B0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439813, "uuid": "76b814fa-52d6-4dd8-83b8-f8ef615ead2b", "value": "1536:M0nqwYoVZJmkWiBV5p8WNFtgHwA1rK8PJaE3kQDMiiJNhai9BDxAr7gO5zYu/wbL:HYwZAk5VU+zgQCK8xalNUi9BDxArsOV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772439813, "uuid": "678c4083-91b0-404d-82a4-16aac6831086", "value": 92068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772439813, "uuid": "a8974bcd-80eb-4e5c-9f14-3c70325b48d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439813, "uuid": "a3f3add4-0fbe-4116-8164-5fb18a44f61a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8353edf3-1619-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772443425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443425, "uuid": "2ecf0238-8d6e-4ca3-b899-8153e4aaeeeb", "comment": "Malware payload (SantaStealer)", "value": "b469ec07ba81c85a6f1cd17174157f68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443425, "uuid": "27249280-3eb8-4c4f-9d50-71f3ee98fb9c", "comment": "Malware payload (SantaStealer)", "value": "bd65591634a0d888756e66601233a835afe74d476123121b0f62ddcb10d168a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443425, "uuid": "7c66235e-cbd1-4762-a8b7-c8bf6f5959a1", "comment": "Malware payload (SantaStealer)", "value": "d4057c0856464a6be3c99d12dcea1601e7f2b8c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443425, "uuid": "4fb42a91-e3c8-42e0-8a67-012dbc90c86b", "comment": "Malware payload (SantaStealer)", "value": "f169e6248065b58a06a803c6a31afba8c173f16f000ae34371ee25a6ac6e6c8b34cf6e5614ed5c338b8f2e7373efa000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443425, "uuid": "3336ffab-0a01-42a6-a1f3-5abcb586aca1", "value": "T1BAC59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443425, "uuid": "5a04ae80-bc82-468d-b50a-d9d5e9e47b47", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443425, "uuid": "3d9d68fc-51c6-43e9-b4a1-a4c13b93812b", "value": "49152:LavY1Sn5eVNoqWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCIsdGU:KY1aSUevc+9sdBg4x4DPPnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443425, "uuid": "76967447-5dc0-4b00-a9ec-95d336adba5f", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443425, "uuid": "1edef763-82e0-4c54-bb91-105ca06f141e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443425, "uuid": "0ff4ed73-93e4-4147-b3eb-c6e9d19e5873", "value": "20260301_210513_20260302_000512_764YBUVPGO35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eda06c4-1628-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772449807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449807, "uuid": "c9f8612b-2495-4769-888a-3acee7c4b29a", "comment": "Malware payload", "value": "95660b8ac615602605a6156a84cc6c44", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449807, "uuid": "d5977c02-2dfc-42a2-9a1f-d33eba2024d4", "comment": "Malware payload", "value": "bd7237f92cc020ed71ae08a2eff01159900242164030c5c006191c4ca5322961", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449807, "uuid": "388ca8ee-1400-43ae-9071-884be2948eb8", "comment": "Malware payload", "value": "159f56882f8d8b7ee3df9ce89a05b31b2877bc4f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772449807, "uuid": "c061289f-8feb-4194-adf4-c7ca7f26b115", "comment": "Malware payload", "value": "f6e3e4f42442d400ed0d88e3fb2da0dfaf5d5f8548133f047183b16951175a4b992a1ee37fe070b0075a8a04606088b0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449807, "uuid": "c4ff70af-b170-47fd-8608-bc4d803b055e", "value": "T183E2E63FD153229A2B9E7BDBE0022E93995FAC55FD3234627C014741205AC64BBED93E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449807, "uuid": "f19b14c2-9ca2-4e93-b147-498c7945c0a2", "value": "768:Zg6Ur6i4IZNjnTaPOvOl9ivQztjpH7OIJs:Zg6Ur64ZNjngOvOHJ/bOIJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772449807, "uuid": "9e39904b-e054-42b6-ae96-789c1965d620", "value": 33182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772449807, "uuid": "964ab14d-420a-46e0-976a-8bf0fdc3812c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772449807, "uuid": "02413f5d-57a4-4e64-b0e0-8a792cad9490", "value": "bd7237f92cc020ed71ae08a2eff01159900242164030c5c006191c4ca5322961.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2474f10-163f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772459906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459906, "uuid": "de65d5f9-58a6-49d0-8bf4-36bc12991917", "comment": "Malware payload (Mirai)", "value": "bdac377f0f8c4c9f7e9cde47730363a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459906, "uuid": "7c83fcb5-4a3a-4ab7-8c37-3caa11e6e500", "comment": "Malware payload (Mirai)", "value": "bdb39d16543c43c88c4a281f58e53d4e26adbc0c148550cfc04f10db9035e30b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459906, "uuid": "d7cab7a2-74a6-46bc-a1a5-dd6076c725ac", "comment": "Malware payload (Mirai)", "value": "8f2e1430dd0d327e424b93b24acaad3039899ee2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459906, "uuid": "a3101935-ec74-49c4-ade8-769446186dba", "comment": "Malware payload (Mirai)", "value": "2dfce1c59135e243b4095276a66ef33336ddf4fecf4feb930e7f7f0e4e5471ef0090df5a4b5e23a62f4b8a24a98a1f51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772459906, "uuid": "df692f57-81a5-40b5-804d-c133a404275e", "value": "T1B8834A80FA8B84F5D94B493040BBF33FFB71E5794070D66DDF49AE26DD23601A2162A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772459906, "uuid": "d749f6f7-2f31-4275-b27d-fbbdb1ad8ae2", "value": "1536:RgAHn2H5PCu2jnMGNRi0FP6kb9RT/m3huCFrP+mwW0CmKU7cdwmY6SWzjx2wbZnL:RgAHm5PCu2TNU0FikbjodzmKUJmlSsEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772459906, "uuid": "7bb8ca6f-54fe-4205-bb9b-c8e54c1c66c7", "value": 83824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772459906, "uuid": "9928344f-02ff-4d1d-8bb2-0e92e998b66f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772459906, "uuid": "7ad7463d-5d74-4949-b0cc-2d2225ba2708", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6b4aef-1677-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772483869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483869, "uuid": "6d6846e3-f73f-4c92-84f7-e5ea62e655a4", "comment": "Malware payload", "value": "761844b481fdc2cd5043a466b8efc90b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483869, "uuid": "ba0b4aba-63e5-4823-9d77-46e8c7971fcf", "comment": "Malware payload", "value": "be54332d8ed254c41a49bc0f2090631f21a54fb589fdba1a532fa12434adeb4f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483869, "uuid": "33dcbd10-d943-414a-8c73-fa32faf5ad49", "comment": "Malware payload", "value": "ad2afd818027b80bbb28a90003405eadb76b5fdb", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772483869, "uuid": "08bbae75-8ec1-4713-817c-9f530849419f", "comment": "Malware payload", "value": "e678b0a38c272dafdf0a3a597c06cf3013f968849ee71e5f88c94fa06dd2dfcf664721b1c71b8ef2b4a6749052f120f1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772483869, "uuid": "00f1749f-c898-46e1-9786-55fa586803bd", "value": "T13CD41225E2B1BEEAEC02573B18C4009695456D538B2F911B7ED6375F8C7BBE1B08A13C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772483869, "uuid": "24611f1d-a4c0-466d-881b-7d84554a97aa", "value": "12288:HGtl1z3aBhIuwgZGe3GhUY3CChCs56IZWHS21Efjr8R:oX32CuwgvHYy4h8Id21wM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772483869, "uuid": "adc67a0a-0c6b-4b4e-ac3e-272c33d51a31", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772483869, "uuid": "62209665-0718-4b76-b683-6a02e67c5851", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772483869, "uuid": "09e41efb-0def-4519-804b-99e1014c68ee", "value": "SecuriteInfo.com.X97M.DownLoader.2343.16796.2368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36134f53-165c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772472072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772472072, "uuid": "b5700a35-a0e1-4318-9962-d6dd07798736", "comment": "Malware payload", "value": "dc6833c9a5817e213e0fafd58523a3ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772472072, "uuid": "d4fc7750-ce39-471d-b642-fb1c94aae106", "comment": "Malware payload", "value": "beea2c351f31771d2e6fc284509212a4f69e74f06dcdc9385eff85372dbf71b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772472072, "uuid": "f5a69124-6c42-4308-8310-0835fec99b01", "comment": "Malware payload", "value": "676a710824d2b5bfc07864cab8bba08dc4c8ce47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772472072, "uuid": "f08626b8-c579-498e-8da1-cdf45e836416", "comment": "Malware payload", "value": "a3b507f558e0087ca210af2dd08f720c6e3a42ad7bbc8e8b2e674c3759af5f201175bb8b48cb88cb7cb44aa46ffebb49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772472072, "uuid": "34a73582-2236-4abe-b5f8-3bd508abd5ab", "value": "T188454A5AE7A114E4EC77D1BC88815206FBB0B8684720D7DB73AC851A1F336E89E3DB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772472072, "uuid": "3689ec2e-f10a-401c-b72a-392768b21496", "value": "aaccd3027895e88f71ee1337a879e66c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772472072, "uuid": "87b70bff-f0ef-4d85-955a-3401da76abd6", "value": "24576:eMXJjhJGc8w2UNiXTtniFuuNvGgjjsrdcAONdA22xVK8LRPo4WDD9/wr9W:eM5lOAiXTQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772472072, "uuid": "a7423073-4a1c-4e68-8a02-3deeb2240280", "value": 1252864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772472072, "uuid": "85c18da0-9790-4a16-af23-429bce3954d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772472072, "uuid": "cc2fac4c-30db-4d97-b564-4a16aee7abbd", "value": "SecuriteInfo.com.Trojan.MulDrop33.28141.5690.20756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced85103-163a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772457725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457725, "uuid": "956fe2f4-3fc7-4433-86cf-7792cac513da", "comment": "Malware payload (SalatStealer)", "value": "449ada23f652552b69b0170c0d297b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457725, "uuid": "74182bf4-99a3-4854-9dde-5c69507752e4", "comment": "Malware payload (SalatStealer)", "value": "bf4583a8e4f3cc84815e551fb5dd14516aae8066bd30791ac4ed82a88db85ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457725, "uuid": "855e0c2c-b941-4b81-ac53-cad11c353ec1", "comment": "Malware payload (SalatStealer)", "value": "bb3fa10ff8396fbe6a0d8e3f4e3afc95c26112bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457725, "uuid": "6be8fbfd-65cb-4d35-b5b1-28e2af3f4bbb", "comment": "Malware payload (SalatStealer)", "value": "d9f2d62606102ecb5c73a93a06051dbf96b8346c12d4150491a8d03cfd52e3dbffd7b9bb92beb8663a5a7a2db03244ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457725, "uuid": "81e4c316-bebe-486a-9ba2-3751594f753a", "value": "T1BF878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457725, "uuid": "4d7d90d1-5b6d-427d-bf5e-c3fb43c40632", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457725, "uuid": "2eaf7d8d-48cb-40dc-8240-c336fafdda6b", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYft:fMguj8Q4VfvJqFTrY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457725, "uuid": "a5408084-9ff7-45d3-8dcb-f26bbea53294", "value": 37664950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457725, "uuid": "ec2a90f4-688f-4d61-be21-45e0d040cc13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457725, "uuid": "d1bf5e36-31a2-4c0b-ac3c-62fb246bb822", "value": "node.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d467cc9-162d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772451951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451951, "uuid": "dfc37e0d-0e72-4e19-bcb3-264a0bce88f2", "comment": "Malware payload (AsyncRAT)", "value": "e20ece0966e8502946995d791375b11e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dianganadores-duckdns-org", "colour": "#45AA3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451951, "uuid": "3cd0e7e5-41b5-4fae-b8a3-ac474c7ba7f4", "comment": "Malware payload (AsyncRAT)", "value": "bff9fe40dc446a02b458e9177134be246d722474c3e38561c1d38a46b450ba6a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dianganadores-duckdns-org", "colour": "#45AA3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451951, "uuid": "15809b8f-d1f5-44d7-919f-4b46b3aecda9", "comment": "Malware payload (AsyncRAT)", "value": "e97d74cd59d136a25008d032e85c810ec46f3967", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dianganadores-duckdns-org", "colour": "#45AA3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451951, "uuid": "37cf74f7-37cb-4302-96a2-0cd3d13700e6", "comment": "Malware payload (AsyncRAT)", "value": "5f71c6e277c897aecb89892df2b686b53f78fb98eaac7d0ee2f5fa0807d82896d8d7e0222077e38a203340eaf4efddc8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dianganadores-duckdns-org", "colour": "#45AA3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772451951, "uuid": "bfe1bc3b-33b2-45e8-b711-7ed21f8d8cf6", "value": "T11DE23B4877D44322D6EEAFF12DF261061670D517D923EF6E0CE485EA2B67AC087407EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772451951, "uuid": "7e63f6fb-c7af-4737-a641-9a330bcfde52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772451951, "uuid": "d11db167-e379-4702-a42a-fad50a1a837e", "value": "384:fEmNYo85DCeup3fEhjLuwUr3Tm2eaFOYKdRApkFTBLTsOZwpGd2v99Ikuis3OVFM:cA8wlaPBs3Tw4xKdVFE9jPOjhbbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772451951, "uuid": "279ab8c2-bac2-4def-abb9-88a803cfafd0", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772451951, "uuid": "fc4b0938-2ff7-4c9c-a3d6-41fb40fdce6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772451951, "uuid": "bcb8a477-c231-4e4d-bd6f-0e8cf574b832", "value": "bff9fe40dc446a02b458e9177134be246d722474c3e38561c1d38a46b450ba6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f60151-163c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772458566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458566, "uuid": "8e2d23f0-af98-411a-baee-d44808b826cc", "comment": "Malware payload (NetSupport)", "value": "82a019c4e64840faced30e8bc8f2d4cc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-ppp", "colour": "#46779B", "exportable": true, "hide_tag": false }, { "name": "pwn-ppp", "colour": "#2FFCE7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458566, "uuid": "fe3b8a45-5e78-4cfc-88f8-48965d80d447", "comment": "Malware payload (NetSupport)", "value": "c0af6e9d848ada3839811bf33eeb982e6c207e4c40010418e0185283cd5cff50", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-ppp", "colour": "#46779B", "exportable": true, "hide_tag": false }, { "name": "pwn-ppp", "colour": "#2FFCE7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458566, "uuid": "3b33d8cf-8dd1-42c7-9268-3eedcd2affd7", "comment": "Malware payload (NetSupport)", "value": "8f1aaaef9bce0ea49cdb8b0560f0042586c01920", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-ppp", "colour": "#46779B", "exportable": true, "hide_tag": false }, { "name": "pwn-ppp", "colour": "#2FFCE7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458566, "uuid": "f4f67f24-b9ed-4925-8455-b396bb930913", "comment": "Malware payload (NetSupport)", "value": "55f2e256bca50ba646f633611dc410da2b5287a7ef17661c17ec33f8dfacc2edb2215cc6ec67c70104fb3e3b9adafbc8", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bookstablesoon-com", "colour": "#BB6D86", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-ppp", "colour": "#46779B", "exportable": true, "hide_tag": false }, { "name": "pwn-ppp", "colour": "#2FFCE7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458566, "uuid": "1681e7b4-37c4-4ed6-bfdd-f1fcff42d5d5", "value": "T184E5339F5E439627FF7179AC28AE649FD50980874F379563CC1A1418CFB5A0E8FA3A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458566, "uuid": "b6030564-28b8-472a-ac39-75eeb1dc324c", "value": "49152:tCYvgm6WXgUDL5KG+EAm/6SHDhln/rhfk3yjJ59aXOHC82fBE5BFrBwniWU:SWXgUpB+bmCKDh5/gmJaXOH32fBENNWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458566, "uuid": "9e72d572-2e67-4b62-84e7-5ca7a8bdccd6", "value": 3025089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458566, "uuid": "268f2ead-cd7d-4d63-9485-00ee96f06f8a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458566, "uuid": "9556ff23-c847-4d76-95d8-0496db0b3095", "value": "at.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946bfee9-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444743, "uuid": "39b71cfd-839c-450a-8de7-4ceedf3ac1e7", "comment": "Malware payload (SantaStealer)", "value": "4fc8117f615a333e448e2303eeb49cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444743, "uuid": "70973424-bc3b-47ed-b642-5bf1db858b78", "comment": "Malware payload (SantaStealer)", "value": "c0c37d4b15adb9b54c63793980fcf5b3d918a10c776150d3597d1a2eae88df75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444743, "uuid": "cbc4de36-2ed0-40b1-b30b-f9ee4dc2faa6", "comment": "Malware payload (SantaStealer)", "value": "daed91edef0f29972a72c17aa39433ef608a8ad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444743, "uuid": "adf27e88-bf78-4c50-a826-e39672b603ff", "comment": "Malware payload (SantaStealer)", "value": "c9306e949a8f0223773247560ffa3149ae2e0442d9677591034c50a63ce68375c041cb95a519cf5e831fd9bda61039cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444743, "uuid": "6ff7fcbe-935b-4d2e-80f9-6e3dbadcaa26", "value": "T163C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444743, "uuid": "cf75d153-eb6c-4ffd-b947-b5f1d1737219", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444743, "uuid": "a47c4c75-82b8-4a99-8527-2cf23ef69c54", "value": "49152:zavY1Sn5eVNoVWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCTsdGu:yY1a9Uevc+9sdBg4x4DPPne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444743, "uuid": "4d06abae-93d1-4d6a-9aa7-4ba0cdcabd13", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444743, "uuid": "4652423a-18e3-4c9a-92d2-2fe65ec51fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444743, "uuid": "1ae62c4c-a6cc-4f81-a7b1-33f9b010b404", "value": "20260301_214251_20260302_004251_81ZEH0M339B2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b3b1a8-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487528, "uuid": "f0009d41-33aa-43e2-9294-b14c8d147ff1", "comment": "Malware payload (Mirai)", "value": "a2d40fd02b676cbe7a8c584e3e8f25bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487528, "uuid": "18141f64-78a5-41e0-bcc4-d1e24f0737d0", "comment": "Malware payload (Mirai)", "value": "c1b0c6d9b03f291e2fae0c58da11d798c4fb528de495dbd4b461076bdf9a8dfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487528, "uuid": "99493a35-1c4b-42b1-a09a-80038977e65b", "comment": "Malware payload (Mirai)", "value": "376aa9708808ce6d8c4db416b2d09492b3836f21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487528, "uuid": "ce5f8411-cf81-40a6-b21f-fbe577c28eef", "comment": "Malware payload (Mirai)", "value": "3c9c0ff1db19e9ec898480ba66906e5957f4393713a6117cb134f3a401f355c97b70ad8cf017b882d9e7a227592be150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487528, "uuid": "96e63ba7-1e4a-4a2d-b63f-7d2e1ba12c77", "value": "T1E6D33A2275791E2BC4E4A87E22F74761F1F157DA25A8C90E7EB20D4FFF212206507AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487528, "uuid": "2c7031fc-78b6-479d-89fd-c800c1c8c12f", "value": "3072:nZUlV+Fawd99IVWFjKc7RgyhOFe30Hi09lshKw0h:ZUH+FD99IVWFt5OgEmhP0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487528, "uuid": "1d8ec488-fb35-4c65-9548-999e00e5761f", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487528, "uuid": "6ee71ab8-1c51-4d24-97cf-629fa0d17776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487528, "uuid": "49a8e549-3b02-405a-b530-0109f2ac506f", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf6232f-160a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772436836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436836, "uuid": "f6168887-6022-445d-ba19-c204cde21047", "comment": "Malware payload", "value": "e7e864d0df06a0b396ebb2d40fbfde0c", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436836, "uuid": "32828441-35bd-44f6-863f-54bdb5bafdc2", "comment": "Malware payload", "value": "c1dc9d15190da5e3f93ed747c240dfc6d4dea67018068fd3963e75ac6b09b7f2", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436836, "uuid": "000a3572-ab3a-4a14-bce7-22a0fee444ed", "comment": "Malware payload", "value": "679b68424ac0a2694878cbf6e0fa417c9ea07fc2", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436836, "uuid": "0f6a1c74-cff6-44ed-8100-b715560b6f1f", "comment": "Malware payload", "value": "8338b0e26d873e3472946a95cb32fc6a1fba8fab7c66ceae72ac74f2c6e153d14e3585d230d938795a666be3da464f25", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436836, "uuid": "3331f611-4d41-47c4-ad58-fc18ce393902", "value": "T17035F5A84E1B38C8986568D6C252B1425FA5063F6D3DC8477B613E01A62F31EDBCDB4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436836, "uuid": "3864f2da-a301-4f85-83c7-5bdabf9ddaa7", "value": "12288:L4w+vGYKlUe4dnUr9kfgPM37ATOxPL1i/5Ux77wNSCqTqqcKbjAxASlnpz7DF3Ck:kPIxKN1Geq3VXclK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772436836, "uuid": "46f22432-7dbb-4391-8ca3-747c9719f05b", "value": 1160522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772436836, "uuid": "90d44694-e606-4b24-b51d-7991b43c8ef5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436836, "uuid": "1741f9b9-2c04-428c-b790-e641e4b5ecbe", "value": "c1dc9d15190da5e3f93ed747c240dfc6d4dea67018068fd3963e75ac6b09b7f2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2bb167-1625-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772448700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448700, "uuid": "4ca849c4-3ad5-4ad9-8790-dd29282a7eef", "comment": "Malware payload (Mirai)", "value": "ad6b08f218d99471cf8c7a0744aecff4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448700, "uuid": "c4ba0439-64a7-4292-803d-be015b313aef", "comment": "Malware payload (Mirai)", "value": "c2405ac1841c76fca51540329b0cf58de31598981d4230975e830611d9ecb387", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448700, "uuid": "566a6cb7-d6a4-41c0-b14e-fdc25c2c9201", "comment": "Malware payload (Mirai)", "value": "acd36d0cd9294ff652aa5e9d8e0620f9ed8ee534", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448700, "uuid": "5231b169-2b93-4d69-b40e-6e850b412ca4", "comment": "Malware payload (Mirai)", "value": "5ca316ea5a0d2b6d6ec2f9dba4bbd2c8e4d8549106a638b3844f7189b0f6b9f5df5d855876906b329eb9b35075c7e18e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448700, "uuid": "bc0a41a1-3938-4898-95f8-d0e824dd7c0f", "value": "T1EFB3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448700, "uuid": "8215c9e4-2a63-49db-b8c5-42c609627bd7", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZWoamm/QcuLB1niDNb:YuFX0GIk1MHyphTamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448700, "uuid": "fd457739-1365-4b52-908c-cf2a94948b2f", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448700, "uuid": "d4d6cc16-3c4f-46cc-b55c-0b8185a44fb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448700, "uuid": "b2c5c505-4085-4873-8970-17383bd88a65", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32597f4c-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772465194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465194, "uuid": "2f2a0a0a-32db-4367-94e0-7b389b0002fd", "comment": "Malware payload (SalatStealer)", "value": "7c027b6c6392f6101ad1fad32912f6c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465194, "uuid": "eeb58583-10e6-4dfa-a8d2-30944144bf9b", "comment": "Malware payload (SalatStealer)", "value": "c269a1688acb63875501e577159fdb4db5ed27f4fc0e42c2f287cb192b11cd7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465194, "uuid": "aefd4a56-0fd9-4d6a-b803-4e7b85413361", "comment": "Malware payload (SalatStealer)", "value": "cc18836ba139f5b25444e8c4c9c915f18a432988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465194, "uuid": "99d1bdb8-2fd5-42ec-833f-97654380b93a", "comment": "Malware payload (SalatStealer)", "value": "fe8fb1fdb183881eeb22f60aaa2b9ec8df317d081cff412bf718f8511814b0e0c15af294e393e80e57c571d739f87b11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465194, "uuid": "38990b55-95e3-49b8-9fcc-58d3e1c2060d", "value": "T18FC64A41FACB54F5E9035931406BA23F23319D048B38DB9BFB547A2AFC7B6921D36609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465194, "uuid": "af1f7440-d20d-493f-a2a7-b6df31efb871", "value": "98304:+u98GMhZ7oWV+JSnjlmtVc9eH1wyFel5:OFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465194, "uuid": "16d6b0fb-da2e-4579-901d-ccf84d32ceb2", "value": 12108288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465194, "uuid": "003b0a39-2c2d-4bab-b93e-59f12ce98b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465194, "uuid": "4b2ce5c9-e944-4146-b5e5-8a4f6585b4fb", "value": "s2a11n3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8cefa5-1619-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772443338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443338, "uuid": "25db5885-67b2-44cf-83cc-eb6bce5699b8", "comment": "Malware payload (Mirai)", "value": "9c00e95ac5706e48d50baa292667d2f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443338, "uuid": "460e03e1-5ae6-4dde-8b9f-ec1e5b0c8656", "comment": "Malware payload (Mirai)", "value": "c35fc61a13aa65abf7d5cf2e6a201e241146b0f80fe75efb60e7518f07c8552b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443338, "uuid": "e731bd4a-ee7a-4233-9643-1137d0494341", "comment": "Malware payload (Mirai)", "value": "6adb32e15b639421b6807378e11dae499bc6a49f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443338, "uuid": "10e2e0a1-e843-482c-b899-b1e302929a0d", "comment": "Malware payload (Mirai)", "value": "3f7b754421d3fa792f9a99c12612acc719505d60b663eb0d6ebcd06126ebef4f325583b13f4976b5b7b82a3ccf877399", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443338, "uuid": "355a013d-6d79-4fb6-9508-e4769e3b8977", "value": "T1A74618177A28D70ED628223458B1CED56B792C4645D6A527F391F309A8F20BD8E6FCF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443338, "uuid": "967683b2-f108-4d4e-9dcc-fd7cafc66213", "value": "49152:QPEV727Y0PsgOlvDXfageRhuNAkZ+uxg+ujHGbo6CgV+yMSoIn7j/oDcZJutZws6:x0j8lgtZ70nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443338, "uuid": "3f8a0433-4fbc-4f78-935f-8de06d4a4029", "value": 5636279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443338, "uuid": "6c24f368-9ed8-4935-8f31-81a9411abc3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443338, "uuid": "e97ed533-9e29-4466-8aed-80d10fb1ee1d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2ecf5d-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433775, "uuid": "391c70b2-2c27-43a9-9426-79c84d89fe61", "comment": "Malware payload (SocGholish)", "value": "1b9f19e0c5aa310961d7bb171d91d104", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433775, "uuid": "fe273326-35d8-4c7a-b8fd-a8628743ad5e", "comment": "Malware payload (SocGholish)", "value": "c4322586146802babacee36f00d5df5193fb6a3eaf2f89954aa0479960548b0e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433775, "uuid": "77529e24-37a3-4e6b-a76a-08042cd73ab5", "comment": "Malware payload (SocGholish)", "value": "2e16d0f1bfaed43ffaa79bde088f200645a95691", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433775, "uuid": "14296063-5106-4f81-9a7d-a00ad103551b", "comment": "Malware payload (SocGholish)", "value": "623557946d9129bce20085a44cf18b9955791d746f3ab69528d8b691b328243b31361090515b5fa17baa78655d427af5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433775, "uuid": "52acbea4-346d-4af5-817c-83c5d9005689", "value": "T1C0D0EBCB18490438EA9D082202BA0E8570432E082C545E23CCAAC42409393EA48023CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433775, "uuid": "a206dd8f-0bdc-4acb-98a4-2d7c9b8fd87d", "value": "6:bQnyX7BWyG3AgO9lH92AGuRWd8LHtj8OHMd6pdDdYzUSAH3vnLWm:/m34H92AGuRWd8Lh8eI6bOAH/LWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433775, "uuid": "2c6713d4-0e5e-42e2-b585-0dbcd70f09ad", "value": 277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433775, "uuid": "0c7bcf51-5ac0-43b3-8203-9be9cba01d77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433775, "uuid": "5ebd7769-4f5e-4f25-877a-12f12b287127", "value": "c4322586146802babacee36f00d5df5193fb6a3eaf2f89954aa0479960548b0e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5b5e20-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444756, "uuid": "2ed9e8a4-a9dd-4f11-81d8-91a697b0af09", "comment": "Malware payload (SantaStealer)", "value": "b9f228eded27fb2c3811019efa8c2429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444756, "uuid": "bfc14be4-7e66-410e-ac9e-ebe0d4ad3fac", "comment": "Malware payload (SantaStealer)", "value": "c4b3f673f8ffa160138ddc982131a617d352ab9b2a27503ddd0dbaef6ccdd15d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444756, "uuid": "5ea6d6ca-45b6-4d00-a482-5770b86f986c", "comment": "Malware payload (SantaStealer)", "value": "4b7fab504de8556c8e4b07dc51d9b8076820fb87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444756, "uuid": "174442d2-1afb-48ea-b0d6-3a13cf86e369", "comment": "Malware payload (SantaStealer)", "value": "7cc68496ca29be357a03814d180001821cdb7c57d606c1a547de909f1f8b384fe8b22feac671ffae4ca623f703ab5de2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444756, "uuid": "0c774c02-65b7-4fb1-a5e8-e75a6fd802bd", "value": "T164C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444756, "uuid": "ed28d55a-8e8d-425d-b725-c53b5728b4ff", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444756, "uuid": "b7698d05-6664-4793-845e-d635e7f85df1", "value": "49152:AavY1Sn5eVNolWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCUsdGl:zY1adUevc+9sdBg4x4DPPnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444756, "uuid": "41b9be90-39f9-4729-a81c-025fdf3cddfa", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444756, "uuid": "0ee15f06-293b-4949-9620-fd6f3aa527bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444756, "uuid": "ac0c2bd5-5077-4bee-9704-ea81cab6d8bd", "value": "20260301_222749_20260302_012748_D5G9657V24UP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e772fc22-1641-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772460773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460773, "uuid": "e4007e1d-e378-4cde-b142-5f8a1f843926", "comment": "Malware payload (Mirai)", "value": "d27cc80537344bcaf836a50696cfd792", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460773, "uuid": "f4038945-4c3b-4323-b4d8-d8990e64ff6e", "comment": "Malware payload (Mirai)", "value": "c62c0cb5e0bb8d3cd96dbc2a2a6f42ec9fd2d4fe369006a2416d3185d893e34a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460773, "uuid": "e14367e8-8902-40d2-92b3-f0fa0bde97e7", "comment": "Malware payload (Mirai)", "value": "f55b5bceabdd2d6491d273494d542a7554be4f0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460773, "uuid": "734ce91e-e00d-4951-9201-370655258c57", "comment": "Malware payload (Mirai)", "value": "7e2591e7317e56f63123ec417bd0fab13796cc402741cc3f02d354b12cee948f9bc88dfd9d3d065725086783aa1f5530", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460773, "uuid": "589b01ab-e868-472d-b410-7c05f3038dba", "value": "T132C38C87BB4B1860C86107F11BDB5B9D3AA331118E2BD8F76D0E757B983D5CA090A792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460773, "uuid": "1434f6d0-f417-472c-83da-cd7db898a0e4", "value": "1536:QDmqw4271QOWLmnqLYLkLeDwgx193lC+5L6g+BMx6sRg/GwbZnO/LWb:Ew4271+JLYIiPn93bL6g+BeguwbZnOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460773, "uuid": "4a0e7350-57ee-43c3-9fa2-69d1bb7bf5c3", "value": 124192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460773, "uuid": "e1da1bf0-1b35-4206-8615-240dcf24b9f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460773, "uuid": "aaff124b-48f8-46c6-af40-0cd6ad9cb105", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819bf124-1672-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772481648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481648, "uuid": "751d181e-20e2-40ff-a0f8-ff1e99cada77", "comment": "Malware payload", "value": "73a8e38f92a174ba34c711226da24291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481648, "uuid": "b0625083-bd22-4141-a5bf-e8c630f72f5b", "comment": "Malware payload", "value": "c671c87dce61b1596076ea91342f1a6f353913596154a9b3cb2a3d39e35bfd79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481648, "uuid": "62ea03cc-8850-4f02-b3f4-7d1ff19e0f9b", "comment": "Malware payload", "value": "ff8e52d4625a62c79d437303402ba031c8363409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481648, "uuid": "e88b7da2-2973-4ace-91c7-e3edc9b816ad", "comment": "Malware payload", "value": "bd46d6a6f70f8208b2db21b936bc0e35249f06a1598d6f383ede933703f3fc9af87840bc456d77ead557c5829ba56e83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481648, "uuid": "0ecbc317-97e2-42f3-b692-f96fd71cb613", "value": "T153E633965EB240E7C241F833D1826BBAD3225FF6BE54D69D22085EE0F60E3E7C6454E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481648, "uuid": "06a28dd0-45ee-4bf8-9ba6-f30efc1383d8", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481648, "uuid": "6fb69120-c670-4720-93ef-e5aa63b596a0", "value": "196608:cojvVUr3zJQugkIoANC5d90KV5Ee6r/FKNlWa7CwI84c40gYLAoVN3imRSko04:cBJBI1w9RqLxKNlWBwmc40gYvvSccF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772481648, "uuid": "03f8d620-d18d-4ff6-bab6-962458905dd6", "value": 15031296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772481648, "uuid": "38688eaa-fcd1-468e-86a1-06df7c70edd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481648, "uuid": "a416913e-1417-406e-9868-3718ccc64622", "value": "Installer_v2863_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91d0243-1686-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772490358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490358, "uuid": "bc350eb2-c5aa-4166-a1a0-e757219e1689", "comment": "Malware payload (Mirai)", "value": "b8e0ea374aafc4fc9196a13ad2b0e3d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490358, "uuid": "b5fc9b58-6528-4436-b644-a46cdee4c362", "comment": "Malware payload (Mirai)", "value": "c76590bd3c27c485dac2c5fd4c3c2cbee803e2b963e6a272323a9f88cbfc773e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490358, "uuid": "5549c2d3-cc62-49a3-9654-07652888cb21", "comment": "Malware payload (Mirai)", "value": "238447ccf96b6ce0e61e96afee15e3562c27bc43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772490358, "uuid": "7a67e606-b56e-4240-8193-dffe0696f61c", "comment": "Malware payload (Mirai)", "value": "ecd3ab0994306a47939d248b76d582b6d452a3974e24e3bb950f6c6eb1a696f083dab5159956bcb474b16ab999da250e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772490358, "uuid": "2eb96d6d-bcc6-48ea-8bcf-a8b790ab0154", "value": "T1F725D0A772068E11C2854373D1CB8A4197FC9685B6A7FB0E71D6239A14073EFDE0A397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772490358, "uuid": "d652bfa9-ba21-4e06-838f-5946a318ca6e", "value": "24576:h7xrIPZCYr1yWr9BmNurn4buqSqiLSRz:h/YrcWDm04buaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772490358, "uuid": "b11fd419-3ab8-4220-9ad1-4757f889b54e", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772490358, "uuid": "d63e4d2c-9c21-4ad8-a93c-725f950f969f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772490358, "uuid": "9fe5a291-061f-46f8-ba76-46fc8536f638", "value": "SecuriteInfo.com.Win64.MalwareX-gen.73557988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c581fea-1623-11f1-a769-42010a9c0008", "comment": "Malware payload (AmosStealer)", "timestamp": 1772447709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772447709, "uuid": "57d1b15a-9712-45bc-9273-0f6b2ceaf72b", "comment": "Malware payload (AmosStealer)", "value": "78e59679cfdbfc2832feaf9b918edb81", "object_relation": "md5", "Tag": [ { "name": "144-172-92-231", "colour": "#AAA376", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772447709, "uuid": "4e865a76-187c-4313-b942-06c2195088c6", "comment": "Malware payload (AmosStealer)", "value": "c8613819cb4978591f4d98edd56bf3fdcc9f52245778416406d5b1e582a7024b", "object_relation": "sha256", "Tag": [ { "name": "144-172-92-231", "colour": "#AAA376", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772447709, "uuid": "b604f9dc-8fa8-43c0-9e73-df48dab934a8", "comment": "Malware payload (AmosStealer)", "value": "c42095e7214c65536e405d1bc7f39afe9fcdb61e", "object_relation": "sha1", "Tag": [ { "name": "144-172-92-231", "colour": "#AAA376", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772447709, "uuid": "a0c11743-bc61-448f-8f3a-cca2aac1c58b", "comment": "Malware payload (AmosStealer)", "value": "56278c3fc1072149a2094e3b8d7e861bef5ebe700f1e0ace9dc106667740e57ac49ba67b986847d61f2a4e44673639f4", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-92-231", "colour": "#AAA376", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772447709, "uuid": "ebd814fe-7395-4c28-ab03-4c1209293bcf", "value": "T116C44B2720796440FC4532B9FBCBB6FBAE103D7207BC94B89E81C72359FA2759A4514B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772447709, "uuid": "f4c837c3-14ec-46f1-8c35-afacf5e91516", "value": "12288:OlJw8AF9MMVLW4s2SEv8LWiR6/8JGYPdzj:OlnhU0ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772447709, "uuid": "c971cd21-7e8b-4b19-87cf-5ea7b66e3ab9", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772447709, "uuid": "3ccf74bb-6fd8-4ff4-9213-4dc5676ab796", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772447709, "uuid": "e400ce92-337d-4bb7-b79e-13b91699fe8c", "value": "Hisefuhu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df298df7-1600-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772432842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772432842, "uuid": "e6ae3b30-0288-40d4-9f49-fb930e5f84d1", "comment": "Malware payload (ValleyRAT)", "value": "78ced422d8b5571c5794d900d0bb8039", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772432842, "uuid": "ba82b073-fa06-42ef-a4d1-bd39b96efc23", "comment": "Malware payload (ValleyRAT)", "value": "c878508f5476df6e84aeb153408fec8a760fbecfa0d122468bef1a18fd473064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772432842, "uuid": "d6c6129b-bcda-4e26-83da-d2ff9e1e7136", "comment": "Malware payload (ValleyRAT)", "value": "bf67be8c8984ee30527e41075dd5a4ac6bf24784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772432842, "uuid": "0aa8e8fc-8f7f-4d98-a73c-d66c5c455b3e", "comment": "Malware payload (ValleyRAT)", "value": "abc74b6e74543da94c6a2aa76cc988229117ef599ad6ec33c7547df383ade04e66fcac0b93a5d6f8b8d6f4771851449b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772432842, "uuid": "e09f5000-3089-4ae5-83ba-26f5a6393720", "value": "T1A28633A963B208F4F9B5917EC1B68249F272B02A4775D79F13A006521F27BE15C3EF42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772432842, "uuid": "17b5cf87-8760-4977-a2c8-ceb3d1369a4c", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772432842, "uuid": "5a9c5f26-259c-4dbf-ad04-ca6ec8d82db4", "value": "196608:Faxc9VjA1HeT39Iig7auDXURuAGCTMQ4q3rq2:QxcO1+TtIinuARuAWQ4qbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772432842, "uuid": "558b8850-2e5c-48c7-bbb1-d121ed3fae3c", "value": 8381171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772432842, "uuid": "333350b7-af6f-4b29-a514-a3d94d94285a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772432842, "uuid": "613fb6c2-93e3-49a7-9807-8fb3a18d4401", "value": "c878508f54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede96069-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433726, "uuid": "71709113-fdac-4cd9-aa09-b305b2697b0f", "comment": "Malware payload (SocGholish)", "value": "36301897341fbb1e621f5444af92a1b4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433726, "uuid": "6048810f-7aae-42c3-a260-6ff25aa474c8", "comment": "Malware payload (SocGholish)", "value": "ca7344e582bb532a76620c6032ca8b2f9d169e1b9bde51fde4058b9957916e1a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433726, "uuid": "ba11f2ee-d298-43e2-bc19-5db7823c0c92", "comment": "Malware payload (SocGholish)", "value": "c829cb91c8a3963741e2d839e828933b893c976a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433726, "uuid": "7f6a9750-a217-4111-860c-9666913f2921", "comment": "Malware payload (SocGholish)", "value": "b29f860a337235d759d22d4d549a2279f4caa336c392aa192c1bdf3da728ef58d6eaa1aec63166be1c80d60e86a54dfe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433726, "uuid": "7651e79a-2bc2-48f1-93a0-0953c1182312", "value": "T1D5D09766184D203C3FA8102A3033870C3242228CFCDA08728CB788200200BD1091E70C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433726, "uuid": "e636e637-d7dd-4348-bec1-4b3a8d497997", "value": "6:q7XnE9/y3AgO9lcRW5E5OGIdPMuEBN2jyutbkgIzm:I3oa34cRWQOXMuMkbkgIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433726, "uuid": "3e18cc7f-ee63-4917-840f-a4b61252c377", "value": 242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433726, "uuid": "00851556-6d35-443e-a0e8-f990b0bc5edc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433726, "uuid": "e206c599-00e9-485e-ba4f-e135a677cf91", "value": "ca7344e582bb532a76620c6032ca8b2f9d169e1b9bde51fde4058b9957916e1a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54013c67-1626-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772448929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448929, "uuid": "e5a9c578-4357-483f-9c65-5a6b387e5628", "comment": "Malware payload", "value": "65e8083693b1fe8e585600749fd3f3b1", "object_relation": "md5", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448929, "uuid": "6f085321-0c49-42cf-9a9c-524dc95c1137", "comment": "Malware payload", "value": "ca99c4d3e0c7001078a9b8e261034ad55c4957f807eadf0ff1620e00dda125f3", "object_relation": "sha256", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448929, "uuid": "45c40cbd-843f-4dea-8544-60dcb1084b51", "comment": "Malware payload", "value": "45d02915aa87765351c34a65bc7e178cf0e0f82c", "object_relation": "sha1", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448929, "uuid": "1c8b58fc-2487-4ab8-8fff-8d01b0b6a100", "comment": "Malware payload", "value": "10fa756eec5e051971062b60115558d5f0c0ae3cf3fc02a3c4183ceed3c95545e6b4144c10e78a7d8e93c3ffc66849f9", "object_relation": "sha3-384", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448929, "uuid": "2ff8cbf7-c0f8-45a9-bb60-621271a4e457", "value": "T1D5252247BAD0CA57C1A7823809C2995192096CACE7F88DDFA9077F5F70FE6B09D8601D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448929, "uuid": "7c573dc3-d75a-444d-9c84-5c17f8a075cb", "value": "24576:Kt8gBRkZx2RIEkBn1PcBmWgaVVTRnUB8DBMWuSpdi:bgBeZxXEk47nHRUyDBMdSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448929, "uuid": "f8f4124c-154f-4802-9046-8d0f68a11ca2", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448929, "uuid": "1fc530b9-3fa7-460d-a876-8ab2b94099bf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448929, "uuid": "c09ebd3d-e172-4b8a-8a63-ed0ff5abcaf8", "value": "ca99c4d3e0c7001078a9b8e261034ad55c4957f807eadf0ff1620e00dda125f3.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282fae13-1626-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772448856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448856, "uuid": "4489ebf6-bd81-46c6-8d57-6ce56dcf1d66", "comment": "Malware payload", "value": "0c68e2d1bcdd3fb76c1c51925123ad4c", "object_relation": "md5", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448856, "uuid": "1f3b42ff-13e1-4b4c-a586-b299e3dca475", "comment": "Malware payload", "value": "cad4c2a58e1d8cd6b05c1e71a168f90ec488d5d405b045e501f54b5fb38a6044", "object_relation": "sha256", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448856, "uuid": "d551fad7-77bb-46b8-a63b-5e524f15a442", "comment": "Malware payload", "value": "86b3e4ee5ca107e57617cdc869a8a06e2e8b37af", "object_relation": "sha1", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448856, "uuid": "b391fc90-64be-47a0-821f-4450de651236", "comment": "Malware payload", "value": "592c7781719a12461c022047cab6e4a719e4edf5442a8291cd8f49278c7d526f4f4a5876a4deffe34aed9680f2ef6575", "object_relation": "sha3-384", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448856, "uuid": "a0e695d9-eca8-4a19-9b95-72eaa93fee2a", "value": "T156252247BA80C902C167953885C2D891311EEC9D9AD4DA9FFE03BB1F70FEE699D9201D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448856, "uuid": "39cef3f3-c8b2-4bca-b4fa-64885cb07053", "value": "24576:vt8gBRkZKxHZVTIwUK0NJGYSQzf6LnzONOC92+:6gBeZc5VUwUK6GnQzf6/0f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448856, "uuid": "2e230240-73ab-49a4-bd8f-5c2f1522f48f", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448856, "uuid": "a297a982-a1cc-4971-ae88-433ba9fad67e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448856, "uuid": "64f0cdb7-a2b4-42f3-9827-b2f9fab81308", "value": "Purchase Order 300001529 -Invoice No. 92T.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af2b6fd-1643-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772461477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461477, "uuid": "0a824006-253a-465c-8b24-434fadd9c1fc", "comment": "Malware payload (Mirai)", "value": "ebac9a1fd1b90b1bb9f1229f16e4f7f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461477, "uuid": "9d17ca4e-9f39-4455-b52f-5543f7917bc6", "comment": "Malware payload (Mirai)", "value": "cafeae9757bc27fdaba436e2d1a72d16257c917cccd406bd9391a9cd3cd585f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461477, "uuid": "aea0b871-f185-4317-a60b-9a2348a74b28", "comment": "Malware payload (Mirai)", "value": "58869d801e5741d07b4220b4fef0773683218b7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772461477, "uuid": "52d5d73c-acc8-4a20-833c-f156f84f0c6c", "comment": "Malware payload (Mirai)", "value": "6c1b93fcd98675a1408dda8c95fb96953ad93eea21ad1f549144997f16711237ce041e578b91b0f761bb8a7561b57aea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461477, "uuid": "9379de2d-b036-4f79-95e4-abd7e3ae0078", "value": "T1ECF30956F881CB11D5C111BAFE1E518E37232B78E2DE7212BD246F7C778A86B0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461477, "uuid": "ccf6aff0-e502-4c8c-af81-b143f03c082d", "value": "3072:+3QFBpUqkrBBMXz3hMnmakG5Uf67MTD5cWTHCBgXY3g8sd8:bFjBm7MXDhMmaXU64D5cS4gI3kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772461477, "uuid": "95fa1cec-9de6-4235-82b9-9a6c15bffd84", "value": 169852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772461477, "uuid": "75fc8644-a380-45b6-8c1b-732a1c0524e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772461477, "uuid": "ba2feae8-68f0-42c7-92d4-24be20c7d17c", "value": "csk_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361e8b3d-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433847, "uuid": "965151b1-6794-4985-b680-775085175191", "comment": "Malware payload (SocGholish)", "value": "6610a9fa24101e329a21ca539ca6723c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433847, "uuid": "2c831f50-9455-4f9f-bdb3-3fb86b43bc29", "comment": "Malware payload (SocGholish)", "value": "cc1467f361fba0705df5d01cdf94cee593811c7d5011064a219fdd5cecd3287e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433847, "uuid": "dd5da035-6136-41a2-a522-630e151cf2d5", "comment": "Malware payload (SocGholish)", "value": "6c54a72ae5bca06faad3bd376958a2240ae17f1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433847, "uuid": "219ebbba-e7c3-42b3-a623-95e229b06865", "comment": "Malware payload (SocGholish)", "value": "5ac35a7b7519fe33dfa8faf987d915f968c9c077420b626a7e90b7f56cdfc321c4ff33c90ef684ab7f6b5f0e6032af61", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433847, "uuid": "21a75956-99e5-4349-9dd6-429d395ef883", "value": "T145D0979E380600152EE81D3402FA9A0A32833C09240494A2CCFB5828E020BC4029222C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433847, "uuid": "ec3b3a1a-54f8-4143-be1d-366aef17f30e", "value": "6:fO9gO9lfTRWF8tK8dGIdt2RvVTPT46VaJn:GTfTRWF8tK8dVUVPvVaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433847, "uuid": "d75eed8e-a4c7-47b3-9e30-0b11709570eb", "value": 234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433847, "uuid": "67c5795e-c173-48bf-bc03-238e997ac1b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433847, "uuid": "40299625-08ef-46d0-8ab1-af2f5abace8a", "value": "cc1467f361fba0705df5d01cdf94cee593811c7d5011064a219fdd5cecd3287e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c591fe79-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433658, "uuid": "ab9dacc5-6512-4c5b-ac2e-8a31af8ff011", "comment": "Malware payload (SocGholish)", "value": "6790e532df8fd1633db183ddd37655f8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433658, "uuid": "6c6d77c1-96d2-4e49-a9ea-dedd36c7d2dc", "comment": "Malware payload (SocGholish)", "value": "ccbdf817ba435e666b930c8b8c2447b66581208ff6a870ad2d3f8c670bb18a44", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433658, "uuid": "413ab727-7aeb-450c-b011-a35600c7f4ba", "comment": "Malware payload (SocGholish)", "value": "8d1494a925d69f336ba5339a133bda66bf1d9b48", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433658, "uuid": "6d538733-dc85-4617-8b08-0a04770f9586", "comment": "Malware payload (SocGholish)", "value": "2f4b22f452607e23a7f95786629cc90df5cfbaaf125a98e4221802f6599e6327eb3944258e84a75db3ee74c73f347072", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433658, "uuid": "99b7fdbb-4725-4e4c-bf3b-30ec32fb9f76", "value": "T136D0235F341910117789103562724B4D3041351471444577C97BC456B630FD7075F3EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433658, "uuid": "63976d6a-2205-4935-b122-418d0fa93506", "value": "6:SorgO9liRWeV/WQ3eW9yY5N8GIdtFe4NtJXl:1BiRWK0u6VFvNtZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433658, "uuid": "c0da59eb-366e-4d1a-bdb7-c912dce065c3", "value": 224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433658, "uuid": "a381b8ac-1e6c-49aa-b8e4-e054b200185c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433658, "uuid": "7eeac408-d9d9-4c1c-b5a8-cbc2aa0cdb2b", "value": "ccbdf817ba435e666b930c8b8c2447b66581208ff6a870ad2d3f8c670bb18a44.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca25021-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452675, "uuid": "86cfcb02-832b-40cd-a47d-1632e3c8c630", "comment": "Malware payload (Mirai)", "value": "f75229beec6aa4b9279c65fafbfa409f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452675, "uuid": "39cca46b-ffb7-45e8-828c-1c7679455ab6", "comment": "Malware payload (Mirai)", "value": "cd1d9b6bc067694bbf179a2eb6a2736e9c8eab34e684746027f3cd960a106499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452675, "uuid": "91cff09a-221c-4e16-92af-9c1ecb22e1e6", "comment": "Malware payload (Mirai)", "value": "78b0ecaa8fdc2e46f89d0b3a32db3e7fc21c0904", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452675, "uuid": "258ee056-3420-4382-bc8c-edf45ee0e901", "comment": "Malware payload (Mirai)", "value": "1beb759061d3657335cdf5403bb8778ff80efa70c943c9762f9e114f2b40dbe98367a1e1651c8c9e81319d652f1d1ec9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452675, "uuid": "c4e0b301-e4e1-4bb4-a0ce-4b2b56f576f1", "value": "T1FBF35D86EA408A13C4C61777FAAF014D3322E759E3DB73068D185FB43F86A5E4E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452675, "uuid": "05f5534b-dc19-4ea2-ad78-af54cd3a83e2", "value": "3072:3PFsu+bVZFpfnHpKhjiYq5YYujSrwGy/tBF1EufX6OxM/9a8cdAr:f2u+bVZ/nHwMgSrwGy/HFxfKQM/9aldQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452675, "uuid": "fd542ab0-826a-4bf8-bfdf-c6f68e5075a9", "value": 163542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452675, "uuid": "e51dc259-dba5-4470-89be-32dda1f3a87b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452675, "uuid": "22d57ac2-d983-43e5-ab6f-4ba947dce299", "value": "MMaaRRiiOisecTanee.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3542d04a-160a-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772436852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436852, "uuid": "d4fbe534-60b6-4444-8ca1-cd990283b13b", "comment": "Malware payload (AmateraStealer)", "value": "078940d77456d0f276afbeb66d8743df", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436852, "uuid": "75267f1d-3e74-4c82-ad84-8d03b27507a9", "comment": "Malware payload (AmateraStealer)", "value": "cd5d04a12df998553eedaaa3ce33344a4554be587575bc221d85aa4d929b3946", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436852, "uuid": "14d198df-b000-43cc-9986-17f98fdd2ef8", "comment": "Malware payload (AmateraStealer)", "value": "f07bedf38c6d0055fe41a9e4de15e323fbb72d68", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436852, "uuid": "b94f296e-6440-4968-b024-fcc38f2f837a", "comment": "Malware payload (AmateraStealer)", "value": "2fee991587cc11156f52cb9949d3298acd7b51d2f2a779a0333c41cafe0793658b3d6ddf9d1f0574d51620214388b4a2", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436852, "uuid": "98b12fff-6dcb-4afb-badb-5ce494ec8521", "value": "T1E574E948DA128437F0D643E6D6FA1A7DBCF97711234010D3E3F158C6D90AAF276768AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436852, "uuid": "f05b2e9f-0c04-413e-a1b6-dbc0bace65a9", "value": "146b9ec6dc6f7fbce3da4fd985359b9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436852, "uuid": "e66f4ce8-6da7-4f1b-b401-bfe78dcfe7bd", "value": "6144:MjdACAYhIDYh4SZawR5OQ8IJWunrbJ0TxHwLaLuvgjhVf1N6BYh/74M9hbq8eyeQ:4IPQ1JwuygJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772436852, "uuid": "09c416bc-672b-4cd1-a7f8-de462fad6127", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772436852, "uuid": "a586cc0f-3cd0-4ca4-99f5-4566b3ee2d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436852, "uuid": "89ab591b-c314-4ca0-af52-afece4fa9480", "value": "cd5d04a12df998553eedaaa3ce33344a4554be587575bc221d85aa4d929b3946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92b427a-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433691, "uuid": "39365549-2dfa-4596-8223-aecf6aa3a693", "comment": "Malware payload (SocGholish)", "value": "69e4bb5fc31eb3fd627ebdbfa0dd1b4d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433691, "uuid": "23204b92-c22e-4f8a-94f8-b4f6820455a8", "comment": "Malware payload (SocGholish)", "value": "ce566cbf1dd9da662c5119f89ef2e3073eb04a606784ae64a672b463519d9557", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433691, "uuid": "acab9816-bcf5-4bc0-b7b0-fbc8e0d772d9", "comment": "Malware payload (SocGholish)", "value": "0dbbd3964f1f910da375ae3feb333e083f5d87c3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433691, "uuid": "90be4868-8d1b-465a-b197-a5b019b8b071", "comment": "Malware payload (SocGholish)", "value": "f8c13f60a513af189c7a77f893e59cdeb6c1201d63e19448f333f40c099adcb902f5d742e28ec996f9c6bf5a141d5125", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433691, "uuid": "fa229513-abe2-4b08-9df4-60a3b4829c6a", "value": "T1DED095C91504201C5B752195213BD75E7006703FBD20039585768855510CAE4001545C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433691, "uuid": "10482b0f-32bb-4566-93e4-cd737a6dfa1f", "value": "6:qSsSCtAggO9lvSuZuRWssavGIdBlJXlM/CJ:wSmVvSuoRWssavHJXZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433691, "uuid": "f03f3056-a6ac-44ac-8a9f-cb5caab92f0e", "value": 240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433691, "uuid": "0ba5cae2-7ea6-4417-8d9d-eed9ebece2eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433691, "uuid": "27ba0c70-d522-41ce-8fc8-e23d27ec102c", "value": "ce566cbf1dd9da662c5119f89ef2e3073eb04a606784ae64a672b463519d9557.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ce835e-15e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772419129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772419129, "uuid": "fc81033d-3893-4e2d-a578-24931256b913", "comment": "Malware payload (Mirai)", "value": "3cdd8d08837ba93451782ba4eba5edae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772419129, "uuid": "949dfd78-0fe3-4e89-81f3-ae503824fac9", "comment": "Malware payload (Mirai)", "value": "cec33f0758294d966a7bc6e35a01125c886380bdb078259960408be48b4d52a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772419129, "uuid": "406340b9-3a70-4e77-93a4-55cec07f8c60", "comment": "Malware payload (Mirai)", "value": "a984fe9669466a043cbd3be4e142b945e3661964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772419129, "uuid": "0960e0d2-2f73-45d8-98fe-f7a5f08ef29a", "comment": "Malware payload (Mirai)", "value": "703f35df4be4c2d1adf5251d8e5ec459f48418e56167dc65fd8df2f89418d329627dd583aab7f17a50e0b14a48987e1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772419129, "uuid": "0d0014d4-615e-475f-88df-626fab27f2f9", "value": "T109B31A52BD929F13C5C221F6FBAE06483B137B78D6EE3142ED247FA127464DA0E27511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772419129, "uuid": "ac1afa75-0c91-4740-875a-54a06927ddb2", "value": "3072:2KJ+J4ecGHoAUi8qcXSHAorMvTwhvIEsX:t+J4e5IrhXSHA6M0hgEsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772419129, "uuid": "f4d7d216-f7f9-4818-a88c-8385929a4fd3", "value": 113068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772419129, "uuid": "5bfb6175-d13d-48b4-94c5-9f1219158c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772419129, "uuid": "9d95c8b9-db82-45ed-bf01-ede742bec144", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d144f54-1662-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772474822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772474822, "uuid": "54080e7f-9fb9-46b5-aba3-7a17b70a3b36", "comment": "Malware payload (Mirai)", "value": "987c8843c917f337571d8437daa630f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772474822, "uuid": "c737275f-268b-45b7-b866-a15372a2068b", "comment": "Malware payload (Mirai)", "value": "cec7a0a55b41d85606ecfe3b39d64fa8d589bdcfff54f673637f7a2c6412aadd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772474822, "uuid": "026ed332-8014-433e-9b6a-26dfa4b90c13", "comment": "Malware payload (Mirai)", "value": "3c299a708936a85ba0490d872096d9e33a2f20aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772474822, "uuid": "292a9316-58f3-459d-83a2-d4e11dbde783", "comment": "Malware payload (Mirai)", "value": "85f6be85fbef86c543f6ab1569420969cb824b9a06b614efd604b0a5a133a4f0411ea49e2996261d16647b3d6e81f588", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772474822, "uuid": "a04a1dd0-730c-4cc1-8bf6-6842b42f666d", "value": "T163B36CC4F643D4F1E85305B1187AEB369B32F479192ADB42F3789B3D9C62500EA1AB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772474822, "uuid": "5b1f24fc-2a07-4f59-bc7d-c5b3aee18a22", "value": "1536:5srPpFKO+Gk0/33FfpRvWcC/MdwA73uemf0BpSJWm+hflMgFs:5srPp6F0/33FfpEhML7+ejgJeqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772474822, "uuid": "f2a5df5c-5a57-4c87-b1c7-f6b031a99016", "value": 116876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772474822, "uuid": "4000a7b8-2dc1-488a-9db9-817edffe5170", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772474822, "uuid": "0324bcc4-4be5-4b0f-a14b-3d8ea2973107", "value": "csk_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cad7c0-166d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772479482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479482, "uuid": "274d3462-d538-41d8-975a-1d636dc9f5e8", "comment": "Malware payload (SalatStealer)", "value": "ff724bb931ca65acf60ca85a503cb3aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479482, "uuid": "638222fb-e121-4d46-9332-a5a916b01928", "comment": "Malware payload (SalatStealer)", "value": "ceceb10c620a2efe287eaa517bca67b770fcdafe22eea5459d91b2e010f70d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479482, "uuid": "f43e21cf-177d-44d5-a723-a9a918296068", "comment": "Malware payload (SalatStealer)", "value": "07dc28e749270299794c10cc042558a09e0593a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479482, "uuid": "27e020d7-e067-4314-9c0b-137c669b614f", "comment": "Malware payload (SalatStealer)", "value": "cb8aa1d3f11f0a8d4431d82addc06209b92dba70f9a1b4f37d8d52a531dab8913ac2a8c83268df5e7f74d8d5ba4d4843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479482, "uuid": "6d0a1057-fe88-404d-8c02-1ad330bcc762", "value": "T18CE5332456F38EB9C3890C313FD5707CEC59507B1CBA411D2A7EBDE6E2A339D556A00A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479482, "uuid": "923c3977-122e-4f7c-87c7-1e04a2e0d8ae", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479482, "uuid": "f73d3109-31f6-48c5-b2cd-2201cc6431ac", "value": "98304:By0LFnQzmxCOmMgHv7l0RsNKWTMUGgwy0:dFnQzm41HR0rWTMUX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772479482, "uuid": "8a728fab-1fe6-415a-b4a6-f1d0eed2154a", "value": 3296256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772479482, "uuid": "f7e31796-376e-469f-a043-94b536ad31a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479482, "uuid": "ccf581ed-3b79-4ec1-8d7f-112213c92c6d", "value": "DELTAXPC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c01b8e-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772434012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434012, "uuid": "9011c357-bae9-43b9-b2b7-38788a450b02", "comment": "Malware payload (SocGholish)", "value": "2bb853e2d71d314ffc5419ca3fc80a06", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434012, "uuid": "15c9a54e-5224-4fdc-9cb1-9f84534c45d8", "comment": "Malware payload (SocGholish)", "value": "d0858a2d532c8bb3bdd8f98ff78c2c16da33c171815aa5c89ffeb84ee76b8cf5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434012, "uuid": "b385293c-db6e-4198-82e8-489a9a7e3098", "comment": "Malware payload (SocGholish)", "value": "960a13027beb2d1b8f32d6e2eee6213101b60c41", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434012, "uuid": "3f43f070-d21e-48d6-b832-4cbf2b0a7d4b", "comment": "Malware payload (SocGholish)", "value": "67becf345b71b9f40012e74259788d3adf263f75d0549f0efdbd6ee71f8be9e19dbb94bd102e914e0cd216d7faa4aea2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434012, "uuid": "453b1b1f-89d0-4bd3-85eb-fde4495b754f", "value": "T1BFD097763C0862341B5A02FC32B78FF834B036382A200911C93A98C44920BAA012AB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434012, "uuid": "0f092bc1-fc32-405c-af99-799069c167b9", "value": "6:SQOhRAgO9l3AxRWrMCsVMGGIdP+98vVsYYn:mYwxRWBsVMGX+98veP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772434012, "uuid": "b4afd028-fb7a-40c8-bf4c-8e5c256848a7", "value": 235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772434012, "uuid": "804e5a29-ab2d-427c-afd9-3e79ac316fb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434012, "uuid": "8a71de09-912b-4489-8f9c-25e1cd09786e", "value": "d0858a2d532c8bb3bdd8f98ff78c2c16da33c171815aa5c89ffeb84ee76b8cf5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19fa2fb-166e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772480037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480037, "uuid": "6a7fe5e7-2b76-4bdd-ad1c-df895b9c56e8", "comment": "Malware payload", "value": "dea287ef5916eced7808ca3704ae67a6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480037, "uuid": "57abae07-7ae6-46e4-a12a-ea45201d0afc", "comment": "Malware payload", "value": "d0b18d94c4abd7f0f3a3d07fd2172956f6ec9654b8cbf087954017dd92bd9e4f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480037, "uuid": "d1b1bbf5-74e9-471b-91dd-5cbc5f122a0d", "comment": "Malware payload", "value": "055e0229236497b91216b89395351ae8c9eed8f0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480037, "uuid": "5e176fb0-8137-4dc9-90ab-99fad0662db2", "comment": "Malware payload", "value": "697dccade4985afd5a1e4b7feabe31668f65d44933937b8b46a01cc9b9ec2e0f8f8904a01a453ebaef8dbe54348bd61e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480037, "uuid": "56782c2f-007d-43ac-8f1e-254e27ebcf1b", "value": "T151D633AC7AF21C879EA4516F78441FF8737840743A5CC0217262C7D9F6A31AACB95CA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480037, "uuid": "3f565ac8-5935-4a77-bcae-5259b5913f93", "value": "393216:pEx9SPTatbIaGXKI3AD0VGdGlHtrpNqK9:Y9wkInwbOHZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772480037, "uuid": "53b3603c-0f59-437f-9567-b2c5d10e36de", "value": 12861229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772480037, "uuid": "c6140606-916b-47b9-b3ba-fcdeb25ac0b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480037, "uuid": "dae0ad39-9e8a-4ac9-b5c6-99381be000ea", "value": "6526_Predstavlenie_na_naznachenie.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b45c45-168a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772491936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491936, "uuid": "fc026358-6a6c-42f4-9e1c-2dec4cc0bc19", "comment": "Malware payload", "value": "f4194346ba76a8ad7f2b3ba380f93925", "object_relation": "md5", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491936, "uuid": "964d1fe9-88e6-4ef1-bdb4-2909666273f9", "comment": "Malware payload", "value": "d0e6c07c094c482eed3ebe6441a1348db9668ef4f596e563ad2f1637bb5ed5fb", "object_relation": "sha256", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491936, "uuid": "c4e3a8ed-f2a8-4336-bd97-4e0ca02d6bb7", "comment": "Malware payload", "value": "a7a48e8ede994b59b94721220b1bf8396881eab6", "object_relation": "sha1", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772491936, "uuid": "af0c6677-7bc8-4f93-ab19-9fb17749687e", "comment": "Malware payload", "value": "5a8a61d579b1c9a41c101f07db8a60a817c4ab3313e6c5a5a28478f834ab3bf1ce99a2f186f01bcbcb713fb1a5311462", "object_relation": "sha3-384", "Tag": [ { "name": "141.11.107.134", "colour": "#B94228", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491936, "uuid": "0a851219-33bd-410e-aaff-0c6da9d11fea", "value": "T15C8228897B06D8CDC5B68179C4322D6AA129F36413724BEF67B0482A0D67FB07D2DF94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491936, "uuid": "185f2bd6-9bce-4bd4-a654-0cf5f078caf1", "value": "ba782605aac629a26bc1fecb2cf3b2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491936, "uuid": "b2d56e96-a8ee-49bd-a5c6-9f61fff51dfc", "value": "192:oFuOW7Lam/qxNvZzgUuzjm+xatsJlNf6gr2PxsMKup7xofn6xn3dzG6Gc+HFcI/Y:oceV4P6gr2u2x2n6n3c6GnWI/c+To", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772491936, "uuid": "330fe240-139d-48cf-8773-b9f084461a80", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772491936, "uuid": "71c24c09-4f1a-4952-a74e-98fc948d72b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772491936, "uuid": "1d5eb11c-9402-4baf-bd8d-d7ae1ecefa60", "value": "TeamServ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9b02ce-1665-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475865, "uuid": "4e05e549-beb5-4c9a-b4ea-58886b46c9a0", "comment": "Malware payload (Mirai)", "value": "c7bc07fdbf2571772704ad90c97f61a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475865, "uuid": "d80d5e48-9f22-49c1-8869-60af7a72710f", "comment": "Malware payload (Mirai)", "value": "d175b00e1f9f126b064faa7d08ce9baa866f4938042feed2fb612b6677248a8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475865, "uuid": "0b6604e7-51bf-40fd-96ce-c7456491e221", "comment": "Malware payload (Mirai)", "value": "354e42fd417532e241d09147dcc2155d37b6912a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475865, "uuid": "211a382c-82e7-4a5a-b291-8006f54a1dfb", "comment": "Malware payload (Mirai)", "value": "eb3122ebd25a68416691da0421ea97aa5d5e5824883ebca84121f85b53bd1a7ebf2a78fec8472ead9030da729d819a97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475865, "uuid": "171d8dac-41e6-4c90-9114-0255ea98f7a4", "value": "T178933A55FD819A12C6C11277FB6E028D372313A8E2FE3203AD256F21738B96B0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475865, "uuid": "1097e2cd-2707-4114-aa27-6b87f34a6810", "value": "1536:qdi6OB+dNP+rl4EFi535lVAo+HZBoeNEV77W1QHp1vvMB1:qdTOB+dN0i5plVAoeZBoD7qGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475865, "uuid": "956e9d99-07c7-4273-ba4b-1afe55eadfd5", "value": 91948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475865, "uuid": "ade558f2-57cb-4310-b8cb-a782c9871f4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475865, "uuid": "0e283261-1fa1-4f2e-90dc-fdd76554c752", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0503c3de-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452662, "uuid": "0304d791-7954-45f0-951b-ccbd953fa6f6", "comment": "Malware payload (Mirai)", "value": "329727d432a75bb40bfd5bb60827a531", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452662, "uuid": "2b62ec27-0c3b-4526-b02e-4c07b0828dfb", "comment": "Malware payload (Mirai)", "value": "d1cabf8a5f0c29b3b076fc69c3d5d0cf8a6c512b7a4cc504731b82b396482b26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452662, "uuid": "09cf9135-3276-4c20-99cc-4680a47f26b7", "comment": "Malware payload (Mirai)", "value": "56cbc28650e3d325ad047a1e3e494787621a9717", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452662, "uuid": "98bab1cd-b946-4577-8215-421dc9a797e1", "comment": "Malware payload (Mirai)", "value": "27b863441d19043030f0d920d02aec389b46e26bb5a60c7f09ff213fed889a70f89acad46aa45829bba46c9f686c738f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452662, "uuid": "00fb18a9-8c11-4178-afd4-eb1ba1004c10", "value": "T1FE739D76D0B86D98C5148A34A6AC99B88B17A40467A33FF2C6C1CF654047EFCF2147FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452662, "uuid": "af2d1238-2bc8-45e5-ab8f-fe262eab08b0", "value": "1536:P/kM1DnBApwt1N0Haa+9mUESf9RwU9K4H00lRCi8R:PMMxnip4cxS1qkdH00D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452662, "uuid": "140b106e-7d15-40c7-9197-8f98aec473b5", "value": 80596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452662, "uuid": "4a90a329-0f39-4b8e-a621-8d1e5bd2d448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452662, "uuid": "f39fd42a-6ee2-49a1-b589-533695bc1f90", "value": "MMaaRRiiOisecTanee.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f99ea4-163f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772459907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459907, "uuid": "d63a04e0-6aff-465b-9153-6a8821bb3794", "comment": "Malware payload (Mirai)", "value": "933ac056137c1a4faf943ec7522f7b62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459907, "uuid": "41d0bc1e-96df-4f79-ae01-ffb246878d74", "comment": "Malware payload (Mirai)", "value": "d210d44e14f8910ffa11c314640bee3f4b5b4cf257386a8afc9aa44270b343ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459907, "uuid": "68f55cd7-2cb8-4a90-b8ff-15d7058ce02a", "comment": "Malware payload (Mirai)", "value": "e620bd0a3cea22f894f18bc58c3e590402255254", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772459907, "uuid": "b715eb39-b5f2-455d-984f-8d8b92e31de5", "comment": "Malware payload (Mirai)", "value": "2fd783ff6ade70d67fd76a14641860a1eee1248d244f91e39ea8bc7bc88ec45351505ae0c210822cceb7ee9f5a376ef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772459907, "uuid": "d3e8e89d-3e58-4e81-a641-253c53b8a284", "value": "T1B7936D22BA3A1D27C4C4A57B62F34765F2F5078B25BC8A1E3D620E4EEF2465032572F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772459907, "uuid": "f6156ab9-263e-48f1-8076-3b3f0d670c3c", "value": "1536:DqltwuSGISjQGZTXFkxPec6ClUqXltVioM53RYYScTr70cgtgZrwbZnt6:my4LFkpec5NXljio8hRScvrFwbZnt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772459907, "uuid": "20978e42-0ee3-411f-8ce5-42789cc8eefd", "value": 95288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772459907, "uuid": "96716150-d894-4af9-951e-955caff6c719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772459907, "uuid": "91f35b00-bc93-4b0f-b63c-b2e41d3e3e0d", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d751ed0-15fa-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1772430047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772430047, "uuid": "09f985a6-a213-4ae0-9898-334e937ab6c9", "comment": "Malware payload (CobaltStrike)", "value": "a61605dd3f79baf8dbd71e3544a71dad", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772430047, "uuid": "cbeb9887-3ee1-4848-9839-334581d6454e", "comment": "Malware payload (CobaltStrike)", "value": "d31c5d0d58e57d7196ae1ac91fc2a40824dcadf8c6be977074a76abaff71fc1a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772430047, "uuid": "a91d0191-e97e-4617-985b-36c060ce6b2f", "comment": "Malware payload (CobaltStrike)", "value": "a1cf6e36229061836f516bdfdbf5ffdb342d4ff0", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772430047, "uuid": "f81ecc6a-7ff5-4c5a-be8d-ce821b4931c7", "comment": "Malware payload (CobaltStrike)", "value": "8fa76115023b2c148381eeb3259b2553fb49f4ac34edd977d386f082227560ece76a38008fcad7a87f7efa5c81851933", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772430047, "uuid": "9472d3db-569a-4546-a1fe-011d323c7645", "value": "T1E9F59F0AA3B901BCD0EBD178DD469603E77BB80D0371A65F07D099A62F673A0DE6D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772430047, "uuid": "17f007c0-ff03-4690-864f-fb589d48fd6a", "value": "5d51836cf354971ddc9f92fcb8789969", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772430047, "uuid": "96bc5c1e-ca8e-4138-8f3c-630ff6926600", "value": "49152:xOnEtQ7Sqe44ec0i3DnKdSN+CG2tlG50vkSKuQUeT+uXEkjNEEBHLvSOPK:xlarc0ibJXtKwa+uUkjDBHLvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772430047, "uuid": "c3928645-9117-4db6-ad21-0f3869a7f4e4", "value": 3592336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772430047, "uuid": "8750323b-64aa-427c-8967-c975e12c0b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772430047, "uuid": "a1ce0dc9-ecd2-4f6a-9316-bee6d3d7511d", "value": "winrar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2103d1-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444734, "uuid": "5fdc568a-c857-4d91-b601-8394a59d7ada", "comment": "Malware payload (SantaStealer)", "value": "9ba4c3f406b9835e4bea520677c529ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444734, "uuid": "3e2ca5b8-3d78-4871-97f9-246fd2f6accf", "comment": "Malware payload (SantaStealer)", "value": "d327592dce9adb58df0abe570247ce8839bd55f511d5f0389349041edcb624a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444734, "uuid": "bf5aa4ec-01d1-45ca-85dc-38cca228db6d", "comment": "Malware payload (SantaStealer)", "value": "f4e56cd63e9b9e9d4ddacea945857f61945a34ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444734, "uuid": "b25c385b-1c85-48df-b356-ee0156b6cf3a", "comment": "Malware payload (SantaStealer)", "value": "a16a564235e8b0969d5d70b53acece794e9f788915ff1a33cd30c34734eb0f006b979c304737f8f0808bcc17d40ce833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444734, "uuid": "bb2504bb-6a21-4d6c-bc15-66caccf44480", "value": "T1BEC59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444734, "uuid": "6f4bd333-ddeb-438e-8665-24e4d845a5c4", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444734, "uuid": "b8a4c39e-bed3-45c5-94a6-90581c93d0c2", "value": "49152:QavY1Sn5eVNoMWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCwsdGM:DY1aUUevc+9sdBg4x4DPPnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444734, "uuid": "f550631d-3f3d-42a0-b30e-3a03e4658d3b", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444734, "uuid": "4f6eaeae-5175-4c07-8f66-0ca1218bf73c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444734, "uuid": "efe4131f-666f-4701-863b-d3a29bfcdfe8", "value": "20260301_211527_20260302_001527_50M237Y8914D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fb013a-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433840, "uuid": "646b2354-e927-4292-8f8f-d335bcbea8ce", "comment": "Malware payload (SocGholish)", "value": "27ac4b3bd01bc14e57564e08dfe392f4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433840, "uuid": "53fda9e4-4b09-4e81-84d1-18d610388b58", "comment": "Malware payload (SocGholish)", "value": "d34c1bf24f853e92d5b20993c44248ede64abea7867762fb0f344b78bffcbe2a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433840, "uuid": "7d6beb6c-f015-4d6d-a536-6c4568a9156d", "comment": "Malware payload (SocGholish)", "value": "fa027706852261f9a7bd2fea05375b85a23116f0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433840, "uuid": "08940bd3-fe82-44ab-b1c1-fa04c300196a", "comment": "Malware payload (SocGholish)", "value": "4b43241bbdace0b41b124eb01916d7c9620e4299b31fb24e41d3cca20bae1ad2d895db888415016d756b091b25aa905d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433840, "uuid": "571684b5-e598-40f7-b106-3ec81353e58a", "value": "T130D023AD3C8E2055B37A3830137B8E09305130152181EA52CCF684D0B0346DB451EAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433840, "uuid": "b7932a55-6acc-40b3-8182-45f8f153bd8f", "value": "6:SNoPb9RRAgO9lFvWRWf/tiG6CsAk6pdtMOq405LHn:Q8CZWRW3tPFo61MF5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433840, "uuid": "9957eed4-472b-4b42-9052-2056cabfc3ec", "value": 231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433840, "uuid": "0df436ad-1bce-45b8-aa77-1718004f15df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433840, "uuid": "1d9c6bf5-db18-4252-9b7d-151dc407c4bc", "value": "d34c1bf24f853e92d5b20993c44248ede64abea7867762fb0f344b78bffcbe2a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102bc80c-164b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772464707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464707, "uuid": "fe095dc2-7858-48c1-ba74-138ff63f069d", "comment": "Malware payload (Mirai)", "value": "3b662691f05ccf2cb04a1418b0e3962d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464707, "uuid": "804b44f1-d8af-43dd-8eb4-818df6b92664", "comment": "Malware payload (Mirai)", "value": "d3c3b099647f7f120edcd70d9d0ce0dc6aa1b20b90b4feb83cad596d8301955c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464707, "uuid": "c6db78c0-0cfc-483b-b942-af95ae2c6322", "comment": "Malware payload (Mirai)", "value": "139af1c46a0058f379daa39b30e7f56eb895cfc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772464707, "uuid": "288fc4cb-62b4-4212-afca-cdb7e76c79c8", "comment": "Malware payload (Mirai)", "value": "b863313d1562b552a10eb6975ef011b1cb0159c5e8b53e0bcc6c9ebd77f9612f5e456a217153cdab0d5ff5ad45a41be6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464707, "uuid": "e3e69f38-9060-483a-90c4-bd52ab63485a", "value": "T16043E755B892D957C2D01376BE5EEB8E332573E4CACE3223F9255B2C3A8650F0D26E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464707, "uuid": "0e734765-e131-4bf1-a4ee-7bc615fa6869", "value": "1536:j4oVSEZGInXG5/a4Suvz7ZtHMP7m4XDBRc8:soVSMGb4Q/4TBe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772464707, "uuid": "a30c8968-1243-4301-a6ec-80554e96b5c9", "value": 55888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772464707, "uuid": "905efc0c-b665-42d3-a6ea-278fc3584326", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772464707, "uuid": "66f88db5-c4e9-443e-a5af-f4e2b11924f1", "value": "csk_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c848ca-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433819, "uuid": "d6dbd702-5458-4d51-82fc-3018302da99f", "comment": "Malware payload (SocGholish)", "value": "3e7d6fb51716a9d07177b273727d60cd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433819, "uuid": "64d76772-58f2-46dd-afca-5b3572a870df", "comment": "Malware payload (SocGholish)", "value": "d4cc9da5d797c8978329a5f2ae2ed83402835b7c876ebe9eaf82163e69a1703e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433819, "uuid": "db7d8f09-28cf-4220-adef-3e62af1d27d1", "comment": "Malware payload (SocGholish)", "value": "b0c04bd2cb4508c5433d8326fc1938000fe13968", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433819, "uuid": "9cd2d99e-13d9-4f99-b764-5635d8d6c7df", "comment": "Malware payload (SocGholish)", "value": "51b167ddd20e603020a82e690175edfa4e99960691b259864ba43eec58f47bd7f948a8d527be45e15bcd09e6779c70b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433819, "uuid": "6c3416cb-9ce4-4fc7-b5d1-6cdddb028e9a", "value": "T13CD0EB6B244810384B6624E0097B6A887811130808810071CA7A88252700FAF006AB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433819, "uuid": "3e90fb4f-3d1d-40db-8950-b2e7cc28c89b", "value": "6:CZX7e+IAgO9lZaLyuRWDagyQ7eQuS5Nv6pd7g6MXuVetQd68m:CZa+I48LyuRWWFQLTv6jg0VetkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433819, "uuid": "c8a63050-fc67-4155-8367-dfa5d7cc04c8", "value": 271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433819, "uuid": "6ac63b2f-f8db-4473-a094-31bb6feb6f45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433819, "uuid": "75e640f9-0682-4cb4-a636-35579a519a7a", "value": "d4cc9da5d797c8978329a5f2ae2ed83402835b7c876ebe9eaf82163e69a1703e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5a5a61-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444761, "uuid": "2102ab2d-e07a-403c-83a6-3f96cf3599b6", "comment": "Malware payload (SantaStealer)", "value": "01d4b53ce168b2407a02449211b049ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444761, "uuid": "0d205c09-0d43-4b5d-87f0-0d9ffd812446", "comment": "Malware payload (SantaStealer)", "value": "d57377579402603b634c4b9a8b8f676884f91c24f0cddbe42c0828252f701886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444761, "uuid": "2d4563cf-4a84-45af-bac8-c4903e0a24d5", "comment": "Malware payload (SantaStealer)", "value": "23da9fc317e70ae289fc80e4d393e129be488b10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444761, "uuid": "bd12a72a-47c6-40e9-a25f-e6724f696a08", "comment": "Malware payload (SantaStealer)", "value": "2c8211dcfedf314e136b61525edb70ced0a5635e528b6797f743093982122164a5abe9ac192d776b07437c6f4ad38b50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444761, "uuid": "67aed4c6-31ac-4abe-a712-ebe689f4a8ba", "value": "T1DDC59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444761, "uuid": "008abf28-c2ba-43e8-981c-374a3168a187", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444761, "uuid": "bb543a8e-2abe-4623-a608-6ec9e9e7de05", "value": "49152:0avY1Sn5eVNotWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCbsdGA:vY1a1Uevc+9sdBg4x4DPPnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444761, "uuid": "460d93ec-ba7a-4ee1-ada5-3d8144d1435b", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444761, "uuid": "db9cd75b-f075-4344-9ac5-791d85750f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444761, "uuid": "beef6ba5-a4e2-4bc7-8965-e61928f9d786", "value": "20260302_042758_20260302_072757_RS7C78N05622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c516b5c-1612-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772440434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440434, "uuid": "5130155b-47b7-4a95-a528-900dfe7cb405", "comment": "Malware payload (Vidar)", "value": "1b8beb7301e033991ad22e445141a163", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440434, "uuid": "7b4ab2ad-ef68-492a-b09d-47c3526b1a08", "comment": "Malware payload (Vidar)", "value": "d5b8981675ab45bb9699f320dcc55b72d1a379c8c0051da84fa11c3bb75334f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440434, "uuid": "888f381c-1eb5-4c60-82aa-d67acdfdae43", "comment": "Malware payload (Vidar)", "value": "81780db429c71e2a38ee880452469855a76e8ae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440434, "uuid": "fe6a8575-428d-44f3-8574-291516cf9962", "comment": "Malware payload (Vidar)", "value": "341a03cd012e6dfcb178425d6a150c5982ea56bd1ecd91f767236b91f43082a9f17e5b442e67b53efb3c44ff524c44e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440434, "uuid": "3832c7f7-dc43-42fc-b4a0-ddae1d8718b8", "value": "T1C6050F19FBA6DA16C815523D8CB79B497771F488EF028757339AB33E3C223806D87169", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440434, "uuid": "e9aaacd9-47d8-4c6a-8887-b41f5d3ef358", "value": "2bc8993c8fddfd53114ec47e8c13ef00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440434, "uuid": "0f450687-4dcb-465b-8305-c8dbe4f0a3b1", "value": "12288:zBXlVVX/Aupk7Es8cwi0Y7+1NjhkngBvfC5w8:BJ/YImp774GgJ6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772440434, "uuid": "42682e65-5596-46d9-94ec-029f9b875423", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772440434, "uuid": "c20c0223-bef0-44ef-b5ed-68434ceb8b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440434, "uuid": "2f546200-ba39-4795-8885-d610d33a0fe7", "value": "1b8beb7301e033991ad22e445141a163.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e0a98e-1619-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772443433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443433, "uuid": "b61b2382-4cc6-41e6-8199-c9744afba849", "comment": "Malware payload (SantaStealer)", "value": "1c748e6b2be5c3622acf733f9df670bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443433, "uuid": "f9e3df6c-acb4-4396-9af0-b7a66323de76", "comment": "Malware payload (SantaStealer)", "value": "d5f7072f37da49fa1f349a21742b27741642a1f4c5f04ddd733667c94551ee60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443433, "uuid": "d18c146c-6a11-4669-aa26-54410158f5e6", "comment": "Malware payload (SantaStealer)", "value": "e283ec01d68c336c51cf5b336a619ebc3747ea57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443433, "uuid": "adafea0a-2956-445c-9d3d-b87342c1d772", "comment": "Malware payload (SantaStealer)", "value": "0134633c1cc28a0975a107cd000db6f3284ad4466cd4379a12cadc2b15296114d4f3ee1b5461ea6e1cc4bf1326a002b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443433, "uuid": "3d4a7c64-646d-481d-a645-8dd8dbf40573", "value": "T174C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443433, "uuid": "de362293-f57e-4f79-9210-ca75bc474e73", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443433, "uuid": "2a232eee-2592-47dc-9162-ccae4fbe2a3f", "value": "49152:EavY1Sn5eVNokWFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCysdG1:/Y1acUevc+9sdBg4x4DPPnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443433, "uuid": "7081d6b7-d284-4718-b6a1-deddaccba9ac", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443433, "uuid": "b8c2e4ee-11bc-4673-a686-69c97d5205c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443433, "uuid": "550ba6b8-807c-4b6f-b393-6e5e8b0d7afa", "value": "20260301_213725_20260302_003724_D1GEBII0G0S7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1695f33e-163d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772458705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458705, "uuid": "19a62126-8da4-4d44-a6de-b837b8464b12", "comment": "Malware payload (Mirai)", "value": "bae6e2315f3d5f04f28f11a26120c6bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458705, "uuid": "3b802898-87be-46c6-a369-5b29e2165ff0", "comment": "Malware payload (Mirai)", "value": "d65c948539aaafaf5c33136b003352b38a90412f7a114554b7a71d661a20dbdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458705, "uuid": "825f3fb7-75a3-4bf3-85f7-8d0150b97bbb", "comment": "Malware payload (Mirai)", "value": "e69184ae7b66da9c1cbba953103dba2c0f30d5fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458705, "uuid": "227e17e7-53fd-4c73-82ef-ca362a9c45a5", "comment": "Malware payload (Mirai)", "value": "3dddb63750160e9eec1fe7ea71c550ce465becc1018a1752bba24ac3e518be64f4e88e7050e5fd653e52e33fed99d619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458705, "uuid": "68ccae65-0de3-447f-86ac-0cbc5904ee3d", "value": "T14C834B037A8194FCC499C17447BFB13AF862B07E123CB2AA67C4FE17AD88E105E5D695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458705, "uuid": "55481736-440c-4da3-ac3c-2e846e71cf75", "value": "1536:BThAUTObq4HdqUo2NzB4jKiRke2oQOya5TQBgqQ1qu18v6Svb435h9vgduxdwbZc:phAUabh9qr2N6jKiXtQhOTQB81r18v6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458705, "uuid": "944d1334-5b38-44cf-8f53-c33441f7ca5d", "value": 87872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458705, "uuid": "3031462e-cdc0-41aa-8546-dc75aeae01d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458705, "uuid": "598b0f07-d68a-428c-b988-d3cb1c5af368", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a367fa-160a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772437035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437035, "uuid": "303bc69e-7d96-4226-b2db-1c5106e26891", "comment": "Malware payload", "value": "663f8e1087e5896ea0aed17b8b9977b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437035, "uuid": "d09280a5-5965-4443-95c6-ba1ae860bdda", "comment": "Malware payload", "value": "d6773d443e2b1c2cf5deb71e874fb2287e74b534ee1674948a3cd870eb6246ad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437035, "uuid": "f4cb33dd-52c6-4743-9ad2-6d4f6be1de4a", "comment": "Malware payload", "value": "e9627518f53ba25754a32671db25923254d9302a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437035, "uuid": "21c4171a-e676-47d9-86ca-c9fa257d32fd", "comment": "Malware payload", "value": "2ebe3dafeb2767d056f919703d9c64d7c678e2aa8a6b0ca50e2f501483d58f3ff3502153502c6b40b8f44c63f631b57b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437035, "uuid": "4e1057bd-636f-408c-82c3-d58273a32837", "value": "T1B1F0E15094E07C7027F8894D9490424CA171337763A67E2062D08DF60B96010736B797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437035, "uuid": "3418a8f0-999c-4e2b-9cfc-f10a39bc4b9f", "value": "12:MquhRnFxvhsOV6FZIcOpO7qilauv66s/kTFmKI5YHj6X:MfnnDhzV7c0GfssFmKIWD6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772437035, "uuid": "a7671834-4765-402b-a872-4407a43bc6d9", "value": 554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772437035, "uuid": "757f8c3f-2ba3-4532-aea6-6bbd91b0471a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437035, "uuid": "5f85a924-68cb-4f94-a57b-ab3303b40614", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5a35c6-1646-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772462848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462848, "uuid": "a2b1a52b-57c1-4b2d-a958-8430388219d9", "comment": "Malware payload (Mirai)", "value": "0d6b9675318ab0302700196027b30f90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462848, "uuid": "f224897d-0401-4cfd-98a7-263c72a66c70", "comment": "Malware payload (Mirai)", "value": "d67ddcd0e4d4b6a0d1c1902bac1304a2a14066f83169cfa70ad531cb84bbba00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462848, "uuid": "43c04661-b0fe-406e-a54f-74413ca81c23", "comment": "Malware payload (Mirai)", "value": "a34b38c2651b28973504b775db4765dab5b1a81e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462848, "uuid": "079aee45-e5aa-4952-b3e6-72f96aadb09a", "comment": "Malware payload (Mirai)", "value": "b5173a4ae7f60dcf0b2eeff6592d0fec5c8c6df7a3e871b01710728c2ca7e92fafc1f0c8728393d61fb9e46757d7f876", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462848, "uuid": "ffcd551e-34c4-47ca-b9ee-81e516364bad", "value": "T1D6A32B46BD828A11C5C503BAFE1E118D331357BCE3EE72229D106F25B7CA96B0E7B456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462848, "uuid": "972dc3f6-2a56-48e9-b99e-1d6c19f0fc47", "value": "3072:VeT81aycJHIK1+JfwJmXasoxHECueXL9cwbZnj:gT2ayc1IK1+Jf4AaTxJuMJcwRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772462848, "uuid": "a699e57e-4a79-4e4c-831a-b1c482303c72", "value": 99572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772462848, "uuid": "a99463fa-4640-412a-9381-bf8052e371c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462848, "uuid": "d6c29223-a180-4f54-b77f-03d88799eef4", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f245dd-161d-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772445258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445258, "uuid": "66e194e2-108c-4440-9723-a15bca039f4f", "comment": "Malware payload (CryptOne)", "value": "341a0e2b03c735ad11100425e6fb04ad", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445258, "uuid": "0490e9f0-2d5e-47c8-bc38-9c4af4a689f8", "comment": "Malware payload (CryptOne)", "value": "d6c17c8ebbede7632785cc94c2e0a6571e59ac262e4e438f6683ad2fe6b46a6d", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445258, "uuid": "c1adbd5e-051b-4295-b00d-fa5ab8577311", "comment": "Malware payload (CryptOne)", "value": "bc2b624d64d36cb99e913201b4b0f155405bad4d", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445258, "uuid": "c8cec4c1-ca9e-40bd-8050-02569782d388", "comment": "Malware payload (CryptOne)", "value": "b0dc3edbbf8857b001e33675e558116db4332e4b071ef0051df0f1f44e38ff1b99db320e603a62ecb4586c1314c7e5ee", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445258, "uuid": "f4ab2b78-6fff-4371-854a-1907fa280645", "value": "T1A056EF355354CC33CCC32FB4854A214C7BC5792F6FE8569B2EA8FEE89B1EA636410685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445258, "uuid": "62be0e16-7bab-49ae-81bb-6970ec2bf9f8", "value": "c49145fa1609ea5c9df8ad5668221f7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445258, "uuid": "ed06ee10-f112-4e04-bfd1-86e543397628", "value": "98304:J6o8+l7fyT1WpWeTEBDErn8DOCo2DcB5:gONfq1XKEBDgn8W6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445258, "uuid": "149c3afc-959c-4fa7-aa59-0a8f2e6b2c93", "value": 6268928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445258, "uuid": "d54a44be-d13e-4f52-8578-305d6d7adcc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445258, "uuid": "fd23ce6c-77b2-4412-9569-53f71a1e0d64", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfb10ca-160a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772436865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436865, "uuid": "3a1d9c45-296c-47c0-ad97-2a4ed6e8e946", "comment": "Malware payload (Mirai)", "value": "3ba2a12b4448a369775fc0fcfdd764f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436865, "uuid": "f61b9a7e-325c-44ea-a3e1-386df6b5d03f", "comment": "Malware payload (Mirai)", "value": "d71574f7d8459ec6fcee0c00e07ab440279a67f5c25c07767f90277d4c180eda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436865, "uuid": "b3663318-2af3-4900-ad57-f11a55de03f9", "comment": "Malware payload (Mirai)", "value": "94ac42020f8b578b15ec320cb8e1c54d7bcd17c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772436865, "uuid": "114bf819-57c6-427d-997e-82ead49ca477", "comment": "Malware payload (Mirai)", "value": "a0adf878cbffaeff16197b5577f2d9e24d2ec391c9d7559e2f57079059280ab6f77518aefce573f4220b749779a208fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436865, "uuid": "f8912589-a7a4-4744-b8fd-54d56ef90793", "value": "T11AB3C609BF610FB7E8AFCD3746E9170535CC691622A87B797934D828F64B24B09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436865, "uuid": "73650026-2fb6-4273-99df-2495562b61d0", "value": "3072:glpjNEjuuUDp3Ot/1gSbVY97GdSBwbZny:glpjNEjuP3O/1tbC95wRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772436865, "uuid": "d4474f4f-22f9-4aae-8e2f-17dd9cd0bd7b", "value": 109232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772436865, "uuid": "28d0eb07-ddcd-4e6f-8444-53f28cb19e42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772436865, "uuid": "b759e0d4-2200-4752-bf3b-3f73de9653ad", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55badd44-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476420, "uuid": "8b60396a-ba82-4d4f-bd6e-252e1163ff94", "comment": "Malware payload (Mirai)", "value": "aa83a8214bb9846e0017a2b4862688e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476420, "uuid": "a6c12241-99fc-4e98-8d4c-7f2a6a4497d4", "comment": "Malware payload (Mirai)", "value": "d79349a91bdd78758db0a82c82a3f6aeff82f3423acdcd96ae2803e842a18502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476420, "uuid": "09a6d3eb-24bb-4c42-911f-035ea76c2487", "comment": "Malware payload (Mirai)", "value": "85349a0a837abd8d61cd5deeca658705b114ce19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476420, "uuid": "064c6fe6-c918-421d-a88c-615840a75fee", "comment": "Malware payload (Mirai)", "value": "96e330262d414ae371ff21c06295da535e1a935b90fbb16d43170c7b4383d30e32c8e038443fc5f01367e80100975114", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476420, "uuid": "ae12e711-317b-4d84-9b23-8a5537890fde", "value": "T1E4932A06F9419F01D4D325BAFB9E564937136BFCE3EA7102D9209FA023C69DB0E76912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476420, "uuid": "12b7977b-37a6-4dcf-a8ee-3073ae236729", "value": "1536:6on7NPuUV2OG5zJxi+l+yQliDxPUhMYqaaKtY7NhUC:RNPzV2OG5z20xPUhhqaaKtmhUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476420, "uuid": "31c523e8-31e6-4e10-9078-132d00377720", "value": 90756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476420, "uuid": "9d57ffbe-61d3-48a1-b757-2051d606d912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476420, "uuid": "2072132d-6300-4c4e-8f27-0289b4678255", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6712d844-162d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772451968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451968, "uuid": "7af3c72c-501c-4415-8908-000b67e683f1", "comment": "Malware payload", "value": "c90a396149a1d10785f3783ba6f9bb86", "object_relation": "md5", "Tag": [ { "name": "dianganadores-duckdns-org", "colour": "#45AA3E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451968, "uuid": "fa45b6fe-a277-471f-90ed-eddb466bc9c4", "comment": "Malware payload", "value": "d7d296026439bcaf381423dc9e7e8fa9ab8db7fc7e6f281d11ab03bbc802e649", "object_relation": "sha256", "Tag": [ { "name": "dianganadores-duckdns-org", "colour": "#45AA3E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451968, "uuid": "286d243a-2cf8-4d31-a905-32c0b5338329", "comment": "Malware payload", "value": "024e53c1ddd2e33e1729f2c72e1ab1f4009415b5", "object_relation": "sha1", "Tag": [ { "name": "dianganadores-duckdns-org", "colour": "#45AA3E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772451968, "uuid": "e03fc6a4-02c4-4a1b-9302-c011a4d3b8f6", "comment": "Malware payload", "value": "ae86ac7acdc6c1f9ece2850317fe128b2ff2f47de7716657879837a0d5b581d957006cfd9e24a984379eb7c1780a10fc", "object_relation": "sha3-384", "Tag": [ { "name": "dianganadores-duckdns-org", "colour": "#45AA3E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772451968, "uuid": "f86948d2-62df-4694-b755-6c897cb9548e", "value": "T188626B9A05772287913B043009E8C76D9EF75667CEBB80E92B06BCCBB99FC93E904055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772451968, "uuid": "4bba56fe-15a5-4b0a-b764-73114b3e672f", "value": "384:To1U9999999jbMMI6JlKIbMzTuSuTZnyyyl8tttttEdMtMcqb:T9999999jbMMI6JQ4M+LTZnyyyn0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772451968, "uuid": "bc189fb8-d644-4478-b269-812a1deafa1d", "value": 15043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772451968, "uuid": "02aaec7c-3813-43bb-8488-5e5fa7de0047", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772451968, "uuid": "317d5a33-ba98-4598-8547-5b318cd5d6d0", "value": "4f0190aabf763b79ab3f5649b12cc5bf3c545b2e7047f6befca7638918123fe2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a62559-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476318, "uuid": "3db72d21-ed69-40ba-9b26-37d851b79c26", "comment": "Malware payload (Mirai)", "value": "c36a5a4d8cc2f48d0800898566fb11ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476318, "uuid": "bb12a112-b58a-4c45-b55f-006a78c7f093", "comment": "Malware payload (Mirai)", "value": "d824113be81330ca7157e736c37b1435b3b284e4e1c6417bc571caef98b5889a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476318, "uuid": "adc375c1-c3d0-48ec-afd2-e643c0f1339a", "comment": "Malware payload (Mirai)", "value": "cdd981a54376ce6b0624b45c707cdfd55b4b4bdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476318, "uuid": "17d60b81-43b6-4138-a82b-06bdcec1eb7f", "comment": "Malware payload (Mirai)", "value": "b1d7513ab2d48df546f6cc396f9a3b5d0223823dfb62dc869b1a5130057acbcafb5b672128b1d8cbd43330ddb6c28dbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476318, "uuid": "442e4f64-65bd-4c83-9ebe-176f9453324a", "value": "T1FF532B17BA82C7BBC48B81F45BEF6D229D32B8FA1672719563E0FDA15E55CD02D0DA00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476318, "uuid": "cc28a8f3-b78d-41d2-a424-a0b8fb75d354", "value": "768:VQ8G9tVjQuswrWYD+gRlC2MO2gMsZ2LgUGbJCnwPBdd58o3r7GHFX9hyvuXh3RkB:gtVjQwyEljMO2eSgUGbvz3WHpGfBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476318, "uuid": "fe22bee5-472c-4d4e-8ce5-f789d943f2fa", "value": 61144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476318, "uuid": "7223842b-2b5f-4462-af28-5cec8c278932", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476318, "uuid": "986ecdc4-1616-4522-9bfa-ece490730412", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2ff9dc-1656-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772469450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469450, "uuid": "3d41267c-f468-4241-adfd-6009007d8763", "comment": "Malware payload (Formbook)", "value": "b0e438448fb3aedd345a8c897ff210a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469450, "uuid": "28796d29-5d2e-43ac-864e-d79c17bbaa09", "comment": "Malware payload (Formbook)", "value": "d93a5d602961d1d23e77b613866be9056abe8f5c833776a20a2635fbbad772d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469450, "uuid": "f183c910-12c8-4ad5-af42-36cf86821e3f", "comment": "Malware payload (Formbook)", "value": "c0c873d06b3c617440d5035dcaa716ed21e8f9bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469450, "uuid": "346297d1-b129-41fc-af43-899991e55dc6", "comment": "Malware payload (Formbook)", "value": "e222146168bb1a9c2372fe9cec8a092692bf2cc4bf2eec53ebb22fbaa7e33725687146ae23b5945e71889a24173e1d4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "katz-adv-br", "colour": "#35D78E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469450, "uuid": "0bc66d50-456a-49b1-9b60-bdebbd6d8cff", "value": "T11E25122C6698D403D9F5537629B1F2B803BDADDEA511D31B8FDCACE7BD22B150848392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469450, "uuid": "db163fc4-c88b-4e15-a472-5b6fc86816b4", "value": "24576:BTI5aOv0C+g+kyJODVvDAExgjWsP3KmQy9fyWjytjGTEE1Y:OUC9IkUOdMESSGcMcqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772469450, "uuid": "9ac97f42-52e2-418e-9730-0bc831132302", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772469450, "uuid": "35fb893a-22a3-4e25-9c71-b0087dd1d3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469450, "uuid": "98d9410a-a91e-450c-9dfd-b1c6f10f9c8b", "value": "EmscoIpEjfgFrxV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73d8738-1653-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1772468504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772468504, "uuid": "f4693707-d75c-4f43-b7ae-68847b5c7f68", "comment": "Malware payload (OffLoader)", "value": "ec59d5d991ecd9c426d6c28af2f1c7e6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772468504, "uuid": "32300ab5-0635-4415-b7f4-be8f32fef29e", "comment": "Malware payload (OffLoader)", "value": "db28bd02d536008fc341b13a14b81750332f2b5f98a1093cfbee80ac269ba368", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772468504, "uuid": "59400921-c535-4693-9eb6-210915b633c9", "comment": "Malware payload (OffLoader)", "value": "d22258084e27047d2623819c40c49510a19b1bc2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772468504, "uuid": "7171cfa8-d9b4-4f1e-84c5-1c6dc4403c17", "comment": "Malware payload (OffLoader)", "value": "62b44488890e9faefa4bf7dd4c28e51971df591f9233ef11d9bb644d23c84eae09e285989b47097f56dabb286f30153d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772468504, "uuid": "e3f02fba-2a7a-4834-9c87-9d746edd47e4", "value": "T1C5760223B24A633DF06A5B3745B691505C3B6E6164CA8CD696E43B8CCF3A0601D3FA77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772468504, "uuid": "294d1ddd-7535-43f2-a569-c9b10498f6a4", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772468504, "uuid": "2a3336b9-722a-4044-9f88-49b6039f3a6b", "value": "98304:7N66wqQxwmgp44uJhTm30E+TJlXAqGKqViMpMd9Z8SAZW:bxQxS4pnTmUJlQ3ViMCd9Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772468504, "uuid": "6101401c-7384-4d84-b4bf-453f26785102", "value": 7530623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772468504, "uuid": "2887d124-6af7-4dd3-9530-e89dd27dfbd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772468504, "uuid": "0fde774d-1cf5-4c4e-b2a2-157ccbf9868f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f43600-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487527, "uuid": "b03f9810-470f-499d-8f93-f90b408c255c", "comment": "Malware payload (Mirai)", "value": "31f6beb6b4bd8bf7fed9de44c3834f72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487527, "uuid": "c22daaff-d87e-4f72-91b0-ba140f8f38e9", "comment": "Malware payload (Mirai)", "value": "dba106059ac1b609232478f0fd2b5de6e9aa0ff5eba87a1acb947a16935e492f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487527, "uuid": "9a2cb26b-b087-4d3e-b8b1-4596c67f9b4e", "comment": "Malware payload (Mirai)", "value": "7b0d6d0167d89c9f71430e27790ff439ef6041a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487527, "uuid": "3db98309-0138-44ac-ace0-740956f891ee", "comment": "Malware payload (Mirai)", "value": "93fd94bdb612f6c4bdcfe3c5f72e039c84cdd373a6f3e86fd545a8d3f499af93eb89f1c354b12f26607e107a665fb153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487527, "uuid": "e97014d6-f09d-4b8a-ad5d-046c749ba09d", "value": "T13EE34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2577C796B0D77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487527, "uuid": "5dee7cc8-60ab-4fd4-abd4-a3d5a153c6e4", "value": "3072:CotWnBLigk1Tc7Ym2EbvhO1QCakyXLWEi66Co2kd:VWnligqTcEm26OeCa9U66ckd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487527, "uuid": "560c2221-5db3-4cd8-a2f0-1d4a7dc5d72c", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487527, "uuid": "f83283c4-6dd6-4f5e-ad57-fe613f0ba7cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487527, "uuid": "71d29b69-7da0-4783-bc80-9c64893bb0bf", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9e132b-1626-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772448808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448808, "uuid": "7330add8-5745-4da4-8f99-55c741fe1645", "comment": "Malware payload (Mirai)", "value": "c4aa76575728900a9c52c4c9d69534a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448808, "uuid": "0c65178a-9c6f-41dc-8a2f-e72c5b888f2c", "comment": "Malware payload (Mirai)", "value": "dbdb84fd69542d3c45846c5283beb334958c66717e65d9a924b9c3840d8b875a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448808, "uuid": "bc58402c-ba20-4f8e-bd35-6f80fd93e204", "comment": "Malware payload (Mirai)", "value": "39c10fc315f6831835633f2c2737f09ecd0f9014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448808, "uuid": "3d024218-3f93-48ef-8696-8fa66732a745", "comment": "Malware payload (Mirai)", "value": "09a57beabc97968a59ae8633d5b65b598954704639d9bdeba5704f9b662cd178306b85eab2863f24e1a7378cbd239395", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448808, "uuid": "fdbe7d4e-ce76-40e8-a20c-251abeeab690", "value": "T130E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448808, "uuid": "f772daec-d084-475f-b535-329e87d331ec", "value": "3072:dgZc9h1jlnLA2PiXYeyCcnVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZnVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448808, "uuid": "89a78d30-bdd1-496c-a3e4-d8c62386d7bb", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448808, "uuid": "6f7fd8b5-1cce-491b-a217-c689fff8e8ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448808, "uuid": "54f729e9-df9c-4980-b724-15f8f1417d4d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c196847-1607-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772435521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772435521, "uuid": "0059ab75-4bde-4199-8505-db15a765d6da", "comment": "Malware payload (NetSupport)", "value": "2d30e780247d5f04f4e20e39b4b10146", "object_relation": "md5", "Tag": [ { "name": "45-131-214-60", "colour": "#B03435", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772435521, "uuid": "94d11b01-e054-4d04-873f-e02e2953343d", "comment": "Malware payload (NetSupport)", "value": "dc15d94ee0f492beacecc1a96fdf66836887f0a79b63021bd3bd222130656e93", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-60", "colour": "#B03435", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772435521, "uuid": "2dd08c7d-6aed-4791-8af2-339f0f6e57f5", "comment": "Malware payload (NetSupport)", "value": "675ffdd206d95d385d3a298de2acf9fb07d682d5", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-60", "colour": "#B03435", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772435521, "uuid": "4cf88538-fde0-4a3b-8e88-38b9b2c27637", "comment": "Malware payload (NetSupport)", "value": "8e0f279334874b5f4e07ece1d6f239753e7a1a3967e0e8922f2aa19ff54ebea93f54181ee1ed32acdaa2a0ff13d2626d", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-60", "colour": "#B03435", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "varusa-xyz", "colour": "#9C851C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772435521, "uuid": "9e169ae4-0ff6-4203-951d-d1249ace77c9", "value": "T175A2E112769C7462FFB85AB9244286008FF3B84F53EB2490E6D4E9D9BC7167C4BC3452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772435521, "uuid": "8a88f75d-22f3-410a-bb9e-a598b9068691", "value": "384:C2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSf2b0z4i:C2+x6TLKQXK1myQCSr2VS4jTXaRnPubK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772435521, "uuid": "96596f6b-fc05-496a-be15-c471305dcc9c", "value": 22194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772435521, "uuid": "9e6ef0e6-087c-4687-9f48-74d10677a843", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772435521, "uuid": "453d0759-4648-4109-b840-3077ebfdd40c", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f04720-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475775, "uuid": "5f8c97c3-5efb-4adf-a356-19091257e76c", "comment": "Malware payload (Mirai)", "value": "e02e73f05a15cf25ee489976a6f08a12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475775, "uuid": "1f561a6f-be95-49f7-a84b-4ac1197c6d6a", "comment": "Malware payload (Mirai)", "value": "dd83b13d12a2faa17dd69f4db0778fc57c111ba80b3f8a087a59245697510a06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475775, "uuid": "e540ddd7-3c15-49d1-a013-edefba571008", "comment": "Malware payload (Mirai)", "value": "864a58549dd62bada8723053d131523d1ed8794f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475775, "uuid": "48b12a2f-9439-4ce1-9806-9712ac429430", "comment": "Malware payload (Mirai)", "value": "95a9de9edc72797f22cf8f0f296f9372cb3aa3c6379be4db30b64c53b6e91e4a2151f25e1039f5b870dd41c60182eb2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475775, "uuid": "8d17da4d-a5ad-426f-9e9c-84fcba040a21", "value": "T124932A56FD818B21D6D112BAFA1E118E3313177CE2EE72129D146F6077CB96B0E7B902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475775, "uuid": "b8f2739d-602a-4e0a-afa5-8833c8c1fcda", "value": "1536:/snAmQ6vfd3J+abGrwDQjrVVL+aPSt/BCDDxiu9pI2D67Uh50Y1g4B:fmQYZ1bGhjxVL+aPf9pI2D6ghGYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475775, "uuid": "7c255f80-7878-418e-9b5f-4d3019f9c635", "value": 97544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475775, "uuid": "c0554eae-ba4f-40c0-b438-7276e98f4658", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475775, "uuid": "a2613204-c4a3-4249-b30a-b8ff92b1f737", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca832a5-1632-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772454259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454259, "uuid": "1dd763f4-2ee4-4807-ac05-44e885095b83", "comment": "Malware payload", "value": "591aae15106147bdb5bc7b26049b943f", "object_relation": "md5", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454259, "uuid": "c955ab27-2b49-4e83-97f6-aef1f3e89c00", "comment": "Malware payload", "value": "ddceade244c636435f2444cd4c4d3dc161981f3af1f622c03442747ecef50888", "object_relation": "sha256", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454259, "uuid": "f9760cd4-9f30-4379-b07d-afd47711979d", "comment": "Malware payload", "value": "cecf87d582b4df4323eaef04c9a648d43325043a", "object_relation": "sha1", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772454259, "uuid": "40cf1191-1f5c-4c85-af44-405af6903d2c", "comment": "Malware payload", "value": "232a89bd4ca8dbccb269eb162af958c7434daa7a8a17611c3c436116fd6857cb9185905def82cd90b6e7f08de8d9cd5c", "object_relation": "sha3-384", "Tag": [ { "name": "Amy-Cherne", "colour": "#77720E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454259, "uuid": "b71fbcb6-eecc-48de-a0f3-3b87aba4e82a", "value": "T19E183380CE62D051C5380479FA573601CFB2DC33BF166DEB5C597A6AD6BF848A81E42E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454259, "uuid": "66a03c84-ae44-4c8f-ad5d-e3377f52a1a1", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454259, "uuid": "18071d76-d3e0-48e0-a249-2f4ef8af336e", "value": "1572864:BZcy/5CmaOQKGk55K5QWn50nfM81pzdBfGuJQXGGTqK6eV1+Jd8Cv5qPZ:BZJFH3WninE81pfDoGGTJVYhv5qR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772454259, "uuid": "24240c61-44a0-4c57-b94e-265838e4ff7f", "value": 88529904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772454259, "uuid": "b5dc988f-9911-4bc6-a1a2-8803ce87eb08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772454259, "uuid": "ee59d7b2-a3d9-4261-9518-ce4b7331569f", "value": "ddceade244c636435f2444cd4c4d3dc161981f3af1f622c03442747ecef50888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17124056-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476315, "uuid": "e578881f-c15f-45f8-a6ff-6c07bde9d7cd", "comment": "Malware payload (Mirai)", "value": "63f140bea59fb2488a54701080ae403b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476315, "uuid": "78bf73a2-53a2-4c09-99d5-036ffa5aea2a", "comment": "Malware payload (Mirai)", "value": "ddd5674c37f5e99822fec74d5a2e01797c033aa9e326b4e4ebb73922286b675d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476315, "uuid": "c912bd43-bba5-4f83-9e0e-2a3f6eee288a", "comment": "Malware payload (Mirai)", "value": "619667cc661308fcadbc2b178901b19bd6219948", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476315, "uuid": "12e191b5-908a-4e1b-98d1-db0285f08e9c", "comment": "Malware payload (Mirai)", "value": "ed1257ba0f716f5618882a9a01414b8b7fb1a6a8d5ea3cd8a521a1a4ea1ecb17bd0c4535e1cd80e7aa544344be9bd82f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476315, "uuid": "f7c2d6bc-9954-4b8e-96cb-25abb7423c70", "value": "T1B793991A7E11DFBFF65D823007B78F31969876D636A18185F26CDA481F7028E241FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476315, "uuid": "df8404c3-4317-447f-8cfa-cba129482b47", "value": "768:58nfwDCqCEKrU065YAF846NtR4wpyD8I8rJkJoyJkTv2DEe1pIi/:+Y5KrU065YjZSSr+JuTeEeLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476315, "uuid": "2cba6fee-d1e5-452f-abea-36d03521fd79", "value": 90348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476315, "uuid": "25aa67df-1435-4873-8456-4841f5dc2c51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476315, "uuid": "77757481-85d7-4413-85d2-3910ed2a6a6f", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8374dd45-166c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772479074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479074, "uuid": "cc0ec3df-e598-44a7-a545-eca492422661", "comment": "Malware payload", "value": "3319db89f6b0372f7381f52e514190c7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479074, "uuid": "eea76648-6d13-453f-9c8a-6138ab09a6eb", "comment": "Malware payload", "value": "de0e0e528886830ef37fdd97352113523ba4e5f2eb03efeee9c68f983f45d32f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479074, "uuid": "ec19b018-848b-47ec-8324-148972995a72", "comment": "Malware payload", "value": "e15d410b316632497dad4ff1ce87048a8417db42", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772479074, "uuid": "c997ae0d-fa75-4655-a753-2c4f48fa203e", "comment": "Malware payload", "value": "95f53af9c2a7b4f7f287b0c3ea0b352060fc31fd82789479e17722679b019941121a4054d6d6cb03acff34fb84265252", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479074, "uuid": "f62d5772-3b31-4023-b9f9-31d320015038", "value": "T1BB462B6396EB4CA9CDD7A3B866CB53326334FD3589385B2B5644C5213F136C06E2EB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479074, "uuid": "39d4bfbd-6a7c-4a89-8426-4287de3ccaf6", "value": "9ca4ec370f5a973886c8f32bb575352e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479074, "uuid": "02b75d8b-aeca-43bf-b0f8-817c15904403", "value": "49152:97U5tkRWwEyMHu+kPCN346s3ruRMPjXRIbU84GAv4g45uI5sOYShIRx0y2+hOxZD:i5+mbFAUsOMNsZcS5huGGYcnfWxAde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772479074, "uuid": "ceb30d84-7a07-4b6c-821f-20f862c96520", "value": 5503973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772479074, "uuid": "313cb563-aa27-4a21-9ae0-756fa06e2af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772479074, "uuid": "d2feccfb-2a66-4ad2-8a87-88dac33748d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f482964-1619-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772443445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443445, "uuid": "04a75f6d-1135-4ec1-ac8c-cfbb26b03678", "comment": "Malware payload", "value": "7426aa69e7f892f6eb1be8b6d05ab468", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443445, "uuid": "d5d6a11e-b211-4c1e-a446-316c02af7859", "comment": "Malware payload", "value": "dfa3539353b89089a3599f4775a296b270751738186af515bf3e630dc054bc7d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443445, "uuid": "54f3ea9a-1282-4c17-80ec-3b1dea03de2c", "comment": "Malware payload", "value": "df7396c01052e9626279846150d705a7a80a0218", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443445, "uuid": "0e345427-f7ea-4da2-9f43-81ed41c62754", "comment": "Malware payload", "value": "e25ec28784e7bac16e38c1517f6cadcfe2b32880983d125b6b463c9d171fb25058ef3ed9ad8b15b9234dbd15c1e60451", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443445, "uuid": "6687d700-e70d-4c71-a37e-f6a6b6cffe13", "value": "T13BA633C6F32A5AADC87785324C964739272A5D21C683AB472890377C7D7B3C80E95FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443445, "uuid": "399c58b0-9130-4c60-9406-25ae5ceed415", "value": "196608:Zhr+jcuEvWeGNPYsuVcyku4qXbwrZrhzAaYAvZzoT/gClpgoLyStnFSV:brszPNYqu4ewrhzAaY8polpgoLyStnF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443445, "uuid": "49bd497f-e0ff-4662-ba05-0c50c978457b", "value": 9705630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443445, "uuid": "f834ba2c-a137-433a-8c69-da05bddfa8e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443445, "uuid": "66e95a37-d4b7-448f-b182-4bafd6974206", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b822c0b6-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772434065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434065, "uuid": "a85fa0c9-693b-4e5d-9f9e-0b2c0f15194e", "comment": "Malware payload (SocGholish)", "value": "5bedabab8dddaf03ee75c14e1e5c9ff9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434065, "uuid": "a731bf2d-4c54-462e-b43f-9a908a7509a7", "comment": "Malware payload (SocGholish)", "value": "dfc159e0987ac2ea946fd45fa61f81d828a5302d02d53dd7cf88cefefc79c316", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434065, "uuid": "1bf2142c-102e-4d1a-bdf6-6dcee79e3ca0", "comment": "Malware payload (SocGholish)", "value": "6fb00338d9ddaec12d5527343844e3cc0824ebac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434065, "uuid": "5bcfd587-02a0-4d9e-b47b-264af85fdf6e", "comment": "Malware payload (SocGholish)", "value": "33e4a0f1c2260666e9007109e007a8c696c2e640f3edc18987db522284274cf5dd3571661af72455897a6e4efe3def4f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434065, "uuid": "b31187a2-059f-4ec0-9673-8b68635aab66", "value": "T19CD097BA188A21BC3AA9506A3033CA0D32563248FCEA2876CCFE48110204FE2081F60C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434065, "uuid": "baaa7969-31c1-480f-877d-52edcd44cac4", "value": "6:q7XnE9/y3AgO9lcRW5E5OGIdnvYk3wgyutbkgIzm:I3oa34cRWQOfL4kbkgIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772434065, "uuid": "150395f9-e485-4bfe-bc04-6941b7637d33", "value": 253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772434065, "uuid": "ea0eb540-85de-417b-9ae0-83331a782672", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434065, "uuid": "929fdb59-b512-4fd3-a586-9c80f6cc6d56", "value": "dfc159e0987ac2ea946fd45fa61f81d828a5302d02d53dd7cf88cefefc79c316.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0d2253-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475758, "uuid": "70335b6f-be68-4c45-b4ff-a016b7d90979", "comment": "Malware payload (Mirai)", "value": "e0df9cde89f12a834e35ef4d910b3457", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475758, "uuid": "8529ad0a-f8a8-4f8e-9653-09f37608e3df", "comment": "Malware payload (Mirai)", "value": "dfea1bf3dfb101160653a6bd9974eec22ac79af611ff1310164e1594b5e49ffb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475758, "uuid": "36df44bf-36de-4097-a808-8618752c2474", "comment": "Malware payload (Mirai)", "value": "1804b96f2be0dfaf0efd8000139b7f647502ea49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475758, "uuid": "c791341b-5f2e-4da3-87e5-091ab3047f0d", "comment": "Malware payload (Mirai)", "value": "f0cdb186de082c4629e2ded53bed088614ec1cbe52130841ad4d75cf205cabad2ec3d7ad2e1c02ee3cbbde58adcfb7a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475758, "uuid": "4090383a-f36c-4dc9-b8e9-e8d7fb2a24e2", "value": "T123330792FC82869AC5C067B2A72E568A73A263A4D1DF3313DC584F1037C965F4E77E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475758, "uuid": "d8c9984d-7bbf-4fa3-9a66-c8fcf64eecb1", "value": "1536:XzVjMJ4CZgxUEen7lJAs3flPSMxg8+Z+dM0:XBMPZgxUEeQURxg8eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475758, "uuid": "6c494ef7-7c7c-4f0c-a2b6-cf488f7959e4", "value": 53836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475758, "uuid": "38ca945b-a7c9-4a4d-be10-d963c00ee558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475758, "uuid": "6b6b2974-6550-4542-a9ba-25b72f491348", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0ae085-160f-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772439333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439333, "uuid": "8066b512-4625-4844-9e86-9ff586e7ce4a", "comment": "Malware payload (VIPKeylogger)", "value": "cd33a21a21be83f3fd44503d6e7fb1be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439333, "uuid": "1436bc4c-62fa-4a0b-9df3-842f5123455f", "comment": "Malware payload (VIPKeylogger)", "value": "e0ba3d10eb52b06278afd0279cc2fb89921b2cb1935b2416148bcb5e8751fa15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439333, "uuid": "0920010d-de4c-40d8-b869-278e68ca1ba4", "comment": "Malware payload (VIPKeylogger)", "value": "6dc0666870eb3bf8f49fb7c44f253ada034df9db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439333, "uuid": "2b99015b-b7a8-443d-82ac-335e288c7128", "comment": "Malware payload (VIPKeylogger)", "value": "2f5d034117aa5da5966a8d5e2229a697dde4fc4bcea50401a56b6c13c70402369a5a5ebeda77a6fbfcee6e285456b46e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439333, "uuid": "354cb392-f1dc-4e33-b58f-0799ee9afb45", "value": "T1C13533646630B185C07326B22474CBD7EE6BD0132D7BABCF23914B7C3D65D62E948A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439333, "uuid": "2a73db4b-e6f7-492d-94cd-e1b83a789668", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439333, "uuid": "2bf530a0-9e8f-4ef5-8899-983339223062", "value": "24576:iM69yLxCDTsLeOaEsLV5cLgS3ET04aIKStbrYOJmydhrokLKX5:JLx0F4Lg+ET0UKStb0emuxogA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772439333, "uuid": "07f0082b-9ac8-415f-b3dd-2e8a91464944", "value": 1072176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772439333, "uuid": "f15a7355-fe3a-4320-80a1-8cfcadc5b9a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439333, "uuid": "aa80a813-67c6-445c-b5d2-94e6212e593f", "value": "271407441-043419-sanlccjavap0003-7874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad4c282-1619-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772443438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443438, "uuid": "88eed500-9c8c-4993-a2e4-427edd78753f", "comment": "Malware payload", "value": "d48ba3a1be2f960e3b7a84a0479ddea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443438, "uuid": "f04a8f09-92b7-41ce-b0ad-92428c3772d1", "comment": "Malware payload", "value": "e10e1f305d3bdb44ec79685264ded1052a739b69ce10e0005fd4ea1aee7dccbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443438, "uuid": "bf5d99b8-4d2f-42fd-bb70-a1e2f9b77fa1", "comment": "Malware payload", "value": "ad2ba4e70321e57bd1bcaa5c4505a23817f6bce0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772443438, "uuid": "b3c8d61e-f36c-4bdf-846b-27e17916d874", "comment": "Malware payload", "value": "bf8e835b08567a905b9d68e05f4e02a8dab2e316df85d80d174b514e2134ad972a9e00fb10755e9cb459a74793ca33cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443438, "uuid": "3b6e80d3-e863-453d-863c-8486a4e5ae59", "value": "T193451221FBF941B2F28A157504BA772C667BAE815724C2E393A43F1CED323C19D39199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443438, "uuid": "c46e34e5-f025-49ee-a2c6-5170cd89d8a0", "value": "270319a845d916cc11f9ac242935014a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443438, "uuid": "3f96c3e4-f5fa-4082-8d1e-2502eb1fe55f", "value": "24576:Tul20jI1QMIsopqyEzrJTwcL6e9TOJ6cP3rGRfP5Ok4I/bJ:Tuw08RopqyGrJTteqT0zP7GKkr/bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772443438, "uuid": "106916a9-58bb-4fc4-bea3-31ee102fc23a", "value": 1228645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772443438, "uuid": "3e3171fd-52e2-420c-afc3-bbd613d6b46e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772443438, "uuid": "6eacab83-58dd-4a7a-b2be-04f61e266f1e", "value": "AD325WN-AEG._B.53(3471).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be25133c-1673-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772482179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772482179, "uuid": "9aa679dc-53ea-4a57-a0cc-1b511a417b29", "comment": "Malware payload", "value": "dcbe5b26ad534eeddd22fdfab7c9f08d", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772482179, "uuid": "60a29ee3-d191-4eee-8738-7b6ec1cfdcab", "comment": "Malware payload", "value": "e190ad0b45882fdd19e62883151803a32adb148e8eb7475f1b316a00d9ecc82f", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772482179, "uuid": "f2233fc6-f814-446a-bd9d-066d52c43f2c", "comment": "Malware payload", "value": "c3dd4be71aa306b31e1d0dccd689c5e3657cab3f", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772482179, "uuid": "bc43fd8a-11a8-46ed-9779-9411a4e7714c", "comment": "Malware payload", "value": "1e73ce09f50d7950b92a9af93e86cca85d1038be435139829be7b66be2eafe6af6d4dfb19b71c26595571661b24afb59", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772482179, "uuid": "32943dc7-73b1-4a7d-9dba-fd00d1c450c5", "value": "T16F76D49EB3851BF85918AAED8307358E53A1917B2EF7201C95E0815F782EF133A74D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772482179, "uuid": "c3207f8e-5990-4219-a158-96ec969d914d", "value": "24576:5dnLjZoajdnLjZoa1dnLjZoaadnLjZoaUdnLjZoa2dnLjZoaMdnLjZoaidnLjZoZ:ZNX6YCMy8O50/0fgliBRsQhZ7ZDy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772482179, "uuid": "374cc1f0-caa2-4a58-a07b-42256282f0b6", "value": 7479207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772482179, "uuid": "c6ff7321-592d-438a-a1ed-de686913cc19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772482179, "uuid": "acdff6e4-9927-4e2a-ac6e-ca9b1098ec17", "value": "create", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45ebb15-1671-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772481276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481276, "uuid": "512054c0-8821-4254-9f39-96eeda9948b6", "comment": "Malware payload (Mirai)", "value": "6c7dc8d90ecbbf30ac991bde84c2ceb0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481276, "uuid": "54d5e0ab-2e50-4988-908f-0a790adab2fa", "comment": "Malware payload (Mirai)", "value": "e23f8ba7bf289df08075b13c8957fa5d89583ed7d4e7cb52d14fe95b64143c2e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481276, "uuid": "29862840-b800-4f15-98ce-81056fb2e994", "comment": "Malware payload (Mirai)", "value": "c031ca5b18ddfe763f7d471b5100882e08fe3072", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772481276, "uuid": "c50230d6-de24-45db-ad40-b053dd8752ed", "comment": "Malware payload (Mirai)", "value": "9cc40a5411bdcdfbb47cd1680c56e0c2093612aadc9eb7bc34f8e95a106ccf890b7d139f381e243803f6ae87a4eb4d1d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481276, "uuid": "60406100-1e64-443f-acbf-f37381284e8b", "value": "T10225E07732174E10D3A44373C1DB8A4593ACA683B6A7F70E7585239A14023FFDE5A2A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481276, "uuid": "acbcd69b-8222-42a9-b27f-a03d58b78003", "value": "24576:odoK67R3Ts5Z6UuQAlm6OD2zvisDdks8G9h:/FjQZlu37tDdks8Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772481276, "uuid": "4b181223-6eb6-4326-bec0-12feac51d29d", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772481276, "uuid": "c180a3eb-c80e-4114-8d93-767503a0081a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772481276, "uuid": "598e1769-0331-4417-a31b-597459f5f201", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd3ac35-1626-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772448969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448969, "uuid": "07f44a13-d4a4-4d95-a117-055d08fd5b05", "comment": "Malware payload (AgentTesla)", "value": "e450439d2cfd366545c0115fdc4ac9ee", "object_relation": "md5", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448969, "uuid": "f5aab6e2-3164-42dd-835d-57c9fa9f793d", "comment": "Malware payload (AgentTesla)", "value": "e242c6184c8ec3f11073e638f3bc192fe9c9a87acd0045594633c839cb723a9d", "object_relation": "sha256", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448969, "uuid": "d88b6525-f85d-4ff4-a949-159f9401b1d8", "comment": "Malware payload (AgentTesla)", "value": "91bbb40938cd4e33e9159f8f5aa3b33e72fbf9db", "object_relation": "sha1", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448969, "uuid": "5c16be03-9d34-45f2-ac83-42715867f9ab", "comment": "Malware payload (AgentTesla)", "value": "f8a73181113c2dac8b4cbe7d5b6a2203a5f28daa20b4bfdbd7c5658256b6ba88dcc813615038ee9fee3588164877eb41", "object_relation": "sha3-384", "Tag": [ { "name": "192-3-176-231", "colour": "#DFF939", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8747049877", "colour": "#5A3DBD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448969, "uuid": "07ba66f7-eea0-4ba0-ac53-a4860a2d2e96", "value": "T17B164B48ED4497842F23CF357B6071D14392786B7D4A9A82E02BDDB2BFB3199AD25D30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448969, "uuid": "985ad5a7-1e28-41da-8c4b-eb7be4f78780", "value": "98304:9n+1WwXNFadmBfRg2eUriuy42bw2gAwxINUl4AaiBTQpn8JkZKp2W8ETkf+Elh+e:41Z9FsgRgzxDE2gAuqBiBkpn8JkZSb8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448969, "uuid": "514ae914-295e-4d4e-a517-c6b0000f170b", "value": 4279762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448969, "uuid": "4c81045b-2abf-4e24-af92-bdc5a418893d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448969, "uuid": "825ec6ed-ea78-4e67-b90d-b8478f4d954c", "value": "9sd9fd0809g7sd8f789g73438g97dsf8g798s7df98g.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1368c6eb-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433789, "uuid": "cf416ea1-1b14-4729-99e0-c260bff9517b", "comment": "Malware payload (SocGholish)", "value": "7ec4bea815a2757e528c0de71a07baf7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433789, "uuid": "9b40ee68-58d1-4681-be8c-a9d133b3bc45", "comment": "Malware payload (SocGholish)", "value": "e2c4327ee329d30bae31841405430c39f4f04cf79c144d2843fd0010a52d5559", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433789, "uuid": "46370642-17c2-4ac5-a2e0-9c48a5cf4dc2", "comment": "Malware payload (SocGholish)", "value": "c85ee713b43c84fcba7facb344895b5d17128b66", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433789, "uuid": "0787f649-1a49-4e07-9687-a7f212401002", "comment": "Malware payload (SocGholish)", "value": "da690347255af2e9c3814b0358c1b9ac3d148e79194bf4e48c6793d4a46a968585c842b2234e9c771f1fca83f1f48bae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433789, "uuid": "0c383b9e-b180-4604-8f35-db6f279a1b15", "value": "T14DD0EB6725150D242B662429032A6F093C262E086C33885BCC1DC0940828BDB889258C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433789, "uuid": "e51378b2-e95e-4a92-964b-d7e1cf85a542", "value": "6:bQnyX7rGJLggO9lDeRWZzhAk6pdDdYzh6XfuCln:/HkYDeRWZzhd6bjXGCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433789, "uuid": "72cf6455-5ec7-42bf-a9cd-e5b7902462a9", "value": 277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433789, "uuid": "b176b902-1973-4989-a2df-254f553b69b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433789, "uuid": "bdf73d83-f6bf-4b71-b988-6a7f045b7eb4", "value": "e2c4327ee329d30bae31841405430c39f4f04cf79c144d2843fd0010a52d5559.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b262f9d3-163a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772457678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457678, "uuid": "1885b4d3-2212-4781-b05d-3b824a27c30a", "comment": "Malware payload (SalatStealer)", "value": "e03fa24cf70d7fa845cdfc8224e1b716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457678, "uuid": "d61e0739-2bd3-41ba-895d-a571de5a36bb", "comment": "Malware payload (SalatStealer)", "value": "e2d4970176451e55a4741ff90ed59cda7f1418bc885c6cb812d512e1741ef051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457678, "uuid": "38da2af0-c3a1-45a8-b421-bd2ba7c2e432", "comment": "Malware payload (SalatStealer)", "value": "2d89033e2cd17732e752b54219c4d082b5a6b47b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457678, "uuid": "7dcdd108-3e11-4666-a0e8-e263f7d76832", "comment": "Malware payload (SalatStealer)", "value": "a300ce900bf59e09231353daf979089a2a780fda8f0383357bab7d01496298407d1596d7bb4a6181fc1e453a57f3ebf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457678, "uuid": "27443108-9856-4700-8729-0a5d835e3f16", "value": "T19AC65C41FA8B98F5E9031831419BB23F23365D05CB38DB9BEB547A2AFC776821977604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457678, "uuid": "0ded5ce6-0cde-445f-b381-94f0aee5751b", "value": "49152:XspwUG+2vLajDhEmnJ6F4kkmvlQKj9O1MEOWAKpz9I//nMN08hZERXyvkK6jXZBG:8GUGLvKEkLvfInB8hae6TnKa3p2uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457678, "uuid": "5e5f1dc4-c9e7-45ff-aa9d-41226e7a8ec6", "value": 12107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457678, "uuid": "46aa03b4-1420-4279-8fdc-7fecfb0e4911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457678, "uuid": "1c479433-e7c7-480f-a760-cdf58b201b02", "value": "aufnl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf14ef61-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433674, "uuid": "a1cde585-60ca-41a9-b140-dfbf8d8fbe4a", "comment": "Malware payload (SocGholish)", "value": "30a5533f6cd6b0138f28c66d8ed09c55", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433674, "uuid": "3227c602-fd42-455f-b634-4d5c6b7ce04c", "comment": "Malware payload (SocGholish)", "value": "e63b1551d0ca50555a1cdf1601c4e28552814a6705dfedf0e375c8aafb46e6f6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433674, "uuid": "1abde802-022b-4111-8ddd-2db7b2d1f0c6", "comment": "Malware payload (SocGholish)", "value": "888850b382379915cde245787a95f067478ccfea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433674, "uuid": "a1299f33-160e-4d62-b1c0-994d4de19306", "comment": "Malware payload (SocGholish)", "value": "d4b635f5b801abedd95913f603f823f6f464dfdd9a41bc31e0cbfdae103e92a6ba45cc979348585b0c9ae1bd373df61f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433674, "uuid": "8e53cbc6-ea53-44c6-b5be-cf1b75ceee63", "value": "T1E2D097893804682939D428A871FB8B0FB043122824602A39C97AC8C82520BE201424EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433674, "uuid": "5970e1fd-f108-4738-9f0d-4f63dde7bc20", "value": "6:qSrJkG3AgO9lfeNxRWFz0uvGIdnSf3ITm:RkG34fefRWFz0uvfSf3ITm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433674, "uuid": "7645231b-a4cb-421d-848c-09437dcee951", "value": 235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433674, "uuid": "ada34115-b7d2-4b59-a4b9-143fec744146", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433674, "uuid": "0dbc28a5-8608-47a9-ace2-bac45fb75174", "value": "e63b1551d0ca50555a1cdf1601c4e28552814a6705dfedf0e375c8aafb46e6f6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cf0c39-166f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772480252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480252, "uuid": "9874002d-94cc-4df4-900e-b4cd4d7259e5", "comment": "Malware payload", "value": "0ba496271465c1a99b94305512d87293", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480252, "uuid": "6458a81e-e0fd-4b2d-91da-cc76ff685bbf", "comment": "Malware payload", "value": "e6546987895c75548a5d06447d9e2d9ea8319aa8de0cf6b690d2644e7e5a6630", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480252, "uuid": "5d6f2f7c-56b1-439a-8448-59aca7ae0615", "comment": "Malware payload", "value": "a0e1af6721eb6a7848bea10f22c28702d301c4b2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772480252, "uuid": "5fc04afd-6ecf-4246-8500-2af6962d4640", "comment": "Malware payload", "value": "88cbc57ed6135a23ecfa39a3f072ce411672cb00f96e060a5281c52bb0bac2a6dd0497f8f0dd67fcd14adc16919bb703", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480252, "uuid": "77fcad47-9264-4e3b-8974-52bc023100e6", "value": "T116D6339879D5005B4B9670BB71645FF0B228D0B03A78C452F697D7D6F3A32A6C786C23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480252, "uuid": "3aabd7a1-8a48-45b1-b459-3fff16ca31f3", "value": "393216:NI1eUDBxIVib54vfnCxoQMxYpW7FJeP/NWQOkbgc1qY:NrgIY5H6IAFk/YyF1qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772480252, "uuid": "c6973c35-5ceb-4e72-9a8d-e73fc1084c35", "value": 12621775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772480252, "uuid": "e49e1ec7-54a8-4812-a6c2-7bd5b667e675", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772480252, "uuid": "81ab250d-b956-448f-bfe3-b144b3b87f40", "value": "6526_Predstavlenie_na_naznachenie.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec05508-162e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772452625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452625, "uuid": "5162c6b4-b591-4bf2-b149-a4843c02a698", "comment": "Malware payload", "value": "5dad372787b5747f05458030d8ffcd70", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452625, "uuid": "f5863487-3155-4e5b-9fa2-283dc13babd5", "comment": "Malware payload", "value": "e725ecbb3c1e9eb1632d8c6236b14dc2f04120e9c3d0332563540f3362086129", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452625, "uuid": "64400396-4ccb-4291-bf50-6f530f8e135a", "comment": "Malware payload", "value": "a5bdd8c0617a2d1680df1cd68ebb8701a21191c4", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452625, "uuid": "3e90d480-4bd2-4ca5-9c67-ab8d99218699", "comment": "Malware payload", "value": "820d296122b35f2190b8f73faf0b26f3a80178d2b877734efa38ffc2c9d8392e19b05f8165583ef3294b39531f14ed26", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452625, "uuid": "007298b6-517a-48cf-9c18-5df347281c9b", "value": "T1A1A5335FB409482E8C1597B251418605CA7E0FFDCC5D0AFDEBEB9DA35286F88A481CDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452625, "uuid": "98d3a0e0-7f63-4f07-9778-ba71b07ba48a", "value": "49152:lKqJqEvc1uEm8SGyyQq35335s8/LEVAxnzY4GkgkoylhWYI/04YfbAExb:lFvcsEm8xd5H5QCdY4Gkg5QY3042AE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452625, "uuid": "55c34508-e71a-4ad9-830d-a4b812d21845", "value": 2221887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452625, "uuid": "83478b4c-33db-4fb8-90f0-537cd6153d20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452625, "uuid": "32703574-ee79-4464-8702-ad33787e669d", "value": "2c5d60be38c7e78f88868c1c95c6cf6660f9406ec49f4f503bf00810a24d0682.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01d8296-161d-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772445192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445192, "uuid": "8aebc5a8-3d94-4b85-9555-5d8eacc01a04", "comment": "Malware payload (CryptOne)", "value": "dfc2d7616cce2b1716417a552439b4d5", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445192, "uuid": "d8a7f244-6d91-4859-a0ef-7410ba82b63e", "comment": "Malware payload (CryptOne)", "value": "e752c66fb37de1a9d88944a247342b5645192862f4b115893d30fa2f4a8154c8", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445192, "uuid": "7a93cda7-86ef-40a2-a793-950cb6f221e5", "comment": "Malware payload (CryptOne)", "value": "10f895ef3bc109209902b49f76a4491ede85f2e8", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445192, "uuid": "21d9dc62-e96c-43b4-bc58-977ad746c692", "comment": "Malware payload (CryptOne)", "value": "6a2da5448ff22e83e88adee85e2ca6dcc219ebc74fc957200fc24f588b47f2c187b8438fa77210f1989a0923bc0d7f41", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445192, "uuid": "be96f1c0-86bf-42aa-9d9f-aa1fc09389e6", "value": "T1EE66E1E1D18118B6FE1BFA35DB27DC5DD7066833193859C85E84A9CC192EF21A73A233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445192, "uuid": "249cc613-4852-4f48-81a4-3b2eecaf7ab6", "value": "c49145fa1609ea5c9df8ad5668221f7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445192, "uuid": "c41b39d5-bd3b-4a8e-9e74-9c36cccda780", "value": "49152:O6o8JIZz19oZgTPJsMJkD9t2+VGwJD7Br8OFkX3Dao0dyCvb89ArS+VcFu5z4VuA:O6o8+RosGM+Bt/BJvBwakmI9VvNpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445192, "uuid": "613501f8-875a-480e-8dca-e5f4f8e27a9c", "value": 6631936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445192, "uuid": "087f88f1-f4c1-4042-b5c6-794ffc6aedd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445192, "uuid": "69674969-2ffe-483f-861d-75b78a0122de", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9eac5e7-163c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772458576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458576, "uuid": "1d03a350-5309-4a74-b827-96bd91658fe8", "comment": "Malware payload (NetSupport)", "value": "923f7553fd390f929f6838e05f5f6430", "object_relation": "md5", "Tag": [ { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458576, "uuid": "d9f4d58e-5b56-4157-bc11-a5ac2117683c", "comment": "Malware payload (NetSupport)", "value": "e77963e5f47e7d3aff790bb23dcf6c32b455a2ee580a7c420c23c605e5a0cd50", "object_relation": "sha256", "Tag": [ { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458576, "uuid": "fd3391f5-bc2f-441e-959d-44a349b8c6ee", "comment": "Malware payload (NetSupport)", "value": "dda1840b1103c78ebd81a4663212e3aa3013c2c1", "object_relation": "sha1", "Tag": [ { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772458576, "uuid": "d20548be-e0e0-4bd1-88c9-1d6a6216dd67", "comment": "Malware payload (NetSupport)", "value": "39391d980d886f0b3ba203d5863e438b8a099aac40e099756fd228f10be50f1139490317706b5a944463eaa649df2411", "object_relation": "sha3-384", "Tag": [ { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458576, "uuid": "b5e96fa9-2e98-42a5-b98a-68db6db4a6b6", "value": "T13126339A990989DFC95B4F74C10B5E1AD33E3A41F25E7080F6728252CC89B9F4BB871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458576, "uuid": "769d0cc5-00b6-41e5-8b44-ca9007eeedeb", "value": "98304:sQqukSsCqutSsW/VYj3b2+30/wBaV0W/VYj3b2+30/wB2VN:sqkSsstSRQy/2qQy/2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772458576, "uuid": "a4409b75-ce34-4fd1-b487-8c51005749b1", "value": 4429374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772458576, "uuid": "58080e5a-2bfa-4b99-82b1-e9810a7cdfe3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772458576, "uuid": "26c11645-fefb-489f-b553-479a5ca34c2f", "value": "at.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9952c88e-161c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772444751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444751, "uuid": "165e9721-1412-4cbe-a6be-1248a8e1b144", "comment": "Malware payload (SantaStealer)", "value": "eae7c190bdc5dd0ce90a009451e2ad7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444751, "uuid": "a8d34ff8-4b15-4a2a-98b6-40ff3922cca3", "comment": "Malware payload (SantaStealer)", "value": "e8003647df15edd32d45b78831e806de2426846182ecb80ffd59271dc696a82f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444751, "uuid": "f456dc8e-8071-4652-991d-3cfbdac1983d", "comment": "Malware payload (SantaStealer)", "value": "41c9cc339a0e6ff6e82b83e51474cab269394fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772444751, "uuid": "7e382b34-2a0b-4565-8e79-0d4d874299af", "comment": "Malware payload (SantaStealer)", "value": "44c7dafa52c4fd37cb67ce67506bfecda5abceac4090ab5cd3d8ae8423d75e209664641c329c9ad15069eb067c2b2c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444751, "uuid": "648b3f0c-12ea-4018-af54-dad6a7c3e7db", "value": "T107C59E0AE1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613F45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444751, "uuid": "f33c2668-70c6-4bd7-9c6f-60d5771daed1", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444751, "uuid": "7f09b134-2a2a-4c7e-9588-444bd719acfc", "value": "49152:5avY1Sn5eVNo9WFjeZRc+9sNfBZSOwKHRjUk4Pzt1nlCWsdGj:IY1aVUevc+9sdBg4x4DPPnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772444751, "uuid": "1b3e5d86-1385-444a-9aab-7f6e70989117", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772444751, "uuid": "2ed7b1d5-b7e7-4c47-883d-df4aa6b06d60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772444751, "uuid": "88d7c788-f144-45a2-b932-37595436dab0", "value": "20260301_221904_20260302_011904_VCRFO395G4T0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7120b692-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433946, "uuid": "62c4678a-d16e-4d8f-8363-2db966da96eb", "comment": "Malware payload (SocGholish)", "value": "2e8de2fd599b5cddcccfe17d8ea7ddd1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433946, "uuid": "8f9a4632-4461-405f-86b8-37a69a933335", "comment": "Malware payload (SocGholish)", "value": "e845a141f674f9a0f2bacb8bf76d0fc5130257537d7490e55d87a23fb8c8906a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433946, "uuid": "9b09045c-2924-4359-99af-ff86db23c98d", "comment": "Malware payload (SocGholish)", "value": "3dbfeaf53e146d88abce233d8d6bf876bf7349d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433946, "uuid": "19879bfa-6b72-479c-9916-31266dc55de5", "comment": "Malware payload (SocGholish)", "value": "2cbab8d99278dc511f95485c9b35d768d92655eb7aa5a4281aa06d9318512467fa9c957b2493194cf4de395a18c5d9ed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433946, "uuid": "a35d951e-e157-4c70-983d-b696fdbc1556", "value": "T196D097D6340810AD1FE609322337E70A744270182456145ACCA7CEE090A8DB26817A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433946, "uuid": "71ea75b0-897f-4906-9adf-7ab7f3eb5e75", "value": "6:S8KGgO9lRnvRWL/tNAWNjsl6pdPu8X2RAF18Tf9MoQDkbQt6:KOVvRWztNAWBsl63uG2RA78TfiJob26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433946, "uuid": "1b9ff227-8293-4d27-b8ea-6d176edb3b4f", "value": 247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433946, "uuid": "102690ac-4c86-4eaa-abbb-412a8975b9dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433946, "uuid": "3eeee8ff-e7e4-4159-a82c-1f9a6ebc8f05", "value": "e845a141f674f9a0f2bacb8bf76d0fc5130257537d7490e55d87a23fb8c8906a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40abaf56-1604-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772434294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434294, "uuid": "9e825e5c-3380-4aff-8801-8bc0a36e8225", "comment": "Malware payload", "value": "915ef833141ef2e57cbf7c1b91320ade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434294, "uuid": "cd0d9019-442a-4e93-ad0d-436ba7793213", "comment": "Malware payload", "value": "e8bb69991932216c904ad7e57149f619cc2d76b5cbfe2ce959560bca126d20d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434294, "uuid": "f0f4db7d-8d7d-47fc-8bb6-ebad40c51af0", "comment": "Malware payload", "value": "92717ccb83eb7d72b07e5719a93b65df99a20d88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434294, "uuid": "38f945b9-2020-4b13-a8c4-29a82f38b922", "comment": "Malware payload", "value": "54147aef068bca8998e11710dc8406dbb51d1ce918f92d9153610cd361b5193a8e77dcef953f0fb4e6a42536f90cac8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434294, "uuid": "3d9cb370-63bf-4c70-8a84-52ce02813a99", "value": "T16C52E807F361C93ED8A84374445B4535B37AA814A33203376B5866381D23B649E4FAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434294, "uuid": "a9e47e20-9839-4b8b-af42-aac422abe5a9", "value": "96:RK4uTNvB+B03DoQnoM4FDFp1BL1iIhlROe10oiVXAa3GL:R45vwG3DJR4FDF3p1zhlROe10oilA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772434294, "uuid": "012ff2ce-3c4b-46f6-931c-3d0b39813f29", "value": 14504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772434294, "uuid": "317e7465-796d-4420-9192-ad208c58d253", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434294, "uuid": "72e585ff-a7e6-4754-b0de-59346c42b4b6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12de5c34-1666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772476308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476308, "uuid": "92ddc3f9-6179-42f0-808e-9c3eb2d51899", "comment": "Malware payload (Mirai)", "value": "9211cb79cd1f1d2feef18df047cbb570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476308, "uuid": "e4f61b5b-19ba-4a37-b7ac-a776709b1340", "comment": "Malware payload (Mirai)", "value": "e925b2b7922b98a1605c12c41f79cab73c138ada8cfd75cf60737065eae1f54e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476308, "uuid": "cfb932e8-6493-4275-88f7-3aa31f2b42f5", "comment": "Malware payload (Mirai)", "value": "6b81d44aa6ff748d576ebdb43759cd83524192e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772476308, "uuid": "c264bbe5-1551-48e0-93a0-e8fbce87551a", "comment": "Malware payload (Mirai)", "value": "a2b5ed9ec86d14fc36c6afe4ba2d0346f501a2720c0c33f727e43cf874f63e61ec8a41fdc534a79e6e3fa9c874050155", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476308, "uuid": "201202ae-f8d0-4116-b7b7-f01ad4f982a9", "value": "T18D43F746FA43CF73E85311F112EB6F629D31FEFA2866D582E374BDA099110C1A506F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476308, "uuid": "517179ed-5b40-490e-b919-db99432f5903", "value": "1536:zo5/BzniMnZNWc552Vg3OxjeSzWz85U28:zWQc55UGAZWzkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772476308, "uuid": "4d9d4e39-90d8-4aea-b57b-346821bc97ca", "value": 57456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772476308, "uuid": "3f7e03a1-a4e2-41fc-9520-3ef96b70e68b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772476308, "uuid": "ef229fc8-b194-475d-a1f5-41941aac6943", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2835e4-1664-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772475704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475704, "uuid": "73c96304-c7ad-413e-9d00-b796f020af7b", "comment": "Malware payload (Mirai)", "value": "83c6c727b171ddd2d4e2e394ec98e208", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475704, "uuid": "db8b66e6-abe2-47d0-a5b1-d2b36ef892c4", "comment": "Malware payload (Mirai)", "value": "e98cda86083fba2a54e57b88e49ff6e91dc3c4b1f0fba25daca20cfa95afc919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475704, "uuid": "cb7e698c-c86c-4796-a353-0d74b1a0b0f9", "comment": "Malware payload (Mirai)", "value": "39eda19836c5935a64c9baf1acbbba78213640ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772475704, "uuid": "ff90ce0f-eeb3-4f0a-b3a6-4841dc5cd906", "comment": "Malware payload (Mirai)", "value": "d35046ca72dda035385f5719004044995dccf727c214c08c0ddee82dba80208130c86e4de380f0f6d1f42021d4db1c44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475704, "uuid": "5a21264e-7cd8-4ab3-ac12-cb7bc4199990", "value": "T103936C22FA79193BC4C4A97762F34726F2F6438B24A89A1E7C720D8DBF1465022577F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475704, "uuid": "e18b1693-0827-47bc-bdd0-d079160e635b", "value": "1536:/IOOuLsIgE4zNzO9uIgmL0LNOUxVg6tJlaq5u0qQ7Z5t83Nau:+9fOWAUTDla6uPXau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772475704, "uuid": "2b1f9c5d-e2ab-4f9c-8433-bdb80e4631ff", "value": 95056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772475704, "uuid": "ab773d57-41e3-4470-985b-29409be7f28a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772475704, "uuid": "97f54cc0-af5f-496b-aa2c-2fec153d23f2", "value": "nwfaiehg4ewijfgriehgirehaughrarg.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e23027-164e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772466216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466216, "uuid": "5f9d2712-958d-4ebb-8717-d078b80d8b35", "comment": "Malware payload (RemcosRAT)", "value": "30c054bebadfdbbc9d825cce71f8d172", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466216, "uuid": "8380f4f6-186e-4b12-8fab-8aee5119cb48", "comment": "Malware payload (RemcosRAT)", "value": "eb43e00841b16c0b52cf29386ab25d60c9e33f9634d15de59cc2b8336cafd3fb", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466216, "uuid": "6a66bafc-a3d4-49d7-8c4c-a609c9970a99", "comment": "Malware payload (RemcosRAT)", "value": "31801e98f3f2236ac3d1bf91cbfcf9edd185c94e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772466216, "uuid": "d9c5cc61-5bc3-4e72-b400-2e749f920b9d", "comment": "Malware payload (RemcosRAT)", "value": "3762bd36afcaf511faac24778264212e9fb8ac7a05a352bce7d1f60de0abbfab96e7ed2dd03259d40307b8c78c2b3bf4", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466216, "uuid": "62a7eaa9-433c-4176-9f81-3fa2ddfb30a9", "value": "T19E4513D958D3958C1C7A02F2EF3C75209F7D301A3AA91EFD34C04ADB225958B5493AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466216, "uuid": "3e1ae261-1a6f-4dc3-9c9e-680c0d1e74e0", "value": "768:Q44444444444444444444444444444444444444444444444444444444444444F:XcI5SFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772466216, "uuid": "50177348-ff0c-4d3a-a828-e2f15d120840", "value": 1240064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772466216, "uuid": "6acc2954-91fd-493c-8811-a03c36a0c008", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772466216, "uuid": "76620508-8710-4ec0-95da-e787290ce02a", "value": "Productos listados.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7f2e0a-161f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772445914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445914, "uuid": "41b5fc74-cc23-4c59-af8b-9cf137ed1c12", "comment": "Malware payload (RemcosRAT)", "value": "1819584d648d5b928117bc94c7773736", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445914, "uuid": "573b1bcc-098b-4791-856a-ebbe774248d6", "comment": "Malware payload (RemcosRAT)", "value": "eba7cc03097f2a51ada7e787ee48c728b75cd20ff1fe8c5551df3d3eea0ed808", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445914, "uuid": "ab3d3ea8-175d-4164-96b4-1b15212b3120", "comment": "Malware payload (RemcosRAT)", "value": "35d98a13b3fd0856a349dd54866016970ded0906", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445914, "uuid": "debcaf47-10cc-4f0d-8f99-f13eed8fd915", "comment": "Malware payload (RemcosRAT)", "value": "493a0b6c63c91280200f9d0272c3935704798d2c01b5bd4360a26008b1f5745eefaa3472a9a1d8d7c734e98fd43f8030", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445914, "uuid": "a8bb60ad-287d-4d31-bc3b-de99c7f140ff", "value": "T11856E7C0329099C32A3F1A74EA1D25C3AD4519F7E9F49B4A71863F97B198B01BF346B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445914, "uuid": "0e6b988e-1a8a-4f21-8196-9e66128450e1", "value": "98304:W6hBfgfJNmWKTWV1ArS99elpBoY2SIgtC8fl+xE2cLTlLEKYzbYKUm5cSbIaFYJG:B81DKpZfl0Et7Y3xU8claGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445914, "uuid": "6dfc7a20-a93b-46c7-841d-0937f04377e4", "value": 6246694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445914, "uuid": "27e972db-3c33-478d-a628-aff8e026df95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445914, "uuid": "008af86b-3c9d-4a83-a649-aae69e88540d", "value": "DOC20220513PRELIMINARC0559DOC030273211.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576f16d6-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772465256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465256, "uuid": "44452152-84bf-41f0-9dd7-65c603761349", "comment": "Malware payload (SalatStealer)", "value": "38025a2fce872ef916af6baa3944708d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465256, "uuid": "d1af018b-b6fb-4875-8bc5-235cc394814f", "comment": "Malware payload (SalatStealer)", "value": "ec85cc1356ba022a303ff471f9dbc25d3e382c1dac3cc50445f44e93755a39cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465256, "uuid": "38c244ca-8850-4369-9f8a-033027b20ed7", "comment": "Malware payload (SalatStealer)", "value": "f570898d312bd189ec7828afa289403612e08d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465256, "uuid": "e2092f82-2ea2-4e3b-9035-7594bef9a9c9", "comment": "Malware payload (SalatStealer)", "value": "bd1c5fef098ba6512372817f3c43bdb3d5a04ab96ba1b1d7f8bbe5a67e315e431f1941ce2cebfabc5c8309f2ee8da023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465256, "uuid": "e72c31a7-9405-432d-a1b6-39ae19e97e8c", "value": "T1E2C65A01FA8B98F5E9031835416BB23F63355D049B28DBDBFB543FAAFC7B6811926205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465256, "uuid": "c4771ae3-9b52-48b0-acc3-6b55a659940a", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465256, "uuid": "19a3ad82-5255-4694-85a5-e8df247a7334", "value": "49152:LHsMJ55Q36bKKGpw3F+0hN+pYgcSp1iPylE5iJ/nPNFax3BQ9rMEak+SqpmWAC4p:r7J55AKSi8J/DaxWhV+DZTbCkcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465256, "uuid": "73690951-fef9-4608-a9ed-9a379ebc592b", "value": 11674112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465256, "uuid": "17650027-74e0-4527-a2b6-009ac5277c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465256, "uuid": "a9473679-ed91-49b9-8d13-6d1d85c59268", "value": "vmnormal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189ff700-1641-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772460426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460426, "uuid": "a1bc5129-8b2d-4933-bef7-a51bda708d68", "comment": "Malware payload (Mirai)", "value": "a19482015696b321dd58fa55bfca6cf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460426, "uuid": "572f1827-9f44-4877-9cac-91f1b6bc6b06", "comment": "Malware payload (Mirai)", "value": "ed04e19c647cc9e1f292311ad5fdcb4b3ac3a7681b58e408c0e532749e29652d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460426, "uuid": "2232c553-3d98-42a8-a652-49079e114b40", "comment": "Malware payload (Mirai)", "value": "dad7e17e466e132d38cae98be9b0fbd8afc628ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460426, "uuid": "b07298fb-0b5d-482c-ba68-49b8f251c90d", "comment": "Malware payload (Mirai)", "value": "294d1ad5e3467a082c131be6cc72ee9a5f20130132d5d0b20cb0977ce8958f6b189b4b80c134dbf6bdcdee655e337902", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460426, "uuid": "2e15ef95-ba5a-49d5-bf30-c838c882cb16", "value": "T178B3A50E7E218FBCF7A8C23047F75A21B69D33D526E1C585E19CE6015EA034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460426, "uuid": "ddde3880-59f7-4466-a786-05c34102c4f4", "value": "3072:OHJvgEXn8yTjNpeEeyovwUV05DxwbZnoW:04EX8yTjNpeEbJWExwRoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460426, "uuid": "a57568b0-c485-422c-bc91-6c0c48e64396", "value": 117680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460426, "uuid": "2ef14038-b091-42a0-b173-a48cf25dd404", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460426, "uuid": "5580394e-1491-41fa-9775-befc45a1db8e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29aea0d-162d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772452095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452095, "uuid": "cc64b357-9a2b-4b3e-a4e5-d07e227b3eb2", "comment": "Malware payload (RemcosRAT)", "value": "64615e373f5e395d5b8399a317a72923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "systemcopilotdrivers-ydns-eu", "colour": "#D83C14", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452095, "uuid": "4b76bf4a-b5bf-4427-87e9-63c760977852", "comment": "Malware payload (RemcosRAT)", "value": "ed167c4bf3d0beafbfe5ead4e0a7b14d617a4cd847ad92b885434ec72995b9f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "systemcopilotdrivers-ydns-eu", "colour": "#D83C14", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452095, "uuid": "76055eae-5204-4b6c-9474-1a4bb20bde7e", "comment": "Malware payload (RemcosRAT)", "value": "99eeed18ffbce51324e050f643c3fa4e988109aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "systemcopilotdrivers-ydns-eu", "colour": "#D83C14", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452095, "uuid": "7c8d73a5-0204-4709-94a3-99ed274365a0", "comment": "Malware payload (RemcosRAT)", "value": "c8028f909efb2c0f8584581d338234b168b9c29be855476f58f059470d088669540162a24018e143843b2ac5ae5c8c11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "systemcopilotdrivers-ydns-eu", "colour": "#D83C14", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452095, "uuid": "77aea3a3-8b07-4158-a47e-f3a589bbe55f", "value": "T17EB49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452095, "uuid": "00b571bc-7057-4d7a-86f4-03745969a58a", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452095, "uuid": "eecae260-8427-43e3-ac4a-df31b23a5f7e", "value": "12288:C6pxxGI8gvGOHJpAbDYGxLhZ+sPZtfmPFN:C6pxxx8U+bDYGxLhZtZsPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452095, "uuid": "90d8e9ae-4d0f-4094-b616-c93b222d156e", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452095, "uuid": "062d7a72-0e29-424c-ab50-5c59dc3bd13c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452095, "uuid": "4f58a0d9-4f4e-4046-a97c-f4dd9b0471bc", "value": "ed167c4bf3d0beafbfe5ead4e0a7b14d617a4cd847ad92b885434ec72995b9f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e81fcc-1601-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772433152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433152, "uuid": "d3a77304-373a-48ff-b31d-d5ccf7c34ca1", "comment": "Malware payload", "value": "93477e4de933792f491a71abb925842c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433152, "uuid": "b6b97e27-adc2-47ed-9d83-e12bfce12c17", "comment": "Malware payload", "value": "ef58878a84c80af773e1439ec6debe12b42569f7fc3643c67ce690e9e43b5718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433152, "uuid": "04470d88-8731-4f43-a8c9-c6514eca4408", "comment": "Malware payload", "value": "5246f99e3481319a7da7cfe93618d0ed31ab6945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433152, "uuid": "e4db1f49-358c-4fb1-9364-dcaa11e696a7", "comment": "Malware payload", "value": "8e84882ccc9af8417e26ea58127595619bbe0d54c684fb99d9e66f614b2d54807146332102316e73ebef310bad270cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433152, "uuid": "e9e685d5-7554-4e65-a502-dca17906452e", "value": "T154748E11BA85D032D9A605719B39DFB64A7DFC700FA165C7B3C41EBA8D202C17B36B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433152, "uuid": "ea62ce7c-41df-4f30-8ad8-183bcff205f5", "value": "db06da63173470308be96b80c5e2a5e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433152, "uuid": "d22ac25c-16be-4bac-ab8a-1a1c041cc652", "value": "6144:rlWYc3xnv1qcLU2w70X7ExkEoh2k128kVQhO7aq5Rw:+3TqaU2w70XQCGxUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433152, "uuid": "f72fa4bd-c493-4c6a-a213-a59082954a71", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433152, "uuid": "d1bda9ab-bfbe-455f-a12d-db5c4ae17712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433152, "uuid": "1a2b9b64-ba5e-482e-a19c-aeca3f672c01", "value": "GTAVietUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e96b67b-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433807, "uuid": "6027f6dc-cd19-4b74-b05f-bda8e5378997", "comment": "Malware payload (SocGholish)", "value": "a2429310176703a7706b935cabbfa817", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433807, "uuid": "16baef56-b48e-4eda-8cc4-ef0d4ffc2754", "comment": "Malware payload (SocGholish)", "value": "efa35591f5a9ef13cb0a6cf419e8a69217bef499a9964347018d4eb748d192f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433807, "uuid": "12d80d36-9744-4e63-a60c-7ee1f54f2c3a", "comment": "Malware payload (SocGholish)", "value": "a26907e3fe5866c1c8cab1ae11c66873ed1e792a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433807, "uuid": "98df8fb5-a109-4e98-856e-ad4790a6bb55", "comment": "Malware payload (SocGholish)", "value": "d076fd1846afdb0ad46abc86df7213221a510d480c3ba22a21a84113a3bfce30e51871bdddb2c38430718908047a4a7a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433807, "uuid": "1b94db16-36c8-4554-950f-d3c3c3a09a81", "value": "T1CCD095E3284B141426775DF44777C5DCB0813314201055658823CC14B6209D714063DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433807, "uuid": "8b3bb3ea-284b-48b9-a2b8-0124fdd4af95", "value": "6:SYsCJQjd3AgO9lvYKyuRWJhh8U6pdsG+652SuSg+HG:sCed34AvuRWJ38U6v+oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433807, "uuid": "71a24bd6-f475-4300-9da3-64ab27a9e10b", "value": 247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433807, "uuid": "41b73da9-f6cb-4269-8023-f6927b2615e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433807, "uuid": "d6e37ff9-47be-4434-b993-381c67b4b25c", "value": "efa35591f5a9ef13cb0a6cf419e8a69217bef499a9964347018d4eb748d192f4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f4adb2-1613-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772440750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440750, "uuid": "203d5d16-257a-4e32-800e-fc28e43b1b58", "comment": "Malware payload", "value": "d5de70d82c329b1467a9b463a9286c40", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440750, "uuid": "d1d71877-7924-41f9-9437-d57281234d64", "comment": "Malware payload", "value": "efde52b4e7854277a4511c3ae348aa80a602a2814e18452da3e46c1b12171dfb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440750, "uuid": "22b9bbb5-5288-44d4-ae2d-62b95f36cc92", "comment": "Malware payload", "value": "3a37546e77ab7e049085d2e0166e18cb2792a637", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772440750, "uuid": "0d009fa6-1c44-42f5-a183-a64f6393b632", "comment": "Malware payload", "value": "b0750194de0d02a0dc4616787263e0b5f63b2c2a16b376a01be10d5085ae1c7534121d17d5fa770e735766afd4aaba6a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440750, "uuid": "167bd45a-839d-4acf-9925-296c6da2ed29", "value": "T100F0DDD0A7517C186730DD0ED2C4764602340BF1B95CBD3E9AE09AD60FB99C33187794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440750, "uuid": "c0a9638c-2688-494f-a198-5a8db7c9237f", "value": "12:8q0HsOt1VvhsYf2+AIfQgc/jveZEMTT3WykYV0VyVIVs6X:8RHsOt1xh1f2+AKQgcLveZ/T3/JmYCSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772440750, "uuid": "ec3473fc-36c7-423b-8b1e-41d8c126c928", "value": 609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772440750, "uuid": "b4fd4d66-2896-41c7-a58b-e3b846811486", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772440750, "uuid": "5da67060-db73-484a-831f-06a3cd9e9302", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2349e6-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433936, "uuid": "f814f783-b067-4865-a628-641944decc2c", "comment": "Malware payload (SocGholish)", "value": "b3ce16d2d432af1b91c7c41f8f3f6561", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433936, "uuid": "9c172df8-e744-4930-9ebf-1b3a62dd8dae", "comment": "Malware payload (SocGholish)", "value": "f08edf14933e29ea8ecd527211d735e80e4277d29a64dcadcb59b5d44b05c15c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433936, "uuid": "4c91717a-4420-4ee9-bd66-f0b78a2e53c4", "comment": "Malware payload (SocGholish)", "value": "6921b7b4c22bc3c7b1a0d728e6f47228ff824618", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433936, "uuid": "dccb1f51-7f11-40e4-be1b-03dc5d66971c", "comment": "Malware payload (SocGholish)", "value": "52c15b060d1c89762075b81feff482d9fa08fec50c6fded082af24551631b8dbd18e55242931744f9a54668e5955705a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433936, "uuid": "be2b18e7-dbde-4ebb-9fd1-d6070f204e4f", "value": "T189D097AE7CC640011F4523FD3237CB3DB40B3228A2188210FDBDC4848320AE90AA6A4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433936, "uuid": "5510e02f-01f8-438e-8df9-6ff6c9125cfb", "value": "3:SdfsINwAyXggO9lNMDoRWEGYPXuNhJO8GIRXGX0x2OCCrKBnx8LRBk6DAcVQlPdV:SkwgO9lkoRWpM2m8GIdUO5rKCl/DA/im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433936, "uuid": "7e95da00-9d2e-40d7-ac0c-b37b267b4f54", "value": 243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433936, "uuid": "5bbfc352-91c1-4171-ac80-d36b43bdecc7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433936, "uuid": "3bc946cc-0b4a-42b9-aebb-e15fc408f784", "value": "f08edf14933e29ea8ecd527211d735e80e4277d29a64dcadcb59b5d44b05c15c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755a4472-160c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772437818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437818, "uuid": "b4e55505-9a61-4223-8c81-6d165e1634fb", "comment": "Malware payload (Mirai)", "value": "80611716450641089d0058418178c007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437818, "uuid": "b9f61423-367c-47dc-8290-9918f720bd86", "comment": "Malware payload (Mirai)", "value": "f1a9662ad682b7bb827f8baa6e9a0fa40738472c6603f9b4c2bc19e24b906377", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437818, "uuid": "7a6d82d4-8954-46dd-977a-efa0be30ec81", "comment": "Malware payload (Mirai)", "value": "2abde8e2f82d03bdeea8530e0660030e63a3833a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772437818, "uuid": "acbf385d-6f3c-41c0-9fd5-9c5c3cd0f88b", "comment": "Malware payload (Mirai)", "value": "edf9d610a600bcced30f0cdb468ef48eb4a5f936f91acfe5b78b59a78cfb6c3a30f3c2c9e09c1553a990b7126f70c55b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437818, "uuid": "9c28916d-610b-475e-90cc-1e5e13c52bae", "value": "T192635CC2A643D8F0E81A0772123BEB22B7B3E5391138DA96C7957933ED55B02D5473AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437818, "uuid": "203f2bec-e047-4d32-b4bd-5855590e98f6", "value": "1536:1JKeZ/GmJ+Huc3v5U0AChyMw6fB4Ea9WsiM6wbZn5:1JKeZ/GmIHuc360ACsMrfar9uwbZn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772437818, "uuid": "32735974-8eaa-40a0-a244-06db07d93682", "value": 71924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772437818, "uuid": "e960a18a-61f3-41ff-83cb-fc94b52210d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772437818, "uuid": "04cfc14e-7db6-4326-a6b6-4a34bf7bc0d5", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2cd8b8-1626-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772448891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448891, "uuid": "7fa76928-9d18-4063-a3a2-a8691237d866", "comment": "Malware payload (Mirai)", "value": "987045adb4cd68d6c4a457939a2dc8a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448891, "uuid": "2ce68d16-4059-423d-ac46-dd28029ddc6a", "comment": "Malware payload (Mirai)", "value": "f268f841d396d4e316176f681f24016dd4b51f4178372f53ee7b7a8703823edb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448891, "uuid": "bb5d36de-a4bc-445e-aadb-ad9eee5d6313", "comment": "Malware payload (Mirai)", "value": "41f63498e975e5b86acf0e6743b843f39388cebe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772448891, "uuid": "885a091e-51c0-42cd-a039-e5ef539a446b", "comment": "Malware payload (Mirai)", "value": "6d9f9d686d7eb7d35e86ac80bc5755e5ed98a74b1bde00df1da3b0eaffb37fa5eaf26cd3fa2a5f638671874ee3389bba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448891, "uuid": "85e22f5c-2a4e-4685-966c-4c6940481b5e", "value": "T122E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448891, "uuid": "a570cffa-c332-467e-8f19-572a3ddbf038", "value": "3072:JW6dm9tS1aRGQdK76t/zCaI5mrThPaLEnvPrNb:c6IG+LCLmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772448891, "uuid": "33922271-7d8b-454f-a920-92729e0b85ab", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772448891, "uuid": "43876329-88f2-4097-82c3-0413a74cb72b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772448891, "uuid": "396f8147-727b-442f-b4ae-ac257f4e1e32", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e825e55-1680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772487521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487521, "uuid": "4e0e80e4-f171-4b6e-8c41-cb55be3cc72b", "comment": "Malware payload (Mirai)", "value": "7f3d6f32970fff44c3af6089c99882f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487521, "uuid": "214e9da8-5486-4907-b24a-83de267e9069", "comment": "Malware payload (Mirai)", "value": "f28ab7cd7c540dfd42a2996e3438bb547f290efc8e84d418a875019b26c186af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487521, "uuid": "3cd70473-d86b-4c52-b9cc-9b24a29db526", "comment": "Malware payload (Mirai)", "value": "a1ad8b6123d4e09ce1794a52c7624b21a688edc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772487521, "uuid": "d1b8c5eb-b2b5-447a-869f-d843c0c7d069", "comment": "Malware payload (Mirai)", "value": "81b89270652095433fb4c0ec19a384b227384beacb8e3228cf6e43a05d770e66c7211c508959d43ee674f0a177432d0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487521, "uuid": "8725f721-2ddd-4000-9acb-5fe8cc4f0244", "value": "T154E36D8AF4019E7DFC4BE57E44670E09E931A3A13143172E52DBFEA3BD321A64D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487521, "uuid": "64242797-01eb-4e28-b2b8-15ae3c2211a8", "value": "3072:PcDl4ys6ESmF2CXtX/d7XDFP03OPm9RZBVghUG:BDSmF2Yn7dxPm97ghUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772487521, "uuid": "7457c80e-d8c8-4bfc-840c-9751c85d94f4", "value": 147332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772487521, "uuid": "bb574a0a-4469-446f-ac60-74537e4dd0f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772487521, "uuid": "0a7e54ed-31b0-460d-bdb2-bafb0b08c968", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fef1162-163a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772457647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457647, "uuid": "0f33b536-a04c-45a6-a8fc-6de419ed23f4", "comment": "Malware payload (SalatStealer)", "value": "c8c0fffeef868b1a8c775a93cc653bff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457647, "uuid": "59361d1f-0b9c-408d-9a3f-28edfe44e532", "comment": "Malware payload (SalatStealer)", "value": "f352c3d2c9eb887f778388c75204b8380f361bcb617ae0b0e168f4b3f6b18deb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457647, "uuid": "103dae8a-8b80-4882-a657-326e7ac96b3c", "comment": "Malware payload (SalatStealer)", "value": "871e0332068e16c817eb6b0ad1fce9da412fa9d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772457647, "uuid": "641bdd25-3716-432e-8fd6-1a06fa339253", "comment": "Malware payload (SalatStealer)", "value": "921b0e736596ee98db81309d5e7fa4e6622eea73ff709a794a06d2950daf71b2159d677b8afaee0adbf8354ebcd0d925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457647, "uuid": "bfc1fe3d-ff15-451e-8996-2dbf73ba084d", "value": "T18EC65C41FACF98F5E9031835505BA33F63315D048B28DBDBEB547E2AFCB76921966208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457647, "uuid": "93931a45-39cf-4dac-b69d-b654bd26ff57", "value": "49152:DqM7vkTWaGlZQYUL2hIrgt2g4y5LMLz4wAvTvsveqFxNtAtQ/ujOcWyklw+Emp8l:mwvkToQCcSUeqzAtQ+lGwib1OeOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772457647, "uuid": "67f9980d-fd1b-4e34-b440-12861118ab50", "value": 12112384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772457647, "uuid": "101b1b02-13cb-4f07-a63c-504050790852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772457647, "uuid": "668d0795-80fb-498e-8c72-dafe0976166f", "value": "9w9aw0j.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625fb980-1656-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772469569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469569, "uuid": "054f45af-c712-47cf-adeb-310d827af638", "comment": "Malware payload", "value": "193746a66c64e4f1404282dbac0d240d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469569, "uuid": "fcd36ebd-7423-425e-b663-39a61ea90e23", "comment": "Malware payload", "value": "f40f3cd91f0cbbab578a64ac279ac9920ee8beccfb2cbe6bb65f46b0111c1f6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469569, "uuid": "f3814aae-43f7-4516-aea5-deb8cb936712", "comment": "Malware payload", "value": "62bf300622ba14c880d44a00e932082241a167b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469569, "uuid": "76efaeb3-cb0a-461d-8c52-5c3713c1ca2d", "comment": "Malware payload", "value": "ac6994bdb014ee0ae8f561f3637d42b999c3767d93fe5330642b39894c180062609d5784d1142585c133d3e8ce4f2675", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469569, "uuid": "731c0e74-312e-44e5-bbe0-dccc01cde58d", "value": "T1EE459E56A7A841F9D0ABC178C952460BEBB2B415137097CF13E48A6A2F23BE15F3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469569, "uuid": "ad3c99ef-0919-4535-b03d-a742b36ade9e", "value": "10061943f2331ead0e46ebd6e129974b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469569, "uuid": "06e11206-050d-4797-8b5f-7fcf224ffd20", "value": "24576:EsF/gipI0kyfUyknNZVtpPbRUjxEAOzY4UPx/7DuP+xQk4cvV9XLTCh0lhSMXl:DkyfENVpPbuYzY4UPx/7DuP+XzHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772469569, "uuid": "159d6ad1-7af1-4da8-b722-3ea5c2743fcc", "value": 1247744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772469569, "uuid": "cd72664e-6004-43cf-918d-f71f930be6bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469569, "uuid": "a49e5dc7-ee72-4633-9955-03314057242a", "value": "f40f3cd91f0cbbab578a64ac279ac9920ee8beccfb2cbe6bb65f46b0111c1f6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d724d5c-160d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772438315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438315, "uuid": "254fb1ad-ffcf-42e5-ac23-2335b64f7010", "comment": "Malware payload", "value": "b77476264e95e2b60d1f4c0babc3f179", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438315, "uuid": "092d333e-457e-4757-a0e6-f55496697dec", "comment": "Malware payload", "value": "f4e2293c67c35fcbf4b07e37f6839f6fafdb52c2eaff9a435cf93e83dc331b65", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438315, "uuid": "c482fbc4-e2fe-437c-8e7c-725b884a1cd5", "comment": "Malware payload", "value": "f04a5a6e9205865902b19e85cafa6bad84442109", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772438315, "uuid": "7fc593e8-b37e-44ae-a3c7-e1e3bf5926fc", "comment": "Malware payload", "value": "8ccee61f6d621020b8894fb8ed768fab9d5474e49b32f8691ed1025ca00d276da9802f1c685ffcc27655fc2365b12a4d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772438315, "uuid": "d44f99db-00a6-46ab-ba82-466d0365c8f8", "value": "T15BD39E51B580C072D97E19380434EBB15F3F79B0DE60DD9BA7581E798E302C1EE26E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772438315, "uuid": "9bb2bdbe-5658-4664-911e-a427365b99af", "value": "1fc5dab6d287ba68c9efde7acf57753d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772438315, "uuid": "d346e196-f6c5-45f3-b7b4-2b52e57997e7", "value": "3072:E4MkAoFhlCGnH+QScRSCYjvFkKFbNds3sbDp:E4MNoFq2e7cRjYWKFbNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772438315, "uuid": "ea2d2360-79cd-45cc-8d8a-c7c574ec458c", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772438315, "uuid": "414df0db-ac62-436c-83b9-05c5b2032813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772438315, "uuid": "88ecbd59-acdc-41f5-ab5e-eb49a50b3fee", "value": "RBGUIFramework.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97eeeb6d-161d-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772445178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445178, "uuid": "9d7304be-6c58-4bce-9998-fe0ac7394b90", "comment": "Malware payload (SantaStealer)", "value": "d1742a2c13c38f3cc29a23eafbdddcf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445178, "uuid": "bb18af44-af34-4640-92c2-62be5be550ce", "comment": "Malware payload (SantaStealer)", "value": "f53d493686ad5e22de411f03c6bce47ca352945f891052b4761292966fba826f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445178, "uuid": "7c0c20b6-a0a7-419b-a425-2f9c469a9b95", "comment": "Malware payload (SantaStealer)", "value": "d124179c6738cc5ffeccd9a84f6c61725438a871", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772445178, "uuid": "1c74b250-2d2c-4816-b400-5509a4faf3c4", "comment": "Malware payload (SantaStealer)", "value": "6e950b7b1887c5a09551916ebea1b0cc7dfc49c5b0e4ace5ddb93abf83947161ac4b55635c41b533e7891dad5cb6af7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445178, "uuid": "53c039f0-f819-40e1-a2ae-3ccbf2084a50", "value": "T1085633F72BE60C05E6D4F971E4A73287C5B51C259AC6832C57BAE20036BD6F04A1CB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445178, "uuid": "9c08edbd-ec01-4576-b91f-02de8278f185", "value": "e4e7c560e86639269dcf5a60c8dbca8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445178, "uuid": "654f3c07-69d9-49cc-b725-629c5d8bcdb5", "value": "98304:Scs27aEcstF2PJLqZgu3wLNydV7UIfwD5lmwB7n27wXvoZI8w4umKR4:Scs7EcWuFq9KNSlfwD31p27EQZjPQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772445178, "uuid": "0e4ea781-82be-4194-9c9f-a7af95c10a47", "value": 5988352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772445178, "uuid": "4a24754e-9a27-4844-92e7-214f6085ba0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772445178, "uuid": "3527fc6a-2a6b-4d4b-9fdf-13f93f42028e", "value": "zCg4Tsb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5cbc33-1602-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433720, "uuid": "fc51fc2e-2d99-43df-a0da-4fceac4969f3", "comment": "Malware payload (SocGholish)", "value": "25f3b75ffa92690786e14cef81ada155", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433720, "uuid": "1f195edc-598a-4b38-b77e-7cc687044621", "comment": "Malware payload (SocGholish)", "value": "f586679d3b8239a2cd1674997fa8bf6f0b81381ba23f1934ccbc10c6b32e6e9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433720, "uuid": "8bf1f9dd-a869-4d21-920f-cf777c79fcc2", "comment": "Malware payload (SocGholish)", "value": "c5a50044f1daf9907000dd4fd451c5cb39e78fde", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433720, "uuid": "2c6fb33b-5c95-4d1c-8d90-8c714790f897", "comment": "Malware payload (SocGholish)", "value": "6f70d6f9fa68040b9739a5ad970b34bb614aaff57e97c05921dcbfcaf55551c79af1dd84a276bd4aad482370d64c8ce8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433720, "uuid": "2b29c904-7b50-4571-bc0f-6f47f2cddc8c", "value": "T191D097BE742C10084BB932257472A30830E165A832900D36842E943C4400B924A1D28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433720, "uuid": "ebe31902-54f3-4fc4-b5e7-9f987c1d9239", "value": "6:SsLZgO9lZH2AxRWDNZ1eZhKGIdYdWyWXLuKmtTrw:zbQoRWxyKgIrXLudQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433720, "uuid": "2dcd04d3-54d8-4fc8-844c-0c393311d3ab", "value": 236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433720, "uuid": "fa7f2d91-34d7-4ade-ad65-1e70152f0412", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433720, "uuid": "d807d646-1a9e-455e-9c74-b109dfba86ec", "value": "f586679d3b8239a2cd1674997fa8bf6f0b81381ba23f1934ccbc10c6b32e6e9c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04036db1-1647-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772462969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462969, "uuid": "fdad9208-9b14-4623-aab2-1d98b6188ac5", "comment": "Malware payload", "value": "36d941ed9bb71d4f3947ab11db2cb386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462969, "uuid": "535b88ae-e981-453f-b8a7-1f0c116a5eb9", "comment": "Malware payload", "value": "f68a3d90f36ac83dedf1e074287e8fd663c4049fddc628b89a23545c0cf732ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462969, "uuid": "2756a784-b3c5-472c-971b-26ecd3b9785e", "comment": "Malware payload", "value": "15643b12e43a125d68edfc5b91195366c0422354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772462969, "uuid": "723f0a50-dbdb-4bee-ae84-f2e6b93b0ef7", "comment": "Malware payload", "value": "144d99f3ffa57c1668387ce009ba8ee4473352c86556607f71ddb3c731381147c02df09ff3d3fca5c080e474f60551eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462969, "uuid": "84304e49-08a9-4028-b2a4-ca234555a8f8", "value": "T141B6122BA264652EC3E606318F72D2704B7B6D6D64168C1B07F07D0BFFEE4631E2A651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462969, "uuid": "80e90410-62d6-489d-9847-a11c5bd08d71", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462969, "uuid": "96e7aa8f-414c-4a1b-91a4-d124793db8bf", "value": "196608:52BWAOmtQlQwCQ8DtfDF0smWN0Ic86sfhh/KMWcKjdK52ADvrl3:gBWADtQ9X8ZrFmu1Jh/KXjdCDTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772462969, "uuid": "6af45011-8fcd-448e-93ae-798566853412", "value": 10677080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772462969, "uuid": "9b27ce6f-4ff8-4108-8112-eccae826b56b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772462969, "uuid": "049a87c7-89eb-4683-a1e9-7fded5a47e12", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383b54b2-164c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772465204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465204, "uuid": "68317eff-ac94-4492-a68a-2eeda79513e6", "comment": "Malware payload (SalatStealer)", "value": "8fb8cf6ae40a469f19ee0ce54d99d337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465204, "uuid": "dd740da6-1111-4c8c-8499-d64b98d22ff0", "comment": "Malware payload (SalatStealer)", "value": "f77a09d39e36c4ee55fecd79884fcc1e61a99e6ef3bca54b110f01b5c0cd8571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465204, "uuid": "ee8f9f01-c68d-4865-8f78-f149152eb036", "comment": "Malware payload (SalatStealer)", "value": "8a78631b1d9aff3e00366c15775dfc1c804f24f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772465204, "uuid": "e710d156-4a8a-4e11-9b19-20e490a9e011", "comment": "Malware payload (SalatStealer)", "value": "7e82bf84a98d28754aa0cddab0b671b3f72a8547b6c198c3a98442c5ceb13279400a36b3f64211f754ee609d8439ea4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465204, "uuid": "d833265c-4707-41ad-9599-727a5592eeaf", "value": "T1B5C64A41FA8B98F5E9031831406BB23F63315D049B28DBDBFB547F6AFC7B6911966208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465204, "uuid": "aecef86b-e526-402d-8ff2-ff47c86433fe", "value": "49152:JHsMJ55Q36bKKGpw3F+0hN+pYgcSp1iPylE5iJ/nPNFax3BQ9rMEak+SqpmWAC4C:Z7J55AKSi8J/DaxWhV+DZTbCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772465204, "uuid": "11561eb5-c18d-4f94-b3c2-96ca8537f55a", "value": 12120064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772465204, "uuid": "ac787b7b-e65a-4049-b970-88bb6a127372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772465204, "uuid": "0c3e62c8-56ea-47d1-a810-2df1e4a947ab", "value": "TEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00daabd0-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772433758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433758, "uuid": "79d20163-fd13-4ee6-a544-4bb42abbe8b8", "comment": "Malware payload (SocGholish)", "value": "a0eb6015484e93c392b91e80d544a5e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433758, "uuid": "29c2edbf-f5ab-464c-b1f2-e612006cb386", "comment": "Malware payload (SocGholish)", "value": "f88ca1f50185ef5bd10810c33d3506a6d11f71e86fa2da19fd292000220f9220", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433758, "uuid": "2e0b72b8-ab23-455e-ac99-379715e44f36", "comment": "Malware payload (SocGholish)", "value": "984a6e43fcd99b19922c6ce7709de78b33f9d4f2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772433758, "uuid": "489bb3a0-93b6-46b9-8168-0e72c4ffc4e1", "comment": "Malware payload (SocGholish)", "value": "80e09e20036f85da53bb1328729488824d64baf8fd0aa5b53e0ceb56311f5f3a7e6571d429fc37108e5769aad3d71e76", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433758, "uuid": "70ff03b6-d6c7-4b7a-91f3-e38eb02a9e79", "value": "T1B4D095BD34280524D7F6ADAD477F6504F00F190018031957CD9AC972502BFD3045968C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433758, "uuid": "884640af-0ff7-4e1a-8e32-07a22595f2b1", "value": "6:q7X74wgO9lRRDRWL/tMo/ke6pdHEso8I4ipXLMKPTT2:IDfDRWzt5ke6cs7cM++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772433758, "uuid": "17f51166-06c4-4ca0-b5d1-4e5a5c1816f9", "value": 258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772433758, "uuid": "a094ade5-8fcf-40d3-ac7e-0e5367d39b9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772433758, "uuid": "ab944cb0-4d51-4943-8dee-4441786c8399", "value": "f88ca1f50185ef5bd10810c33d3506a6d11f71e86fa2da19fd292000220f9220.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53aaeeb8-1611-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772439909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439909, "uuid": "6f0735ac-3f53-46b3-a549-c49ac3e3a54f", "comment": "Malware payload (Mirai)", "value": "a396f47438be17a31a87c20a19ac7787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439909, "uuid": "c98820de-93c6-4452-8767-febb71ddb796", "comment": "Malware payload (Mirai)", "value": "fa6eea7d6c31866de0d6084a4928b56156786634c0b0007a6234cd06eae49c40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439909, "uuid": "36058904-589d-441c-89e4-c1f22159338a", "comment": "Malware payload (Mirai)", "value": "a43ecb78170887164a5c97ab6b33d48034f95bd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772439909, "uuid": "82bd5038-5d6e-4e34-b42e-906149ab824d", "comment": "Malware payload (Mirai)", "value": "59e34d005c4515ac3b8a5a58e8f67567dc7109481cea7701a65e6030dc8c40a6fdf2fce28389eb2e719d6dc96c68e84b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439909, "uuid": "5254129a-06c3-4b1b-a1a1-aa6959a1e70c", "value": "T1C1835B22BD391E27C0C4A57B22F74665F2F6078A25F8CA1E7D621D4EEF2461022872F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439909, "uuid": "1d290131-9b7d-45a0-abd5-89deccfa7b0d", "value": "1536:TOdkMSZw/QAb/Z+is3Vw+H/G2t2t9oM5DuWd4omGtvpVJwbZnDH:SOq4is3VwC+2oLo8DuOXpLwbZnDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772439909, "uuid": "2339db3d-5f0b-499c-81d2-7403cf3558b0", "value": 88336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772439909, "uuid": "34f6eb94-963e-4d14-ba49-61ca8c81160f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772439909, "uuid": "33c24ceb-b051-4346-a491-8d7d79677577", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4413166-1603-11f1-a769-42010a9c0008", "comment": "Malware payload (SocGholish)", "timestamp": 1772434032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434032, "uuid": "ad87ceeb-4129-46aa-8cbb-4a523e4efaba", "comment": "Malware payload (SocGholish)", "value": "bb959c89922c3ef6be5105742ea7b94f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434032, "uuid": "ef1b893c-9426-48b9-9944-b9369bb25e6b", "comment": "Malware payload (SocGholish)", "value": "fce0b35eb3fa3db05e5c6532705758a8669d5bb6fc1825175c0ee67bbbd38862", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434032, "uuid": "9c5be86c-cb13-45a0-a177-9aa9df7612a6", "comment": "Malware payload (SocGholish)", "value": "f84192f30b191f701e9143e6fa3c0ff04e244ac8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772434032, "uuid": "b60b4d48-4620-4931-aaca-4a4f534bab3a", "comment": "Malware payload (SocGholish)", "value": "465fa387ecbeec9cc1f36dad75ce3607f1a2128595787d3e4517829bcfad2ccf576f7ad9d3c92c67bb51ebf7d20b80ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434032, "uuid": "f796ac4f-f10d-472e-a48a-f34916135e62", "value": "T168D095F4394E651405496024DD6755283021309864A4647DC835D58CC410FFB055B48D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434032, "uuid": "7d67edb2-ad69-40b4-8788-f7f38f1c7eaf", "value": "6:SocmggO9lhYuRWmyQmukuM5N8GIdgTByMwgqhQlnlEB:sh/RWakCWy8qhUGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772434032, "uuid": "592360de-299e-4a51-9966-b935c494c1b0", "value": 238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772434032, "uuid": "4cebca57-06f6-44da-916b-9995ed7f6626", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772434032, "uuid": "05a05454-63d2-43d3-8af1-8b7cc6f0be05", "value": "fce0b35eb3fa3db05e5c6532705758a8669d5bb6fc1825175c0ee67bbbd38862.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee4ad95-1640-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772460061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460061, "uuid": "521b453c-a624-4a75-a89a-193a1aa62305", "comment": "Malware payload (RemcosRAT)", "value": "d3841b28896309390c9b125ff6edd2ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460061, "uuid": "940276f6-08e3-4760-b886-7405dd678393", "comment": "Malware payload (RemcosRAT)", "value": "fd049aa61dbc6f9b398dee00ff9e2462e8cd32d2e9578d671ee971c60c883d6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460061, "uuid": "3e7d9e26-7e91-48a1-b178-725e6fe916b3", "comment": "Malware payload (RemcosRAT)", "value": "644b3c5ba8cd07ec4473867b558ed07abeb43735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772460061, "uuid": "216101ba-57af-426e-90eb-57e537b77ba4", "comment": "Malware payload (RemcosRAT)", "value": "d5d4e13e85b9d0ba2ae93c517c8db888184db46848b2c27607700fac9fd96417a324ca0e5a0e23a50ff27d1e87ab2a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460061, "uuid": "1a85a1d1-b8cf-4406-9aa2-7142a687738f", "value": "T1DCD22F8A7DD5F26003B650336E3FB25AA53EACD1B94DCA88D3B49054F969308D1F1B78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460061, "uuid": "76e6586c-8533-49ff-b000-54541378b9a7", "value": "384:kinwl2sPQJQucbG213u8rM4R8uKkbQUgU6ZfZQAP7GXQtDGJpGRcmArP8BNi8aSK:k4022QmdR8uBkUg1ZkXNwoToi8aLW/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772460061, "uuid": "91220923-0fc4-4ea4-bfe1-f663d96ba32f", "value": 29505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772460061, "uuid": "099475dd-ca3f-4e66-815f-e66247f2a961", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772460061, "uuid": "da550047-ceb5-4633-87da-6e5982673b19", "value": "attached RFQ BS-00151.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a65c286-1601-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1772432941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772432941, "uuid": "9555180f-b87d-4284-b7e3-dc621e02e89c", "comment": "Malware payload (CobaltStrike)", "value": "6b682b402e876e30f408d6a9f66aefcd", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike!rfn", "colour": "#87B2C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772432941, "uuid": "70432599-6851-4762-8569-7d36b9330f19", "comment": "Malware payload (CobaltStrike)", "value": "fd3c02351b6ae032ec3a13134f0720b7743906fda41484d51ae37074f0d29e58", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike!rfn", "colour": "#87B2C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772432941, "uuid": "cfa1226c-1cc0-4c34-a1c7-1ac932e2f57e", "comment": "Malware payload (CobaltStrike)", "value": "129cc14d9f9daaab366c3e0b33b3c8a21560cf66", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike!rfn", "colour": "#87B2C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772432941, "uuid": "87367e69-f3c2-4f59-b90b-7c53f6a59875", "comment": "Malware payload (CobaltStrike)", "value": "85593c767a047c301642fcfbde6bd13a2d09e4a488879253a1d469a9e67038d7e8faaf5078bcdcee9a89d5b1812f7389", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike!rfn", "colour": "#87B2C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772432941, "uuid": "4665cb4f-9178-40cc-89d0-c7970c74c737", "value": "T1FBA58C0FBCD108F6D0AA9232886666927B71BC450F3227D72A90B3BC2F76BD49D75354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772432941, "uuid": "2a8d60ba-3395-4fcc-be4f-c0bb5fed9f40", "value": "05b2335e3732f5f424e17dd923547d42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772432941, "uuid": "a9d30b97-20c3-4e43-888e-a91531e4524f", "value": "24576:dmb0tQ5nsDnIxCbvyI5xUxu4Ggv0uw4uPSH/+7vR8MJdMxGnPF7+3WZQvC7J5Qz0:cg+5nYGIEx3v3yZ8M9PFVB4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772432941, "uuid": "0ddad53a-2bfb-4196-9a6d-c29b454106da", "value": 2136576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772432941, "uuid": "d3cd1b1a-adbe-44b6-aca2-25c1d3e71221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772432941, "uuid": "2307b31c-6aa1-4fbc-8354-09e7c6cdff8d", "value": "ssmagent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a06f8b-1656-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772469578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469578, "uuid": "36351ccc-21e1-47c9-a829-2fb104484d62", "comment": "Malware payload", "value": "267d79245d4bbef2e282b2497ba9d6bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469578, "uuid": "abfcf77c-a594-4114-a14e-92a56364db1a", "comment": "Malware payload", "value": "fd833679ea33831a761cb3f2412e63d2745ecf5a0cbd9193b4bef2b5f3539f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469578, "uuid": "86c1b05b-36dd-4d78-a65a-3fc3e4d3b228", "comment": "Malware payload", "value": "82b979cd4c898aa1919fa094adfaf7d84662aaf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772469578, "uuid": "b663de4b-51f6-4ea3-b9ed-8a8254846301", "comment": "Malware payload", "value": "8b3f0da063aeb12d5d83b7235646644cf7fb8341b4300a39e2c4b08f1bed0738202ab64f908e8718e821cb38dc510580", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "puzo-monster", "colour": "#1EA491", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469578, "uuid": "c47d6e34-5ff5-4ae9-b818-ccc91c9d8dd5", "value": "T167459E66A7B840F9D1AFC178C9524607E7B2B445136097CF13E48AAA2F23AE15F3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469578, "uuid": "f19ccbc3-c06b-4af5-8542-eea0226749a2", "value": "a21161adda12d436de4ed9210ace2276", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469578, "uuid": "e89d4479-13b6-4bdc-a86c-caf7040799f1", "value": "24576:bV1d6+rOeGwz3lVSw5NRGytZHPsu87A3ISajElV2gXkchX9h0lhSMXlc9av0:U4OetzSwvXZHPsu87A3ISOxgnhE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772469578, "uuid": "a2652f31-36d6-4c9e-9360-73d8178d4f2e", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772469578, "uuid": "d0dc09b1-f328-429f-92b4-00550c086867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772469578, "uuid": "23577a4a-f680-413c-a1d4-00c04f57b2ac", "value": "fd833679ea33831a761cb3f2412e63d2745ecf5a0cbd9193b4bef2b5f3539f72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f310a8-162f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772452664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452664, "uuid": "2dd7e01f-1cf9-4c57-963f-8a71be8965be", "comment": "Malware payload (Mirai)", "value": "38eb6eeeaa3aa4fc475f90512158c17b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452664, "uuid": "e637c06f-3058-48b0-9ae9-e5ae4da4eabf", "comment": "Malware payload (Mirai)", "value": "ff5f8087afeadcf3125f99a2272494f85caf1d6905114a63f10d10794c484b2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452664, "uuid": "67ae78d8-1bb2-4e33-bf75-13c2c4226da0", "comment": "Malware payload (Mirai)", "value": "4b6aec069259cf512f6399504af8f6d7cf25ce69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772452664, "uuid": "09009d7e-7550-4bb2-b35c-58208ac8970d", "comment": "Malware payload (Mirai)", "value": "3a65b8c530ba184dc139555932f8250e5d46bb93623cc8b412ad2a131bc9fc850d4e28c81f71230f583e161d5103b1cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452664, "uuid": "9ab17c25-2bc7-4d63-8a21-8854b1c4de62", "value": "T1BBA32A86BC819A11C6C51377FA2F108D330267ADF2DE7262CD151F647BCA81F0E6BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452664, "uuid": "d94a20e1-b3e7-4667-996d-83dee63a986a", "value": "1536:4Nnr0vpp/rFFSHs6h/d43AtnA78bPiqimKF/yqtBiJ70q5duUndOw7nizCIGiHmn:m0h9FEHztfNDbPf9waYq5MUnjghZmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772452664, "uuid": "bcd0b5b4-7a3f-467d-a4c4-d34108f03a65", "value": 99632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772452664, "uuid": "d57c60d1-375c-4e09-b43b-3b28c60f35c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772452664, "uuid": "c6b5977b-1686-404b-b608-5d2b2e0f649f", "value": "MMaaRRiiOisecTanee.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }