{ "Event": { "published": true, "date": "2025-11-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-23", "timestamp": 1763942582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e0684027-93ab-4f44-b67e-f5ca12f637e9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055ab7fd-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889357, "uuid": "a9428922-fc78-494c-9bb2-1d5bea8f2a32", "comment": "Malware payload", "value": "c2aa05d5f686b084e5f7f5484238ae42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889357, "uuid": "31926521-4819-4867-afd7-f3294ee8afce", "comment": "Malware payload", "value": "0004e4f7811297f65d9f82d13f36e6400c02b4d7e63951867fc6d1f1daa706b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889357, "uuid": "0ff9c8a4-0059-417a-81f6-071eb72da2ef", "comment": "Malware payload", "value": "7eb02c5835ed1874d59e5f3c9d4e09ba569ced00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889357, "uuid": "6df725c7-be8f-409c-a4af-3722147ff796", "comment": "Malware payload", "value": "60404ca74261d19fd89e214166b29e3fe42a44cdfffa4c0786a20e7e852b930503f5ca8068ecaa8b78804aa49f505182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889357, "uuid": "fe42c495-a823-4558-96b7-6cca1841dfbd", "value": "T173C34A49F616C1BCC938C07BE1A0C1B25F181EBA54BBCB7B35663E672EB97410916D32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889357, "uuid": "15e5a70a-8694-4ac6-a49a-618eaf1e20b8", "value": "e029f98a2da83608852f59fa44f95f0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889357, "uuid": "9b4502e7-d26f-4110-9b82-3af6b98f6c3d", "value": "768:/iZNZiZNPp0b5BbrMVUTBv6mkZ8jA7IwnDoSdC:/WNZWNBGBrM6Fv6mkqyoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889357, "uuid": "4e104b39-7fb4-4f41-9ac6-ab5db88daeff", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889357, "uuid": "d1d8f4c5-09f9-49a1-a385-412d5a2ba91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889357, "uuid": "814f6200-5444-4bd5-914d-7b7b1097715b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f1b0c8-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889358, "uuid": "1181b8e4-7514-4c00-b6a7-0a5d57aa93c6", "comment": "Malware payload", "value": "a4937ec1d4447a4bad23309d38aa8d5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889358, "uuid": "dabf84f6-8b9a-4fa8-ae13-1913c046765e", "comment": "Malware payload", "value": "005f064451bcc7b0afe52b7261f8de8419149987d4ab9eb46982d0dbf65dc7f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889358, "uuid": "a7b61a6c-0d89-4607-aa6a-b2d55bbd508a", "comment": "Malware payload", "value": "c34b6aee2aca59d8d51c0001c534b36484fc90d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889358, "uuid": "1239e277-ec00-4264-aacd-8f34c79c2d94", "comment": "Malware payload", "value": "b49683c3f74cc0216e7472c2f8ccab77c3b215ebe9838c7d302d62ebbfe73676d27731291e0f9d39751e0614ef0dafe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889358, "uuid": "60dfe831-eefe-406f-b6dc-e45f545234a0", "value": "T1BF235B18AB6CC65FE1EF0E7D64631A21127293511303DBCA4ECC64FEADAB78406257D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889358, "uuid": "fd741395-c62c-4b75-90d9-6779c6f264cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889358, "uuid": "fd7df9d1-60af-4b8a-b418-5de79d052051", "value": "384:RxiHABz9q3FxmHu+JjOdb4OQ1FRCOHu419awgncpMQiW4zmkZXOfq1aK2rkLp9iP:RCIFqb4d1TCOOuKXbOfq1ck+Yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889358, "uuid": "2cd6edaf-3ebb-4ba9-ab1b-3b46f9981a75", "value": 49164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889358, "uuid": "07efae95-a2e2-4cb6-83ee-8bd8a58107be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889358, "uuid": "2e0974f6-95dc-43ca-b57e-e3361107797e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a14bd9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889359, "uuid": "211422d7-6b75-4e51-a268-cf22c74cfa12", "comment": "Malware payload", "value": "ac60edc830b948b1f21286fbef9fbaf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889359, "uuid": "098d63d1-79d7-4840-9146-bbe860c218b5", "comment": "Malware payload", "value": "007dba85a17e9c13dff1f4b8a72fd6c2482a1d470c0e21eeaa6a9a91fada5c3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889359, "uuid": "0d17145f-1dc3-4118-a028-bcd30487ce03", "comment": "Malware payload", "value": "9547c2889c58ecf8a2898bf20519883af5c5fef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889359, "uuid": "fcb0ab8f-2a71-453c-81ed-6e92a4bc6dac", "comment": "Malware payload", "value": "01292521b8361ebd194648dbe804f2a030f2a6d611741ac0dc89c8e502503e756d5490ba85be72e3fca234254a1467a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889359, "uuid": "181abbac-207e-42ca-89be-d25e8bb95e3d", "value": "T1FC35334E1AC23B55CFEDA3B54A831891297333DC57A0F839770CA48A12F36495EB857E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889359, "uuid": "f42b0c26-3047-49f6-9241-669b8b98378c", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889359, "uuid": "36e3d4f0-3fb3-42fe-8740-d52626798ac2", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFDrtoB:+YhQs7tWVToP0Hs0/htDH3pGaFdoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889359, "uuid": "24c6fa66-d177-419c-958c-0c2c12a72dac", "value": 1122248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889359, "uuid": "0d5a996e-75f6-4f67-b57d-d2f8f18cffe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889359, "uuid": "6cdaa9c9-4523-4452-bc8a-78503e437128", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee33f77c-c882-11f0-a129-42010a9c0007", "comment": "Malware payload (Gamaredon)", "timestamp": 1763912511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912511, "uuid": "cf726a9f-9790-41eb-8322-d66a2bd33d49", "comment": "Malware payload (Gamaredon)", "value": "9b1c9a813d94f161127099e9e0352e80", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912511, "uuid": "19d5b19a-5ae5-47c5-8899-3b94532fad45", "comment": "Malware payload (Gamaredon)", "value": "008af94fd04c55582d9d8d6547f1276c04523494b25e7ff8f8f1bdc444abf1e7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912511, "uuid": "096c43e6-a47d-4d2f-a119-cc48bb27cd5e", "comment": "Malware payload (Gamaredon)", "value": "3f53dad341bc52fe433a27e2563a5f6ea433c036", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912511, "uuid": "e5fd4bae-63bc-49ae-892a-35d39701567f", "comment": "Malware payload (Gamaredon)", "value": "28dc24f55f463c0a183566404d726363a4133961a115e896b9137270ce1410b7968039d77991c481cd80b4e1643415c2", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912511, "uuid": "4931a782-41ed-47ca-b1ec-c9d791a313a1", "value": "T10D933A1B740312A48B1636C7C6873347DEA895793A362892F1319CA72917CB9FB4ED3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912511, "uuid": "6d81ae34-a66c-4fb0-901d-f79bb7e829cd", "value": "1536:+TdiOH1rl2E2TQT5iSCsl7SPtHpytFxvOSP9gdIqXtbhbcb5bsb7qMJywSV0GJ:SVrl2EtkJslctHpytFESP92HqMJUV0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763912511, "uuid": "86645202-a2f2-4b80-a181-02102e885ae1", "value": 95353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763912511, "uuid": "f728d6fc-4082-4423-970b-c528a1d28ece", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912511, "uuid": "056a96b8-9ca6-4f18-b8bb-9fc54dba5206", "value": "payload.ps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073f1390-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889360, "uuid": "fbac6df0-98a6-4036-8279-1d509c679e6c", "comment": "Malware payload (Simda)", "value": "10a8a5cc4cbed24b187ce753949333cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889360, "uuid": "a53aad96-7de0-4048-8e48-07d5709ff36d", "comment": "Malware payload (Simda)", "value": "00dfa182571ba6f2914a7d36b299792f52171a939ecaa3597e71e6d1cdb38a2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889360, "uuid": "d0de5fac-fadf-424c-aef5-eaf1826513cc", "comment": "Malware payload (Simda)", "value": "54e89c0bbe1b99d6b52e9c9f9b850488ccd91d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889360, "uuid": "e178f28c-a1e9-46ea-91e6-6bcc2202175f", "comment": "Malware payload (Simda)", "value": "5c05c4ab6a05a1927523bd1e8bbed65efff9c1257899889e438e762b3db13d5d1df7e18cba440a1d54b2cc67bf5966da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889360, "uuid": "4a3b14ae-0337-4f1b-a19c-a3478045d5f7", "value": "T159941244DA0D51F6C9245F3749BA3F1737B9D0DA834AE6C3A0884568586AFC8FF3A531", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889360, "uuid": "c51385c7-b9f7-4c79-8653-5e796841ca9b", "value": "93cdf17b0bf4d79b378f492663d563cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889360, "uuid": "d2fb5abd-0e0a-41bd-bf13-c7dfe26de1b6", "value": "6144:HC8okEvTyoZVOgd2QZiw5NLclL5orfQH:isjCF2QZiOU+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889360, "uuid": "4d0645b2-51cc-4728-b604-8eaadef6c009", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889360, "uuid": "e017f746-b671-49ee-ae02-8614027ac5ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889360, "uuid": "4fe0b5de-8e7e-48a7-85ea-b1843263fc8e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4990825-c853-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763892201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892201, "uuid": "a9cb5d2e-c0e9-4b00-9c95-03c49caf2064", "comment": "Malware payload (Mirai)", "value": "76073a7f223f37fbbfb8ebfe0682f67f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892201, "uuid": "e33ae2b9-8ede-4170-8ac3-019742cbb954", "comment": "Malware payload (Mirai)", "value": "00f547bb5c6f067f6b16997b5205097c43cdd390a934953c416ecd4c1b46cda9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892201, "uuid": "b1ae4481-e3ec-4cd2-83c3-d34f08a43ffd", "comment": "Malware payload (Mirai)", "value": "876f52889ae0d2b55c174b989b6a4793894b4f8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892201, "uuid": "beea85bf-7dd0-4504-b72b-83fbc87bc775", "comment": "Malware payload (Mirai)", "value": "d6cac6f6cc3f7efbb072ce413e5d7e446464c87e9f245284ef088399ee866fccc699b6038f9b0b7e5f1854340fe29181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892201, "uuid": "e6aa8eb5-2332-4488-ac4c-221f99a6e45c", "value": "T18104AE9FBA8F2551C04642F00F8BCBAD6B935119BCAED4E66C9A753F0C352EB6531390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892201, "uuid": "fb0e13f7-b3f7-4f8f-a2f9-a52ad1420396", "value": "3072:aqDx1v+6agiLT+Ohsyli5J/xMUc2ngP+q:aKA5/i5Jv6+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892201, "uuid": "68e5fbb4-9228-4088-be42-f6f8a3e20b79", "value": 173692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892201, "uuid": "fc3ead13-db83-4a0c-b91b-8036f806fc02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892201, "uuid": "6f32d587-963a-4776-a7e3-a46b5ed0433f", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07faef1f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889362, "uuid": "62fd7c8b-79a0-4832-a276-38ef1fd532ad", "comment": "Malware payload", "value": "5665129a94aab080a0caffb0fb816a2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889362, "uuid": "c68838d1-2ceb-458e-a9bc-dc559471b363", "comment": "Malware payload", "value": "0109a8fc5637c92b03dd812251473cdf19ec46312d8089bf89b5edff07d3d75a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889362, "uuid": "036cf0b4-1591-4208-8b6a-7121e3fb3528", "comment": "Malware payload", "value": "ae3da90ddcdb0f0afa7351932573ffb7a585af68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889362, "uuid": "7dddceb2-2ee2-4e06-9c03-fb4f513c73e7", "comment": "Malware payload", "value": "7d6590fcdef00dc7b6392225db96290a35becb2f34eec04f6a76234f3935482f8bd316ac0017e52183bc27a00b70c311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889362, "uuid": "47767076-ff50-4ba3-8a11-beba0a762ff2", "value": "T1BF653323799090F8C88A5D37005EDBB1DBB2AEB626B56665FFFC187A1C314915A0FF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889362, "uuid": "79c7b523-5e74-46d3-9411-8282642abc8d", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889362, "uuid": "24d7fb87-8a07-43ce-92b7-b161a5126f5c", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lANCPrHQMHyXUu8Z:7E2lVL3Ze+/F5ndjFWmrjyx1cmbbOXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889362, "uuid": "980e468b-d8cd-4139-ad1d-f44877a27ef1", "value": 1426762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889362, "uuid": "952b2213-672c-4d29-83cc-f46c9063892a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889362, "uuid": "80b3ab2d-335f-434c-a0d6-3a1cbf045ca1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0979fab2-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763889364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889364, "uuid": "0ec71c70-fe02-4f6f-b7a4-1756c8001e3c", "comment": "Malware payload (AgentTesla)", "value": "ba4296e6b3c55f42f3e5ec13f0fe6a8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889364, "uuid": "2aabc425-f4dd-4567-891d-2370886a2563", "comment": "Malware payload (AgentTesla)", "value": "0111d221b951cad9cff4b30d595cf0a58536f21be92fc0958dce2f10fef39a87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889364, "uuid": "06848781-e6ae-42ac-86cd-bafb7fbf89e6", "comment": "Malware payload (AgentTesla)", "value": "4004afc2e4d441be20e3967e8a0a6ee4a198ba9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889364, "uuid": "199fc87b-d639-46bc-9d70-bc1494085803", "comment": "Malware payload (AgentTesla)", "value": "ee07da4db383c922378930dd72d10bd032f194d4f7fc00172725208cac1d4fe0a76a9862f8c080a7dbb654113bc150d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889364, "uuid": "ec05f6c9-e6c2-450f-97ec-75ec3976624e", "value": "T1018733CEAEEF7345D4943378D8884992021FD8729E5CE66CFE92171DA3FA310425F6A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889364, "uuid": "789df365-6cfb-4eb1-b722-89fab84d6e70", "value": "786432:UeMNCUGYGwRF4j0W51zRYQZY3WhxPbeJS4KQaBQ/SQHNBuVrOk:Ue7UGYGwRFkP5N6/oB2SNBS/HHPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889364, "uuid": "d0fa13c3-9a1a-41e6-8989-c05bda471b56", "value": 37396480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889364, "uuid": "ad0a7a4f-b990-45fd-892b-bc3b2c5c18cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889364, "uuid": "24f10916-a3e3-4547-bc22-318056ecdfed", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a12b76e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889365, "uuid": "f48fe2fd-0ac1-4019-8c6e-42418b1fa466", "comment": "Malware payload", "value": "a904fb38305389896b5bf5acaa7b5a9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889365, "uuid": "e374629b-3cbf-4fe1-b823-921fa8bb1bb5", "comment": "Malware payload", "value": "011c6827f60d362a99e9688779fdab7ce8c693f6e9b7fb7a16fed16ee7a5b844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889365, "uuid": "9ffe772e-ba0d-4e0e-a914-9bd2d113465b", "comment": "Malware payload", "value": "c2364157b6e88012e7a7a9ff9732b2719b9a9bcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889365, "uuid": "0c1e5fe0-c119-4fc3-b0b2-685f7068e001", "comment": "Malware payload", "value": "319c63eaf0ffaf088c2bb246a690719506776ec3ba311c7013491f549b9516533d2d8f77fc8ce7efbd2564c541eae35a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889365, "uuid": "14f2b771-7b6b-4ec9-a7ec-ccad2022d64e", "value": "T11984E137B7C0CDB7C805063002876B768EB3F93925B18467FBD49A276C74951BE6AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889365, "uuid": "0ff11cb6-b432-44ef-af5c-622680e77e52", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889365, "uuid": "99c823a1-bfb5-472a-b18f-d12d26795c99", "value": "6144:BtKe6YiDdv3m3mgKHDjSehyyxaOCVGrVo:BtKe6Zv23YnUyzYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889365, "uuid": "21f504f0-19ac-42bf-8a63-e9698e0f6911", "value": 380404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889365, "uuid": "aa916129-8177-4059-99d0-0d3fd0bd3e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889365, "uuid": "9f818503-2cab-43cf-b991-62f934c40f99", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abc1ec6-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889366, "uuid": "b7a174b0-344a-4950-923f-c5996881effb", "comment": "Malware payload", "value": "8baf5729acb713b198a132e13ee5f259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889366, "uuid": "9a9d236d-e202-441e-ad97-1f5f625dd1db", "comment": "Malware payload", "value": "0189f7ce8fb5da356fc96c0e0827f0e648100b4aafcdd8837671460bfe94d184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889366, "uuid": "84d340a8-2797-4050-bac9-85e169cb9933", "comment": "Malware payload", "value": "54ee0622544e23ca95ab5819abe97d7c0d852034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889366, "uuid": "8ea7b54e-3116-4f85-a05f-da687cc6419b", "comment": "Malware payload", "value": "93e45a997964edf63d8b08bb20f0ec26ec78ddeff091f37f54ab2e3e1f678fbd26b003a57c0f7ad1c12390a9b6773684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889366, "uuid": "3e19d98d-ec11-4cdd-9617-f291ec12debe", "value": "T1E825334E07C22A59DFEDA3B58B461891256337EC4764B83A771CE08A03F364D5EF81AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889366, "uuid": "3a2457a4-d28a-4afd-8fe5-db207412b078", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889366, "uuid": "c348c98e-4850-4b92-b6df-d9e5cd839574", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFyjtF:+YhQs7tWVToP0Hs0/htDH3pGaFyZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889366, "uuid": "15447c21-bdc0-4431-864a-9738833c6df0", "value": 1039273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889366, "uuid": "908453b0-4fd3-4b0a-b55a-0ea3b1c8a65d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889366, "uuid": "95040111-c2b4-4e68-9901-8261731f8f86", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b661899-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889367, "uuid": "45798fc1-e3a8-413c-bcb3-aa6083e305e3", "comment": "Malware payload", "value": "ff2571eb9d3da61b470c98a757f28ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889367, "uuid": "fa040585-1f73-45d0-aba1-93ba1383e328", "comment": "Malware payload", "value": "018ba642e4e3df1988e93789076b42761b351e1fd0f32e75af642a9d48e6e91f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889367, "uuid": "748ef6e2-35b2-4e8b-826d-51f06072ffbd", "comment": "Malware payload", "value": "4fa16de2d3f0422a3cdbfbde5cd11c84f7be6aed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889367, "uuid": "183d673f-460e-491d-8484-5fa8431b9a81", "comment": "Malware payload", "value": "274a73e11ad01a2676c21870f8c8bb7cb5fd924fbc371de99aca6783ec8c5a1df221c43a91da6d083c5b1dd53b495c48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889367, "uuid": "9850f815-95d2-4771-b991-b88f01f9d574", "value": "T1DB45332927923E8CFFBD9FB9830D5E1059A013C95F6EF811BA997C5253D21C3B866231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889367, "uuid": "be5d8367-e806-462a-b8e3-d32329d79818", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889367, "uuid": "70ad6d3c-a73e-4eff-9519-64baaeedf212", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVv20:+YhQs7tW2zku73bFgVlRlbN015CoVv20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889367, "uuid": "e0e63bb2-5487-4235-aaf9-866c6e9e0cc0", "value": 1188662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889367, "uuid": "946aaa93-c03b-4615-9065-501017af4458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889367, "uuid": "60d0a47b-248a-473a-94c9-b8160201ec85", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2e7e0c-c851-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763891244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891244, "uuid": "958e0b86-5154-474d-8e84-aa65cb5b9681", "comment": "Malware payload (Simda)", "value": "224bbd7732edfed98b8cebdceddc9507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891244, "uuid": "086922ef-6e67-4503-9e51-c4eb7f610379", "comment": "Malware payload (Simda)", "value": "01b51e4a4c514c6ee8d9c2eb8b888182e24d21e8fd2b228e376a42048cbfe585", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891244, "uuid": "09109c8e-5cab-4ff5-ac13-7546bccf5467", "comment": "Malware payload (Simda)", "value": "f8e3226ccc8b5219538b3d76dec935ce5127f999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891244, "uuid": "50347c8e-de9e-4923-9414-bae425e3c1a2", "comment": "Malware payload (Simda)", "value": "be11550784b9a9b3b8e87cabfffbc784f3b75b8e166e5fffe6af0afac7b6599e84ad06b5fd6ff9bcf3c67960b6b53bb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891244, "uuid": "836c9991-97eb-4210-92dd-0c5fc0a5bdb1", "value": "T1C2D4CF51F285C176E0F1167296BF7B2B106D69654718B8E3E798BEC92C740F23A3C287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891244, "uuid": "26e735c8-8403-4231-a4ab-ad7fb9c9b85d", "value": "101036759b28ecf59ff4865b1e53f3b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891244, "uuid": "250354ac-cabf-4232-9cf5-263a8106d1de", "value": "12288:OwmWIarYnEKhsRKk34CW9DQvSkN29qyFhJy56d/eoyXjn9W:OwmWrYnxWKk3NW9DQvZN29X7Zyz9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891244, "uuid": "1ad8f114-c74c-402d-97d7-a552a1675962", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891244, "uuid": "f4a4d46c-10db-4484-8159-611bdea6bfe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891244, "uuid": "0c77ace0-39f5-49c1-8fa6-1a809b405515", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0efc8c-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763889368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889368, "uuid": "50d149e5-7836-410b-9350-08e7dd2d5ff3", "comment": "Malware payload (AsyncRAT)", "value": "94a8cb1dd2b84c7c490c8d8b2e6c90d0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889368, "uuid": "a0042393-8bc0-453e-9873-e1c52191924e", "comment": "Malware payload (AsyncRAT)", "value": "01ef10bdb8fe9b35af49715047de24ac015386dcb2da25988a778d63953b06ae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889368, "uuid": "8c9e7f0c-d4f4-4bad-a36b-7ddce4f2d296", "comment": "Malware payload (AsyncRAT)", "value": "1909d35956a95230f2912d25bb078db8e7809cb2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889368, "uuid": "cf18a548-872e-4cc9-a4e6-15a8be68d6df", "comment": "Malware payload (AsyncRAT)", "value": "c442b43bf34f70534ecd4848bb42c9de3e5de35342e065311f65b0e8e353ed60dfcff84f7c6d1fe5f8b361c7a70f5365", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889368, "uuid": "d3e22226-5854-4cdf-989a-4525364bb8ae", "value": "T160836B58B7E40529E1FF6FF058F17122CA3AF6935D03C62F28D9019A1627A88CE517F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889368, "uuid": "1a29dcae-6b29-446c-b782-ac66167a64fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889368, "uuid": "48d418eb-30d6-4b91-bc7e-30f86e88ba51", "value": "1536:R0rhyA4GJXaZJhEOTbDbTUJW6riS/OqRF6kCv:R0rofMEbDbwJP/OqREN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889368, "uuid": "8e105c02-0d19-4952-9d6f-55c41cb859b7", "value": 81932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889368, "uuid": "555ae0a6-78d4-409f-923f-d0d63308dc09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889368, "uuid": "246622ec-bc7b-4dd1-8d5c-4e8a5659561f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca304f3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889369, "uuid": "07835526-d18f-4bf7-9bc0-7a30bb80919e", "comment": "Malware payload", "value": "2c5e40a71e2c76bbeb5e57024841adbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889369, "uuid": "117ce946-0628-4018-ab0b-193a608a077d", "comment": "Malware payload", "value": "024073faf474c6ebcaae6ae500e349bbb72802c6afca28cbb81aa9f84fba81a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889369, "uuid": "2f0e7975-b5ce-439d-beb6-1298ebcdbe8b", "comment": "Malware payload", "value": "09a5ed29c19bf301850c39897c660efc8cd4b0ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889369, "uuid": "c70e483b-5b51-4d43-92f0-1a71231b8bc9", "comment": "Malware payload", "value": "23d4c8005bfb2657585ad126e1faff050794f797c2f2f378575a13c5002d34fd5e469af2175540b649e986e720595d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889369, "uuid": "53396435-ac53-4b44-a902-2c075fc7791f", "value": "T1B0235C49B75CC62FEAAF4E7D74A2162012B5D7611503CBC61E8C25FEECD77018622B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889369, "uuid": "2d610d15-52a0-4f60-8d64-60de604dc530", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889369, "uuid": "9b41c78f-7533-4981-91ff-9b31014ef50c", "value": "768:dImQZqx1lYcTYbFiAnSaPAjUq1fzu4AOXbYC1XkUbSn:20lY4exPWRh7buUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889369, "uuid": "c10911fa-46e1-44af-b553-a916a2e1a9a2", "value": 49164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889369, "uuid": "060fa32f-9cf0-48cd-913d-7d7fb727082e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889369, "uuid": "2628f711-8818-4e8d-9bd8-f67132a726a4", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d635a16-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889371, "uuid": "53d7d088-0400-44c6-b187-eb1261897d3e", "comment": "Malware payload", "value": "9086bf873fd0097dba6b87ac45d66c60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889371, "uuid": "af2a2727-affd-4484-a164-e74a74c779b9", "comment": "Malware payload", "value": "029140bd81eff6f142e2f71508b9444d0f4c83b7c0dbb548ce0f4d3e46436208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889371, "uuid": "5b1e316a-e4a7-4701-80eb-e3f385086cf8", "comment": "Malware payload", "value": "c65ada0c933e273d445d5d401f91973ae8ba1e93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889371, "uuid": "20a4a059-bbf6-4cb6-95e9-c9b2ecaac6ba", "comment": "Malware payload", "value": "96c57a8379576c7c61fb08893ca45ef97ce69fc1e124bbf691786279786016600e0abddeb9f1b62182d4662141e83032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889371, "uuid": "9f555698-e412-410b-b5a1-48c2e1e28f6b", "value": "T1B24533282A523F9CFFBE9FB5C2095E151DA053C54F2EF8107E997C9293A1593F8A9130", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889371, "uuid": "ec41e498-d457-4ead-8fd4-b5dbf1f373a2", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889371, "uuid": "7c563842-841c-41ee-983b-c0a867a4880a", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVRHcnB:+YhQs7tW2zku73bFgVlRlbN015CoVheB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889371, "uuid": "31d69eff-2db0-431c-9c18-a28bcb35d458", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889371, "uuid": "accf4e6d-e207-47d0-8acd-74448c1e54b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889371, "uuid": "7a29f4b9-9045-45cf-92c0-3fd68ed06240", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bd0e18-c852-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891806, "uuid": "ac8f7d5f-6f45-48ed-9fb6-3e825aecb80a", "comment": "Malware payload", "value": "a5ecb5fef00e860c50f492940a8f31e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891806, "uuid": "8ff2308e-7c3f-444a-98bd-62e260868b8a", "comment": "Malware payload", "value": "02e83568cc6b6cb10c011ca93ca7893e1791744a1e8d7da3756fb3c41def15d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891806, "uuid": "08f62787-692e-4ebe-82e1-893662602f5e", "comment": "Malware payload", "value": "54cc6c6193866a15043c363c430e8e81fdd60801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891806, "uuid": "b5f12e17-5c06-40a6-8257-e1ce593fe354", "comment": "Malware payload", "value": "bd7b295a40ae0cd6885e7c93d6a3168d344e9b88b8b3825bf4ffd070c85fca353aaf4f07c30104365a22ea757aed4342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891806, "uuid": "67a69ed5-a38f-489b-90f5-bfc85a0caf79", "value": "T1E835230B33C15271CE4A533206872AA15F73A7BE0770983A77E8654B1DF29447FF8AA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891806, "uuid": "395cf105-ee23-449a-9b60-13b536863f80", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891806, "uuid": "ebfb0435-b14e-4861-b9cd-86be83585ce8", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mK:qE27hQs7tWVToP0Hs0/htDH3pGaF5+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891806, "uuid": "be402230-e80a-48b3-9363-8b10e83d8d49", "value": 1102459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891806, "uuid": "53ddc172-1ef4-4fa8-963f-3e7d87210a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891806, "uuid": "344cbff9-febf-4bfc-8e62-e14c6785d3d1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df9f9a8-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889372, "uuid": "27fb3c49-7c4f-4679-92f6-2ffb92ec86db", "comment": "Malware payload (Simda)", "value": "09cf5e7d22b6dd4a06f2915ad2ceab8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889372, "uuid": "676a7ce7-5be7-40b8-adcd-02425c11f349", "comment": "Malware payload (Simda)", "value": "032b36c68380028eafa4a4bb9c2ab24d7bb6e963f4feb8652e0b30f52dde63b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889372, "uuid": "e9c0659a-86a1-4141-b032-7a2012f56099", "comment": "Malware payload (Simda)", "value": "89cab9a82785f4667c2620bf02f93f447d6b0c40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889372, "uuid": "606ec8bb-4a34-425c-89e4-cd4409b6b493", "comment": "Malware payload (Simda)", "value": "c2d2f436956554a8c9987b4fb270663d0a921ee79a2a2e8cd63385a289d7bee4107957465bcadd2b7988d0780a855882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889372, "uuid": "0e8b8173-1d3b-47eb-84d8-c5941a919509", "value": "T1FE748E26A4508176E0F4223051FA7A6B2DBD2E6443ED28D377646E8D2D742F372392DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889372, "uuid": "2b73957b-8d0a-45f1-b655-6ab89a192e7f", "value": "257ea21f64dde694bae577e3a7755e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889372, "uuid": "200e2585-8bad-4193-a54b-cf46bb151bdc", "value": "6144:+x45rA5OSkJ28R/kpM3kRaWV/wEsNbqw8rlRTFiPurp+EStS3sth:GOSkz/kBubqw8Am+EKS3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889372, "uuid": "52c8f706-59f5-4df6-970a-453730697bc3", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889372, "uuid": "54b5eac0-8dee-40e5-873e-2e7e98b5a245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889372, "uuid": "a0111e88-5c92-4629-9c94-3fa0d7498023", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb900b4-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889373, "uuid": "18e3f3a0-f355-4186-9fd2-e7a6bbc7a34e", "comment": "Malware payload (Simda)", "value": "e588bb192baf7624898369f2534d774d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889373, "uuid": "1876609a-1cb8-42db-bb0a-00695736f95a", "comment": "Malware payload (Simda)", "value": "03336e55e9bc4f0ae61098eeb358c36cf558683c457e7ccce374a61335df36d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889373, "uuid": "428a1291-4857-4153-86d2-570ff8742c33", "comment": "Malware payload (Simda)", "value": "1aa0a61393a6ead6cde128a4cea8ed8e576218b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889373, "uuid": "6fe66210-3da8-49b3-9c84-2b01cf5c943d", "comment": "Malware payload (Simda)", "value": "506acd129c1e9dc300ddc0dac8775b68d799604ff3a3a0e5a405542fb68b047c6383cd347ee2646d276fc0228e1268c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889373, "uuid": "cd7333b7-b3f1-437b-827b-d28869c2bb22", "value": "T183B51223B89D73B2E67F403B26C78362217CD81B336E963D59503826BC632746A53F94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889373, "uuid": "2b9d9509-ebdc-44d2-b99f-8702b575b1d7", "value": "cd7fcdda5ab111ed483e93c44d1d1ae1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889373, "uuid": "f96502c5-b41d-4fd1-849a-fc1848944c3a", "value": "6144:XQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy6:oXkej+f4VDOEVdbgtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889373, "uuid": "2018821c-2d44-4fdc-9b2c-5132ebbad2d0", "value": 2400946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889373, "uuid": "86faf4e1-30fb-4d14-8787-e1fc823eb6c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889373, "uuid": "fd331099-6dc8-4734-8c3c-17e6ff6255fa", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4f489d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889374, "uuid": "1f381a39-3151-47ab-980b-455838dcb36e", "comment": "Malware payload (Simda)", "value": "4e72dbef289c7de5b58fa99fff262eab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889374, "uuid": "64606e80-2fb0-4076-8ac8-958b64aa050c", "comment": "Malware payload (Simda)", "value": "033b07970edb6c05f25f96871a1e19284624852aa4955cab7e987b9229b6946c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889374, "uuid": "ab067d4e-08c5-4935-a85a-fa3ee0c794cf", "comment": "Malware payload (Simda)", "value": "88b358d8c9534e54c3b6e64becd0347679d8a897", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889374, "uuid": "60ef161d-40b0-467f-a27a-0fcd7fee3cb9", "comment": "Malware payload (Simda)", "value": "a8557e3e1ef87b851102fb6400e33b7c0182affc12f8add4a6d68d5a8d0df36229000659d71caf72ed0850c369c5ae96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889374, "uuid": "7fc0625c-732d-4e34-b0e3-49cbe5da6e5e", "value": "T1FF24123266C05A23C4B5097B55F3B34335AE83888326C5AB18499AD63EA72D7FE35770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889374, "uuid": "3936b013-3a29-412e-ad09-a0abb8691830", "value": "3ce7105d1e904763c53a96a44fc006e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889374, "uuid": "7a4e2d2b-c736-4378-a6a5-97acdca2b0ef", "value": "3072:Pg/T01/NkSp48GzFoMVZrjB2+4M9eOpssvSX4FzU5chdhGulEV5SCmGFkInV/0at:8ErGjVqiFPGYrGZMCrCIn6aQdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889374, "uuid": "ae0dcfca-fd5a-4fed-9016-2007221f5391", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889374, "uuid": "743a10f1-11b1-4fac-82e1-9e3c85b19a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889374, "uuid": "6ce5aea6-bbe9-40bf-9cfa-a1c4c7609005", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe9c168-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889375, "uuid": "2b66a2cc-7331-4158-8ec9-37d4f8e02726", "comment": "Malware payload (Miniduke)", "value": "05cc236f0f71b8476c8bc577e80fb595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889375, "uuid": "5c67cba5-106d-4b83-b9a7-babc5f2ba9ca", "comment": "Malware payload (Miniduke)", "value": "0357c7846928976bbc0a773b9796a7cb17cc7952c1484585b3bbec16d10d3e5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889375, "uuid": "43797fa5-72b8-4d3c-ad35-00600cacfe68", "comment": "Malware payload (Miniduke)", "value": "9334907be731af00176d5b7fad44832a9e13c810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889375, "uuid": "bb7e12f2-15ad-4645-a6c3-abc84093f076", "comment": "Malware payload (Miniduke)", "value": "f295bc7a1d4c73bdfd79f2f7ac89f46a0c9f8e3c50e9ad0a537e2aa509bf12965d45fce38d54cbbc54a5a63bd4e2a8d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889375, "uuid": "33d3d1d4-570e-4552-98be-584d8a45b702", "value": "T12D048E3533F580B1E53316B46DF1AB62967EBC384A71858BABA41F5F2E346918339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889375, "uuid": "ea49ba64-9101-4597-92b8-0f59130eda21", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889375, "uuid": "ed49df17-ce27-4f0a-9d9f-d48400fe71ac", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZtYIWJkET5Se:+/LhS0rKE/FLITo9m0IWWEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889375, "uuid": "b6c2cf9f-ee86-4e4f-b889-19814400405c", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889375, "uuid": "d5a5392f-9ae7-450a-939e-1cf4ba9d4fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889375, "uuid": "f747c597-b32e-4be6-8fa5-df5fe8359ed5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10820586-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889376, "uuid": "3793879f-877c-430d-bbe2-f4a0cf21044e", "comment": "Malware payload (Simda)", "value": "da30265e638856227bbbc8cff7de105a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889376, "uuid": "75ade0d7-29c2-4267-b738-e5dae1c71a6b", "comment": "Malware payload (Simda)", "value": "0368e76c14dc2de2daa8f90b95112214d3106bf0c281203bc28379000442baa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889376, "uuid": "90bfc0d5-f91c-4040-9b55-d408beb893ad", "comment": "Malware payload (Simda)", "value": "7a8331d1e203c1bed69e855e94e17810570235d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889376, "uuid": "a08c97c3-b14c-4142-8911-5d1912067f51", "comment": "Malware payload (Simda)", "value": "d724273dce87ce0a3db6c7004f93a703e5ee980da79a416102950aefcc4176802010c82cd70e1f11779f50e23f48d404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889376, "uuid": "2a491e51-e0d9-4c40-a812-7f0aec0b874c", "value": "T1A224022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889376, "uuid": "0aa36330-920a-4244-8f46-12acbf987806", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889376, "uuid": "1bdf6b69-d212-462f-9a3f-c6e7e44080f0", "value": "6144:DZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq56:VquCuygMQjd5vJIBP1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889376, "uuid": "f6f74720-e458-4684-bc9f-d1f3bf708502", "value": 213010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889376, "uuid": "643ac360-7bee-4926-9f20-8184ac81880a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889376, "uuid": "c54ec951-b463-4cdd-a631-443343ad089c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777ea6f2-c852-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763891696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891696, "uuid": "98fc61cf-bd50-4a5c-b574-59ab59b0d131", "comment": "Malware payload (Mirai)", "value": "ef69178c7b575f98f9ba7d19dbd9cffd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891696, "uuid": "55a0d209-e77e-49dd-b231-fa9f25284860", "comment": "Malware payload (Mirai)", "value": "0384ae6623e3c9c39f5bd1114d4cb1fb79d78b8828e06fbf3bf4a1791fa73b35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891696, "uuid": "329b856b-42af-40c2-90f2-deb45a21e82f", "comment": "Malware payload (Mirai)", "value": "2e608f9da78d15f0686ffa496916de3c97b55fcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891696, "uuid": "02c22df2-35c7-42ec-ab73-de8c83fcf269", "comment": "Malware payload (Mirai)", "value": "cbf36235bdf6c8abdefa86d906359acb1b1430270f7b16c8dda4ebbb8e7b9a36920c69b06dc9754726b626a4fa517fc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891696, "uuid": "cee26c39-ad9e-4fe5-add6-5dade1659d5c", "value": "T12844D60E6E325F7EF7AC837547B38E20636923D612E1D584E1ACD5011F6039E642FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891696, "uuid": "513306ed-c767-4531-b98c-c2c0aba8333d", "value": "6144:V/begxlrJv7NTnEWKwbagCpacFKNsbf9xQUvetixd+W:l97RnEUCXIUd+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891696, "uuid": "143844c4-3e9a-4622-8df7-12af53e51929", "value": 276856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891696, "uuid": "279ddaed-ef2b-409c-91ea-f089748d48ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891696, "uuid": "26a27852-8dc9-4202-8d43-c700192e8c31", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1149323a-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889377, "uuid": "5ff40abf-2e7c-4e31-9112-3d6727d75f55", "comment": "Malware payload", "value": "7c25a2e249245afd224914d750f1df4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889377, "uuid": "2b284ed8-b130-4ea3-9b13-12510648f8c3", "comment": "Malware payload", "value": "03c98e55095cf9ec718018375a446b711905384872b1ed21f212112eb496047a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889377, "uuid": "578e39f5-bc8a-4926-8b02-a08e3346f5cf", "comment": "Malware payload", "value": "52e77d92ba32e6986c3f8665d1d23a29ed8f0c5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889377, "uuid": "4bda9373-1ee7-4a00-b429-4c4c7eda463f", "comment": "Malware payload", "value": "a3f0cfc7d26a66c3dc41e3d9b6163a37254cc6c4a773e6ac7f14d102b89190d87ac8716a17dde4ece22eb0991951a4f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889377, "uuid": "9300046c-c432-48d6-9538-df0c0753b659", "value": "T1A04533692992AD58FFB69FB6820C0E095D9023841F5FF8156B48BCA651E24F3FC76330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889377, "uuid": "aecca85f-1a62-463e-a6ff-122cf202273f", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889377, "uuid": "6a5bd9eb-8b1e-4a86-adc8-131aed8d4a5f", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iWtPWnQKP1ii:+YhQs7tW2zku73bFgVlRlbN01Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889377, "uuid": "2a205744-18ea-413d-865a-6c18c0935412", "value": 1275920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889377, "uuid": "2c888f4e-3d3c-449f-be89-bf7c81ad6eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889377, "uuid": "4ba9420f-5569-4dc1-b224-7953316d9f72", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120c4be3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889378, "uuid": "7310a1be-981c-469e-9816-eeee02dd97fa", "comment": "Malware payload", "value": "162bd8fa7919465a6faaa8e42f839d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889378, "uuid": "0a05b271-2c06-4e62-87aa-485652c4cf34", "comment": "Malware payload", "value": "03dfbb2d3c386e185331531c2c03ef5633604441d13990f808dda78a15d168a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889378, "uuid": "962b15e3-4ccf-46c2-bc73-492edca604f9", "comment": "Malware payload", "value": "55cdbcdb76bdbffa39f058b18b53ab453d2ad5fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889378, "uuid": "2f1a05cf-9644-45ff-9abe-dc6831611f50", "comment": "Malware payload", "value": "f23c4cc312c66985ef8987df5e5381e1708429c565d906bad60083b9b3c45883ac72b2f2deaf33ff9bb349bf966356bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889378, "uuid": "8c4bdcf6-2680-49f4-94af-ef213955a182", "value": "T13D35334A16C32728DFFCA3B75B871891255337EC579468393728A48A03F264C9EF85BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889378, "uuid": "30ca1a4a-4c20-46ab-8d53-ba1b25dd980a", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889378, "uuid": "2a919af7-be71-47ca-855f-45bba94fa06c", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mu:+YhQs7tWVToP0Hs0/htDH3pGaF5+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889378, "uuid": "fe13d557-bade-48fb-b089-d15b72b0088c", "value": 1101277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889378, "uuid": "7914e1fa-88a6-40cd-817e-988fbc4b5446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889378, "uuid": "90569ba7-98e3-44aa-908b-c3e2224b7009", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c84ce3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889380, "uuid": "edfac744-01cb-4ea6-a25c-292972c0e1a1", "comment": "Malware payload (Simda)", "value": "5d8b8d0e76c8deea19505231d259094f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889380, "uuid": "9d7181fa-1201-449d-9995-bbbdd390344a", "comment": "Malware payload (Simda)", "value": "03fc1bca26bdee369461699e1be3d4b1c50e088c44d219bc40d69667f92da94f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889380, "uuid": "67791e98-3c0f-4c86-8d65-bfc591052685", "comment": "Malware payload (Simda)", "value": "2e944080798d6ce34416a7e388c8eb37a3227628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889380, "uuid": "25169d25-9d3b-478f-b878-2579319587af", "comment": "Malware payload (Simda)", "value": "267e0fe1de27e9306700a22faaf891c79289cbf9987f2396a474ce00df141117e840de1e73a441a5a70a49c3199718bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889380, "uuid": "e5c1244f-d35e-4f82-9187-7d1380196e7a", "value": "T192D423226D5D4E63C6A714BB1BF6FF552326E598132BC7679C00420F0C756C97F3AAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889380, "uuid": "d4f69a5b-79a0-46a2-bc4d-4e2a8e0e32ec", "value": "088303a3216315a2ba8d66c94c7b80a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889380, "uuid": "2b92ca04-45d6-43ca-a6b3-e3e8a64b6ff1", "value": "6144:umKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3s:g71YpQiU/RcO1VQInVobc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889380, "uuid": "41fee696-5250-4616-99f6-5d55c7cf1a4c", "value": 631738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889380, "uuid": "a3f028ae-a3ec-4b23-bf23-3ea61af79965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889380, "uuid": "e1fe9508-f443-4969-8dde-e1cf30cafa9e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba9a5f4-c87d-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763910064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763910064, "uuid": "84ef00b3-ec58-439a-bfbb-5448c63b3e51", "comment": "Malware payload (Stealc)", "value": "63378703b134baa56bce3ec11d6d5885", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763910064, "uuid": "fec6b889-239e-488b-a65b-654fd42b1a8d", "comment": "Malware payload (Stealc)", "value": "04485fba642f9189de7bb72e100ff3695cbd5530aa58447091aa19f4968c166e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763910064, "uuid": "7cf7a740-6bda-4f05-b14d-83cbb38aeafc", "comment": "Malware payload (Stealc)", "value": "907d6709e6a0ecef42cf7a9e126f8e40d41f1ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763910064, "uuid": "7be41da3-6743-4dd9-9e98-01b89b3d2a6f", "comment": "Malware payload (Stealc)", "value": "53359d97230332831016ce2ad280ee3d4d0b7ccf897055b0f9c4f47c4033262315ef9f47f2bff18aeddf79e1b7f77497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763910064, "uuid": "e31b1935-d732-4dc4-8868-ca8f130e71f7", "value": "T123D57D37BE8284B8C095A334986D51D2BF2DBC086B3667D35F5139342E7BBD0593AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763910064, "uuid": "be260e68-c947-4ecd-a8da-a083b2944fc1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763910064, "uuid": "83aad39d-d9b8-40fc-b6a0-3251a377c159", "value": "24576:87mGWvh5BxkzB2s8RanTE9axBEp739YWYNPxbv5byXmuGiCTGEzsc3iW5r:87rWvh+zB2s8RanY8x0A3byXq5OY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763910064, "uuid": "e20f2347-7216-4f6d-b1c9-9d9f420a26dd", "value": 3008216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763910064, "uuid": "ac15be34-985f-4eda-bb71-ed93a1cce6c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763910064, "uuid": "23f5a38e-e7ed-4325-9d77-242296d7000b", "value": "white.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5f0641-c87a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763908802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908802, "uuid": "6d29344f-3897-47c7-8109-9801bd671e51", "comment": "Malware payload (CoinMiner)", "value": "19fa0edb5220ad9d285873ed718ccf4a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908802, "uuid": "b3d17fe4-7e3e-4522-b31a-45fb2ca3c3bb", "comment": "Malware payload (CoinMiner)", "value": "0480f4a7dafcc57d9ddcdc9c8df7087130a4672c6aba2865d918bfa98689cf14", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908802, "uuid": "b4ba2550-7f32-4fb8-9e58-26affb92d594", "comment": "Malware payload (CoinMiner)", "value": "fd40d4222d527325211da746ea562fdc28ab1f73", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908802, "uuid": "cefb671a-92c9-4808-8012-333ddb8c5aac", "comment": "Malware payload (CoinMiner)", "value": "52b0d4fd90eb5b4c84e5d20aec336bf740ab68deec922d3e2bff76d59f32271aa8b0d03a6f4d3303d2fd03bc381a2c53", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908802, "uuid": "a3dd0940-9408-451c-80e9-a2fbdc6a2e50", "value": "T1E34633CF510342982FDC45B7FC9AAE7BEBEA55D4A7346202C915B21CD05F40182AFB7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908802, "uuid": "645019a2-905c-4015-b8a4-08335cdcada8", "value": "98304:Mbp7vat9fsv2dh07qg0zWcBUi3UmWF20s3Ds0i9O6MKeYo3FpeYR:Mbp76Ev2ngqdLRWoDBLqKp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763908802, "uuid": "de464f48-fa3f-4baf-b8df-29d413bacc95", "value": 5696544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763908802, "uuid": "0ebc0cf7-1454-4f84-b134-ab4609a693f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908802, "uuid": "89b70d06-b5ed-4be9-813d-1edf05f2dfd7", "value": "SilentCode Executor.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a58437b-c80b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763861046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861046, "uuid": "af698f1a-43a4-4015-a830-ef913f7354eb", "comment": "Malware payload (Mirai)", "value": "1143e762897537a42f6223f96bfd0969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861046, "uuid": "85419705-8c00-4c00-8ab7-acb8266008b2", "comment": "Malware payload (Mirai)", "value": "04ac1e6388db732d2f831bf79ff6a6e795bf51eb81e937bca7e6fc676ab131e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861046, "uuid": "a17148db-d47b-4ede-b3cc-c1413e90b122", "comment": "Malware payload (Mirai)", "value": "a2af2dc43740a9a7cc10bd9027c2a08718e028ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861046, "uuid": "cbbd26aa-c942-44c5-a54a-291cd0837f70", "comment": "Malware payload (Mirai)", "value": "c423b45158f53c9b36fa677dca1b2df0bc08cf2d7a29290508febb5738ebb3525d6a9a5832a1dae510b8e06fe1998f1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861046, "uuid": "42f31e0b-95bd-4db5-8f7f-eaa3d91705b3", "value": "T1FAF33AD7F800DDBDF80AE73684230905B630B76214921B377257BD6BAD3A1985877F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861046, "uuid": "5e9de569-b7ff-418c-a071-9bf3be89b9e7", "value": "3072:/ZO9gTphpzLgYNxypXZt5afSrWiOlhVajbi2LgIPZvozmj3Lb:/hpzFyppt5XHOliLhhlLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763861046, "uuid": "c676830c-5353-4811-9597-6da700900349", "value": 172492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763861046, "uuid": "892b987a-7672-4636-aa05-c1fc81302828", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861046, "uuid": "c0a2d9ad-a000-4b23-981e-d896aaa70598", "value": "ngentodluwh.m68k2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1360e03a-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889381, "uuid": "9169d71e-842d-4144-ae03-cd67473f7b8b", "comment": "Malware payload", "value": "109fe91258419a53d1a7cd149d2ef268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889381, "uuid": "5a8c5355-6dad-44a8-98da-15eee77afbf9", "comment": "Malware payload", "value": "04f393c10140b73cdb3961fc3f9076fe9ead2cbfbb9024406a26293d72a149e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889381, "uuid": "f84ea7b8-53f1-453a-8dd8-712d35a05d82", "comment": "Malware payload", "value": "4dbe56e12f12fd97236330d0b13e32ab7087ea6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889381, "uuid": "88853e70-b878-44a6-b76f-a993f0d4dc3e", "comment": "Malware payload", "value": "4e121b27d85054874839a4b49f7a3b079d16685cb2873f1769a690ec8ed1dd6a32fe929a767c75ba526a62d427be81e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889381, "uuid": "11f496ac-d338-437e-9ed8-378fa854d427", "value": "T18EC32B03BE9580BED567C6F04CB9C979B9619F3A1BEA9E4762C0BB052970103B5F121F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889381, "uuid": "7ff1cdf9-7615-4169-b6d2-b655deee4d79", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889381, "uuid": "01e1b9c4-aac9-4bdb-999e-b9109ac55255", "value": "1536:niyzlrXCu2lsuAoeQZZ86ukpj0nGGF9v+4Dv5:iyZCu2lhA1QZZ4kp4F9Xz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889381, "uuid": "992e14bd-fd2b-43d6-aee1-12452312d46f", "value": 125537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889381, "uuid": "f83092ec-556d-45a1-abb6-dd1f4630eae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889381, "uuid": "9ba311ff-f272-4031-92fd-aa72606e67d8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143c46f7-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889382, "uuid": "32d5d606-c3ad-4171-9e17-a3958170d2f3", "comment": "Malware payload", "value": "0df0b51d944af8c589dce80b4ea88812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889382, "uuid": "3b149c4d-92e5-42a2-a6d7-8b4cbf4fdaf3", "comment": "Malware payload", "value": "04feb73ab1238d83bab9d78ed432ad29cb3e322fedffa98545285f6b06ff2eca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889382, "uuid": "ea0f7e1b-9150-4517-b21d-917f5b3bfb50", "comment": "Malware payload", "value": "a25c282b3cbc7031e44986a4df7bda1137f8b2a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889382, "uuid": "310e06a3-8c5e-4166-aabd-baa74c82e217", "comment": "Malware payload", "value": "00bd2cf5f5192ac545eca0e6a32d1937d04b432b809f18c01808a14c6af8356ea2cfb770a3811ec80e062028ee7efa0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889382, "uuid": "4a4e65c6-430b-40f0-b64c-e4cb5fb709c8", "value": "T17A45233A71948CF0D8650E300B4A3BB58FF3F3373655586A6BD52A262D3215CEE9A707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889382, "uuid": "bb1a2b05-25b0-4b7c-bb1e-a7e3b7ac01c7", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889382, "uuid": "690a2630-2901-4590-90a1-1f5579687d12", "value": "24576:v6Zv2WqhsVn57hqQeKUP581L9k+4EBtXMRyP3kAmDC:vE2WqhGtbUPuVt4EBFCyP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889382, "uuid": "d5158ce5-45e4-4d98-b6e8-b582d5ec347a", "value": 1233226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889382, "uuid": "c44c7b4b-5e85-4ca8-9fbd-91f31df33b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889382, "uuid": "f657bbb9-ebe4-4506-ab9c-42838fe371f1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c95da7-c850-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763891020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891020, "uuid": "fa746aed-b1e8-44b8-a904-5302881e3c94", "comment": "Malware payload (SalatStealer)", "value": "4e189631ce3e378bd9c3da8a0299ff3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891020, "uuid": "a0d18d45-58be-4df4-93fc-1618770651d5", "comment": "Malware payload (SalatStealer)", "value": "04ffdc5d148b5a99782ec03566c319d86b0c68f86d1515bf1dd842ad2e9b9ce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891020, "uuid": "f2ac5684-9074-43ea-b86d-9ef1dc1a5751", "comment": "Malware payload (SalatStealer)", "value": "72294f2cb9cb00a51f9554a3a7eb8fdedd0bb515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891020, "uuid": "b51077a1-936c-4848-b4dd-58b683f49aeb", "comment": "Malware payload (SalatStealer)", "value": "ff77e07079bb46a4d3433d30d1d3e45d2f2ad4c4946b016af97b2a19983f9b68ad7b51417dfaddc5746cc6074d311d06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891020, "uuid": "48035938-9abc-4b3b-821d-79c564cce83a", "value": "T1ABC64A01FA8B54F1E9075931426BB23F23305C048B28DBE7EB587F6AF8776A11936749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891020, "uuid": "633abea8-6fc1-4711-bb69-ecfba6381e38", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891020, "uuid": "987b66ca-12f2-4514-bbf7-13c2f5991c9a", "value": "98304:umXTPok6iGvTcS5EOEF2gZXuOZBMIyEODFQbz6G:hoyS40gVuOZGSODFQbz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891020, "uuid": "9c9ad701-5d1d-41fe-8a2f-a39131e81685", "value": 12472832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891020, "uuid": "e5a3ecd2-8300-442a-a068-05496926c88d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891020, "uuid": "32f80c54-428c-4f7b-aa5b-a3bbe9d6d7f0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1507206b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889383, "uuid": "2d1a2deb-32ee-4b11-9f21-242100c53148", "comment": "Malware payload", "value": "7bbb1725cee9862766f1935213382112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889383, "uuid": "745cfa28-5be4-4943-987d-2ac424ed778d", "comment": "Malware payload", "value": "052dc74bc26aa8e29b24c7f3cfb6b3b4f9c18eb9a5baee2cb32cd9c8c65249a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889383, "uuid": "87873b8b-5154-4701-9ac0-a164763c3a1e", "comment": "Malware payload", "value": "5278c2a485788ba29405b440bacfb82170d5cab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889383, "uuid": "9f4070b5-4be9-4502-b113-e1efbbb60da6", "comment": "Malware payload", "value": "5df20d8e1442ea5897d2a22f11e83b3396e3633efa4538ece16e69c51bcae39e3ff097d78c43f62140267be9a63721cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889383, "uuid": "410f6b6d-c012-4556-9567-18f539334462", "value": "T1978533A17595CCF5C6260734036B1FB11B33AF781939A41BF3E41B2B3AB4DA1BB21592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889383, "uuid": "7348418e-b0ca-4053-914d-7de9e1edf671", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889383, "uuid": "7d8c87ab-cc28-45ae-b99d-4f493c785d6a", "value": "49152:vE2ivhQs7dLNuhmuVZ7iHmv5FJRIqXCzjU3ES8caqYbtq6X2cG:82kQCehz7iHwMA0S8Vbtq6pG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889383, "uuid": "84b21d44-41a8-4329-976d-b9213337855e", "value": 1813390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889383, "uuid": "9298b562-958b-4651-a6a9-e3c9adafaf10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889383, "uuid": "24b055db-e2f0-4b77-9da5-825bf3dcb853", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a09d1e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889384, "uuid": "548b4be8-79e2-4fa3-a8a7-645ab0bd15dc", "comment": "Malware payload", "value": "d55364cc6bac32084e151c75d5aec753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889384, "uuid": "095ac771-7dad-4305-8ef6-8345f198b636", "comment": "Malware payload", "value": "0587ced466ddfddd587d38f93749f5c9097e29e149d2591d4e7fbba850305d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889384, "uuid": "e84f55c0-15a5-469a-a3a3-50b50e1a8558", "comment": "Malware payload", "value": "48fcae963c86cdca623997f087e045673fba1276", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889384, "uuid": "d2932c2d-0473-42e5-be20-64e3dec92163", "comment": "Malware payload", "value": "99cfaec0225bfc218c4f4593977f0d9c96312d01d6d15bca366c9f81e42695c57844dae1079f8a0f5069e3b941933ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889384, "uuid": "6d437e6f-49ba-4a9c-8b6d-c3fac9f16e63", "value": "T143D3F823BE645C3EDC6589F168A5DA39B6220F291FA0AD073796F7513DB118372F120B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889384, "uuid": "46936027-ad30-4fe9-806a-551a119802e7", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889384, "uuid": "f5f1b114-a896-4a80-9f46-0fdb0dfd6d2b", "value": "1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpal1gggggggggH:UVqoCl/YgjxEufVU0TbTyDDalQlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889384, "uuid": "e865fe67-ce23-4037-973a-a7a36d353ed7", "value": 138423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889384, "uuid": "2587f05b-e858-4361-b8ed-529ce1f80bbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889384, "uuid": "7bb153fd-0e36-401e-a0fb-ce1c752e0fdd", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16362087-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889385, "uuid": "cedca0d6-8d53-4496-b47e-d6c112373345", "comment": "Malware payload", "value": "ebc60e204db7c1d514cf48681a608485", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889385, "uuid": "3ff3eba7-f812-4f9e-961d-1babc9af3813", "comment": "Malware payload", "value": "059f0480758e8b4f47dc6a9ec1c469a768b982eb41133e1a8039492509724471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889385, "uuid": "9f1847f3-1599-4296-b66a-956762c0ebef", "comment": "Malware payload", "value": "275ec59585c6dcec58e7782605c9e6d679c06e04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889385, "uuid": "e0844749-b4c7-492c-a46d-9004f54e1ea2", "comment": "Malware payload", "value": "e70163b45239c1bbc2cd1327580ff640b9c5b8feb75cf886dab9c5593cbb61221ef8fdb8f164ba2f651165f883b865e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889385, "uuid": "fa526cf7-7f2f-457c-9eb3-3401326a074c", "value": "T15B93E84BF21281B9CA38C537A561C1B21F253E75AA63CA3F31513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889385, "uuid": "7e57adf9-18f1-43fb-b18c-645d0d8ad4e1", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889385, "uuid": "64170e1c-1cae-435e-9f93-5463430f4d67", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdC:41bC4Bk6lMTOWw4PkRAPo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889385, "uuid": "390c6aac-fada-4901-8b3a-f5426e5586cb", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889385, "uuid": "216d5325-ee4a-439b-8d01-e4582a9c787d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889385, "uuid": "21c327b3-0c58-498f-a152-ea2b4ce1b271", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399c8e54-c882-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763912208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912208, "uuid": "e2cbbddf-4b91-4bae-a2d8-b468346ecdd9", "comment": "Malware payload", "value": "f153d0277101282667a01431584bfaab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912208, "uuid": "49490c1c-23d9-4314-94ad-174f3c16886a", "comment": "Malware payload", "value": "05bf2cb448e8407c39546b46892e363d8c250662d7e6001cac79692c6883a446", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912208, "uuid": "3c424a29-1c94-4ac8-a05f-8f7f13c2d34f", "comment": "Malware payload", "value": "d7e007042e55701497474846f340788cc842a76e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912208, "uuid": "8299b18b-8f30-44b9-b086-3e9f0dead905", "comment": "Malware payload", "value": "e3d917f777392e884fb7eb793cec97bd94843cff1376e6094978bb8988e3215045641edc1e20c9ca2b8b83407f44f169", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912208, "uuid": "1d2b1c77-3c23-4908-9f18-144dccfdae78", "value": "T1895633B726103ED7D292D3BA6823C5444C12FE729F0A0565F04FA6E646A274CDFF8B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912208, "uuid": "50231559-322c-4c66-80b2-9ef094f694c1", "value": "9ecad17161342c5ed0725c6d520c5009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912208, "uuid": "6f02bd42-d399-46a6-882b-047994bcfd7f", "value": "98304:KknsMrYgn+y/acuI8/3PP20owZtbWUlCHcV0FOsodAIFdKXP5B:tnsMR+y/ac0ZWU8cHZAIFkX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763912208, "uuid": "348dfaf8-8e1f-451e-965b-b05d71c0f539", "value": 6002712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763912208, "uuid": "4eb89dce-ae80-43ae-9530-4677d40be414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912208, "uuid": "1d6902c6-7327-453a-b499-ec8eb2b9b18a", "value": "SecuriteInfo.com.Trojan.PWS.Banker1.37780.18723.17428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d2042b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889386, "uuid": "c9084dbe-63c1-4f0e-9033-7c330184dc27", "comment": "Malware payload", "value": "dee54015cd1aaae96ad452f190313936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889386, "uuid": "36e13cef-515b-4611-867e-b28c9a6b61ff", "comment": "Malware payload", "value": "05ca2e842751762d45a517a71f4949fa31732b8f10795ae5085ee16e08b2fcf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889386, "uuid": "bd696008-faa2-4834-84f7-9074405887c3", "comment": "Malware payload", "value": "e7a874d541807424251a35af04d8514798691424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889386, "uuid": "46da8f7c-dc44-4d36-b0aa-20818a3177e5", "comment": "Malware payload", "value": "bea687650f24e22f494693f5aff2f0fa136dd831b583e9846fbc569b3ebb18aee11bcae33ab5460cb297461e8acd02bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889386, "uuid": "420e635a-c8f4-4531-bb84-832c083f5f91", "value": "T10FC309137E01807FC557C9F19C69C9BA3A619F391BF25E8B2285AB92297160379F130F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889386, "uuid": "185e30a1-c689-4e12-943c-6f0fb2edac4d", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889386, "uuid": "455fc713-f3d5-4b7b-8c30-36f7adecd545", "value": "1536:niyzlrXCu2lsuAoeQZZ86ukpj0nGGF9v+4Dv4:iyZCu2lhA1QZZ4kp4F9Xz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889386, "uuid": "11d6d5be-8b88-499f-a648-562a6e41c1e6", "value": 125531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889386, "uuid": "3a91efc8-9eaf-4331-b9d5-55666253fece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889386, "uuid": "e88b36a4-b229-4ea4-8526-5a23f6d59c55", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177c1987-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889388, "uuid": "e4a453e5-44c7-42df-b4ac-d9c1b772b708", "comment": "Malware payload (Simda)", "value": "c838555201141138691880abb307e1e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889388, "uuid": "7d4a7bad-68e1-49fc-8fc3-959e5c48da15", "comment": "Malware payload (Simda)", "value": "05d434eda767dafbdf15939e1d51c70a68612b54536992227788f8981d8f5661", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889388, "uuid": "8c090c78-d08b-41a9-9ce1-3339243a0a45", "comment": "Malware payload (Simda)", "value": "8387d38ebaa67c5016932aab2372e3431c76bae6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889388, "uuid": "d0bb8bbf-5528-40bc-8ed1-6b67c988d278", "comment": "Malware payload (Simda)", "value": "e95623f289013f5a3ddeff756f9b93fec0e85f022e5d7391a2743e30a161e20281f7f13aabb85997ae9812e8b87aa5c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889388, "uuid": "3667fdc4-5f5f-4142-b1cc-48f8790e407c", "value": "T16D241201A2A712E3D25F8EFB8975A70711BDF3922703C993460557ADAC220E1FDB57E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889388, "uuid": "c6e187b2-c05a-45b5-af61-5b461363bd62", "value": "012fa4cbf6ed4b0464e9cd5f5b29f2bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889388, "uuid": "9b79da0c-759b-41e5-b313-f81ad76ac128", "value": "6144:QhVRLLpQTSjddv1sNUo1nVkuNxlNOqJnrogfTa:QT9psSjdd9sN91VtlNHJnrosO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889388, "uuid": "c3d03c1b-5106-41eb-8a8f-0faf64939d33", "value": 218112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889388, "uuid": "1055034d-c2bb-4200-879d-6beea44c0aa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889388, "uuid": "6c61f8b7-4085-47f4-aae1-dde8c42a5040", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1821b438-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889389, "uuid": "bf4ae2af-8a92-4a0d-8874-03a03dc75684", "comment": "Malware payload", "value": "03c94085149bbe566a7e8b8c8f10a6d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889389, "uuid": "7dda510c-2284-4bef-a866-6cd042cbc2e8", "comment": "Malware payload", "value": "05ed1f8c5f42abdd351dd4114150d9c1c720d2452c1f6d0d543cd985aa1ae59e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889389, "uuid": "9c81c407-5823-41ac-a720-ee8b111c2770", "comment": "Malware payload", "value": "096b961efd1aa276015033d5ebaf029280d5f240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889389, "uuid": "a6de1f1e-cf7d-4654-911c-d760f08dfb91", "comment": "Malware payload", "value": "39014e1bebb76409ebf83cd2a9d7c80acd02a01f17a7767845410aeb6bba201e8264dfbe2e076c5f21ddd4e5cc8800fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889389, "uuid": "a7838b65-3a10-4729-a684-961f5732d420", "value": "T1EF05122372C4D8B2C4421530025AB7B5CE7BE87D2B22D417F7CC1B276C79958EB6BA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889389, "uuid": "8e091070-3b90-4cb2-abfe-f1509c9278ef", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889389, "uuid": "75124be6-3c3d-40a8-b3c8-e811aeaabeb6", "value": "12288:otKe6Zv23YnTjp0Wn91PsXeYmJMkaLqGDtlTwSDcNHpcd:K6Zv2KOWnLhGDjwSAH6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889389, "uuid": "60ca49c9-7907-4608-acba-f31773f5120b", "value": 827299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889389, "uuid": "bbeeb024-8ff4-4cc8-b3a0-8a389ee86aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889389, "uuid": "60cd3c52-c1c1-4a81-92af-8334e0e27501", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed751ef-c88f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763917720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917720, "uuid": "d1142b76-3191-42c0-aad3-dd928f5ce7f3", "comment": "Malware payload (Mirai)", "value": "e1378e380eff1166a972942fff8f8d36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917720, "uuid": "19754f2e-0386-4a84-917e-680c543910f9", "comment": "Malware payload (Mirai)", "value": "061469b2aa9aa1528f939be37ac60a60fc7c3c3ef3290968ace82b8ad9bc751f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917720, "uuid": "c7bbbf59-6389-417a-be05-4240a0edf9dc", "comment": "Malware payload (Mirai)", "value": "cb6baffa7299df31247d9770dabb522e7a163261", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917720, "uuid": "dc1a5af0-ea65-4c97-8139-13d57f6562ec", "comment": "Malware payload (Mirai)", "value": "27289690af558e4f7902d6f069a0aac0811671df07466c39218c4a6c884841c646c4afdd77ba2368d12d66a14dc28188", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917720, "uuid": "89210b23-b8e2-4819-8568-fccf9eba860f", "value": "T15A336C36E0299ED4C6960134B4E88F751F03F1C883532EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917720, "uuid": "763cb1d3-d49a-4e62-88a1-f36f5bbb09df", "value": "768:ea2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+mjCLQoV3TvmCozw:ea4U7G7SvT6ftBzmjgVzmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763917720, "uuid": "c743843d-90b1-46df-9bf2-766a5768aca8", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763917720, "uuid": "f96707dc-1795-4b70-8e4c-78f7b17a50b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917720, "uuid": "e07a5221-d273-47f3-a0d8-84450e93000c", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bbc61b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889390, "uuid": "71dfdb27-0b33-4ba5-8c0b-50422b18795b", "comment": "Malware payload", "value": "57609a808944b4e48c9f1ee364e266e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889390, "uuid": "88b9afc2-fa1a-4de2-b00d-db9826ed98aa", "comment": "Malware payload", "value": "0653ef8983a5d5d8d028e2f89de423c0faabe415704fe702d2a070d53f4a7a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889390, "uuid": "8d23abdf-6de2-4f9e-9928-bdd305d722e8", "comment": "Malware payload", "value": "ead1d3655ab0fec7ca90d4ac62fb93c4ff56bdb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889390, "uuid": "aec0b835-8c40-482a-821c-e2c057665dda", "comment": "Malware payload", "value": "b1c862c3dc6d7436ebda2215fe0f8f2115dfab1935ce1c3d51c6fcd529806245a2decfdd4ac21a8ece115e35e33b1021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889390, "uuid": "fe2e43a2-1230-4733-bbb7-bf73160b6ede", "value": "T16F14E847F60281B9CA38C537A561C2B25F257E75AA63CA3F31513A2B2D79B001D1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889390, "uuid": "2d840f46-6a90-42f0-9dfd-75be0f95a033", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889390, "uuid": "35e5acc4-5f8e-474e-98b5-53b585afd56c", "value": "768:wUKxW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAar4PzpyRAJ7IwnDoSdj:wUKHbC4Bk6lMTOWk4PkRAPoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889390, "uuid": "eba81c08-422e-42a4-97e6-2851e952620b", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889390, "uuid": "013b44de-27e8-4d1f-a191-f2ccc3cb4694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889390, "uuid": "63a0e232-4085-4ccb-9680-2993ea037179", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4786c4-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763890010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890010, "uuid": "c619269e-d331-4d0b-888c-b4d751f9e9f1", "comment": "Malware payload", "value": "e194688e7fce695cf39cb23ed181aeb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890010, "uuid": "d1a56114-6634-4f03-b49f-d5f0df5903c3", "comment": "Malware payload", "value": "065b141ccd96e8b1e139e54500b1a3d222cd5b6be00b1acd1d00c24df9a0397d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890010, "uuid": "b3bdcce6-a16a-450a-9f53-7e1053950b8f", "comment": "Malware payload", "value": "93d038ae859eafc7d44063469e134f484bd089b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890010, "uuid": "9880b8e3-e8c6-4cc3-80db-444f89073a43", "comment": "Malware payload", "value": "5e9f3c8c8e4482b0637147f4077a3e4d702bcdeb9ac12632b95bf9047748ee0c721c1394a2c0394d384b09979c1eaa6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890010, "uuid": "2c76f6b9-b318-4574-aee5-8f44fae7d9a2", "value": "T12535231F31C16272CE49173207472A986E73D7BE1B70802EB7D8514B2DF2584BE7AB99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890010, "uuid": "6998d2f5-aec7-496c-9a4d-b736e84721ec", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890010, "uuid": "d74879ce-c8f2-4427-bb36-08afc159bde0", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1ZcAQwab:qE27hQs7tWVToP0Hs0/htDHi7HQwab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763890010, "uuid": "d5f92ac1-a9c7-4b76-b9dc-d362b606338f", "value": 1112753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763890010, "uuid": "515f17d1-5409-4f52-92e2-efe91cbaa062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890010, "uuid": "86624fe1-7d0a-483c-b0f7-7c1a37a8b73f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198f3a22-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889391, "uuid": "67ecc892-42b7-4764-af87-b99e54b089d6", "comment": "Malware payload", "value": "3759fbbc99e751d3cf1d0945be011d71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889391, "uuid": "7a325cac-f124-4f03-9ad6-0b637791937a", "comment": "Malware payload", "value": "068688c11488696cd7ece91a9601debb17f2c7e472e57a66b7491207c7de61f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889391, "uuid": "47499eb4-9169-4402-b456-73eadc7e32ac", "comment": "Malware payload", "value": "9fa0fc3dd35f43a015bd1b9b711a425af86cfe72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889391, "uuid": "72cde227-fff5-4e86-95f0-131eeea6cc6c", "comment": "Malware payload", "value": "fc2acf8bbce18467948b73a19d97c121b14db458dccd296c933cae6538fbbc8006c04bbdbb7a63a7f24f02d1bf56741e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889391, "uuid": "fa9f60dc-51a3-4fea-8248-c905e2e31b9b", "value": "T13CE56C17B284183FC06B173A4837A7549D7F7E216A269C0F57F078CC8E7A5817D2A64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889391, "uuid": "ef4c79e2-f57b-4901-b35e-a4889d8aaf42", "value": "3d349bb1fedb23758a6e397e5d691576", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889391, "uuid": "32d4351e-e5c4-4ff0-8825-3077a74121b7", "value": "49152:+UJ6ZNXox4SgJhBsfHJq/nCFT4Mv0Pt97k:+tR4xGnCtvwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889391, "uuid": "e5acf6b1-2dcf-422b-851e-818ca8596b5d", "value": 3301910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889391, "uuid": "15175783-d1f0-46f0-b04e-0a15310a20fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889391, "uuid": "6c6e530e-250d-420c-be0d-52fec6b228ef", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3708f3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889392, "uuid": "75d58453-8c87-47fe-a442-9a746f55764d", "comment": "Malware payload (Simda)", "value": "75a60016fa9cd41c74736d4d6a70083d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889392, "uuid": "8c6f3ee2-fb2a-47fc-90cf-4a69f1adc53a", "comment": "Malware payload (Simda)", "value": "06a4cf7c6abdffa266ced8152b6866b4394c46ce026069f3a7f6644df8cc026a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889392, "uuid": "39251d18-6962-467f-9cb2-d43a15f7e445", "comment": "Malware payload (Simda)", "value": "cf534680aba675e0cd8541df28ee565b44ee84b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889392, "uuid": "937d0877-e643-4cf7-afbf-0666e6b62c6d", "comment": "Malware payload (Simda)", "value": "bccd08f9e3bbe58cd12655045669101ac5a1cd8958b89bcffa84c3f67d2a9e503eb7233e8ec941682023609911758601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889392, "uuid": "1c434a1b-7351-48c5-b2c2-7680ed2ac190", "value": "T1D384123BF6A418C3E6B63A3014FDE15819A8952C3552AE3BB40613DD2F662C44FF5B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889392, "uuid": "cc4a36d1-c4c2-4ae0-abdb-1853614a9cc2", "value": "a0f41bd5de82cbb844f692b48ffd09bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889392, "uuid": "a9748d22-1d0d-4704-abb8-96215a9ff855", "value": "3072:moAbvJrZ/CEp1Td3INNAILgwKRpP3fJ2pwLAt/iw1JmWTe1eyfLUH+xW6Lyk:m7vJN/CE/TZINiPPBIwcuWTegi9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889392, "uuid": "0032d125-330d-4d8d-8548-cf7314364f68", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889392, "uuid": "57e3fef4-f458-4f71-a746-2f10abc45b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889392, "uuid": "1e32a3b1-e9ff-4f93-9894-b51b1fbebd08", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afaf9b9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889393, "uuid": "c71ec4fa-c46c-435b-ba55-21b379aca04a", "comment": "Malware payload", "value": "34c73d62d74364414c4aed0ab38ead55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889393, "uuid": "1098c06e-b480-48e1-a005-2bf50d075353", "comment": "Malware payload", "value": "06dde2c5e762ee94784ac28a2fb5e103517c288ed3a855be39f05c0250742f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889393, "uuid": "af56ccf9-5521-49e6-b018-9aef76b57dfa", "comment": "Malware payload", "value": "66356a09ce4b415c366b86fc0494ae9096fd09e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889393, "uuid": "16e4fbb5-f275-4169-a7d9-38a7a83c3809", "comment": "Malware payload", "value": "0a618d6336806fd8304e6b3ccc030e273d0bbf389cba7083d1791d63cb67d5731f4d7e1ec58312aae2dc8d93f7f2daa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889393, "uuid": "a0a85756-3f97-4018-a8e6-4b628e9af0b0", "value": "T1C725334506C33A44EFBDE67A478737A939BE3F8813A2583E7A0DD24F41B151D79A40AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889393, "uuid": "9e759687-cfb6-4760-850e-1f353ff2c038", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889393, "uuid": "d5f6ef05-e45d-4658-9abc-55a0e83b1a5b", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuN2b0zAp:+YhQs7tWVToP0Hekxbl5Tuob0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889393, "uuid": "f7700961-88f3-4e08-aa21-ced97e4c5327", "value": 1038349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889393, "uuid": "392df955-c468-478a-afce-213860ddc545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889393, "uuid": "2e60aa1e-cfa1-4a6c-b2a6-9810e0d2ba46", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb902e3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889395, "uuid": "80963659-1967-4c24-884f-ea9f5999db41", "comment": "Malware payload (Simda)", "value": "dd72894c5e4842bb385fd6672da1a4a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889395, "uuid": "d5e22aa1-c5ea-4d4b-a200-d3366e0952b8", "comment": "Malware payload (Simda)", "value": "06dffb4e1e40c4d4719cff70ee31f3f0a5e32c18f162cab41f6c6eb3815f05db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889395, "uuid": "40984815-5154-4c8e-87ca-2d062b2ff8e3", "comment": "Malware payload (Simda)", "value": "8eb79833c2c33f1139eab896c1559b35a809b691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889395, "uuid": "861c44ed-4212-440a-a975-13ee52ef5d0e", "comment": "Malware payload (Simda)", "value": "1bf6a41c152509e5a8498d0b3ec552fd9c4cd4f76313f970e2addc8d96a6dc0ba6b811955d3e91ee59d0135d9e8ef6a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889395, "uuid": "9e0ba2d2-8a23-4dba-bc10-2e86105a23b4", "value": "T1B6D423226D5D4E63C6A714BB1BF6FF552326E598132BC7675C00420F0C756C97F3AAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889395, "uuid": "c6af2efb-6a94-4461-b62d-16f5cf7a12f6", "value": "088303a3216315a2ba8d66c94c7b80a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889395, "uuid": "4203ad90-5c5b-4bee-be45-e880892cabb4", "value": "6144:WmKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3s:471YpQiU/RcO1VQInVobc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889395, "uuid": "ad46bcfd-e5ba-43a7-b2a9-29adc7910f5a", "value": 631738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889395, "uuid": "3c80a971-0f94-4758-a96d-22ca3b6e813d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889395, "uuid": "a2f661b5-c779-4164-aa23-03c8c0962537", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64673015-c843-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763885222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885222, "uuid": "1f3613c6-54cb-41ba-a979-860d0cb79a22", "comment": "Malware payload (Gafgyt)", "value": "2a13518943b972cb1ad47f0e1cc154b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885222, "uuid": "03177757-9619-45eb-895c-80915a05bd3d", "comment": "Malware payload (Gafgyt)", "value": "074ca5637549f4b3c9f3dacd13d5c2957abfca6abcce51420129e4396402dd01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885222, "uuid": "3018f343-a335-465f-b969-cecd66aa3676", "comment": "Malware payload (Gafgyt)", "value": "0f2f687229a5479a81b48e5c94fd226dc5551b01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885222, "uuid": "f59a2ca3-da3b-4b05-929f-d59fb89ca474", "comment": "Malware payload (Gafgyt)", "value": "4f9dd759ce816fa0897d51dfa8d54c7c33dae9ae8a010d664acef79bfcb1864839712201ed09baa12185b99e160910cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885222, "uuid": "a0109cf4-6159-4194-aa35-057db6019348", "value": "T16EB30804F8448727C2D327BAF78E439D7735566457DB33116A38BEB82BC6B982E29170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885222, "uuid": "e12a1871-92a1-4e52-bea2-3fc5fc416488", "value": "3072:9lX2jKRi0ZDvCTpDv7DSubUmGVrQAXiUXouX:6j6ZUpDv7DImGVrQAXiUXouX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763885222, "uuid": "567721e1-b1bd-4a3b-bc5f-4dc32e581f83", "value": 112657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763885222, "uuid": "5031be8f-0f6a-4229-9247-3a5d66a7eb8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885222, "uuid": "673d03cc-4f19-4af1-bce4-7c4ea8680d3f", "value": "a-r.m-4.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c51583f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889396, "uuid": "b79be155-131b-43c3-ab7d-d448ae98526f", "comment": "Malware payload", "value": "cc4cf0cc19dce09a51951c79af3281ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889396, "uuid": "a0a63b72-c493-4ded-a5fb-54c6cca6a4e6", "comment": "Malware payload", "value": "07a2adf8fc5fc9e9ffe61967db4bd671d6db89f921b593610b20e09f3d3d661c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889396, "uuid": "4d3894e1-3277-45cc-b539-032db75a60ba", "comment": "Malware payload", "value": "932a76c550952a13c0ed3491fc300188d69a4388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889396, "uuid": "1fdfdba6-5dbd-4e19-8498-93a44ddc878d", "comment": "Malware payload", "value": "126ec2548ff550bb2c6c924e4477c01120944a27f66ff172a53542f0ad10a43ab8c99862c00fd864f923558474b3f5c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889396, "uuid": "baa5c3f0-f586-4742-bc46-5c83ae60a9e6", "value": "T126B32A27B2C364FDC11FE535C1829B31AB31F8554662BB1F1E6CDB222D10EA09EBE654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889396, "uuid": "2d7fadbf-35e9-4a87-a7fe-1e893c73c5d0", "value": "019d3f36f692b8c998a29d364ebdb623", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889396, "uuid": "894b4e97-2065-41a9-9dae-ba1d8a8e0e66", "value": "3072:htHxlUY/9id0JZPYyhbIcGNak/qMkitFM1sgoK5a:LHxodWxxhb8/qMkitFeMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889396, "uuid": "99b1b09c-5a30-4f74-9f2a-aa47fda779e2", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889396, "uuid": "e95780ca-9808-4aca-8ca9-101cfa61d8b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889396, "uuid": "542b9d9a-c784-4103-929b-33c227f829d0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253d015f-c890-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763918187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918187, "uuid": "d7d69181-2724-4913-b114-7ad1175e2adf", "comment": "Malware payload (Mirai)", "value": "e16acb4350183527c8d5ab31656acf33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918187, "uuid": "cbaaa612-57c8-4b66-a13c-4622492641a4", "comment": "Malware payload (Mirai)", "value": "07ad16f0878b5af7f123753058da3660d83cac7a6244038fa82a5279ecbcdec7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918187, "uuid": "7f6d9e47-22e5-46d4-926d-5e5e6125198c", "comment": "Malware payload (Mirai)", "value": "8adf5f34e33d06f5bfac6ac358131bc116ade73a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918187, "uuid": "de35d54f-99f5-42f3-9253-072721afcf7d", "comment": "Malware payload (Mirai)", "value": "82be6b6bf8b4d52be0aa8d0112babcd213db8a77b6fae26409e38952d0eed19cb85857c88cefcf3057de83241b080d40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918187, "uuid": "3b0f2982-bdb2-479d-8508-0856972d2416", "value": "T191C3E696B8819F22C6D156BEFE1E529D33231BB8E3DE3103DD146F2437CA91A0E7A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918187, "uuid": "5918ed65-a34d-4bb5-9272-02c211bf2609", "value": "3072:fUi4y1t2eFxG8LsQ16K0Zwz85l6rO4O4zEnCIXirOOvnd1zn5Q9:fUOtvFxG8LsGV0eIblJULIyrOG1tQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763918187, "uuid": "6d82970b-cf2a-44b6-85e1-83a6758e9456", "value": 121372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763918187, "uuid": "a52fec4f-1cdc-4589-b038-05b6305c45f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918187, "uuid": "0de09f91-c6cb-42aa-a6dd-86e568145706", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cee6df8-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889397, "uuid": "edfa0c6a-c35d-47e6-9e08-633f31b1d0dd", "comment": "Malware payload (Worm.Mofksys)", "value": "87c7bed31e1e555d01b6ce99b029c7d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889397, "uuid": "ddc72c56-9c1b-4f56-b6a9-092deabfcf16", "comment": "Malware payload (Worm.Mofksys)", "value": "07e43a44d0d80105350e24a5123e513367dde2f3952808a8bffc39be328bda70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889397, "uuid": "4e54e72e-8ab2-4bce-b176-667a996a9098", "comment": "Malware payload (Worm.Mofksys)", "value": "a40520f50e2f432fb87e4ecf067b3c40fc321e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889397, "uuid": "2c46c8aa-a1ae-44d0-984c-7c13108f7fff", "comment": "Malware payload (Worm.Mofksys)", "value": "e353ffac1f1fa19c90352eb3fbbe74a1c0c9a3dcd7f1cc16e541bb3db9356436454c7502c9d71e09b3a6464844acc174", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889397, "uuid": "0569ea3e-5b9e-49cd-a3ce-a89ed96142fc", "value": "T16B24F92FEA00712FD4A38AF0586665A6BA317D251BD1BC0B27E0AF453971A13B5F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889397, "uuid": "38566239-7b11-48cd-b9d7-2efd3325230f", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889397, "uuid": "0e4bda79-d5ae-4dfe-b97b-f845dc95a4c7", "value": "3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unt:5vEN2U+T6i5LirrllHy4HUcMQY6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889397, "uuid": "d013ae72-839a-481b-89d2-b9b60b713b29", "value": 211740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889397, "uuid": "9abf8915-a303-492d-91be-c5409310820a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889397, "uuid": "df97cbfa-2ffa-468d-aa6c-4a80966a13ac", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8f3b0f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889398, "uuid": "1e61b715-8b53-463d-84c9-e7f6e6b08f16", "comment": "Malware payload", "value": "57dfc4a66fa411439ed13cfc3964fe1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889398, "uuid": "118c0086-2e4c-417f-b562-08ed32d2097e", "comment": "Malware payload", "value": "08307fe96a8c5fabb36e8b1850dfbbd171008c90b71cb0e0ca645536e589d047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889398, "uuid": "a959de44-61e5-4830-85c0-0f560922693d", "comment": "Malware payload", "value": "aa11e81b0f2b939e4328f63085ff276128442599", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889398, "uuid": "547c07da-8bf6-49a6-ad25-865d560cfad8", "comment": "Malware payload", "value": "60f65d16439a04ef43f3dcac3b135ad634bd000cc59f56eb912e85ba284b9616ef600de1ad65e24f6f218ea37a211b3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889398, "uuid": "d4c4bb33-f37e-4ed8-aa2c-08f9a370e770", "value": "T1A884F17777C1CDB7C805023002876B768EB3F93924B2845BFBE49A276C74951BE6AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889398, "uuid": "0b5aa307-ace4-4319-aaa3-b7ea3db1d86d", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889398, "uuid": "cdee77e1-14ef-4293-8de0-c56dfa6de51b", "value": "6144:BtKe6YiDdv3m3mgKHDjSehyyxaOCVGrVJ5:BtKe6Zv23YnUyzY+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889398, "uuid": "e146a52d-d9ef-42f7-ab72-b88e3f824a5b", "value": 393954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889398, "uuid": "85a2a8a9-7d2f-4e5a-89c4-18b4938f73d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889398, "uuid": "7db778b6-3604-44c2-943b-c7c623654327", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3ae6cc-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889399, "uuid": "0870f26d-012d-4357-b284-6786b2da3514", "comment": "Malware payload", "value": "f4bab9bc1d99b8910ff5944e801fdee1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889399, "uuid": "dec07fb4-10cb-4843-94f2-ab058288e0ca", "comment": "Malware payload", "value": "0841a1a68de1823d674e3c24ded16887f89ad82b112eda4b303e44dded390e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889399, "uuid": "28a80183-741c-43a7-826b-c01d024525ab", "comment": "Malware payload", "value": "21ebf4290a712578b60a8d66713a949bc9398e68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889399, "uuid": "be50384b-5e0a-4d54-904e-36c5a41b20d3", "comment": "Malware payload", "value": "975a3bafb1ab1f448e624d705112f9e2f4bdae15e773fa9de116eb4e7a73f9c9074bdd55be7b067feedf93d22d7bf7ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889399, "uuid": "d4596efc-35b0-47b3-ba24-c386f376fa96", "value": "T159C5E1ECA693998EFB476D36B39A135E917C20118A1EC6AB824D46F0FDF7D710F08914", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889399, "uuid": "21853a16-2d48-4bce-bde1-60d90a65446b", "value": "37c6c0cc4d20c311c793c6b743da8942", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889399, "uuid": "3eac4e02-07ee-4148-aa68-9217de662472", "value": "49152:TeS12nRc6C5CEAHD26ICQVt1ULUQRP6a6YPkCLJ37xbIjNyX5Hxzl/n:6S+c6ZEmqCMtmoQRP6aZtnsNq9l/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889399, "uuid": "3d0aef02-b9d0-4b3e-8f6e-2090766fe034", "value": 2687895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889399, "uuid": "1e51ebeb-2dc7-464f-abac-514d0d3e0745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889399, "uuid": "74baa883-ebdc-4a98-83f8-c01a66131982", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed19419-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889400, "uuid": "93666386-c3b7-4fda-93d7-993a0ce1f2a1", "comment": "Malware payload", "value": "011caad59828f388d41125347bea7c59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889400, "uuid": "12e52f12-3e1b-4192-afd9-5c94fd746e57", "comment": "Malware payload", "value": "08819369a46246705efec0897a9c28f5042cc5297cc0ef35ed3c7948d4a6b62b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889400, "uuid": "cddf59ac-65f0-47a4-b7fe-5c006654da52", "comment": "Malware payload", "value": "25e1058feda9c55bbe03dc9abb43568640d87fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889400, "uuid": "1eb33d06-320a-4e2e-9ccd-8a07a4781e73", "comment": "Malware payload", "value": "90b044082ff2f3730c7854ea345cbf78b16b617a3bff340c3db830fec201628abfff053e2443c95273eac2d650016875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889400, "uuid": "ac109a97-1e78-4d49-acf1-c2353867b79a", "value": "T16F14E847F60281B9CA38C537A561C2B25F257E75AA63CA3F31513A2B2D79B001D1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889400, "uuid": "9061714e-907d-49e7-9233-590e0c8fe584", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889400, "uuid": "f0ce486c-048d-46e8-93d2-458b3e8ee51a", "value": "768:AUKxW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAar4PzpyRAJ7IwnDoSd+:AUKHbC4Bk6lMTOWk4PkRAPov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889400, "uuid": "3d8ed051-2bc1-46a5-bb5d-fc748b65927a", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889400, "uuid": "e6e06b37-d929-426f-ac21-690f72782e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889400, "uuid": "f0db24c6-5bb0-4b60-bca4-61553334a5b2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa458be-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889455, "uuid": "97ae667d-66ea-4066-838c-296924447a71", "comment": "Malware payload", "value": "affffcff40e64b03b5f2e47f7c1263dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889455, "uuid": "929feea7-b168-482a-90a9-de70eca26128", "comment": "Malware payload", "value": "08f84a123c5357a66bb1ddd4f3de6dd817b9b351e37a72797cc1b44f5cd72e75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889455, "uuid": "8b7614b4-d7be-45e8-b299-a43ba4645254", "comment": "Malware payload", "value": "c6d073300b30df93583233146ffee58d47376d50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889455, "uuid": "26736571-bfb9-4538-b5db-af1f2e6d7fe1", "comment": "Malware payload", "value": "b99f802da0fb28b73daf135a48ce04ba2f0d3ec9a4aca419feaea984ba4a87e35e282f39f345c67ad667b1e5111ca401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889455, "uuid": "587ec6b3-bf10-41de-af41-d666ca3c2418", "value": "T19D45230B33C156B1CE4A537106832AA11E73B7BD1770E839B7D8A4071DF29447F79A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889455, "uuid": "38259a9a-565e-4487-ab9b-c3305f3f45da", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889455, "uuid": "a70d8a04-07d1-41fd-bc41-542e76c56186", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFDrtoB:qE27hQs7tWVToP0Hs0/htDH3pGaFdoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889455, "uuid": "bfd13a95-c618-496c-b0ce-2ee9f0f4a911", "value": 1173448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889455, "uuid": "0dbb94f8-4cf8-47c0-b4ab-1a925f4483f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889455, "uuid": "8dc41d71-43f0-4b21-b3e7-58305a2c0e46", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7b1034-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889401, "uuid": "0c7372c3-dee6-4b44-b766-ba92708d0512", "comment": "Malware payload (Simda)", "value": "60e5a765811e59241a15a71bfdae2959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889401, "uuid": "885d9669-f0ce-48d3-b498-fcdcf4551e2b", "comment": "Malware payload (Simda)", "value": "090061d2d671e509c9fbfbaa8313513825c7b424051f0aeb6310bbec5039a8f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889401, "uuid": "57bef064-dc95-48f0-8758-1051aaffd432", "comment": "Malware payload (Simda)", "value": "61cbf8be081847ddf47e53b4f6680b4516cf49e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889401, "uuid": "ba6e2b0c-9cdc-480a-99b4-04465bcc17f4", "comment": "Malware payload (Simda)", "value": "3235a7d2c9596d6575b20b3f26cb76028a0b75e4a3521585a1998b9f061c9f64e9a32399bf5d3d3e50131f16e69dc070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889401, "uuid": "01c685a7-2d11-4f8f-8a6a-3350862f394b", "value": "T17EC4122B1B2C9933D6550B3B8EE5EB3461BFF5516733D6D30B009A9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889401, "uuid": "f80f0255-85a3-4056-bc27-126c4db86a40", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889401, "uuid": "1f1b483c-0c25-4173-92f3-786ec19a075d", "value": "6144:QZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:equCuygMQjd5vJIBP1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889401, "uuid": "89e4098e-27ce-4b30-90f2-fe55fe3e24ce", "value": 574490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889401, "uuid": "b8c296c4-64fd-4dd2-93e2-42fd56af3645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889401, "uuid": "d4975b46-091a-45e6-aa35-2d8fa140ef7e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204bcec9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889402, "uuid": "e4df0f63-4476-4943-affd-0187e4250a90", "comment": "Malware payload", "value": "7923bf090462790f84e1fd7c584bac79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889402, "uuid": "8b4e02c3-ed2c-47fd-9120-c1812a4533cf", "comment": "Malware payload", "value": "090827a413e6ad50a360077b68ab78db8482fef91b0b12d2d0a779417a0c847e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889402, "uuid": "f9339649-12c6-4f45-ae09-390f20fd68f8", "comment": "Malware payload", "value": "4843b65de422892452de6a6eab2d5434a1aaa00c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889402, "uuid": "fa49170c-28bb-4ef9-acc6-dbe4927c11de", "comment": "Malware payload", "value": "1e9c04ffaf494eba5cfb3b592a6761312980a298e371a372fe01597c378d04691032e299394323f7ba70bb3b803164bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889402, "uuid": "f642c909-d049-4b96-9974-1de006307682", "value": "T15D86330572B509F6E9B7D179D2D38A22EAB2B8560375C3DF33A482642F237F45934B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889402, "uuid": "93982711-287e-4f62-9ce7-489f6a985768", "value": "7d1e2eb3b49f4770c4fb61600805c72e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889402, "uuid": "289eb2e5-3d42-4a17-a384-0fc7b2ad120c", "value": "196608:i5tA1HeT39IigFeE9TFa0Z8DOjCdylVSE/GoznzZBW0C3N:i5m1+TtIiRY9Z8D8CclsSGorM3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889402, "uuid": "bd09ca93-9600-4aca-b654-e48fded61576", "value": 8229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889402, "uuid": "74c3f629-07dd-4c73-bfc6-a91f38aa961c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889402, "uuid": "018933da-c059-4abb-b8e2-5bf439fdfd3d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e66437-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889403, "uuid": "56b6e965-6e98-471b-9f1f-f98377d9112a", "comment": "Malware payload (Miniduke)", "value": "79cb67926a428085ff0e0be890902c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889403, "uuid": "17103806-ddb3-44dc-bc6b-e84a87d0b4b9", "comment": "Malware payload (Miniduke)", "value": "090db79b2060cbedf18d05b99e5de4cd9c96f9bee6eea731309c3ab4770bc233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889403, "uuid": "af0ff62b-f867-4af8-a880-4d0fe752b4cb", "comment": "Malware payload (Miniduke)", "value": "66a83670260a38f0326526d37941f9336f61627e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889403, "uuid": "3a480258-2817-4061-b015-0faf1704bbe7", "comment": "Malware payload (Miniduke)", "value": "b5b2e79f1d08c4878655a221a0d2747561b203e6d4ab06730e091738b65ee52a136e7f71258b7499723f83dcd65a8636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889403, "uuid": "d19568ae-32af-4a1f-8bd7-237c0a6d3574", "value": "T1C8049E3933F580B1E53316B46DF1AB72967EBC384A71858B9BA41B5F2E346918339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889403, "uuid": "d71dd3bb-c359-4b1a-acfe-6ff53aaf8cda", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889403, "uuid": "7465ef24-4850-4914-8cd6-c80a8dcf2821", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZqkcYIWJkHA5Se:+/LhS0rKE/FLITo9mVIWWHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889403, "uuid": "0e15b3d8-1e87-4a09-9dcc-f00b2578a71d", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889403, "uuid": "cbaa9614-a55d-47d9-a33a-dc61e7c39fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889403, "uuid": "070f1a7b-ab27-4646-a05f-cebede4d78a8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2183d993-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889404, "uuid": "01049e66-ff9b-42f2-90a0-c710b0209c76", "comment": "Malware payload (Worm.Mofksys)", "value": "9e85f913b77dec3f3f15d10044d07fbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889404, "uuid": "87f2d1ac-8768-4cd9-8b73-49d9f2eddc7c", "comment": "Malware payload (Worm.Mofksys)", "value": "0916f597dfde81dd917cc79c58b30121b9ba617d0aebbb957b79ca9537473099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889404, "uuid": "7b65ccb0-3c71-46e2-ad26-34450ca8e407", "comment": "Malware payload (Worm.Mofksys)", "value": "102f94dae45bd6fe09da45788606233b3f4fd736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889404, "uuid": "eab7241b-71cb-49be-b9cd-d704c19ab7c8", "comment": "Malware payload (Worm.Mofksys)", "value": "d03b20cdf665cefd6f6791ced2bb00967a37c4e3ae9cbbbe483e332513c68206a67157a495f5fda774b79909078e49bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889404, "uuid": "4e566913-55ce-45f8-8f7b-1bcfca247cc8", "value": "T1E194081AFF08601AD0AB96F054A9A09BF3667E111FA0DD0B7791BB4A393161375F930F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889404, "uuid": "912e91a9-85b5-4914-9f52-a0825b4e0b9f", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889404, "uuid": "129a9c44-7078-4944-8373-a72c3dc175c4", "value": "3072:2vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uxpUtqtvB1TgR7:2vEN2U+T6i5LirrllHy4HUcMQY6RqHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889404, "uuid": "df20980d-546d-4c4d-8d65-8286d6ae558b", "value": 423549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889404, "uuid": "a252b2dd-f9b5-4869-a883-daa3f9658147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889404, "uuid": "83f7a1a4-4eb0-4cd7-9392-10db7ecccd9d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce83763-c84a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763888242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888242, "uuid": "84923c07-003f-4671-afb8-534968fd3b71", "comment": "Malware payload (Mirai)", "value": "3cd08482237b105d7d368b75978e4555", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888242, "uuid": "7ed04ea8-2a0b-44d8-a0d8-b97fa2f7c58b", "comment": "Malware payload (Mirai)", "value": "091a98adde779bc631ce6ecbb7711008bf89f2a5d23a953d0593a1e188301ca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888242, "uuid": "a16ef19a-2397-4a05-9aea-8cd85605f1c2", "comment": "Malware payload (Mirai)", "value": "0ab372efc3e79373da7a108663006622b623a922", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888242, "uuid": "14f60a60-b629-4d8e-af9d-970d49735e5a", "comment": "Malware payload (Mirai)", "value": "a75f27b3b20ce8ae916eb72bdbffa4d379b4c8e91371b32198c4bd4a05fef6b27c86313e80fbc54f9d8bc7319bd4cee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888242, "uuid": "7373ee87-ec96-4992-b33f-c910a4a156e1", "value": "T14454C70AAF710EFBE8ABDD3706E90B4525CC541722A87B797530D528F14A64F19E3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888242, "uuid": "b278064e-10a2-4a73-84b6-c90717dd56de", "value": "3072:DJpjdZrKTW7LigU2NeBP4v/atECqtVKk/azDHPzb8vPb:DzjdZrSW7ugU2ABostqRCvUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888242, "uuid": "e1c0f61d-9620-4c52-be2d-70f8f023064d", "value": 280920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888242, "uuid": "3b443d88-5ea7-4570-b362-ebb156af07e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888242, "uuid": "4ab13a2b-4dd2-45bc-83eb-5ce169eac062", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22189105-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889405, "uuid": "2418173d-56d0-4e1e-9f41-6067545849b7", "comment": "Malware payload", "value": "26340e643e6897ce193f1f4b4e235219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889405, "uuid": "926fabf6-0f04-4cf3-92a3-6a59b536d346", "comment": "Malware payload", "value": "092dc4e7e16e357d3098327b9c2356b84134a5cadfe4c1a65b1ae8bdbc0d6280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889405, "uuid": "1d666e61-3166-4c08-b2e5-8dff11d468dd", "comment": "Malware payload", "value": "69dcdac83f151f4f5a5a0c27837ab55c7a41ba94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889405, "uuid": "e1eca323-7d4c-40e2-9064-7ee7399b2851", "comment": "Malware payload", "value": "89fdf88984215c439d820d6c8a38c9fc4928b3c1ec6805dc3786dc2968a78488ca3c47b5699f2c34f2f37c96dc245b3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889405, "uuid": "b0ea395a-9f80-4e9e-bae3-3888fa9ef53b", "value": "T1BF64AE7377C08DB2C846053002976B768FB3FA3A15718467BBE4572B6C74D50BE6AB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889405, "uuid": "c3b37266-6777-49d0-afb7-d54d82fc794c", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889405, "uuid": "380f665e-a3f6-497a-ac4b-71cf305ce5d8", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5TKReFR:BtKe6YiDdv3m3mgKHDjSeeRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889405, "uuid": "67d8222c-514c-434b-add3-f90a1c17bd05", "value": 322835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889405, "uuid": "51690143-8ce2-44d8-9113-9b06ddfe845b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889405, "uuid": "7bd70c86-e80e-4dcd-bb32-c9b31ba1e39f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e04dad-c84a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763888472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888472, "uuid": "18557674-573d-4f90-b429-9ac12f2115a4", "comment": "Malware payload (Mirai)", "value": "4eac7bbdca3030ebb7081246c36a050b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888472, "uuid": "0f33f3fc-4853-46c7-ae94-bd311108ba17", "comment": "Malware payload (Mirai)", "value": "094e6c7a079e2fbe0a5adef8a0263d950e6b1649b8414097d13a34101fcae9e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888472, "uuid": "98a57e71-5a44-4ec0-883f-72895f777aba", "comment": "Malware payload (Mirai)", "value": "987b083eb4960a2ddeef120c234601aef4251bc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888472, "uuid": "af9d13a9-9503-4f29-88fc-828f017fc436", "comment": "Malware payload (Mirai)", "value": "8b0057fa0c467d501b0273b05e6e50fa020e7321f678ed4f75acbfd1fcbed207ab2417dcfeaca5bbb887ec612e5b64a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888472, "uuid": "e769b2d0-81db-4bd6-953c-d501d1f8904e", "value": "T13653028181D95240816F403E54FF036EC872FA6E7B5FE2AA9EC9647399D0A5F2C617C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888472, "uuid": "be140b9d-935e-4dea-9165-4bb5027ee2d2", "value": "1536:Xoopl2UxIX/85ontKXA+5DHEOU8snouy8Hyi:XzfLC/BSf5bEP8soutF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888472, "uuid": "b57cb9d5-d040-4156-ae99-23ee6bc34c16", "value": 66268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888472, "uuid": "8cca2eda-27cf-4198-b9ca-9a517b6d7b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888472, "uuid": "91621002-36aa-410c-b04f-906ac7342f12", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b41364-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889406, "uuid": "fd7c57d4-dc75-4028-b1c8-29faea966c41", "comment": "Malware payload (Simda)", "value": "c90f7f9b1ee91cdc50390b5e4638632b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889406, "uuid": "42b9a5a4-e987-4638-b486-f466ac38b568", "comment": "Malware payload (Simda)", "value": "0954d357412d7bcccb3e28d9760e621a7c32a34626fa7fff0f4c101de53ddd05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889406, "uuid": "8aa71ac7-e976-4098-b339-091659149fc2", "comment": "Malware payload (Simda)", "value": "c252da62f787a6593de65f6a1a232c9039ae77a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889406, "uuid": "ce8b38f8-e475-46bc-917e-4a1ef11f9857", "comment": "Malware payload (Simda)", "value": "15fe726abce4ae0553f13ac4c2150fd6aa0347d5d0b4b78d7c6f1af00fa9b9ead0c78cc4e10e89a1fe40a984f90d65f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889406, "uuid": "0c531855-5783-431a-9e49-5f3ebb577fad", "value": "T1E5841213ED55915DC0710132BCB6DBB66D7FD2B9166202FF290C160A2EEC6436CE9ACE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889406, "uuid": "6b419537-61e8-48c3-91b7-2e367581dc2b", "value": "562bef84679104f4bb60284c80d2d238", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889406, "uuid": "2b182504-a8d5-49c7-afdb-35299f37cb84", "value": "3072:8OJM8BUIyMh/fuGk4SGkjyu3wMD32onjlWnrBJke78ilZHMOke7QezadcarPCYpx:+IU9MheRXngMDmgV2Mk0JcRYenA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889406, "uuid": "e058dc59-d7a3-4b81-9dc6-a0ff664687e0", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889406, "uuid": "ac616e93-e781-41d6-b97d-5ed0d088ebd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889406, "uuid": "cebe8156-10ec-475f-b098-23278305412b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23608fd7-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889408, "uuid": "2e17f6ba-754e-44ab-a163-aa0b556c7dc3", "comment": "Malware payload (Simda)", "value": "07b1ba1f46b41cd0d0ed9dc6d6d0b135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889408, "uuid": "23c0ffc5-edb7-43e5-a441-5e812b0959a7", "comment": "Malware payload (Simda)", "value": "096565e7dba18a134a70a87f1bc7158f31007366958a3fa637ffc23085168275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889408, "uuid": "6168a1e7-569f-4aca-ad7c-bc51207c8fb7", "comment": "Malware payload (Simda)", "value": "7a17123c25329904a9cd56c8ab6e84dd874e4af6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889408, "uuid": "a021e31a-2925-492d-96d2-2a30eabefb34", "comment": "Malware payload (Simda)", "value": "8926ec75087070ddd430d610229759ffdd3309f99d54e39621d689ed2738f2b1c15353b412ffe6c67470d38b6ab42fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889408, "uuid": "a70ee331-dcda-4a88-a163-1d6f6624303d", "value": "T167C4123253088DE2D9120DB704F1974225E9E638D3F5C2876926098F796ABA37C7DF1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889408, "uuid": "6aa7d2ff-b2a2-400b-9df5-7cd205434111", "value": "98aa7065495f35513795744857924eba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889408, "uuid": "c44e3484-7428-43fe-86c1-ab37ae4c610b", "value": "6144:St++Jbojf5Vq5OC4qZhZcKYhc/ZfUozYE:9+cff22qZhZcKYhc/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889408, "uuid": "59b5c4c0-49da-4cfc-9446-108b0e7a7b79", "value": 593468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889408, "uuid": "dcfd582b-e78c-4e60-8063-b7a1f2c2bfc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889408, "uuid": "e830b5b8-9b6c-4c8b-96f4-0e0db52fefd2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24222c2f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763889409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889409, "uuid": "799538d4-a18b-4342-aa4b-61cc6efefb93", "comment": "Malware payload (CoinMiner)", "value": "d922592d80691a2fdfe122a155b6b5b9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889409, "uuid": "234474ed-dab9-4d84-ae9b-eaf11c474414", "comment": "Malware payload (CoinMiner)", "value": "09683eb695a58879dd33779adcef82f6d0b73ae4153b5655c33c1fe69c37c6d0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889409, "uuid": "2b42d3b8-ac1a-4431-807c-4c73b99b137f", "comment": "Malware payload (CoinMiner)", "value": "817ead0d80d672cb25e87105957a4c6c46f4281c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889409, "uuid": "635e1018-204e-452d-9c4e-37c27a801559", "comment": "Malware payload (CoinMiner)", "value": "cfbe130bf377b713644be5fdbb978aa5a5fdaf7cfa992bc76141a58874c4a792be79c8ebae4fced95550dff194c348c3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889409, "uuid": "0b765999-1dc9-4028-8a37-345cfacfe9ff", "value": "T199569D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889409, "uuid": "47f4087e-b9ef-4d2d-935b-c43b4887cd32", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889409, "uuid": "f1576afd-1b51-4dc3-9122-43b9e2339dc1", "value": "98304:IvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650x:I/II/6aYXdFD22VatktKpEEd1Qi0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889409, "uuid": "0e43560f-cffa-4ad6-bd1b-2a6ad247b6f7", "value": 6442452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889409, "uuid": "14fded03-3992-4048-a7a4-761560e5d49f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889409, "uuid": "a05743ab-9a48-4f2d-92e7-5fa03e65d829", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b6b516-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889410, "uuid": "ef3b1421-00f9-4f15-9a0d-6afb6dba0ee3", "comment": "Malware payload (Simda)", "value": "37fc2714a13a9d0f1a9965b718e1e996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889410, "uuid": "c95d7076-ca45-4121-93f6-2a93252e5dce", "comment": "Malware payload (Simda)", "value": "097bd5475473d973ae87074af9b1b69a315c926d93a86fa48f89021b80610252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889410, "uuid": "f25dac1a-52d6-42eb-b047-c6c2b1d17b7d", "comment": "Malware payload (Simda)", "value": "cbada8ea10e69044708f58345559ff68454d8405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889410, "uuid": "399c4120-06a8-4521-a9db-4f52740bb684", "comment": "Malware payload (Simda)", "value": "f746cb4f3622ca69680b15870ba0bc57058eef3f63c498d80c33b1ac3007efe1d573507334cd3ea2624b68f222c323f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889410, "uuid": "7245a5ea-bd93-43f3-bfb7-5b01cd769c89", "value": "T1B0141203B26518FEC1E189FBE861F302A62AF5161950CAE38620973E1DE58927E7F171", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889410, "uuid": "06ec290a-dff7-45d0-83e7-f9f01198b5a6", "value": "e13e40bbe88a0b0f403e1860e4c9a9ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889410, "uuid": "222f4267-925a-4149-ac55-1a2231ea011a", "value": "3072:lkEVV2akVeCq+jTG+gKF66PQGWjWc7unJLrTKzsJt4ofNlPgw0L2+SC9a9o:eEVVPx+jTG+Np67uguNf/PfiDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889410, "uuid": "66504c78-b45c-4727-9ddb-1f37cbaf065f", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889410, "uuid": "7c043c74-50b8-4f59-b282-24baff7d18cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889410, "uuid": "acb03ffb-1d67-434f-b560-1dfe92ffe292", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd2cb6f-c84b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763888596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888596, "uuid": "00e8c94d-1a5b-448d-8cee-f28cd1123d9e", "comment": "Malware payload (Mirai)", "value": "f83006c9c3f9ce19cf223bef50a177ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888596, "uuid": "f20f0454-26d8-447d-a1f2-90e76968c246", "comment": "Malware payload (Mirai)", "value": "099d29f38684c1e01d3d51d661678fafcf10e36cfc9bacc8be783c934dcb7b1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888596, "uuid": "74da5da1-e3f4-497d-8d12-2586b3c7e5b6", "comment": "Malware payload (Mirai)", "value": "2df23cc1db2c7112195af48526f2af222626547b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888596, "uuid": "c0df7fb2-4c19-41e9-8e49-c8c1ca89c890", "comment": "Malware payload (Mirai)", "value": "d0d031c1fed95b98699758b3ac4b751702cb2f203e4014eb9cc97dbe0093f1520f09fe3b22beed086cb294d1c4732917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888596, "uuid": "080af7da-2f05-4269-9e91-1254e43b103d", "value": "T187F46C6377218F64E365D67005F387119E9521A30EF290C6A2BCD2207E6066D6E6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888596, "uuid": "07e1bc54-815c-4cf2-b2d7-33db01fd6a6b", "value": "12288:OpEPKmln4Dzrs61rwSWnWv48nGNmzzuf0eXbtqgp9kMToBid3:YwKm569Z48nG0uFXbt+eoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888596, "uuid": "42720e1a-b410-405e-84e9-572dac4cee97", "value": 729928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888596, "uuid": "1ab61d32-5e25-40a8-8606-a6320a2ca1eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888596, "uuid": "f714e9bb-1520-4f2b-90d1-c25c0932405a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aeabe07-c886-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763913928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913928, "uuid": "47bef1b7-8357-4b6a-82eb-94e50e7c406a", "comment": "Malware payload (ACRStealer)", "value": "785152ec840e679381f94fefdd5b27f7", "object_relation": "md5", "Tag": [ { "name": "46-62-234-82", "colour": "#D404D3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913928, "uuid": "4fd7aad6-31cd-4a28-bafb-fb692b04f192", "comment": "Malware payload (ACRStealer)", "value": "09c4641feea6d8c09f8a9b7b13819172820ef08653758cc14bb2e7fafbf86cc3", "object_relation": "sha256", "Tag": [ { "name": "46-62-234-82", "colour": "#D404D3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913928, "uuid": "91e71877-93f8-4dbe-a145-9433f324d301", "comment": "Malware payload (ACRStealer)", "value": "e01d6058b54cb904d196389cd282df261d9e4a75", "object_relation": "sha1", "Tag": [ { "name": "46-62-234-82", "colour": "#D404D3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913928, "uuid": "c00f8496-7ee6-46c5-81f7-beb2461be4e8", "comment": "Malware payload (ACRStealer)", "value": "565327566bcfbe4c4f54c50abb2dbc9266a5aee831f2b5581d1dd7cd9b31bf750094d1a68d4d71c8251371f9a4d43da0", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-234-82", "colour": "#D404D3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913928, "uuid": "0efb2865-aeaf-4809-bdf2-09856cdc9670", "value": "T10DE6330B7AD9F60F5B387D00BE38DE31D6E53EB700E16AA78EB9C005526BD05941AF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913928, "uuid": "e77637ce-33a4-45db-ab03-0847ad182238", "value": "393216:olF4my9gBGW9nOfdVbjzzk6FAvyBOGDu9kZr0Z/AFbO:oT/UcOXnk6FEyMFkt0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763913928, "uuid": "f896ad9e-7816-4486-9ba7-43a257c0abfd", "value": 14266844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763913928, "uuid": "7676c25b-e002-41ea-bd18-4043739e865b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913928, "uuid": "ad18d96f-842e-4927-9ab9-9ea0a9e74c0b", "value": "\ud835\udce2\ud835\udcee\ud835\udcfd\ud835\udcfe\ud835\udcf9 \ud83d\udf38 \ud835\udcdf\ud835\udcfb\ud835\udcee\ud835\udcf6\ud835\udcf2\ud835\udcfe\ud835\udcf6 \ud83d\udf38 \ud835\udcd3\ud835\udcf8\ud835\udd00\ud835\udcf7\ud835\udcf5\ud835\udcf8\ud835\udcea\ud835\udced \ud83d\udf38.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2549823c-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889411, "uuid": "04059938-90e0-4416-828d-24fa327d3f67", "comment": "Malware payload", "value": "63aa4bb1a24222a35a0c5c3f51b5b7ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889411, "uuid": "3759b3de-cac6-4702-979c-cdbd39f7f8e3", "comment": "Malware payload", "value": "0a65547ddb21eb0185faca77ac3482dcf50ab9dd81a016a3c73aea95fbcc3d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889411, "uuid": "6e796ec3-c2a0-4ffe-b90b-b02d0eef56e3", "comment": "Malware payload", "value": "760938fce8cf4520b1c149f077e29829b275a48c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889411, "uuid": "e456aefa-4751-44d5-b3c1-f148840ab32d", "comment": "Malware payload", "value": "f3b97f2add77d17db6cf801d46ae51b6def26d69490e21515985318094ee1ef55f66428a95744fb661ab150c5534b181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889411, "uuid": "26f0ebad-dd68-49cd-be1c-558b47b6c82a", "value": "T193144FAE2948445EC4F89A72B0705A88C9E95C179177CC383ABECEDC4B3730656FF196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889411, "uuid": "3a0a9ab7-84db-47c3-b51a-99dfd78589be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889411, "uuid": "b84e0822-eb32-4269-bfe1-413a0cdac058", "value": "3072:pNjum0ydDKqX0LOUpVOMk+JO7OVOHOWOUOuOIOKOkOmOQOhOXONO1OHONObOROw/:4ydbse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889411, "uuid": "05a62afe-d1f4-40e4-935d-ff5eb29934e5", "value": 193971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889411, "uuid": "34b02580-4199-4834-a1af-c9b600f99448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889411, "uuid": "c0fb4443-9502-410d-b4f7-f7402aa01627", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e90f19-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889412, "uuid": "fa53b0af-3354-4a58-acc4-d9e187c976ee", "comment": "Malware payload", "value": "f36092ab8ba2aa3f590f58a21b688e13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889412, "uuid": "890ee7ee-8d17-4864-9a8d-eb7bff8d922c", "comment": "Malware payload", "value": "0a6580a5724eb191daac90d567863803a85cb6d37d70fa8464050721ae8fcd63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889412, "uuid": "1e437c53-ccf5-4be9-9338-253ec7ace169", "comment": "Malware payload", "value": "22646015014be203b716cf13b867384738965c8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889412, "uuid": "ba5cfaf1-c5b4-4088-8403-137325c383fb", "comment": "Malware payload", "value": "6c93b61b44d6435cd063ead0f9ebbe96b2e1c66c27eee6dc452b342b5b45c3dcc8bd0547debe66aa183575629eed10af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889412, "uuid": "f7183f13-c67f-4339-b54e-ab7a6082cf09", "value": "T1EAA5D0480847511EF9FC81B7E135033FBB7D9701B8A64ED2299D11E8D25C720DEE9AAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889412, "uuid": "cbf4311a-088c-4521-bf88-1632f4985ee4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889412, "uuid": "f48e07dd-801a-40c9-aff6-11b9a87f7822", "value": "49152:uEJGsPtEWWBsgoZVbD8OGSK7qKmgy0BKW6rKk:DVEWWBgZVbDVEeKmX0k7Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889412, "uuid": "563cd1c8-79ab-4f9e-b02e-42ae7dfc52c0", "value": 2131188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889412, "uuid": "27970f0f-03a8-4ab1-94cb-b6a458331aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889412, "uuid": "00a6c36e-339d-43e6-9f5c-f65e0fe3997c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2688c7ff-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889413, "uuid": "8f19d214-eb77-4285-811e-3dc50ba46089", "comment": "Malware payload", "value": "562c07d5c29c7cf6499ced6f09942588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889413, "uuid": "5291dc72-a8b9-4f21-9f57-e6b5784e8cdc", "comment": "Malware payload", "value": "0acbb61f3d212fc660dfd80f3c956b43b01be7459c8597aedfb75256be0ff99c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889413, "uuid": "71e4b621-0eef-4c82-ad28-c1d661690acf", "comment": "Malware payload", "value": "ed76987856046b94dfd5451b466d18842dcbff67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889413, "uuid": "394037c0-ad29-4496-a12a-a9ffb208ebba", "comment": "Malware payload", "value": "ffc344e78387ad9ea723a60fae7392a41ca6ecdaa3375687ad88a3fa457b176197203a2cffa88e6f7b7724793ba5964d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889413, "uuid": "0bcd211f-1f03-42dd-af97-fce3c0a7b33a", "value": "T18374D07377C08CB3C80516300297AB768EB3EA3A25718867F7D46B276C74D51BB6AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889413, "uuid": "120bda83-17f3-4af7-ac35-069a0b68b0af", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889413, "uuid": "0d6f6e95-8fd5-4652-aabe-c6be55b7698e", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5TtI6gpbbWPm4rJ5S7Byz:BtKe6YiDdv3m3mgKHDjSehFgZym41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889413, "uuid": "c7dc1150-b3ed-4e78-82f6-b37be7adb405", "value": 366965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889413, "uuid": "87d6b934-7070-4c03-8c0f-06383b1b42aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889413, "uuid": "8f475aef-d1ca-4517-972f-614cfea8f735", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27209c27-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889414, "uuid": "415114dd-2c42-4e3a-824d-33edbb9fec41", "comment": "Malware payload", "value": "ad50f84d808f46f9b9d9e2ecbb8759f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889414, "uuid": "2838ed52-5f81-4c69-a934-d171ea00766a", "comment": "Malware payload", "value": "0af4c2375e5da06de8230882406bf898be300db11c4c3701a8535413b62c561d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889414, "uuid": "8de5759b-a390-4ba3-aa3b-46034d669e49", "comment": "Malware payload", "value": "ce1ad2427803fd7d1f6cc54404910917428922e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889414, "uuid": "6591db2c-6fce-4fce-b018-a18ef178e1d6", "comment": "Malware payload", "value": "e293ca7a4f279e9e98c54c5fb97447221541ba19bbc697c15bb1df06899136782648194a0e2e2ed67916ccf7ee4d75a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889414, "uuid": "995accb6-f30e-4dd5-af1a-ebf634f2f51c", "value": "T11B34294B73931CF8C67B807986D7DBB1A932B8150324FE6F0694CB332E61D510E6EA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889414, "uuid": "46e469e0-e9c6-4093-a390-dc7edad6243a", "value": "b7b39d5f4f33395d7a4a007f0cd1b5c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889414, "uuid": "a91ef58a-906c-4672-be10-1c5550aa5e0d", "value": "3072:3Wu4w7QUU7yJcDMq54MHuzs+QAla6LSSfU+ZX91jlh/ZgO096dGdwO3mOIQLDhZY:3WuYQNaFiYkOhptlaIOsIRIhUSmIA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889414, "uuid": "fe3557a5-d1dd-4309-9b12-3cb3aba890a9", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889414, "uuid": "3e431a0c-2b31-4483-9eac-25cd41070c75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889414, "uuid": "40b90f09-e182-402c-96d9-2360f5bd27a8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b361c8-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889415, "uuid": "dcd37974-c496-4fa8-bed1-18e0c0fd3b92", "comment": "Malware payload", "value": "2e856b1451e88eb55270fd59be92260a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889415, "uuid": "eb1225de-61e3-46e0-b868-a5eb8a8a15d2", "comment": "Malware payload", "value": "0b05c1b478ad00ed4cfd258845cd2bf9863a7ee15e53fbe26ff1388b7e5b48af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889415, "uuid": "b3e6a01e-9d7c-4e4e-ba82-dc7cf119011b", "comment": "Malware payload", "value": "5f9991b1359428fbbc971b7891d29d8a19c3323e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889415, "uuid": "a639a107-3ee0-41a5-a233-00fbc8aafa95", "comment": "Malware payload", "value": "5ab8d71b1b02045759e1d8574c4f29ff28b1bd3727b57ce889e5b68a6a12dbf1491317543f74bbec4a90771d354954ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889415, "uuid": "9533ee52-6a96-435f-be0c-b17fb2e96932", "value": "T17C93E84BF65281B9CA38C537A561C1B21F253E75AA63CA3F31513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889415, "uuid": "f60296fc-ef2e-4b55-b1b0-db6eeffd8bed", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889415, "uuid": "08042af9-6608-4007-b9d7-cdc1710c0d00", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdp:41bC4Bk6lMTOWw4PkRAPoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889415, "uuid": "d8f12a69-0125-4648-918c-9b1f52fed480", "value": 94261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889415, "uuid": "33dd59b0-9b2c-4fab-ad87-9e6bc5506358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889415, "uuid": "be3e9543-8552-4ca3-8927-34601df47b58", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286ede12-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889416, "uuid": "1c5ac4c9-ae4f-4e68-8acf-6f47d793747f", "comment": "Malware payload", "value": "f75848db2196d8d1174dae1b94711619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889416, "uuid": "f0e613cb-cdf8-4392-b19a-128c4ec18374", "comment": "Malware payload", "value": "0b100095390c79ac6dfee60321608d09ea9c4647041cd640a50a0fbb9b05a843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889416, "uuid": "541d2008-c1e8-49c9-9647-769da27b1a38", "comment": "Malware payload", "value": "1ec260287cd92048942f6fd650bd10cff8630a7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889416, "uuid": "2678aa7b-f1ae-4e3d-82ab-d44301e0f15b", "comment": "Malware payload", "value": "a92708d09353743af048e753173d94b63f38d86c0d6135ca2327f31e36c5cd159cb65a1928fe5e6e88254b18909246bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889416, "uuid": "bf9dbb4e-96a1-44f2-bdad-773573a38213", "value": "T1A7357D5933A451A9FEB7E037CA52C307D7B1B88A4277872F01E04AB66F736B11A1E351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889416, "uuid": "2200a107-655a-47d0-bb3f-9471e73c108d", "value": "a6b79195015e1e45d816e61ee943224b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889416, "uuid": "93bf1f96-2e5e-4521-aca4-162d0890eadf", "value": "24576:iRaZROMOm8FN7TjsPnzt2heeRhQbJEOeamF77zLsTJ:okxOm+7TjsPnztyDMmaiET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889416, "uuid": "431ebff6-ce55-4284-a29e-e4fae4c75974", "value": 1072128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889416, "uuid": "37addef5-e7bb-4616-bdb2-fcbac47a5429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889416, "uuid": "a79a972f-fec3-46ce-acae-f52551c56b66", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290b0bf3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mofksys)", "timestamp": 1763889417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889417, "uuid": "38355786-ab1b-45c3-82ea-44688280d0d7", "comment": "Malware payload (Mofksys)", "value": "1a5800f4a9e38630978ef2427acb08e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889417, "uuid": "5583c5ce-8738-47eb-9681-a8fbe99f8871", "comment": "Malware payload (Mofksys)", "value": "0b285d26f73dddc10935d53e679a3f13dfcff85acb4fb54ababc3e7a5a3afeb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889417, "uuid": "28de19cc-4b84-462b-9dd0-581bde79364b", "comment": "Malware payload (Mofksys)", "value": "637e1ee3926d0d1358bdd503139a8f968a0e5302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889417, "uuid": "30f26e55-bd57-4b76-b408-643f679b0f33", "comment": "Malware payload (Mofksys)", "value": "ee323631d4ab271bfab6a0a90f7aa6019f1901f300fd090a5608ee2ae253502bfafeeb57fd62a9ffedde457b700c59c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889417, "uuid": "fb0ce90d-2569-43b8-8130-1760f31d3c35", "value": "T199540B5BBE44702ED4A787F01431A97AB5662D221FD19C5FA3A1AB1234B2643F8F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889417, "uuid": "1498ea4d-fcc9-4059-9a3b-7265b195b3d4", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889417, "uuid": "360e4ea8-e8dc-468b-9ece-b874892d05a5", "value": "3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6undj1:UvEN2U+T6i5LirrllHy4HUcMQY6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889417, "uuid": "bbaa3a7f-9336-4b18-a8bb-beb4d565cfcc", "value": 281029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889417, "uuid": "ad63fcd7-82ec-4e98-90fe-d815506cdebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889417, "uuid": "84374403-e70a-46c6-898f-a0f923cc05d9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a37f71-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889418, "uuid": "c200ae51-106e-4542-9ee8-43d280dd6629", "comment": "Malware payload (Simda)", "value": "c5664618658cdb34447907eb251ec40a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889418, "uuid": "4caecfe1-71f5-48f0-922d-61ec425790d6", "comment": "Malware payload (Simda)", "value": "0b3a560769cb44d82070b66d0343ce88106299d8e88122b579302b0513f27130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889418, "uuid": "13381045-6c52-4af3-b7b3-666bf9014d8f", "comment": "Malware payload (Simda)", "value": "f812d588b70f70b5d2739cca81b5084a81d7d24a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889418, "uuid": "e5ab4f36-6eb2-4ab0-937a-d5afa0cd7c63", "comment": "Malware payload (Simda)", "value": "1ffb4875a5bc8c5e356b4ef0fa83730129063099c0461eee633687b6dbcfd33902bc1ccdaafab8031c951e933a8d43fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889418, "uuid": "3e9f6206-4ffc-40fa-8a29-7aabcbe42c62", "value": "T1F924022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889418, "uuid": "fa24971e-67db-4325-9a0d-0d746949bb76", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889418, "uuid": "8578fc15-176c-45bf-92fb-7a5b798c3f84", "value": "6144:WZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:0quCuygMQjd5vJIBP1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889418, "uuid": "665e505e-89ff-4532-9f42-08d1418a2b28", "value": 213054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889418, "uuid": "618e45ef-c211-411d-a0e8-b3b085714dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889418, "uuid": "904534e3-e89e-4368-9322-3299b12849c0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3e4247-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889419, "uuid": "5a94c3db-d35d-4e6c-ae17-2fe20bfd722a", "comment": "Malware payload (Worm.Mofksys)", "value": "a03b585da5eb95380aad966939349166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889419, "uuid": "9dd96f19-25be-48ab-a4ec-3e426553e61f", "comment": "Malware payload (Worm.Mofksys)", "value": "0b4fa75632441a8e6adb8f134cb1e3dea7214a371389e8b6f73e2664d42162a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889419, "uuid": "84df180c-7b21-429b-a2e6-87588115c8ea", "comment": "Malware payload (Worm.Mofksys)", "value": "4bf2623bcba574a8f986d1fd8d7a3e2ed41a9228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889419, "uuid": "1defa542-668e-4b6e-8af5-21e59b783639", "comment": "Malware payload (Worm.Mofksys)", "value": "653953cbef128e2b5237822ad369f02782ea88f3280a0f64b0e7f2976038fae4e6029b39dd0476f4303699a2736642da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889419, "uuid": "5d332370-9432-4e01-8b41-c6932f00267b", "value": "T1D224082BFA40713FE556CAF01922E2AFB5226E210F96EC4B22919F4934B1553B5F530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889419, "uuid": "c75ee66a-6e52-43bf-97ab-bbb2c7c02cb6", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889419, "uuid": "7f5060dc-56da-4e8f-86ed-5547ee00f2be", "value": "3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unO:5vEN2U+T6i5LirrllHy4HUcMQY6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889419, "uuid": "d02b78f6-38dd-4751-adf4-3ff52510e32b", "value": 211789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889419, "uuid": "547c4daf-6560-4d17-8722-9cb8cd708b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889419, "uuid": "9a66a19e-da5f-4d9f-ad49-e75170b95708", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aebbffa-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889420, "uuid": "89ce1c75-d7de-458d-ad3b-b32413ebba10", "comment": "Malware payload", "value": "6b87b9ee0b174efe3d5d1a8d7b65a0d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889420, "uuid": "00649ba0-e0d9-49ea-9397-027e41af69d3", "comment": "Malware payload", "value": "0b76a22d2413e2b5d4dc60d51904e004dce64c62bdc80bb40a09a37a50a7d2de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889420, "uuid": "661647ed-583e-43d9-9cdf-840865a1342c", "comment": "Malware payload", "value": "1647481d385b425b1365b31c954bc210aae4ca06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889420, "uuid": "a2c0bcee-1fe5-41fb-91e4-623c92d9f242", "comment": "Malware payload", "value": "eb4d27137564ba85134f278d4a99c845fe8f5d03d30a72cf3e075264dff8956b18da165658f51b599a701d7a65c8e93d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889420, "uuid": "e95e325b-5a74-42f5-850e-01dda2e57f3f", "value": "T18B35334E05C33755DFF9A3B24A8524E5256337EC57A06838771CE0CA03E3A599EF81AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889420, "uuid": "f34c0ca5-3ecf-4930-a24d-2a27cbf9f402", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889420, "uuid": "a916e60c-42c8-4510-acde-d2b4dd7113bf", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFtiE6ALmOv:+YhQs7tWVToP0Hs0/htDH3pGaFPiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889420, "uuid": "d48ad540-d59c-4258-8975-5902e01ea532", "value": 1141166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889420, "uuid": "2a9d4711-1a46-46b3-9196-4c332f92d491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889420, "uuid": "b9417b7b-00f4-40b8-9af9-a92417fa1e27", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b846981-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1763889421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889421, "uuid": "c90693be-aab2-4dd5-94e5-9ac21e8cfd4b", "comment": "Malware payload (njrat)", "value": "b24e5c03d3ee5aa07a4356b188ca08b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889421, "uuid": "b148a4d2-8b3c-41d6-bfe7-3736a948f7ab", "comment": "Malware payload (njrat)", "value": "0bd574d0e076982665e2e0f1de667d8e2c42d5aa00f03ef106eaef5a807b298c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889421, "uuid": "b0b57ff0-f723-475a-be16-261a109b381b", "comment": "Malware payload (njrat)", "value": "bd0d5af1ce9397bfd45fb70f6a7d22766ce8fde1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889421, "uuid": "915cfb9b-02c9-495f-a27a-52b4d7782267", "comment": "Malware payload (njrat)", "value": "6c08a0802dda4a3146081688e059753b822085ded10a0bc638180c09920e17c20b5231c12328c9b2098605807f01dc0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889421, "uuid": "83ba0edf-5494-43be-ac46-aa637d9eb751", "value": "T1CDC4D04AFB4381B0E8090837146AA77B1630AE174729CEC7E7C0FB58B977BD2757A605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889421, "uuid": "26b39f2d-8396-4c3c-be6f-0cd452c5e104", "value": "77eb68348ee30e01ec09fce3582c5f76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889421, "uuid": "6ba4aa0b-c686-4598-842a-d6aad01e5f60", "value": "12288:vsjCF2QZiOU+4zX7wM45QygROD22O3ZGdZK:vOC39Uv7V4WnROD22cqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889421, "uuid": "9ed9d521-4517-4640-a20b-e9dce3c7efa7", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889421, "uuid": "b45c1f59-088e-4940-adbf-a0ebaaec84bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889421, "uuid": "061d0c14-aca9-4296-aec8-1b9c88de24c6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1d48d6-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889422, "uuid": "3cee562c-74bd-400d-85b5-f31f266def7e", "comment": "Malware payload (Simda)", "value": "9acd05a5b27c59d72a1135116234378e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889422, "uuid": "ea52cfc4-6af9-4fa2-9488-942ef599aa24", "comment": "Malware payload (Simda)", "value": "0bdb5f7f03b6be6ad31a7397d265535ae95c85271d0345c6331e296ffaa09f17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889422, "uuid": "be565903-44e1-46bf-a4df-aa9660e9b8d8", "comment": "Malware payload (Simda)", "value": "4a6c4c32ecafc2ddb3ed924478c1515939981505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889422, "uuid": "f742783a-b27e-4e71-8521-fbbbae1ad783", "comment": "Malware payload (Simda)", "value": "893c482572bf051833b508e825e418a55503c5c72afb84b5576a482f0a178df328de0737fd235adb4ce51633f2ad4151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889422, "uuid": "8ba89186-eb12-46fc-9651-d6df6386b659", "value": "T1B1940241B1950902F8FA803514BEB37AA94DDCDF22A0923B70CB6189BFD42C35DDA7D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889422, "uuid": "34900ea4-4111-4dbc-aca9-4c9add8e842a", "value": "e391eee2fda3671a828f8ce7165ca399", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889422, "uuid": "04515973-76a3-49fc-92bc-dcb2e31a4bf9", "value": "6144:fa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:fbapK0JCmRcU9vVokf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889422, "uuid": "df6edaac-2848-4ef4-b782-822a683f02da", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889422, "uuid": "e9becd16-1a4f-4de7-81f0-b1ead2df3748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889422, "uuid": "22375759-5bb2-4b3a-8dbd-bf8ecedac61a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7d8cc5-c88f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763917721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917721, "uuid": "2968ea8b-ff62-4da5-828d-3d7cb538be75", "comment": "Malware payload (Mirai)", "value": "f30852f9c6bb80f8891ca54d7929faa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917721, "uuid": "9c162aad-f377-4867-be91-24df90a48a58", "comment": "Malware payload (Mirai)", "value": "0bf8d4c96479982a4659168b3d6af9e32735bf6d7543051483b9b3605b6c6f84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917721, "uuid": "02411079-a002-41d6-b666-cbe2e78f971f", "comment": "Malware payload (Mirai)", "value": "b4620774724b3a72c5dd08434054ce1b266a5b59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917721, "uuid": "f3734c4d-b8a1-4f33-8412-26b9ec134111", "comment": "Malware payload (Mirai)", "value": "82069435e4d6add3f4956634c7a7629952f67c7f75720830b2fd04200f1e4edaea237e7d0b4f3fb10fe2f2d290743da8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917721, "uuid": "9b691557-67a2-4303-adce-cb993d20b0d7", "value": "T19EB2CFCEF0A03FC8C86E6977549443E16B50A0D175EECA4E734ACC84DE6AB47784A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917721, "uuid": "b2759ef6-cedd-4058-8edc-f4005e54bdca", "value": "384:EKXi9BC8mSxbqbT9zmhWjGUkGgxV0ajdzlyiliKVuA1sVAeR1T8VRWGVCz0NvQOz:EJ9rm2bmZzgUBgxJllM7AyWK1TIWpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763917721, "uuid": "6cf9dc2e-3ff7-46bc-8fb0-9d2f0d92713b", "value": 24976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763917721, "uuid": "f3619aad-263f-466e-9c2e-a744842848cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917721, "uuid": "c7955c34-d258-4104-bae6-ba14c86af9ab", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce1ad31-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763889423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889423, "uuid": "6e8150dd-df2e-4209-9a18-5ffd8019db9b", "comment": "Malware payload (CoinMiner)", "value": "88ae3ba522c96dc06480f95fe85d33e9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889423, "uuid": "608ddc39-fa61-4d0f-bbf8-52a9b7257721", "comment": "Malware payload (CoinMiner)", "value": "0c28e850c798fbe2795087f8e0ac10c1ace6d7a7fc0de7f303d08cc185021998", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889423, "uuid": "3789b632-f912-4542-9f43-81398cc57596", "comment": "Malware payload (CoinMiner)", "value": "95dcfdc9eff574daffe1fcc5f47da45ef7c0e878", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889423, "uuid": "f41a2226-a583-43d4-9353-fb2c6120182a", "comment": "Malware payload (CoinMiner)", "value": "78d852a6c5b21dc8d589d14fd4fc00f6088342fd732cefa2a92941c0a2d1293e9da45b95f9d38cb726ab058c6c2084a2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889423, "uuid": "cb9fb59f-5231-44d2-ad0a-26c511def7fb", "value": "T18E569D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889423, "uuid": "87b75a4a-d7bd-416a-ba31-31204018e23f", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889423, "uuid": "0a3bcd3f-ca0d-4696-969a-e128ce02dd34", "value": "98304:IvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650F:I/II/6aYXdFD22VatktKpEEd1Qi0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889423, "uuid": "6d32fdc6-26f0-4cf7-b0af-2534d6227871", "value": 6435750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889423, "uuid": "7cba6c90-dc08-4088-96ae-48ec8c7d989e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889423, "uuid": "be822232-27ec-4f25-b44a-22d50929fcb9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12099183-c851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891096, "uuid": "ce94d787-646e-47ba-aa0a-2ee4a5be29ef", "comment": "Malware payload", "value": "32d6b2420848b3e4daa7efa781933fdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891096, "uuid": "f531dac2-ca2e-431c-9f54-f2d4badccd0c", "comment": "Malware payload", "value": "0c477bd85002b8f19cbf528dd5b16c0ba3d1741ef03cbfcf1933b5e0eff35820", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891096, "uuid": "6aef6835-9e31-4809-bac8-6dd2ca34d0f6", "comment": "Malware payload", "value": "0c121eb0bf918746b871cc54903a0f416e97ba81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891096, "uuid": "9a9bb6bc-de99-4b71-9b67-8d2ced2820a3", "comment": "Malware payload", "value": "adaea41a90f891c0717c90b6d3c104687f6a228827b58ca13dece3986cc22979c7c66e765f315b395d3d5ab9781b211f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891096, "uuid": "d2ec1111-1e05-45ae-9335-a620551abed1", "value": "T12445233633C15EE8EE4A4E31420E5F208EB1D36A1F7EE811BBD86D1369704D2BD66761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891096, "uuid": "f2403d32-cde4-466f-a469-085ab4a817b2", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891096, "uuid": "5ec2ee2a-7f4b-4035-918d-1943d05a2c32", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVv2Wy:qE27hQs7tW2zku73bFgVlRlbN015CoV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891096, "uuid": "42599d1f-5465-45ee-baae-fa1b56945c42", "value": 1240820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891096, "uuid": "9881c5f9-20f9-4ca0-8aaf-46d8faec0189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891096, "uuid": "be842e58-951d-4904-bc6a-ec5d9ef5ad26", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d885d32-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889425, "uuid": "002c795d-ad64-4935-b8bf-9d466f24d9f8", "comment": "Malware payload", "value": "52b317806aae8d69587ebfa7e7532f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889425, "uuid": "a122a630-f61a-4f1e-814f-c98c12e9309b", "comment": "Malware payload", "value": "0c75cd605e5cb602e2e058b33e34738b2adc8129d9b89bf7c2c34e0c57a3acb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889425, "uuid": "f1bfd36b-6d12-476d-aaa5-85076b4db175", "comment": "Malware payload", "value": "b4df4d61fa95b31a761b5052aa711570e1b5f1b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889425, "uuid": "cd150525-d42a-492e-97e9-ed5c934b53b3", "comment": "Malware payload", "value": "f9dd1399d48b9358531269c1252115c656ccafa1aa1cbad8b4ad7f69302adc72febe91680bf376d8fce26c813aced0ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889425, "uuid": "392cc415-3ad0-4e15-ac50-1e38dde3a834", "value": "T1C325334612D33D84FFBCE2794389175C7BAE2F8817E6583EAA0DC54F42B0659BA6407C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889425, "uuid": "5a548036-096a-4312-9549-0742e47f1293", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889425, "uuid": "aca7a4c1-ec5d-47ad-bfec-e48396cb37ef", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuN2TNQYNI:+YhQs7tWVToP0Hekxbl5TuohZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889425, "uuid": "cb684398-296c-4c53-a9f4-2462bfd38c69", "value": 1033805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889425, "uuid": "531a16ad-9843-465f-abdc-bbe39135897e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889425, "uuid": "fbde4331-e4cd-45ff-b7d4-6b4688a509fd", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2a0406-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889426, "uuid": "6d8155d9-ebd7-47a1-8d4e-f26b3237f648", "comment": "Malware payload", "value": "666335c629531cbe6c47b5b985d01fbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889426, "uuid": "a0960c3b-cd4b-4606-a16d-6df0560e3763", "comment": "Malware payload", "value": "0c79d102f7016a5092382d4d001d6b0ac0741fafcc8849dda474620e5d68c9a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889426, "uuid": "23db8c61-d5cb-4e7c-8dbb-e932d195e7c0", "comment": "Malware payload", "value": "32093bf303f269991c540712e7f91713b579ba65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889426, "uuid": "03a92245-32c0-4ae8-8f49-6f977ad36acc", "comment": "Malware payload", "value": "60743a167ba583a18a7e45cb7e5cbac3f972a606a0c8c7e8b2012b7e429fd7430b85285b418048b755298b5ba0209c03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889426, "uuid": "8e255a65-13d3-4418-add9-f62bc8259144", "value": "T173A5E1A480888447DEE52F7CF5E7ED74EA878FE3952B838942C61498AF3709FB61D501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889426, "uuid": "2b9852b1-334f-43bc-947a-39f37c34f461", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889426, "uuid": "d43c38de-0e32-49bc-8351-3b488dd5a778", "value": "49152:uEJGsPtEWWBsgoZVbD8OGSK7qKmgy0BKW6rKE:DVEWWBgZVbDVEeKmX0k7KE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889426, "uuid": "645cbe09-af60-4da9-9608-9601baf5fa3d", "value": 2131193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889426, "uuid": "cd807994-02dc-4a0e-b274-0a61d356f648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889426, "uuid": "e221ada7-5c78-4dae-b7f2-52e3ee94a103", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec7f854-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889427, "uuid": "4c0844f1-44f5-48dc-b1f5-4677f70e646f", "comment": "Malware payload", "value": "e01e62a726503a767c6738f47e262fc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889427, "uuid": "ebd3f5e4-312d-4aef-a87b-e61bad78ea62", "comment": "Malware payload", "value": "0cc80c9d984bacc0509aae20ce774a0f82a554a666e8cddea63c97965fc146f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889427, "uuid": "c54a2986-2890-4d5d-b169-1f9901e52fa0", "comment": "Malware payload", "value": "433f88b14d7451fce6185dda06fb53deee805af4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889427, "uuid": "33e7b414-8e43-4bc4-92b7-1bcf4221de48", "comment": "Malware payload", "value": "6abb8cc498bfd40376387b45acbd7e51bbb53ddd0242b54fbbf11bb9d68dd514ed54e11d97f9f7f119baccddc3fa40af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889427, "uuid": "3b2cff96-4507-4707-9e85-7cb705040fdc", "value": "T192D4127337D088A2C6421530114BEF76AEF7FD3925629917BBF8175B7C386A0BB66600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889427, "uuid": "0ade5a95-2366-4552-9ede-447713751b8e", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889427, "uuid": "97897408-3986-4278-aa3d-f8c37346bb10", "value": "12288:otKe6Zv23Yn0oSJ/SJO53d6tZXpvzR+QLPRYUa3dAzioW:K6Zv2Kl8uKSZt+IPRYvdeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889427, "uuid": "f8e29dc3-6a12-4468-902a-d1f93b931afd", "value": 641317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889427, "uuid": "83576424-703e-42c8-838d-ee249cbe2f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889427, "uuid": "abbd4f1f-c4b1-4ed5-a704-d621df399467", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3186bc1-c87e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763910774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763910774, "uuid": "3d0fb2af-096d-4771-a20c-d1570d1078eb", "comment": "Malware payload", "value": "0e73498f73c059a94e465ca5a4ebdf05", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Sturnus", "colour": "#BED55B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763910774, "uuid": "9e8b8863-9cd9-4f4b-bbca-e5dcc4cbc821", "comment": "Malware payload", "value": "0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Sturnus", "colour": "#BED55B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763910774, "uuid": "180754a7-384c-4406-b416-7d9fbb08e153", "comment": "Malware payload", "value": "6c9382d4c715ca9915105b5183d5fb7019af0015", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Sturnus", "colour": "#BED55B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763910774, "uuid": "a1860c93-1813-46fb-82f3-2b8f25c70350", "comment": "Malware payload", "value": "845fce3736e22721b08b8859dec8868c7cd2ecaf9149bde586e3c3404956f8deb33e39c04a8b82a27a642c805386a0a6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Sturnus", "colour": "#BED55B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763910774, "uuid": "d5860fac-3729-41ee-9c72-323568e969d6", "value": "T13336E14AFF4DD83FD9B750391F4A067136166C668A92D3872411732CBAB7BC81E1ABD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763910774, "uuid": "c966879b-4167-436a-b10d-78ba00e7efd0", "value": "98304:3iOQbTgr4C7V1X/JJU+9FA31amsSYSizvITd/ee0VrJG:3LQeP7V1Xzu1nsSYSlpGef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763910774, "uuid": "ee022d38-1919-49c8-abe2-4fd6432b450a", "value": 4905220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763910774, "uuid": "43f81df7-e4a8-4272-89f4-a66d53d45a38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763910774, "uuid": "e086c066-67f3-4b83-ad2a-c2c2dec8e25a", "value": "Preemix Box.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8364ee-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889428, "uuid": "211632b9-fa8d-4e0a-805f-fb4efa7882dc", "comment": "Malware payload", "value": "4f36b4cc6558acdb25ce3f9a21d6e434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889428, "uuid": "a3190084-3bbd-4b84-84f5-6c44faa3d987", "comment": "Malware payload", "value": "0d0958183c110dc6289d253be0ed215a0e798ff65f8b8ce2e2cf1fc4df8459cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889428, "uuid": "8e7d0a4f-6735-4f92-940e-7ea428eca6c4", "comment": "Malware payload", "value": "93e7824c6f5dd3278b62fef8450eac5042618ac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889428, "uuid": "037e2eaa-601d-4421-9ab2-008c09c57b2e", "comment": "Malware payload", "value": "d2a797741236b5e0a5a3edff1dc320923394351185cdced63b8e7d35408e1e7bb42c5c8eee49ff0d4168787a059665be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889428, "uuid": "95f760d6-ff5b-418b-9454-a7596b4fd1a7", "value": "T184653333799090FCC88B5E36007DD7F59BB2AAB332B47135AFE9086A1D714925A1FB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889428, "uuid": "7537c0e5-2378-4da4-9d64-cc1c907552ae", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889428, "uuid": "687d64f1-7e2d-4e36-8f69-535a29c0ef5c", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lANCPrHQ0VfgHZhI0G:7E2lVL3Ze+/F5ndjFWmrjyx1cmbbxgAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889428, "uuid": "5032c5ec-4fb1-4b54-b90a-250c83213e63", "value": 1452738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889428, "uuid": "ef21a5f8-2c1c-42f4-92a8-5f5d480308c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889428, "uuid": "12ca80c0-b72c-4e61-9952-6121bd7691af", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302b4f30-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889429, "uuid": "bd3073b0-29ca-46ee-8900-38151da17312", "comment": "Malware payload (Miniduke)", "value": "8c612fab97b155e696a56adc89473b33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889429, "uuid": "9cde76bf-dc2c-44ec-a6d9-d7b58e9f326d", "comment": "Malware payload (Miniduke)", "value": "0d190f573369c756ca8eab3c94e528f6351ccb54f20c0f1111dbab99f04db0eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889429, "uuid": "34784533-f8d1-47b8-ab8c-08d7c0c28fbf", "comment": "Malware payload (Miniduke)", "value": "978fe455cdc248f22868ae44e235fb9b924a98c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889429, "uuid": "1e759e91-5c08-40c0-a56f-eabba1852d12", "comment": "Malware payload (Miniduke)", "value": "9c1d7a0857d96c1281d0f0fecf5f1210a69c9867f3c3a7c6b2016aa1096bbbcb8de4ff10cfff6717f535e11320ecfd4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889429, "uuid": "c14a3039-904a-4e2e-ada9-71833246f7e1", "value": "T1BC24AF2232E08071D9531AF46DF1EB964ABEBC14463589CBABE40F7E5F70691923970B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889429, "uuid": "cb1ef5e3-5d10-4022-b1db-9f68fc57dc84", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889429, "uuid": "20081023-b3a3-4f84-930f-0d5c23e3d095", "value": "3072:Ckha2UZC9CGOIvwu0iBMJ21gjpjVeS0CXjIWJjuB5Se:Ckha2UZCCsvwLiBdgFMUIWdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889429, "uuid": "a2d9165c-9717-4144-8f2d-e3054fa894a9", "value": 228062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889429, "uuid": "af5e7398-5378-4ae9-ac2f-dd0d89e92593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889429, "uuid": "e4c80238-09f3-4c1f-83b6-649f6b39a1b5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cf185f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889430, "uuid": "a245d9fa-0808-4000-9b51-d2a2067f84de", "comment": "Malware payload (Simda)", "value": "1d32705f99a374eebc3296f5ae0fbc53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889430, "uuid": "482158ad-d973-492e-a635-6cbb6c31087b", "comment": "Malware payload (Simda)", "value": "0d809db2c0b1351dd986e425425d43fe0f666e96a8080d345c7da22e91a10790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889430, "uuid": "54e5135b-181a-47d9-ad77-9e352a22607c", "comment": "Malware payload (Simda)", "value": "5ef71245457dc0b34e20af7d474c4bb46c048c5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889430, "uuid": "a6a764a5-abe9-4d33-b495-a469c75de167", "comment": "Malware payload (Simda)", "value": "6f4c07aa6d9f1c955f5ce8c47e79821e5e6b180d83503c3def975423a0c20cb1b1a8083c8894d5beb32321b6d32cb2bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889430, "uuid": "b0e7c3bd-302d-49ec-80c7-3877d9bcd2e9", "value": "T1BC4533652992AD58FFF6DFB9420C4E0A5E9023840F5EF8156B48BCA651A24F3FC76330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889430, "uuid": "8633a990-2816-4a71-9206-39a3b225064b", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889430, "uuid": "fec2fa3c-f082-4c94-86d4-f908bde2a338", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iWtPWnQKP4:+YhQs7tW2zku73bFgVlRlbN01Th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889430, "uuid": "b4f73094-e81e-49e1-be40-b1d766995b6e", "value": 1250272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889430, "uuid": "3b332915-5304-4260-911a-40e36b3b3f24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889430, "uuid": "f06958c6-77a5-4ca0-824c-9cec26f2d959", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3147c00f-c879-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763908329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908329, "uuid": "45e00cdf-0c69-45c3-9613-9e2681329fe4", "comment": "Malware payload", "value": "e37ea5a28e1ecae68286c0b7439bc152", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908329, "uuid": "d51df819-5779-4637-91d0-3bf04b62214c", "comment": "Malware payload", "value": "0d85884024cba70fb78121063ad6b5fb4da59816df50236750cc63dc9f0bfbef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908329, "uuid": "50013286-4d0a-401a-9a6c-ba3cbed9f0e7", "comment": "Malware payload", "value": "143ff27254366d5bf1bdc0ec1df55883e6fa882b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908329, "uuid": "e7f1fef2-092d-433f-8f55-3e92d2c602f2", "comment": "Malware payload", "value": "9eeabf8f8dcc347814eda1a10c2c49a8f635ee1cf42874378c0fff7e45ec29a5b79e3592615e71ebd504ca03df4966d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908329, "uuid": "c2bde066-f517-4548-b440-ae8ba43bd275", "value": "T156B69E31F224CE36C0E9173A409B47605375801A8F97E74702E895F9FD8A7692FB6A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908329, "uuid": "1b124f20-c31a-49f7-8018-58b3235ee166", "value": "041d8c836c77aed8a5f6fee30d16a988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908329, "uuid": "596e0f2e-fea9-4bfc-b54e-fa01cc1bee87", "value": "196608:l2OL+F+kG4siXxvbRCuXj8rBPNb4cfRgx1Dfgr:tKIkGIx9Pj8rP4cfRia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763908329, "uuid": "e51247c4-bf20-4558-810d-aace47944c3c", "value": 11196655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763908329, "uuid": "1829c01f-5751-410c-a038-af1a33bcffda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908329, "uuid": "bced8022-c90d-4081-84cc-56a782a0bb29", "value": "SecuriteInfo.com.Trojan.PWS.Banker1.37780.30946.2122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3167a553-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mydoom)", "timestamp": 1763889431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889431, "uuid": "a9512226-2844-425c-913a-881618e6954f", "comment": "Malware payload (Mydoom)", "value": "2c46e3ffa3c16cf916dfa9a80ea5a28f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889431, "uuid": "ebac13b9-8311-46ed-b4d3-49ce19623e97", "comment": "Malware payload (Mydoom)", "value": "0d8c94b25d4c154334496567fa533fa279338572a19fc9aba69565753c5ce326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889431, "uuid": "d71ae3ff-d7ac-42c6-87a9-73bfb0a819d7", "comment": "Malware payload (Mydoom)", "value": "9dd6d965b9a7ce35dab51a4d658f824f82364db8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889431, "uuid": "2151f3e0-2027-4139-bb29-dec17268db16", "comment": "Malware payload (Mydoom)", "value": "ab678e7f45e47a39142a2b29b8aabc5b47dc6e9e7886c33dafc4869d7d6f44b86e6e83abac64146d338805059f948436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889431, "uuid": "dfb488cb-00d7-4ff2-a2ed-cad6fafe624c", "value": "T12954D01175C0C1B7C4B7113189E6CB399A3970720B6A95DBBAED2BB95F103D1A3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889431, "uuid": "14cabf79-8419-41f7-aa56-afc6ffdd5222", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889431, "uuid": "a548988c-50e3-49cd-a510-8015c1151118", "value": "6144:eDKW1Lgbdl0TBBvjc//o6bRFtVyIUBUPFX3ByFHi:4h1Lk70TnvjcHRbLyIUu5eC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889431, "uuid": "2c0892bd-abfc-43ca-bf1d-02720244523a", "value": 291636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889431, "uuid": "5edac487-5016-4640-add3-6af8020018fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889431, "uuid": "7803061d-7ceb-4382-b38d-106bf1242621", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32063a46-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889432, "uuid": "a0fb0e5f-f0a3-486c-ac2b-b6ecfb99559f", "comment": "Malware payload (Simda)", "value": "72698cab83797f910f6e1da99bcdcc43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889432, "uuid": "28f5073e-952a-4cee-9437-0166dbf94bd4", "comment": "Malware payload (Simda)", "value": "0db64f76c66ad2c208502b4cb1adc7af1f153c551d2a44df9b59dba199491064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889432, "uuid": "4204ff81-b561-43f6-90b6-9dba76b1b7c6", "comment": "Malware payload (Simda)", "value": "c5cf24951fd733800969af8c02323887d2049efd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889432, "uuid": "00aec249-07f9-46c4-bdcb-df35b83748ed", "comment": "Malware payload (Simda)", "value": "e09f5e9ed591d167c6bdc6e2f02a77715b508a8a2782bda42866626cd597c9eac6dcc163f2acec3506c382f70d5e1a74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889432, "uuid": "dc171c4d-d4d4-4d2b-b925-0f581b11fb00", "value": "T146935B565550C235E0F8123085FB7A2A2D6F7DA913DA19D337587E8D28B02E237392DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889432, "uuid": "84d73aa3-e1b1-4754-a6ee-61e8bcdedc71", "value": "257ea21f64dde694bae577e3a7755e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889432, "uuid": "16b94de0-cf29-4f1b-9ab1-303557fc984f", "value": "1536:P5q1GgqrNy52cIOk1PXG2G1cbMuKyzfeRpM3kRaWV/wKniZ:PM45rA52Sk1PXGteMu/kpM3kRaWV/wI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889432, "uuid": "9ae7b890-910f-4d15-a405-e17d6b6a6155", "value": 92820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889432, "uuid": "5a9811bc-1c95-4f5a-a0fa-b1e1175770c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889432, "uuid": "74aa745f-0c77-4202-ad7b-a9746b369b69", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f23d273-c854-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763892407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892407, "uuid": "9d5eb3f8-7a4a-4342-910d-1fafacbc5369", "comment": "Malware payload", "value": "b2344b53e7776436261a1afdb8332acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892407, "uuid": "30f15664-4269-41b4-8ae6-2da16c3178b6", "comment": "Malware payload", "value": "0db96db2dac4a2c48f79dab2ef1a33f84cfa588ae0031e276dd8b4d2b6018950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892407, "uuid": "fb998331-5ef5-454c-86eb-7a17f22a4c75", "comment": "Malware payload", "value": "6fe8296882106149bef1742295591a3c39942518", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892407, "uuid": "d8673a23-2cf9-461b-afd4-75da983b88bb", "comment": "Malware payload", "value": "9132f39db3c517a25765b3310df2954d6f2f4a1b88c5fc9fde131de10df5b6be7ac6156b26af67da7810784032b5f4d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892407, "uuid": "5f0cc777-6e0f-481c-a4aa-a9bc1cc636ed", "value": "T13E35231F32C262B1CE89133107462A986E73D67E2BB0941BB3D895072DF2D447F79B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892407, "uuid": "65836596-cfc2-4794-b13b-5d158a783d09", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892407, "uuid": "b03bc57f-457a-4a0b-80da-819239d230a5", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1BPd:qE27hQs7tWVToP0Hs0/htDHix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892407, "uuid": "236a5f6e-68af-43ee-8329-914b0929d4b2", "value": 1115888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892407, "uuid": "35643eb4-8348-41d6-9d0f-af9df6212f3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892407, "uuid": "45b52d7c-4605-4b24-b10f-f86693719818", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c850f7-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889433, "uuid": "724715be-e0c4-482f-bb11-91baf85326f3", "comment": "Malware payload", "value": "0094056c392c627e7162b6733d1f2dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889433, "uuid": "a4f16cec-6dde-4bd4-91a8-59525edb2678", "comment": "Malware payload", "value": "0de04d885cda64aac828fccac642891a404632c266aeb04ef7affc03f05f4412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889433, "uuid": "7eaf8c0f-a8b2-4d3d-89d2-4c32f214419e", "comment": "Malware payload", "value": "5c20a22a557301fc6f67d48df7e0b5ac4b74d588", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889433, "uuid": "c59b7e45-2f56-43a9-ac44-5defbc361fd8", "comment": "Malware payload", "value": "a870ae9d6767dca2a9c690f43b33bee0f0fb4069027ba51b82e30eaa1e4ffc5a7ad1cdd7c6f823d4a8dd40580fe92b94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889433, "uuid": "c0d10c30-ad09-4494-ada6-9e84e1d5ff77", "value": "T1E9C5E003D6325271FBB2C23427E499BDC1AC7B2307DE49EB17AA3C9850DA558B12D74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889433, "uuid": "a6accaec-3791-4405-8273-d85f275431e8", "value": "b672bf4528e2ef8904397d0b17905606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889433, "uuid": "b990bf4b-818e-4d97-a103-fc59ead04b45", "value": "49152:CxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxg:Cxx9NUFkQx753uWuCyyxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889433, "uuid": "56d4b26c-c68d-458c-a7e4-c406f21f0aef", "value": 2673062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889433, "uuid": "46518120-aea5-498c-8b40-3f84c5e2c8a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889433, "uuid": "ad7333cc-97ad-4aa8-a183-fb0e7ecc9a7b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33735423-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Expiro)", "timestamp": 1763889434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889434, "uuid": "5a5bf8a0-587d-4d5d-afdb-e449fcd2830a", "comment": "Malware payload (Expiro)", "value": "0d2210341d55110db3bbe28343f1bc25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889434, "uuid": "62b78b0d-318a-42d1-99e6-988accd2f8fc", "comment": "Malware payload (Expiro)", "value": "0de9095d3a04682f31251f319a777484c1c8f71e6e54a1d08dd305e8446bf0b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889434, "uuid": "286b94a0-c210-4da6-bbcc-981791031232", "comment": "Malware payload (Expiro)", "value": "a02281f27419f8cf1e0624722496c786110a0d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889434, "uuid": "47070d77-1ba2-4b70-8314-6615fce94b73", "comment": "Malware payload (Expiro)", "value": "d35977a5ad7808d3df3213e8a2293eac07c1db794910ecb25763643a923bc4aaa3a7155b1f4511c166119f32c1ae2f28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889434, "uuid": "13c9765d-cd00-4114-bbbd-0164fa80db71", "value": "T1FAB48D210695BC4DF426CF7A93F249A0E5DFB9528261E9184C476F2E2EDB7913BD380C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889434, "uuid": "5116a42a-fe2a-4bbb-838a-bc532fb454b4", "value": "58e185299ecca757fe68ba83a6495fde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889434, "uuid": "632b5507-2a55-4bfe-9188-376668a962fc", "value": "12288:pr/KsOE3XoeXGI2lEP/RVggeuAE7e7k5FXMAJSnJR1Bhgvk:pr/KsOEIeXG80gF+y23N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889434, "uuid": "7092c591-b2ab-4688-b67a-e79f77eed427", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889434, "uuid": "15ae8b56-12a5-4088-af67-40926601e829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889434, "uuid": "85c9fb80-91c0-4370-b4ed-20a48afb99b3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34087ee9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889435, "uuid": "63ecef6b-c82b-4fcd-bf48-26cd61897a8b", "comment": "Malware payload (Miniduke)", "value": "e191ce05b636e07acd31a589d48fee33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889435, "uuid": "a6769c63-9705-4a15-8330-943685a43e30", "comment": "Malware payload (Miniduke)", "value": "0e5a5d59042821b0897acdbffe06906e9bd4e338201627f74aae2102a2dc6aa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889435, "uuid": "ab8906a5-6ff2-4aa3-983d-a79d3ac0c58f", "comment": "Malware payload (Miniduke)", "value": "b8d5963bcd7c5ee216e81dd12e77b41e94f62e89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889435, "uuid": "6fb98048-cfb4-49fa-943a-6631b53b9430", "comment": "Malware payload (Miniduke)", "value": "8a04ce95bc7c172f2f12d34b8c01823de1872f509829ebada2e7ebff13dbd8a9bca41570a71e7ef297de848e4f70cdba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889435, "uuid": "31507bc4-982c-4adf-a2cf-242d879a1d6f", "value": "T10B049E3533E580B1E53316B46DF1AB72967EBC384A71858B9BA41F5F2E34A918339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889435, "uuid": "39ed5c9f-ab49-462f-bf3f-07c4d7df88a4", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889435, "uuid": "fad0935f-a81b-416b-9bd9-f25d1c465a66", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZrYIWJk5F5Se:+/LhS0rKE/FLITo9mWIWW5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889435, "uuid": "d0946fb3-b133-426d-bf45-3c349415ebd4", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889435, "uuid": "2986789b-aab4-4761-8b10-48176b340415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889435, "uuid": "082f09cf-a473-4d89-8e3f-3a80c7c964db", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a33d6f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889436, "uuid": "a1ea2e8e-9990-4cc8-a8bb-778728ff02ed", "comment": "Malware payload", "value": "b731778d566fd2870215981e14b0fd69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889436, "uuid": "73503d63-c41a-49ec-840b-ed7523ebc846", "comment": "Malware payload", "value": "0e640bc9ca5126749f6eca8322038eedea9c0088121b8161b558b8b2912ad68b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889436, "uuid": "01667a2d-6cd4-4161-ae9e-027c4631c6be", "comment": "Malware payload", "value": "b57ca044ceba592e4edca3acb2085458f75b5d56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889436, "uuid": "33a43272-0e94-4b65-81c3-caaef6c0e337", "comment": "Malware payload", "value": "84b8448350c336f1a990b0fc59e407a62aa972375704249f07730c8176ead47c436b295fcd20231d5c29123c881a8aaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889436, "uuid": "db80cb52-7c50-4f54-89d4-2aa463dda72b", "value": "T12A84D17732C04DF2C942063002ABAB768FB3FA3A16714857F7E4562B5C35A51BE67B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889436, "uuid": "fdac4f51-b870-4e11-86ac-5aafcec2098b", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889436, "uuid": "39bf6ebd-9237-460d-b466-23437edf05dc", "value": "6144:BtKe6YiDdv3m3mgKHDjSeL46HBkbEG8xLhPgN:BtKe6Zv23YnDGSxLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889436, "uuid": "cc3f206c-3340-48b1-874d-c4b4a9736aa7", "value": 381145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889436, "uuid": "4e5d92d7-3153-4749-ace4-34170ded8ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889436, "uuid": "c61b8c49-2efe-4e31-a01e-f043b0716962", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3564426a-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889438, "uuid": "2635ad83-dde8-4e3c-86d6-70df3ad2480e", "comment": "Malware payload", "value": "5044aecf4c21d08b63774d38a7e257dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889438, "uuid": "f5801152-e1fd-463a-9003-309b466e1d53", "comment": "Malware payload", "value": "0ec58d759cfae642f7960769fac40ed23c8d3922f33103ba2e0b4f9329997d73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889438, "uuid": "25932e7c-096b-4653-8182-df4c06dfdb6c", "comment": "Malware payload", "value": "9748d715c94fa3db2fc1a295f684aab71375ff38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889438, "uuid": "e6abcc51-a0ab-4022-b39d-60f6b6459b22", "comment": "Malware payload", "value": "9988123465cddd9d441b85863605ae279ae37aad1a864b68c169a31316c68bd46dbb43803d170bb7bc45ac26cbf1b9ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889438, "uuid": "c49ae3eb-cbed-407f-9159-791257046ea1", "value": "T18856E75233F81C85F2F72F38ADB191164F76BDA459F5C53C2184518E09BAA91AE3CB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889438, "uuid": "cdcd220f-f020-4ccb-bb0c-55f29fc67f39", "value": "68c8b6c1c34258010d37b2cef4172345", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889438, "uuid": "a244de6e-c5de-4fed-b604-7ec1cad9414d", "value": "24576:lYk2GtxdL4GuQc/Xlh3Qh3OXuaq4gTdZrZMj2YDSIT9f5DBMYjvDwKlJRF3G61ae:l/Lx6dQCL6dZ4gTdZo2wSIT9RaY7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889438, "uuid": "296a92da-0ef1-478b-b6b9-f3aad9af5a47", "value": 6185023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889438, "uuid": "f7c59e8f-d935-4dc7-9fb3-c5a74bfdfe1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889438, "uuid": "ab19b178-e6d5-449d-9e93-1781127a59e0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367ebf69-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889440, "uuid": "c5af1a42-9a57-4e32-bfd1-6f08156712f5", "comment": "Malware payload", "value": "a2ef09ca78b551fdb765759392a05614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889440, "uuid": "bd87e87f-6504-4a52-b856-4561892a8e67", "comment": "Malware payload", "value": "0f0f14f72597e6b53c1ba302fd8c05dfb92c90b1ec521d1b0e8212b89b1af3b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889440, "uuid": "d62777e9-9a21-4863-902a-ae0ff2f09a55", "comment": "Malware payload", "value": "16f251677424d4eb6d1fa6c7428fc1bfae0be4b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889440, "uuid": "20296a68-66c5-48cd-9bd3-8b2754bdfe53", "comment": "Malware payload", "value": "48c947e839cd9cd7bb6bb71f8a4cecbc4c9a7ba0c0a6fba3a008028721652458ddd8ad3b3ee2e0af64b3c94114fc8288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889440, "uuid": "45eb7b3f-565f-419c-b06f-98ff699914af", "value": "T1FCE55B17B2842C3FC06B173A4837A754997FBE2166269C0E17F478CC8E7A5817D3A64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889440, "uuid": "1b4c0e10-61b5-4633-9710-3b8996b98e14", "value": "3d349bb1fedb23758a6e397e5d691576", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889440, "uuid": "608a5760-39fd-4bfb-8d8f-46a5a31632e6", "value": "49152:0UJ6ZNXox4SgJhBiSHGGLDs4teyYTYMQs97/:0tR3feyoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889440, "uuid": "a7f76f36-8c7b-4a60-9d88-9cbe3f9ad29d", "value": 3301398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889440, "uuid": "718edbce-88e6-480d-852a-435a680e93b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889440, "uuid": "8754dea3-a9e5-4d66-8ccd-a49052448b77", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7039dc0b-c858-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763894261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894261, "uuid": "2fc3e48a-cae9-47f9-9ade-e4ae410782ad", "comment": "Malware payload (Mirai)", "value": "d7acb152db493d65a08620cc83b1b96f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894261, "uuid": "e0d09d40-acd3-4a90-9332-34c140a7c5f0", "comment": "Malware payload (Mirai)", "value": "0f374086e4c202ad867cbe9a4b3aacd93139cbc175f71e7ab177b866d46e4b60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894261, "uuid": "2d4f48cb-62d2-442c-bd60-7881d57cc7d8", "comment": "Malware payload (Mirai)", "value": "f952f469fa661f42d9147ad82866b58297f75619", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894261, "uuid": "66607261-cb1c-4ab5-92fe-c24d2bdf4574", "comment": "Malware payload (Mirai)", "value": "cb65b3871a9f933d137c26d80f70a1282d14cdb734198cb656a733a4acc62ca20b8ce6a247b6cadd61b767b0cb5f4564", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894261, "uuid": "560b1005-5eec-4079-822b-6bbec1fa5706", "value": "T11EA3F90ABB614EFBD8AFCD3745F8070235CC994222A43BB53574D62CB79B54B4AD38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894261, "uuid": "b2fcb5d3-a5d8-4e4a-b381-df9b1dcd024e", "value": "1536:SB56hUWomWPy7xA/Sizs9lbpmFlEgr9sP5ZmgT0XbT2+5ZpmEDsurcFyok0bGP:SB56W0WB6iQbpmqZOXbT2+5ScABlb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763894261, "uuid": "d525ebd1-0903-4a31-87e4-bd942b1b9240", "value": 105664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763894261, "uuid": "21838b18-e026-4f79-8abf-b213117f5f4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894261, "uuid": "cd768f96-2dc2-4f46-8c55-5b291ac6e0f5", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371493b2-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889441, "uuid": "ef0f55f6-1f8a-4be8-90e4-509b2838ff44", "comment": "Malware payload (Simda)", "value": "3ac66a8cfa2641b2544c0a814be2f135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889441, "uuid": "abdcb026-a792-463e-8f9b-7ba345fb2b25", "comment": "Malware payload (Simda)", "value": "0f471bb7786d4e536c29125501853176cf6e8dfd3124d3fc2b097b17630b726a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889441, "uuid": "d8cc8242-242e-48e1-a786-687995fedf87", "comment": "Malware payload (Simda)", "value": "b394c1340b7085a684ee68933fe81e1292dd1f95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889441, "uuid": "0333beb9-6944-4bd0-962b-6df90c52ed8a", "comment": "Malware payload (Simda)", "value": "d34ba6a9b35d31aacfa4a3d37894ad0fa45beb50e78650af60352b16fa1ba63b6e41120a928e25738b400c3b514f04df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889441, "uuid": "0b02ddf0-09a1-409c-ab14-b5ac29c40e79", "value": "T11B241202A7EF1CACD55F093B67772323D379E2720E70EF96481C185D7CAA14C7A885A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889441, "uuid": "37aa95e2-0229-4fa3-8a1a-4d245f6fa1c7", "value": "fc654781844d06a6ccaad40505274c80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889441, "uuid": "0f1c0e45-ff15-4e6c-b035-18def873d338", "value": "6144:U+Gupq7CAM0TDJZJ8uMYG83Qnqi9p07Sl:U+GmwCt0PWNsJiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889441, "uuid": "24110faf-cbd1-495f-88f2-28a44a59a766", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889441, "uuid": "c6f42f40-52cf-428f-bc45-0baa633b531c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889441, "uuid": "9fc0a8aa-ade4-4df8-bec2-a31cb13d75ef", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcce92b-c895-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763920345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920345, "uuid": "88bb3b26-6aef-4485-9ab9-4a72eef62496", "comment": "Malware payload (Mirai)", "value": "6e4f0413ec17982436800b596a72d3ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920345, "uuid": "79d4b321-4155-4520-8e89-319a26aab279", "comment": "Malware payload (Mirai)", "value": "0feffdb13c3bce429c074cf1b5d10a33001b34a4e21d014d5f5151a9d01283f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920345, "uuid": "bdb92542-bb49-49ee-9f74-19eea637f57e", "comment": "Malware payload (Mirai)", "value": "30835374e3599c4bb0669d9e09e010e23102252f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920345, "uuid": "a5e11e67-69b6-4d5d-9599-7b73ac878829", "comment": "Malware payload (Mirai)", "value": "5e3358cdf93725caaf64319a6bcf0b0eb3d68be9a6f2602aedb5d919e48cfadb4907bffa3dec3a84d151c266a122be72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763920345, "uuid": "6e1886ec-8bf9-4221-bb0c-04a384a61a2d", "value": "T1C8C3E559F8819B21D5C625BEFE4E529E33231BACE3EE7213DD145B2437CA91B0E7A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763920345, "uuid": "29834184-8d0b-4ddf-b4a8-018185f90a51", "value": "3072:l6EtyJwVbuQ2DxhtwnMT4cz6vONoH0zaTY8SEvMREMJhSgGgwn5J:0EtyJwVbuQ2NhtwMT3VSUzaTY8SEvYEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763920345, "uuid": "1261fcdf-dcea-4d50-af96-8f2654216b95", "value": 128496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763920345, "uuid": "57d8d1f7-a787-4308-983a-fe43b36d8d7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763920345, "uuid": "912b1e15-db9e-4c8e-9f1c-ffd9ef69ccd0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c51384-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1763889442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889442, "uuid": "ade3eb60-f0e9-4d85-a387-6ed281028abf", "comment": "Malware payload (LummaStealer)", "value": "c510e576100af1a700d5028e7278482c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889442, "uuid": "4e2230e4-0192-4d32-9283-cb0988dd415e", "comment": "Malware payload (LummaStealer)", "value": "0ff2942601a42220b5dc6efd49f1cb98f51fd5028e73574eb76ceba501092536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889442, "uuid": "5604331b-aba4-445d-8783-893748755ef7", "comment": "Malware payload (LummaStealer)", "value": "02363c2855887e0c951904a2788413332c8f771d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889442, "uuid": "e5ad5819-7ec8-4ae1-a283-ef2bac0e9c1e", "comment": "Malware payload (LummaStealer)", "value": "378e2e9a276b8732309b523a195b8f69d74d948362d05dc0afa9d870ebcb5e9b8c1c8a6fa61beceb62ee5f7aeb742dff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889442, "uuid": "d4ef22b4-799c-4041-8bdd-76a1c4b363bc", "value": "T1B5D4CF0AFA5381A1E809083714EAF77B1630AE174725CEC7EBC0FB98AC77BD16579506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889442, "uuid": "abc9f09d-cf8c-4286-b859-d01bfc1906c0", "value": "77eb68348ee30e01ec09fce3582c5f76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889442, "uuid": "de432ab2-949a-47f0-a8b0-5ef94c8394cc", "value": "12288:FsjCF2QZiOU+4zX7wM45QygROD22O3ZGdZD7AyyymI:FOC39Uv7V4WnROD22cqD7YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889442, "uuid": "0b01647e-dcab-4d1c-bcd4-ce1d510a0905", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889442, "uuid": "7576e907-bb0b-41e6-a4e8-5cf19a952a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889442, "uuid": "7a882aa6-176d-4788-8f3e-bbb3f532e035", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3875bd02-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889443, "uuid": "468b654d-f8a7-43d3-b0a0-34d81132fc9e", "comment": "Malware payload (Simda)", "value": "9ca09faf1267a5a4c52a26f408ee550c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889443, "uuid": "691ad7a1-d321-49f5-b239-eaf7114756a7", "comment": "Malware payload (Simda)", "value": "10214b6429ae05cfe7b4fbb992d830d4f6936e2a5014dad295b70f1e879d7e18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889443, "uuid": "868b970c-e96a-497e-a5a3-9dad55b839b4", "comment": "Malware payload (Simda)", "value": "dbe33db0536c6700fb8e0b6f3572fd8673805503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889443, "uuid": "a63d4940-eec4-4e6b-82e7-9b4fcd7fffec", "comment": "Malware payload (Simda)", "value": "2ff63aef8b040cdaf0bae199304b0737b1c72fff68e3b133ee4dce1d98f28da832023b951f97a0a627e00a8c1516a485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889443, "uuid": "c55ec021-56ca-443e-87f8-2893118c34b7", "value": "T1DB24124B478E11A5F8131B770AFB0B4773B881A5378AED7B394AA3706C536C7B8A1354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889443, "uuid": "e748d957-bab2-42f8-a5b7-e82e814eb081", "value": "2a1bb0c52b45268a32bea7c08363145b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889443, "uuid": "1f453a1d-c382-456f-87ca-eef8b3833127", "value": "6144:HBsKFk5pfANiDyJ3xF4JYK5wf6t0FU29HUYo:H3ijD43xFAwf6t0FUmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889443, "uuid": "3ec98732-9680-4d5a-982c-a5945f72fd6d", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889443, "uuid": "148057a1-c383-466e-8ee9-6ecf7f9a2402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889443, "uuid": "506917b5-1b0c-49f3-bfc7-9912ecdd6ffa", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39113a8e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889444, "uuid": "2ac4f7bb-6e86-43b1-879e-6970ca8c953e", "comment": "Malware payload (Simda)", "value": "28d4f9722aa158749482f6adee2bccb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889444, "uuid": "89d48544-49e6-4342-ba7b-f50a27210005", "comment": "Malware payload (Simda)", "value": "106c3f815b13ae45c63a023f6d09cb39c33df03768ec3557778406133b675cfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889444, "uuid": "1605e9e7-a851-4ecb-a346-80ef36365ee8", "comment": "Malware payload (Simda)", "value": "ffb0473944de3ea8858723b85b53b4de10550fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889444, "uuid": "708353d8-1a59-42e6-9e1f-7d660f1522c6", "comment": "Malware payload (Simda)", "value": "9e77a3aa9fc1d074cc11674798c25ed57d1d13a7bb34a31bb03cc70585c7c586a503a486d546fdba2339073551d56b40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889444, "uuid": "0bbd9179-eb1b-4f2e-8546-b61195498f7c", "value": "T15E240293F38A29E7C2200D3F12F7230711B74A615375C59BE641A66D3AD65C8BCE2A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889444, "uuid": "dec86fb8-c472-43ba-9efd-af66b4194a1a", "value": "1c6c3b0bd56b7f130f1f283a88a358b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889444, "uuid": "992e9b48-353d-4137-8f1a-a33b5d1b7ec3", "value": "6144:ZrMoyX6dxajoPXA1nriwrw1cfCOSJcAb:hysxVY1nZ+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889444, "uuid": "b726197a-d309-4cfd-8870-e085e2db2906", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889444, "uuid": "764fc6b0-6d15-4d43-8b49-f6f6413d11a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889444, "uuid": "915b0182-73b4-4314-9daf-de00f923cf25", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ad3e46-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mofksys)", "timestamp": 1763889445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889445, "uuid": "86153b61-ff07-44ba-a297-1c87862e655f", "comment": "Malware payload (Mofksys)", "value": "53da3193f7266e7933b55afef971ec08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889445, "uuid": "bb437e81-76ba-4ef8-b9df-abaebf64c560", "comment": "Malware payload (Mofksys)", "value": "1098f844792de171b72e7925dca4013b9a2609d85ca8aa45e2356c3b39d331c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889445, "uuid": "3a5c8a18-aeee-4bba-84a0-0bed02af2271", "comment": "Malware payload (Mofksys)", "value": "1751ce8fd6a39b3d21dda8d7dddd900cd9d2e6ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889445, "uuid": "97681e66-9b6d-4834-96df-bfc1851e0b68", "comment": "Malware payload (Mofksys)", "value": "78a79281451d70274ef9777c7c010496cf934c51326e570f91e8bcafd7255712a49e44dfa41c385e6989e8abca2eca31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889445, "uuid": "5e3be6e6-e456-463a-b906-3b1c9a4e38b7", "value": "T1A524F92BFE04702FE4679AF0296662A6B6261D220F919C4F23D17F4A3974553B1F432F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889445, "uuid": "6ca85809-4a51-4a55-a935-835265c1f682", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889445, "uuid": "8f6d8516-dfd9-4d20-b5f4-eca6cc1c9d9a", "value": "3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unYh:+vEN2U+T6i5LirrllHy4HUcMQY6rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889445, "uuid": "ace396e7-0a51-4b03-84b1-c71a84109819", "value": 211894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889445, "uuid": "164ca532-5342-4265-b384-ef56499317c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889445, "uuid": "87cfffcb-3e67-404e-8d2c-2242f62603f8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3fac0e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889446, "uuid": "fc3c9535-173d-4007-81b9-9a2087087523", "comment": "Malware payload", "value": "fead97952ef432794e0d8d7326b2ae6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889446, "uuid": "ab64e521-b871-4944-9b51-72e7499dbc20", "comment": "Malware payload", "value": "10cc7209115504e2e345c5e11dc763b03aaabfac49e3ddb69bc89ab1b1e052c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889446, "uuid": "a5bf136b-2179-40be-94f0-5ff313d2bb38", "comment": "Malware payload", "value": "1d22364960c61a33c5717e738431a9d2ffa1f47d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889446, "uuid": "9ecd7e0c-7b59-42ba-bb4d-92b7dec142f1", "comment": "Malware payload", "value": "94e650468f06c81b4c612f4c4530852da0864e4df2bec8cc0cd0b5fb5e7e0aac709914f116ce460e957c1693197f3c2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889446, "uuid": "c19463b6-0cfb-40b7-8618-7e01fd959bce", "value": "T136D30B277E00506EEC12CDF158A6D66DB6255E350FE1AD2B72D2FB0426B222375F122F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889446, "uuid": "ad460ffb-ad06-4560-a53f-cdc2f0fcfaf1", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889446, "uuid": "23e43c1a-5ce4-4b77-82fe-92ce4c6b4837", "value": "3072:UVqoCl/YgjxEufVU0TbTyDDalhJjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjH:UsLqdufVUNDaFjjjjjjjjjjjjjjjjjjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889446, "uuid": "cb0419ed-ccda-4f0f-8f3f-484ef82d1485", "value": 138463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889446, "uuid": "740ae54b-17ab-40be-97ae-daaacf904edb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889446, "uuid": "812f2b79-08e4-4772-be29-0b87eccfb28f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad78eff-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889447, "uuid": "85c6dcff-0f9a-4264-9e84-9bb449e06103", "comment": "Malware payload (Simda)", "value": "0dc98729e1da60959cc7147869e1750f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889447, "uuid": "1469f4e7-7f69-4c0b-abca-3ff9ab2fd9cc", "comment": "Malware payload (Simda)", "value": "10fd0566842a37df4c8ba6444dbc8dacc08d43b26fead9e3719f57275db89662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889447, "uuid": "b11cd3f7-214b-49e8-bcf8-73b8834307ac", "comment": "Malware payload (Simda)", "value": "a00d0de463f885ece8797e15801832cefc28c077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889447, "uuid": "638c07e5-18b6-4b5f-adfd-bed7784a4495", "comment": "Malware payload (Simda)", "value": "64a6afc9adc046f893d51387a7a9c5e55f1a1ff6bb50bd1de47c37d1a017729d987e26c787a36e78c85e6ccb1ebe8edf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889447, "uuid": "0f707c7a-e243-41fd-a171-d244ffedfd2d", "value": "T1F9941224BE8A2814E671CBB018F771858B7CD26D1345137EB91A1F494ECB14ADE863EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889447, "uuid": "0cadfc5e-b28b-48af-9e94-4552bb5f3445", "value": "752e1ad839fdd9d87e202c92c2bee710", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889447, "uuid": "8e5725b7-a104-46e8-a1d4-a2b07c6d696b", "value": "6144:KnyiqVQBf0EaIp8fkTJJsK1eEzEB1XjrkXb:LEdp8csKpE7XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889447, "uuid": "d7c92b78-9652-4397-98d7-69536f38dcbc", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889447, "uuid": "e3031995-a5b7-433f-90bd-b6c5085b1d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889447, "uuid": "719469a4-6c73-4aa5-a6b1-804243532137", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6ec7ef-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889448, "uuid": "c2936aee-bc4f-4f8f-8435-f7601028c111", "comment": "Malware payload (Worm.Mofksys)", "value": "da033ccc1605095af987c2bd09ae6d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889448, "uuid": "ca1eee62-50a2-4d5a-a55f-8f882e970f6f", "comment": "Malware payload (Worm.Mofksys)", "value": "110229ddb2c7adc282b145dbc437760b6af2b0d119cb122ed660a4092117c796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889448, "uuid": "0416b3d4-4b50-4ebc-815d-966e5fdc244c", "comment": "Malware payload (Worm.Mofksys)", "value": "47805cf4efcbbc5691cc50d021e4ddfd8a88d30c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889448, "uuid": "1e131097-e69f-4793-a621-8cf4a8d984fc", "comment": "Malware payload (Worm.Mofksys)", "value": "4f2fa64becc9facbb91de1a46a15a498f3221e7a1be05da89e2b70ee31642ad9317025dc6c4207d1bfb4e4bf49789863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889448, "uuid": "b1e74158-b756-455a-8a87-690e27163bce", "value": "T1E124E81BBA00612ED89386F1146AA6A6F6217D231FD59C4B62D1EF5B35B0903F1F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889448, "uuid": "b6b28e4c-bb44-4c67-94ed-a8fcc6870131", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889448, "uuid": "8e0825dc-23cf-40fb-991a-417ada0ac8cc", "value": "3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4PmuU:7vEN2U+T6i5LirrllHy4HUcMQY6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889448, "uuid": "9f7f2f32-2e4e-4c1b-8959-f118d2be928f", "value": 226441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889448, "uuid": "7e4d4ff6-608e-4606-b46f-44e2ab0f0b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889448, "uuid": "51c6c958-3657-4d3e-87bf-130190e6de65", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f64fb6-c865-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763899740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899740, "uuid": "7a7b1c66-202a-489f-b4ae-e750afee99b5", "comment": "Malware payload", "value": "f6ae1da505fe6f94ac21f3044a18f6b4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899740, "uuid": "77c66b22-490a-4eb8-8faf-63f1cd0f6837", "comment": "Malware payload", "value": "111089c8db45ccb082ef263d0b844b1dff97860b3b6bbedd4ed1c2aaa7661d4e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899740, "uuid": "3ea1f446-84bf-405e-8df7-5dbaa3fdfabf", "comment": "Malware payload", "value": "2d6b188aed1cb8e85e083b01b5b7f93b02ae873c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899740, "uuid": "82075355-8e21-4651-92b8-0af14bc3daf3", "comment": "Malware payload", "value": "0697c6444bf8c80870cb9336953f0d312a00c75c22c16f261823e4b57e87097d824ef313759e1106c285912421fc1d36", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899740, "uuid": "0981ae16-ab78-48fe-92d3-bcd14f16592c", "value": "T18E6733D8C3364A9EDD310937A13B01B190D62B228117F79B747C666972A38DB8F11BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899740, "uuid": "3894fe0f-831c-4306-8156-e10fbbacdd7e", "value": "786432:ibCZvAmMGhfLOiebRLOrr2I0Vk56ypeHzmDpC5R/Calzmqf6iu:ibyjRyivrr2gPwHsK/HSqC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763899740, "uuid": "cf4319a2-155c-42bd-9e74-807d6f360db8", "value": 32415367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763899740, "uuid": "67b6593f-a008-4672-a472-f0181b1db132", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899740, "uuid": "174dc964-d6c6-45b0-bbf6-09a6484fe389", "value": "51bl_1.3.1_251112_2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a854cbc4-c865-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763899938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899938, "uuid": "dc14318e-b370-467e-95b6-dde4766d65ad", "comment": "Malware payload (Mirai)", "value": "beb6595d03d24b0c922373577bfeb69f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899938, "uuid": "2d20a211-9b76-44be-a0b2-80286886b063", "comment": "Malware payload (Mirai)", "value": "1253c77de47edfe92e3bbc2a3f33c4359dc9ca7f993a37e0448d96fa3dbe0ecf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899938, "uuid": "11d9904e-a9a8-477f-a9d6-d33df82abb31", "comment": "Malware payload (Mirai)", "value": "2f58030d05933f4135c3950f55781a59bfd9a05a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899938, "uuid": "d9bec9aa-b6ec-4b37-b879-fe0411eab564", "comment": "Malware payload (Mirai)", "value": "0e54e13410a72d08b8f81d6a33df07a6962339c8d320cb24e234c3947cd8428b85cb74eb9ad403389039afc576bb6fd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899938, "uuid": "7c1e86b5-7941-4ef0-b7dd-4f0e182ec5e1", "value": "T164C32A16B9519F01D4C735FAFB5E414933136BB8D3FA71029D20AF6123CA99B0FBA612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899938, "uuid": "ef2e9e46-3f6b-4adb-89fc-82ac7ed0d09a", "value": "3072:QawQw2BifE46ELTxNmoO4afax2dNBna7zjivczLIakGH:QawnaivT3xNVO4afax2dN87zXzcakGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763899938, "uuid": "ea1c139f-3c00-4653-8699-a9ed54978579", "value": 129096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763899938, "uuid": "89bc3e8c-4399-49ef-9a3d-3c85ed866df8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899938, "uuid": "55a26537-cb05-44f4-84e0-da820fb45c76", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4490b3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763889449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889449, "uuid": "c5aa2142-8e6f-40f2-934d-ddd00a3cffab", "comment": "Malware payload (CoinMiner)", "value": "73d6b315381beafd954957773fb7ef06", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889449, "uuid": "e16016ce-4ff1-4135-95ed-bb3007474c72", "comment": "Malware payload (CoinMiner)", "value": "126927f225e3b4ef1ecad3e1c1ded01e7454c212bf67288eacdd5266a854d5da", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889449, "uuid": "a1bd2d4a-4114-46f6-b348-c087324e3e90", "comment": "Malware payload (CoinMiner)", "value": "7fec0a97d28b3df8377b1f8d37db85d81b496e23", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889449, "uuid": "06ad1918-7de8-40ae-8ae5-ba1542ba9a55", "comment": "Malware payload (CoinMiner)", "value": "00c700a2e12991208b99f266c429cf54f9aa46077de890973477070bb97278c5ddc5463e00ecd4a79e6c3caa64952ba0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889449, "uuid": "962d9196-a6af-4c04-b041-c07526576d5f", "value": "T1E0569D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889449, "uuid": "8ec60257-376c-46e9-94e7-c1dad96c8c03", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889449, "uuid": "20df4377-186f-4a8b-a62c-9d4898eff157", "value": "98304:IvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650A:I/II/6aYXdFD22VatktKpEEd1Qi0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889449, "uuid": "518f868e-1f60-4c6a-bb91-5e7ec8c530ae", "value": 6438083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889449, "uuid": "bf036c23-c9bb-43c8-8f1a-53c80260fe9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889449, "uuid": "2e165439-4d06-4f6b-af7d-9ee2faba91f2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce2d438-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889450, "uuid": "0c003f93-df8a-4ac1-9059-7eb2e2d8d330", "comment": "Malware payload (Simda)", "value": "9b66ea41f88e61a8f8b6acb2dd12b05c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889450, "uuid": "a28be684-be94-4ce5-b53f-5527ac5811ac", "comment": "Malware payload (Simda)", "value": "129379444c68a3663418e1aecad718886d70947f8aa1dd4da840206c64c512a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889450, "uuid": "dd0fee8f-3079-48e3-9dc2-c8c69f688f55", "comment": "Malware payload (Simda)", "value": "410ad31f2dd709f9dc1aed0f8325bf9833cfdfde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889450, "uuid": "76d63d1f-b1fb-44b3-b56e-da61598f6d4b", "comment": "Malware payload (Simda)", "value": "a87a6d9f14e1a239fbe94b05900b2175a0ca27e4293f9d6b509366becb46e3577141f743984f0d889e9ff9873e8eb50b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889450, "uuid": "d075b593-dce6-4595-adc6-057094e15e2a", "value": "T15F341244DA0E51F5C5641F3B49BA3F1733F9C0D6934BE287A588816C54AAFC8BF2A431", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889450, "uuid": "759c9414-32c8-4784-aa22-9d8db9ea58ab", "value": "77eb68348ee30e01ec09fce3582c5f76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889450, "uuid": "711741c0-b93b-41e2-b6c4-940bea95e2a2", "value": "6144:rD8okEvTyoZVOgd2QZiw5NLclL5orfQH:3sjCF2QZiOU+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889450, "uuid": "829b0045-0a96-4def-bcc2-d656e7c0636f", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889450, "uuid": "6c8b1ccc-10e3-4145-a29b-e77dcb362bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889450, "uuid": "92fa7fe3-e9de-4c03-889a-8a8eb77a6eb4", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d76b606-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889451, "uuid": "55bb5f51-31ef-44e5-a65e-40b7c1caa6a1", "comment": "Malware payload", "value": "2444d1075da29a12f1566261dbddb3ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889451, "uuid": "aae5fffe-4ead-43e1-9da3-483460492ebe", "comment": "Malware payload", "value": "12ab4e976349dd1b47d791971fbdfc3ea506f381c4fcbe1800358e5f9b1118ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889451, "uuid": "33143222-c62a-4b9c-903d-4454a5ffd9ae", "comment": "Malware payload", "value": "b9865778cea3fd888c0baf10789ad4595cf5d00d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889451, "uuid": "15158bd9-dffe-4683-bc72-82b42f9c5fde", "comment": "Malware payload", "value": "b95f1f5062a06f8d5588325cfaa87201127e81740b37b1b3e6a53f68156dd6ca717f0ce0a5d50cf6712fcee2ba14e89e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889451, "uuid": "962082e7-7363-46ae-bf65-cb0d0736d5d5", "value": "T1B7237D425A9DDEAFC4D7023401A22B2312B57831C3BFC71796CD495B2CA5824DD78BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889451, "uuid": "650efac4-3cbd-43ca-9004-ca91e7618b38", "value": "384:0dr58p/r6+A9PfgLnPHQEbL4R8SEzIPj5DoeVlftyaGWCobWt:E18puPQjwEb0C8r5DNPtyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889451, "uuid": "39a21ad1-2b10-4d9e-9eeb-2abd8ef98bfb", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889451, "uuid": "8e341369-5d00-40d5-a2d6-2a1a94f4e142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889451, "uuid": "2bd92507-7e26-4919-9d4f-f9eab54c7f03", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e181a45-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889452, "uuid": "f7c59f66-d2cc-4652-8bc1-09a4ff77a830", "comment": "Malware payload (Simda)", "value": "4b49eceac5617d53e5e18b7a1a09d428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889452, "uuid": "26cdfaf0-57d6-4c9a-ba06-48cf3a77daa3", "comment": "Malware payload (Simda)", "value": "12c30a3047bd7ca6f04361d79c1a9a4105c8cd240baf09d9a191149dd944ba45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889452, "uuid": "ed1154c0-06ea-439a-9401-a0c791fca691", "comment": "Malware payload (Simda)", "value": "6413659d8d7cbd7d9dd3d0865103d72c456ade78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889452, "uuid": "3463dfba-584e-4f42-ab25-3891c127a9f2", "comment": "Malware payload (Simda)", "value": "bf6792940fc2e1787c11c7528ce98f3376d409fe28955cccd100366da1d537f1c54f3c41ce1b793f8ac5e5d685c539ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889452, "uuid": "dec02971-82e3-4d42-95fb-6689641f9d18", "value": "T1C9D4123173099DD3CD120DB70CFD973525D99D3883A0C24E5936C99F3A2AAD2386DE2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889452, "uuid": "b53623c6-b824-449f-9f89-fc1c9213a0b2", "value": "98aa7065495f35513795744857924eba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889452, "uuid": "a7962a53-d164-4dc8-a380-ada70bea5156", "value": "6144:G7++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:H+cff22qZhZcKYhc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889452, "uuid": "3520ce0e-bc81-4bf8-8ebe-eff36fc3fcd7", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889452, "uuid": "ff2dff9a-6244-4f41-b597-d30fc2669133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889452, "uuid": "9946da6c-47c7-4169-8022-ed9514e9b688", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde90cf1-c87c-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763909880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909880, "uuid": "d90fbdb8-fc81-4e9d-99af-c1b18627d3a6", "comment": "Malware payload (CoinMiner)", "value": "8867d9e671c71cabad1eddb3f1d57048", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909880, "uuid": "a334f8bc-2700-4312-9eda-7bf65da711cc", "comment": "Malware payload (CoinMiner)", "value": "12d53496c11077a786010a12e22ce1f66dfd89210dfc32b5ea88bb598b3c25eb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909880, "uuid": "1f64d710-48c1-47df-8ef3-6b9a3c7e605f", "comment": "Malware payload (CoinMiner)", "value": "cacdf00efd255dbbc30a9a2e802a9c23e7c8c232", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909880, "uuid": "31c53677-6ad6-4641-ae04-e9928a707a56", "comment": "Malware payload (CoinMiner)", "value": "fafb6c31ef20aa242c22537a9811085323206540dfb7b32da37522181c45ff89788b97cf06be2e87b966cd8f1af53636", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909880, "uuid": "52e579be-6bb0-4f17-b467-fa5d7bb9fb63", "value": "T1EBC622D905D113B4C0D74A30214B6379B7906E8845ED6E0D7AD17C621FB2EEE328E9BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909880, "uuid": "913601a1-3936-42fb-8a24-11aacecaebe7", "value": "fb8dc34e05bece8fc679be51178ffe5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909880, "uuid": "7a1e892d-5d9f-4394-9837-217e2fd381c5", "value": "196608:fJ388j6imnp1noLBWZUM8cDFXL9GczqI/FisdQpjO2glQJJNg:C8jH01nokZUib9GczL/Fz+z0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763909880, "uuid": "bbb3ab1c-8798-4144-9a63-a3f04bd9ffb0", "value": 12097104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763909880, "uuid": "c5794486-d1d1-4c35-a7fd-9721b405c47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909880, "uuid": "79648280-f13a-4e48-9bc4-2d78e5ccb247", "value": "Cs2Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304a74be-c879-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763908327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908327, "uuid": "06bff5f1-a765-446d-9250-a4aee45f390d", "comment": "Malware payload", "value": "7f98916a5e0c0b8cf179fd2763e027ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908327, "uuid": "0312c7d8-a792-479a-804c-37ee046b53b2", "comment": "Malware payload", "value": "12f2379bff69faa08e142ced1147e20e59102b718b128254d06ef97bdd335ba7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908327, "uuid": "6e1d2dbd-1090-4c2d-a15e-b165aa492981", "comment": "Malware payload", "value": "b787007f897e842105ca0417ddd05d193703c098", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908327, "uuid": "10c5e5a1-1cb6-40d1-9e11-6d28f925f45e", "comment": "Malware payload", "value": "f77f30004b7de6b40085d9af6c8f8c6181288b776109bd098ada8fa756e9b415c35c53afa8b43d4e78dfb5c36ddb070b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908327, "uuid": "6bbda3c2-aba1-4926-b62e-d0c1ff36104e", "value": "T1F456336345817E86D2E2D33E9D33C2404C09FDB6AA4D1662E55F68FA83C619CCBF07A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908327, "uuid": "5075bc05-df55-4813-8102-a9b5751032c1", "value": "9ecad17161342c5ed0725c6d520c5009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908327, "uuid": "f3c6ec6a-6723-47e8-9fc9-2c2b839766d8", "value": "98304:z21kvhCtONENrjX37XDfLcsaJEy16+XFwEETKLjWRter15aQn:BhCtqENrvzfGJEwlKtcWRt2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763908327, "uuid": "71f1537c-fe40-4085-94a1-c4346f1be99b", "value": 6095896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763908327, "uuid": "4c3b2e10-ca47-410c-b352-7865a692e6e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908327, "uuid": "5a419813-25de-4938-ac17-76ee99fe89e3", "value": "SecuriteInfo.com.Trojan.PWS.Banker1.37780.26332.25560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a79216-c80b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763861039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861039, "uuid": "8289985b-c736-4bfb-b334-5e09bde6936b", "comment": "Malware payload (Mirai)", "value": "9da0158a71e4eb7ef87125727c317f58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861039, "uuid": "3ee2db32-13a2-4815-a814-68b8f04c3051", "comment": "Malware payload (Mirai)", "value": "12fb84f22202add8e607e182969ca1f3b2d38d6eae73966c665c6679d21b9ddc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861039, "uuid": "5354e49e-154b-4ecc-b772-eb434e4af1ec", "comment": "Malware payload (Mirai)", "value": "aab0ab2c72429b6e19b5007fbc53f3c153d852a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861039, "uuid": "461f59cd-bf82-4f33-a6b0-b2fe8dd115f1", "comment": "Malware payload (Mirai)", "value": "0621fa022fe8dbe00d3cc337ceea1b1cf1003fd928bd8f18c8128740a23a9c1c7f7696cb30f70236c871dbf0816fd739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861039, "uuid": "394f8163-7ce9-404d-a039-33aed6bfd9ec", "value": "T1F673010A9592E9A064307338B46406DBA64BDE25F7FDE6F24031996478F7FEA02F8543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861039, "uuid": "5ff5fc26-b820-49e2-bcd7-b5f18fad9a73", "value": "1536:7qzmXLMYz3x9ITHdFgmlQ+ACEXschjBLIqiYLaxSuyo0KK5uQEfOS78ah:7km9z3x9OH9Q+vQtLIxYLaoutY5emlah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763861039, "uuid": "981035da-e8b6-43c1-82e7-5c1bb3306340", "value": 75536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763861039, "uuid": "d8e1c642-38d5-4dab-8d7f-6fad3c8dee66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861039, "uuid": "a241cb26-5547-4d04-aead-22be0439591c", "value": "ngentodluwh.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb29229-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889453, "uuid": "751b5d9e-6d7f-410e-b40e-709103ea2da0", "comment": "Malware payload", "value": "8042dec5fb66c5c18e9a7542a819cc87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889453, "uuid": "7ddb7102-72e3-45d1-87b0-f92abcb5bc09", "comment": "Malware payload", "value": "130900d12edbf957e785beea3d1d21813d6e39a7a8833f10b27ea0d1fb785699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889453, "uuid": "2fec3137-3bb4-4961-b4be-ec5c75c3a95f", "comment": "Malware payload", "value": "70b93efc6dafa4f05964e0c6c29a1784c1be1312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889453, "uuid": "6c3aa88a-746e-4df3-96ac-0e6d260969b6", "comment": "Malware payload", "value": "9fbcdd35752b528b42bb7c0681a0c3c9393f643df915117b05cad7aaa2bbb86e0a6739b4c9feb1a815fcac9553422828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889453, "uuid": "cbb6498a-dcc5-40f7-bbe8-5a1c3e1c0849", "value": "T112D3E7236F54405AD851C9F06CA9CA6E7A236F350FA1AD4733DABF112A72107B2F521F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889453, "uuid": "7e8e8500-2eaa-44b2-a8aa-a3574e1f6233", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889453, "uuid": "ec7a5bde-b16d-454e-a3a4-1bc476bd7b69", "value": "1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVK5:UVqoCl/YgjxEufVU0TbTyDDalc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889453, "uuid": "c7e85d5f-0a43-4433-bb15-762661252ebc", "value": 138495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889453, "uuid": "a7de8ca0-60dc-47e9-b3f6-ee4f222a17c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889453, "uuid": "e5467585-6081-4c15-ac2a-7c0e6a7af37b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4790e1-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889454, "uuid": "5d124fdc-dd85-455c-b1d4-a9d0c850f5a0", "comment": "Malware payload", "value": "0aa5391d27a612b0ee6d74517a0b5538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889454, "uuid": "96f7ad6c-c453-4660-ab4a-74e5ea2cbf28", "comment": "Malware payload", "value": "13142d0721a573df25c154d28c58c0bd688bdf46bb0c850a2e5c1fd88c0ab647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889454, "uuid": "1c1d9da9-b27e-4387-b650-217b351fce5f", "comment": "Malware payload", "value": "a1ed9bce02d9ecd23f5acc780ca3099ca904f366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889454, "uuid": "11090b22-3e4e-45b7-af27-0dd9c7a103d3", "comment": "Malware payload", "value": "9d488e5255b264675ceba466abb218ae1e46a1903a88ad54a82a600a9283cfdce1d246732c722f3c9de7ca8c5c89a62f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889454, "uuid": "587631c7-cf41-4c6a-b55b-a4b70cd0b2ca", "value": "T11E05122376C5C9B2C4421530034BBBB5CE7BE8782B22D417B7DC17676C79854EB2BA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889454, "uuid": "8a26504b-227e-499f-98d0-d1ca761ec15e", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889454, "uuid": "d30aa4a1-fba5-4f4f-bec8-10aca6c668d8", "value": "12288:otKe6Zv23YnTjp0Wn91PsXeYmJMkaLqGDtlTwSDcnm:K6Zv2KOWnLhGDjwSgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889454, "uuid": "b27179ef-8ee7-4c07-aac2-2d2b39b13f69", "value": 807092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889454, "uuid": "177b883e-54bf-4cd6-86a7-4fde5301ecdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889454, "uuid": "d7ac8a55-4fcb-4652-8f68-bcf04968e21e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe32b44-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889455, "uuid": "17df4163-e78b-426a-9faf-ee427b957e0d", "comment": "Malware payload", "value": "d7e5434f2efa89de9ca6623dd36b6d9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889455, "uuid": "afd8b287-c815-4959-bf34-02e9d87b0814", "comment": "Malware payload", "value": "133baede951c62786298954d90bbfd07ba3e4b6ba1899d1aededbbcf099658e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889455, "uuid": "4bde1952-e8c0-40a5-a566-9bf327615d7b", "comment": "Malware payload", "value": "d189ef73dd1b30fb2076febc9f1675ce177196d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889455, "uuid": "db8269a1-80bd-49a2-97e8-128edf943a2e", "comment": "Malware payload", "value": "a82425412a3ae3f639c51fcdfbab91658bdee80f1c1cb5ab7aa57b56c662b2922ce116608a5c6321acffc075a30a7f5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889455, "uuid": "b5404119-eed9-496f-85a7-25d63dc442b0", "value": "T11B74D07377D08DF2C8460630069B6B728EB3FA3915718467FBE46B172C35A54BE2AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889455, "uuid": "77e9206a-dfb7-4feb-ab3e-edea6346f3ce", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889455, "uuid": "6dd73843-8d83-4e07-937f-f0b49c5868fa", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5Tw/oPQ6DHfbCJ:BtKe6YiDdv3m3mgKHDjSeL46zDCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889455, "uuid": "b9f4cc5d-8b93-4cb0-896e-8bf8e1e87bc8", "value": 368822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889455, "uuid": "a4c7bcd6-d034-4117-aed7-bfb6bb9a7339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889455, "uuid": "d8020347-e051-4b25-9ce1-0379d3825d8c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f869288e-c853-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763892342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892342, "uuid": "e67b0206-b0e6-4f5f-9b23-be9c4b9c934d", "comment": "Malware payload (Mirai)", "value": "799e35d811873b297bc539d40ddbee72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892342, "uuid": "5226be61-4a0f-43c3-bcef-343505a241dc", "comment": "Malware payload (Mirai)", "value": "133cb796389ff8fda9fb4a5c56e38347ac137832939d0635ddc0a74ebaf8cedd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892342, "uuid": "05f8c9fd-f203-4eda-934a-0be695fc9a1e", "comment": "Malware payload (Mirai)", "value": "a49142f345e8ab8e6e10aa4c19d3dd6bad3bfda8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892342, "uuid": "2aac7732-082b-4fe6-bd09-9e3a5424abaa", "comment": "Malware payload (Mirai)", "value": "3c4ff812ba20163506ffe0c00065e941c529a41a8cf4115bc31a9e9b15028a034d35740553941ee3286eb8cf26c97a89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892342, "uuid": "6b39e7fa-54e7-49b7-ba5f-e0c790f62658", "value": "T1AEB34A17B9919B11D5C216BAFE1E414E331317B8E3EF72169E106F21238B96B0F7E906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892342, "uuid": "44ba2852-de1b-47ab-acb1-b1dabb03c38d", "value": "3072:h21AfbuqvJCbWAXIT90yQakDbBn9JUg8K:h2eazdKpQaGbvJUXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892342, "uuid": "9a6d08a9-3a53-4a72-b186-6acb0a9875f9", "value": 111828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892342, "uuid": "c3781a01-6859-4ac3-a2cf-0b2ef425b4ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892342, "uuid": "1a7874d7-2258-4968-8f31-fea25f9d8e84", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409b6892-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889457, "uuid": "608465f3-e06c-4912-8f23-f772e6b9f0b8", "comment": "Malware payload", "value": "95cddd2eabcc78395e6ac60bc03da325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889457, "uuid": "b261d95d-2f70-4375-9ff5-4bd31a2a5ef0", "comment": "Malware payload", "value": "135e67df4b4e2f6660f24e7b7b432bbdfa26ce7806cf0a2aed5fdbdc4a5b82bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889457, "uuid": "aee91db2-08ad-4761-b14d-bb72fc562abf", "comment": "Malware payload", "value": "7a5e26b901048b36c4b5252cfe5c7c9f4e9bcf19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889457, "uuid": "e16fd018-af9a-4454-8aa9-ed3516063c91", "comment": "Malware payload", "value": "ed7f113ae196a982f0351b2fe930d92d28dbed0a54387663e4a48ab166a3e92adc4b6806d9d938a8627f61507f1dcda8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889457, "uuid": "0f5d1185-9943-495d-b2ad-9acc45ca7a0d", "value": "T1E8652323B4D090F8CC492837019DE7748BB26AB626F5A675AFEC1C6A1C714A17F1BF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889457, "uuid": "f84738ac-a86d-4b9a-afc7-f48490c7ee27", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889457, "uuid": "42427c8c-8b82-46e2-9257-df090cd95f3c", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lAN2kwSk6Ye17l9m:7E2lVL3Ze+/F5ndjFWmrjyx1cmNk7YKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889457, "uuid": "51694b40-9377-4195-9f6a-42538955481d", "value": 1418374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889457, "uuid": "480dadbe-84ff-4e4c-a531-88ed80d21a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889457, "uuid": "4cfb4055-5d22-4689-8293-7a9c479c12c6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413530a7-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889458, "uuid": "2a0c65f8-88ad-40a0-a636-d02d26dafa58", "comment": "Malware payload (Worm.Mofksys)", "value": "2987ad786ca06a56bed4a312026c172b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889458, "uuid": "5f243607-cd24-4a32-8e49-b623cfb76d86", "comment": "Malware payload (Worm.Mofksys)", "value": "13d06c52dcd53b868c68d352949523376a22bce9f9787536dfdf4639e5ea5c0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889458, "uuid": "63002fe9-ffe3-4bd7-ad56-1e5a47bc16aa", "comment": "Malware payload (Worm.Mofksys)", "value": "446eab858ebd6b65627254cd61ae9d80b0378a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889458, "uuid": "478247d5-7bc3-47f3-b969-e07ee8f4c0c2", "comment": "Malware payload (Worm.Mofksys)", "value": "ad23816d1733e19e25efcfe9a0092d0ff3db75a39ce240e7f068ec9ea3c64e1670c0ed2a79653eb6b324e0fd6b813006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889458, "uuid": "13c85625-7872-4399-9694-7040d7d87fc6", "value": "T1E063D031DDC8AEE2EBC84B38E0EDDDC65808677EFBE81BD19209C19255E4C027D1AD95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889458, "uuid": "088a1446-7028-4efa-bd8f-3c73a0e2b889", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889458, "uuid": "8dff6607-0bd2-4673-82f5-356932c94085", "value": "1536:EgXsfgWQN1kYsRxWTg3PwSWe991Rdolpdz6JAkAn:1tWYfGATvPe9slp+Apn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889458, "uuid": "d38cc049-b492-4eb7-b2f9-aeae2de4a69e", "value": 68785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889458, "uuid": "fd67f752-7cf9-4853-bdbc-990331d9c9d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889458, "uuid": "6b5891bc-aabc-4946-885c-063b4f751c03", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f3fd8a-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889459, "uuid": "0d2b94b3-1a1e-4de0-9cb0-7f6f6e002e12", "comment": "Malware payload", "value": "3a7dc85660d693bde5aae6578cfa7f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889459, "uuid": "6a7674f4-1206-4998-b39b-47f6d6fb52d0", "comment": "Malware payload", "value": "1400064b17d8f7a3615877ff6daaa896dfb5381d7e2557bf38949828b1c53a86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889459, "uuid": "13a369fb-681f-495a-bd1a-56b7adb4b16d", "comment": "Malware payload", "value": "74efed22f2ef92b9ca90dc6aea3c5cab256a814d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889459, "uuid": "9acb7720-3b86-45fe-9697-9183fcd95836", "comment": "Malware payload", "value": "275ecdf23e67349c05e111596e32c8691accb7319d000c88e1e21a6c1e5e475e26092446b321e12004751a7c4b14fb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889459, "uuid": "000f243a-8333-4dea-be88-6528a1df99f7", "value": "T1B825232736C5DCA3D1071930130B7BB6CD73D8BA2B65881377D867276CB9824E75AB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889459, "uuid": "c33bb065-5cd7-4386-9e18-c2f695d9841a", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889459, "uuid": "b9e3feaa-f9e9-47e5-b593-2aaec100ec6e", "value": "12288:otKe6Zv23YnTjp0Wn91PsXeYmJMkaLqotbvm9pHSUtW8vDJrEnmrBZ44k63fkS8G:K6Zv2KOWnLhCv8HYgrvBdkUj8ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889459, "uuid": "9644eded-ac15-45cd-a978-1880087e98bd", "value": 1036339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889459, "uuid": "c0cc3627-1577-41fa-9de3-fe7737bafbf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889459, "uuid": "b9eca9ee-ec4e-4069-983a-2eb57cf9529f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428cba6e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763889460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889460, "uuid": "58301b31-1783-4b0b-878c-64229f5f8a5d", "comment": "Malware payload (XWorm)", "value": "3a73cf1dab977e9e40cf416fd85e43cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889460, "uuid": "395bcfc0-365c-47ac-a3ab-a98328f28ce2", "comment": "Malware payload (XWorm)", "value": "1402524dbcd6c8954d300e96227954f8797e125ee533b69ddc64ca54cae35d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889460, "uuid": "bfdb15b5-a21f-45e9-b49b-597f317dcd55", "comment": "Malware payload (XWorm)", "value": "13532302a00924bd11dba86a58a677419556ac58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889460, "uuid": "954ed8a3-71ff-4e2b-b33c-1be9627458eb", "comment": "Malware payload (XWorm)", "value": "d0bd0897856e070b62bff04804f105695dc0e8ca6b2fba2cb3d6a756a562e2ff2baa6ef0398b912d58158dd55c564cb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889460, "uuid": "e5b44174-5a05-4044-af2c-5c641ded59be", "value": "T15B05AF11F7E444B5E5B74935897687628E3ABCA61B32E9CF13C4461A1F32BD0DE38B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889460, "uuid": "45dc8a94-8cb3-405f-ac60-11b16885c750", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889460, "uuid": "edbe382b-4398-4622-877a-5c40c7a6e7fe", "value": "12288:YquCuygMQjd5vJIBP1vYkDi5eJQ7uysMFZzN/dmBW16umyZuiN/HbZ57sqQgc+:YnyJQjd5oAovgKBov/Hb/xc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889460, "uuid": "04b8d65b-62e2-40db-9d79-d686d3ff4b0e", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889460, "uuid": "c8a4743e-03e0-4aed-ae7e-fe6382659503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889460, "uuid": "4e527b17-4ce7-4f28-bcc2-92ad72767187", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431ebde4-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889461, "uuid": "4d13f197-b8b7-496d-84c6-39c530836cc3", "comment": "Malware payload (Simda)", "value": "6b81f32ba5761ea72468b7722a8cf901", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889461, "uuid": "1155214f-701e-4279-a7ee-f9f4ef4c1967", "comment": "Malware payload (Simda)", "value": "14164234fdf8d6cf6d08ad2b1a5341fcabf6ecea1dc159f87af4fe164ef7c74a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889461, "uuid": "e6d7c667-39b9-47fd-99ff-ae4a22ec9019", "comment": "Malware payload (Simda)", "value": "e260772687a9988594065e191d4a1f4bf5719b27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889461, "uuid": "51600c5b-b6f5-4162-8a5a-9df82a6cd27b", "comment": "Malware payload (Simda)", "value": "6d89d5565fb006bf837f4d349cf0e815c28644a34457ee9494d3376a08343012d28d88639b173d607db9f5d08548e00d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889461, "uuid": "eb002b5b-6edc-4b60-b3a0-0ba43e55fa84", "value": "T194240210F198A647E16F083A05A5E03A883F7C7B6F23673E1E1119C27EFA6D1D761B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889461, "uuid": "faab56a7-0310-413a-9f00-3430ed6fbc10", "value": "2e5df9fb7e893bd2efa286b6326edce6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889461, "uuid": "01906502-4d12-4f8e-9266-e2b2be2caed1", "value": "6144:8EQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:8EGDdQNHEwWlMxYG/wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889461, "uuid": "8ccd78d3-a84e-4a7d-818a-5fe3b2957210", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889461, "uuid": "6d829fbe-e013-449d-97a3-ee7ee6119b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889461, "uuid": "679b2327-4f01-487e-abfb-6b04f21231c5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c2a41b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889462, "uuid": "84701994-c160-4a5e-a15a-ce1f69488fc6", "comment": "Malware payload", "value": "17da4a9634e700baf1a8eba830fd06ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889462, "uuid": "7fa3802b-041c-4d5f-b819-29f6c17c565f", "comment": "Malware payload", "value": "1432b4190f80cf985329ebc2f3dbc0f1399e88e2c0012d9b0290e523347cd029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889462, "uuid": "0ac71fcb-a4ad-418e-9188-67618f3a27b5", "comment": "Malware payload", "value": "e731f143246aea913704ec4c37570679edf487be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889462, "uuid": "c5ae063d-c723-4f38-bec8-85e09317dbf7", "comment": "Malware payload", "value": "44d6017f1f1b5fb2fcfddf9f5b73ce9c13536bdf9e40aa4d5923e21a920fd97443f621e82cd51e5bbd8a1dbd5dff4b11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889462, "uuid": "59f51603-dfab-480b-88bc-daca8155c7ae", "value": "T1D935334216C73E84EEBCE2F787C3229979763AD817E1A83AB65DC94F01F0515B16807A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889462, "uuid": "4b6276aa-405f-4036-a437-976ac408333d", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889462, "uuid": "f3733fb1-b300-40b4-82cb-cfba2f441014", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuNpLu:+YhQs7tWVToP0Hekxbl5TuLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889462, "uuid": "1b41d628-7a14-40e2-8b8e-65a3cb460f05", "value": 1091731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889462, "uuid": "e106ac75-e92a-484d-9921-118773d33b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889462, "uuid": "8f3fa1d9-e4ab-45ae-9d57-fefd80d41b8d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1808d86-c883-11f0-a129-42010a9c0007", "comment": "Malware payload (Gamaredon)", "timestamp": 1763912919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912919, "uuid": "cae6bdd9-b693-4326-aba2-3e43786f7fb0", "comment": "Malware payload (Gamaredon)", "value": "cf3f9dbbb8366d853f3283d151e7e096", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912919, "uuid": "1dffc9eb-b284-4e29-b046-699b420621b0", "comment": "Malware payload (Gamaredon)", "value": "1454c4c2b513ca1a536a6f0da2f9a1ec6a1a33d258413efd4a1105215aeccbe7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912919, "uuid": "65f2b71e-ffca-4287-8d5d-453f2bf4cd52", "comment": "Malware payload (Gamaredon)", "value": "23213695582515a5fdf4c42fb9e182e77e01acaa", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912919, "uuid": "b4e1910e-19d5-4c0b-835b-05ef676f9222", "comment": "Malware payload (Gamaredon)", "value": "f2669267b94b6598edee20dafaed839f327611e29cb8b20e6590a473c9b3af6564ff99d90f186e29c55f14cf8e1c6532", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912919, "uuid": "db557b85-cdee-4c5e-b865-32ca546fbed4", "value": "T1A15166437E37536281EAB312B191104BDECA931621AA6564369CE8102FD796CD1F82FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912919, "uuid": "bf3c760e-2669-418b-852e-e05cdcc345a2", "value": "48:/vuLbL0o6NONj5QZLITFgj5ppA2tsLAkANgASXV6ZgWDWxDaSsDIuxDaSsDMuxDb:HuLbL0o6NONj5QBITFgj5ppQXXJV6ijR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763912919, "uuid": "aad44d55-4d25-4325-a382-36351630f2da", "value": 2465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763912919, "uuid": "a54b6971-4da8-4f18-bd43-4371cc386628", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912919, "uuid": "39dd1cf0-6c2d-485d-a0b0-11967b4b0404", "value": "qpzuwtw.bmp.ps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447a43c0-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889463, "uuid": "a9decbd2-ea92-48b5-baac-b2fb9e5375da", "comment": "Malware payload", "value": "070cd4b177b3b30b356c52c732d3cacb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889463, "uuid": "7fe8f51d-e997-43be-8438-46362b69965a", "comment": "Malware payload", "value": "146a5d22c8eb38ef3c0763627c3676b96bc7db040f77ac39efd16dcf45dbe3ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889463, "uuid": "c8b24864-a9a1-41ae-9788-668f7e1a8b91", "comment": "Malware payload", "value": "a1abac010c51f21ed7b7cbb9b2d89f214344a106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889463, "uuid": "bc2267b1-ee75-44be-9f39-7de3b562b002", "comment": "Malware payload", "value": "433d22bbc4b27214b73bb9f82db9a22e523c6807cd943b72f2f627ebacf658a3f1595740303efb6735e51cdd9e1aeec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889463, "uuid": "8341adde-b442-4796-afe6-cd4019a27836", "value": "T18856F119A25944E5F76BE13A8546BE8BC13B781B1316A2CB718A51483FFE3C131BD34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889463, "uuid": "e2dbba23-e8fe-4b2f-a9c7-255d6099b4e6", "value": "98304:FR52xHn8kq+oTl1DQ+zSNKJzj6QIT4bNJFY3OqtJKY5kqXf0FsevpXS50kQQ:Z0NV0lRS0Fj6QjBHY5KGkSIseRSCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889463, "uuid": "944c262a-b2e5-43a4-8689-b48ac5b606e7", "value": 5923092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889463, "uuid": "e65a3e0f-8cfa-45bc-9db2-88f1a6897707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889463, "uuid": "f7bf452b-e544-4356-adf2-152caa9aeda0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f4bdce-c852-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891532, "uuid": "f07c10d7-6bf4-419b-bf4c-076cbb214f3c", "comment": "Malware payload", "value": "df3766401aa7927b80a0ec8b8c850d92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891532, "uuid": "1a999f62-0602-4824-915d-a8ad4f37cd7b", "comment": "Malware payload", "value": "1476ed52cc03ce142fd01ba3e24f93d1edbd6880f2f4c18683eec7a7fe76d177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891532, "uuid": "da24d1de-c490-4bc7-8d83-d5e400892920", "comment": "Malware payload", "value": "e9966b32186ff4245ea9e177b63dbe8e90f7c610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891532, "uuid": "bed1f816-7fa0-4e37-823d-41d980615f33", "comment": "Malware payload", "value": "5ce66ceb8444acf8084c59d73a38c62a229c31340c5b3359f8d3f6cefebca61e1df689bdbd022b8335daddd11aed2bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891532, "uuid": "0a0b4490-c012-4256-be95-bbd7b9b1c3bc", "value": "T19435330B33C15271CE49537206871AA15F73A77E07B0983A77E8A44B1DF2944BFF8AA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891532, "uuid": "aa2781fd-6ae9-42c7-a7d9-edf4017046b4", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891532, "uuid": "5bac0279-0ae9-48df-9642-65a121d5e3ee", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mMW:qE27hQs7tWVToP0Hs0/htDH3pGaF5+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891532, "uuid": "9c03e8d1-b694-4969-be16-f71623e11bbd", "value": 1136059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891532, "uuid": "f25ab0a0-2c40-48c2-9613-52d3f7f0630e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891532, "uuid": "ea1e700e-4848-42ea-9e48-538e745d3d82", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4551db1d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889464, "uuid": "fae65c39-d27b-4b58-8071-5884020859a4", "comment": "Malware payload", "value": "d49908810e782b5c612ac993693897fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889464, "uuid": "44f7ee09-981b-44a1-b803-7524fb9c0780", "comment": "Malware payload", "value": "148ef72da4e497df8c4147d49b79fe9c0762189383f5046cc2e9b9479c2a6749", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889464, "uuid": "ed5a8871-68a7-49ea-8f09-3151fcb2acab", "comment": "Malware payload", "value": "d59c330e1fb2730eefe5a38ada40a683c58ca7ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889464, "uuid": "7e72ead6-8541-462c-976a-d75dcf819ce9", "comment": "Malware payload", "value": "82f77d0ca59e7cf36f13508677c3699708c175b4146f0166b4f976fadf8890a8f076de2aeb0b852101e9819c9c2efdb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889464, "uuid": "735605ee-2447-4059-8fd1-5bc2db250aad", "value": "T1F956E75233F81C85F2F72F38ADB191164F76BDA459F5C53C2184518E09BAA91AE3CB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889464, "uuid": "5501d757-486b-4b37-b5bc-79d53268d4a4", "value": "68c8b6c1c34258010d37b2cef4172345", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889464, "uuid": "b6a4d5cf-b886-4823-899e-f76a718503be", "value": "24576:lYk2GtxdL4GuQc/Xlh3Qh3OXuaq4gTdZrZMj2YDSIT9f5DBMYjvDwKlJRF3G61a3:l/Lx6dQCL6dZ4gTdZo2wSIT9RaY7ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889464, "uuid": "81d3db2a-6840-415a-b163-85e1164e4193", "value": 6199619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889464, "uuid": "2f84c3ba-67bf-4535-9ced-de6d4ddbede0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889464, "uuid": "8befed8d-6d92-40c3-8da6-fbd8911cc7c7", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45eee1de-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889465, "uuid": "0d4a9b27-e5dd-4d5f-9bd2-56d69253075e", "comment": "Malware payload (Simda)", "value": "c0136aa34de47fa5c7dc0d559c9741b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889465, "uuid": "a8c62d2c-345a-4d08-9da1-64df808eff08", "comment": "Malware payload (Simda)", "value": "14a2bfd568f51f09472cfb576b2f10e3222ee4d17c1979e0d058af675c2c1973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889465, "uuid": "3c1d780f-6895-4be7-88ec-a93ebfd67e28", "comment": "Malware payload (Simda)", "value": "56ffeed2e2a3a36873f3bc8492eeadffe4252873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889465, "uuid": "4616db10-39f2-484d-b017-15c4c68b1ccc", "comment": "Malware payload (Simda)", "value": "596db7d3ce0951a632c5ab0691391e76b1eac5ef35529616340a0e9253083694ef2c01af904fe4b2af1fc11f5c60ffda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889465, "uuid": "df56c02f-ea76-480d-b63f-be34db3fafc9", "value": "T10624022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889465, "uuid": "5e9b0d98-f776-48a1-ab46-c2a51d72c23b", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889465, "uuid": "08a7aa74-ca63-4c28-baf1-5eef5e7893ae", "value": "6144:yZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5y:wquCuygMQjd5vJIBP1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889465, "uuid": "e08d2bc1-6ac1-47e8-bbc1-9ca3c2ae2d66", "value": 213056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889465, "uuid": "cf2a6039-47bd-4a08-9eec-d80d900ee6f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889465, "uuid": "dd13d8db-5a78-4f6e-9ab8-35cdcc02942f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46846706-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889466, "uuid": "fecc48ad-bd98-4a28-922d-20e0f13002bc", "comment": "Malware payload (Worm.Mofksys)", "value": "aa63ee70063dfe8446ba717c0e69227b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889466, "uuid": "c91b44c2-956e-42be-9446-481a1122e6f6", "comment": "Malware payload (Worm.Mofksys)", "value": "14b98f2ee550da3123a3962dc7d68a3e8514ae757bbf8e4913af45bcc93264a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889466, "uuid": "5604b0cc-a92d-4d8a-aa09-984ea16bb4a9", "comment": "Malware payload (Worm.Mofksys)", "value": "7ef9d72161dce69b8178324f26bd757ead34d7f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889466, "uuid": "99c7f3bc-a0b6-4253-a45f-fee9d3c622e4", "comment": "Malware payload (Worm.Mofksys)", "value": "78197fa9b27a7e2b73c58413993c63651822c2c492165aab599f7a179779a1a6b37adf28b548a5431caab1ae50b3f8dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889466, "uuid": "06dc3697-a78f-4fc2-b3bb-200520d53939", "value": "T11163CF93BF8C81F9F4C3ED3326B8BDA72A4806957D8A5336B0446D624E38E505B1E15F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889466, "uuid": "7dae69cf-d07a-45c1-999b-412189b22c18", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889466, "uuid": "86a3c3a2-571d-412b-abe2-1c8da25e9f0d", "value": "1536:EgXsfgWQN1kYsRxWTg3PwSWe991Rdolpdz6JAkAv:1tWYfGATvPe9slp+Apv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889466, "uuid": "8724781e-da42-43de-b179-cfe495e6fd11", "value": 68657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889466, "uuid": "fd6cb614-0bd3-4993-9b64-e3fb02003428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889466, "uuid": "dd373e9d-3d75-4d72-ae20-c413cce0829b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb31bdc-c897-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763921182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921182, "uuid": "6f0a87c3-e7bb-4ecc-8fa3-833413e4a6cc", "comment": "Malware payload (PureLogsStealer)", "value": "df96c8ac593215d4dfecdf857c8cc1ac", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921182, "uuid": "dd3c3908-1c19-4d24-9833-1b9b2a4f011d", "comment": "Malware payload (PureLogsStealer)", "value": "14ce84e6579a53287f4c526e01e8174f1b6d774cc189d23cd6f9c141af9be904", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921182, "uuid": "1422728e-3397-4078-b70b-6bccb4c61d1f", "comment": "Malware payload (PureLogsStealer)", "value": "706b0fbcdcbd475a73f2830b5226aafdc7df94db", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921182, "uuid": "d9bc50f2-2df7-46a6-aec8-0e925d9a9f6a", "comment": "Malware payload (PureLogsStealer)", "value": "60f5d4e94ff6d58eac2d09bf442e9fee3bc24da65290c1f77cc7247d3b00c49924ab9888bb8c99b742fbbbdcb9005fed", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921182, "uuid": "831c1dce-a6c1-473c-a90d-22b8d1abbf5c", "value": "T1C9E56B176D9185A9D099F33894BA9193BB61BC0CBB31E3D76F702A342D723C0297AF54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921182, "uuid": "2fbe3a3b-05b7-4b4b-a62d-6af9e108d8be", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921182, "uuid": "ac87d0b7-24f2-4d28-be2b-ae2be423605c", "value": "49152:6shLZY57Ajkl88Qqq8s9aXkBBUuQUjDBN1fjI:6u7JQGDdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921182, "uuid": "125d8352-3ed3-4197-b45c-a0d0e86d7c33", "value": 3030744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921182, "uuid": "f8804634-6594-4d39-a154-21d19b47deb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921182, "uuid": "bdd195bd-7e47-4c8c-a461-05cd328bbe4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47195cb4-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Swisyn)", "timestamp": 1763889467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889467, "uuid": "b68e73bd-9f88-4d5e-a65d-4a04cc4f3251", "comment": "Malware payload (Swisyn)", "value": "4c54e5e8b2225a6e6a8d85322b2a6bfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889467, "uuid": "2094f4cb-3041-4a06-89ed-423394fbd188", "comment": "Malware payload (Swisyn)", "value": "15196b1a08e4dfcad747eb56bcc7044104011277ce1c435a4bd1de5f48dd9b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889467, "uuid": "6b8e4d47-4dc4-4e85-bf4f-6e46e3702a40", "comment": "Malware payload (Swisyn)", "value": "4018a219d419683922cdf8b9d2dc4f1f3816a7f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889467, "uuid": "84139032-593b-452d-ba1a-b131dc179da1", "comment": "Malware payload (Swisyn)", "value": "b84adf9062adc338c6ebfe5ec09fbbefd9cf9e565e2a88d363d44b9b9fc76626e9bf3a0648e948ecad32f38335f8a4b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889467, "uuid": "509dead6-4783-47d9-9e99-b27ad3b95fb2", "value": "T179544A07BD60115BD723C4F0ACBAA55AF8A29E6B03F1AE071691FA4668315473BF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889467, "uuid": "9c8a2f75-7b95-4a57-989a-24a70a7a6de9", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889467, "uuid": "a7abcbcc-c45b-4bca-ba62-c1c0f8cd3ae2", "value": "3072:AygCullUQN7gsBh1L1QygCullUQN7gsBh1L18CCCCCCCCCCCCCCCCCCCCCCCCCCd:ARleK7712RleK771c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889467, "uuid": "97bb8b1c-d705-4fc7-b625-2fec5c5aef24", "value": 300055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889467, "uuid": "c789eaa7-f27c-4a35-84f2-84ba4588c337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889467, "uuid": "3896b6c3-d4d7-4585-b1c1-0cab71c4175d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b6d813-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889468, "uuid": "2d1e4a78-2196-45c4-8958-93ba49cbb6a9", "comment": "Malware payload (Simda)", "value": "dfffe9278de7cc6330e0627b2570e7cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889468, "uuid": "19925ff9-6874-4c7e-b5ce-1d81ec4f038a", "comment": "Malware payload (Simda)", "value": "151c8998a674e1ba181f74aee14ae843199e48418f8be7fec9eac73bbd6d6c26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889468, "uuid": "eb5bb75e-9695-4c27-8d77-91ae4cdeadf0", "comment": "Malware payload (Simda)", "value": "8a7da01540722bed3a73e2d99d1e4ad33c96ee54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889468, "uuid": "3a07175d-95d1-4237-b6bc-c57de5dc0021", "comment": "Malware payload (Simda)", "value": "e202cd5aef1fe2e88534cbe6c92d9dd80d03b3db4d3fb2c76f564ab30eb82ec89fea2527e3551f126a26e9db77b3a9a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889468, "uuid": "4f423242-d77f-4170-aa0d-d7bfddcae4fd", "value": "T14524123BF6A418C3E6B63A3014FEF15819A8952C3552AE3BB40613DD2F662C44FF5B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889468, "uuid": "0edcc4cb-23b4-425c-8534-ef9f135512fe", "value": "a0f41bd5de82cbb844f692b48ffd09bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889468, "uuid": "814be53e-6036-45e7-879c-065bd92bb4b0", "value": "3072:hoAbvJrZ/CEp1Td3INNAILgwKRpP3fJ2pwLAt/iw1JmWTe1eyfLUH+xW6Lyk:h7vJN/CE/TZINiPPBIwcuWTegi9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889468, "uuid": "df0ad8ee-65c6-4553-9736-7964e54448aa", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889468, "uuid": "b888c411-5b1f-4b3d-9491-861675d66097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889468, "uuid": "cf687b64-714a-4c3a-822d-d642ece89d42", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486aaf70-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889470, "uuid": "7eadfa08-90de-4917-b38c-8e7a29bbfcaa", "comment": "Malware payload", "value": "04dd9501c8874f8b6e145d8e18ee1ee1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889470, "uuid": "2d2e435f-07b8-47aa-a9f7-a5f9af49fc74", "comment": "Malware payload", "value": "1526708fd54e0b0518919be65b61539b7e4eb247aceeb7906f910fb9766e0de9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889470, "uuid": "7314acff-ca6e-4dc6-a6ca-9d3cf714eba8", "comment": "Malware payload", "value": "f86d6e333c8c0d0d90928e3a25200433e25e40a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889470, "uuid": "4304268d-810e-4bc5-9250-413d0db32c32", "comment": "Malware payload", "value": "20a340a70f2c0cd0e60a37f58efef1be3e6b161c14e58503f764cfe77b4bd6e78be30aa71c2cc115309246db27a0a160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889470, "uuid": "8d55168c-89c1-4f8e-b3c6-235c9426672c", "value": "T17F463321040D2DD7D37B52731CAFC7AF8752823E1E40AB973377FBA608A7A587149A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889470, "uuid": "5d870aef-a0d7-4daa-ba05-8ed49d0fbea9", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889470, "uuid": "f6bd0a2f-4d20-486c-bfc5-77cbf15f4472", "value": "98304:oKNaPtLSdkXr14y+eKoluMrOh2XD8JGQ7f4Sv3yNo2g5p:NN6Jw44y+pol7OhY8L7wuip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889470, "uuid": "55978650-a093-4494-a56c-4799e4927083", "value": 5394432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889470, "uuid": "c541e5df-dbfa-44a3-8e59-aecd7380d18c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889470, "uuid": "be73f157-5e13-4ec0-b142-5cc1743cf563", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4901794e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889471, "uuid": "9751174d-e917-4106-af66-8a1116be2cff", "comment": "Malware payload (Miniduke)", "value": "17080e71765833267fb8e306bd52f4cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889471, "uuid": "3ff8cb51-7b70-43bf-9208-a847bafd0888", "comment": "Malware payload (Miniduke)", "value": "155dbdf9d6f99b6eba7e0a833c16ef6f9866d2b20e5d98aa9590e17cff0e2222", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889471, "uuid": "02e490e3-bc32-4c03-8b1d-76e1bf6d677b", "comment": "Malware payload (Miniduke)", "value": "59000984be15d06932e209619f1577a19a6fa422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889471, "uuid": "41e2c582-2ca4-4ffb-aa5e-f7ecf8fc72d4", "comment": "Malware payload (Miniduke)", "value": "952abe4f7b75dbb38047ef2876e6a1e3267481e421f1f0b5cb1e46e442ed54ecf1a32aa37674497ab770cb6e99f1d138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889471, "uuid": "96e4b652-4fda-4db7-9c03-efc557f84cff", "value": "T134049E3533E580B1E53316B46DF1AB72967EBC384A71858B9BA41F6F2E346918339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889471, "uuid": "9eeb8ce6-6524-4e30-89f3-22b79afef344", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889471, "uuid": "7d4b14f5-ceef-416f-92a7-543b2477cb89", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZlYIWJkdp5Se:+/LhS0rKE/FLITo9moIWWdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889471, "uuid": "e04f7fe9-c67f-482d-83fe-64c01f61cfc4", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889471, "uuid": "b3244ee8-bb46-4ede-9c3f-ec1f70928ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889471, "uuid": "d7978f22-5252-47f3-a355-49ed24a42497", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ab6157-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889472, "uuid": "445688e5-3e3e-4bcb-aa9c-43a2bdf62173", "comment": "Malware payload (Simda)", "value": "1a088e60ffd8f53d00e0944fe1a1d671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889472, "uuid": "f69c73fb-c314-4965-a4e6-dc7e71a75355", "comment": "Malware payload (Simda)", "value": "1574626b8a80aad87c77ff373ee5a2e2d7eb1b2758c46e868c1274a9c042402a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889472, "uuid": "a61140e9-7113-492b-b095-2682a1b5a802", "comment": "Malware payload (Simda)", "value": "00f7efe465c8ccfa39fb40aba89eb470c2c4200d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889472, "uuid": "d66aaa02-9edf-4790-81f6-9225d2da60b6", "comment": "Malware payload (Simda)", "value": "b523581ae5c06b0c4a472d61d2735d14ae3e5029981523f162fc1c0aea9f2e26df1d144256cae749f49e6f56791d8b9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889472, "uuid": "948c2d11-a218-4f9c-ba5e-cb0a4597e6f6", "value": "T171749D61F185C176E0F116B096FF7A5B106D6965471C38E3E798BEC929740F23A3C28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889472, "uuid": "956189bf-9720-4527-b21d-d664fb704002", "value": "61e0c59abaaf63342f8dbf1c1d5cdc47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889472, "uuid": "f6f13169-3729-438c-a3ad-822b4516d65a", "value": "6144:YtycmWhxR1arY/PbgmFOabPIIBhJXAv7eTY9suz0xhttGSrDKE3KIQvSka8bj:YpmWTR1arYnEKosuzY34CZ3DQvSkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889472, "uuid": "fc12a48a-aef2-4579-8417-4f0c9fe89016", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889472, "uuid": "b381b6b5-ea12-48de-883c-879b99d95cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889472, "uuid": "7341caf2-7bc4-4306-9cac-b72a98b9123d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3f9609-c800-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763856698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763856698, "uuid": "eb4a9c45-8f0c-4cc6-b2b7-b08358459f36", "comment": "Malware payload (Mirai)", "value": "80f67f956d86b477f3171a477ae7ce1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763856698, "uuid": "c0213fb2-0b41-4fa4-9b9c-ec55f92e530e", "comment": "Malware payload (Mirai)", "value": "15ae0ae241a8224a2afdea421f7588ca4b03708b65799fdbcd7cf63ef3f523a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763856698, "uuid": "bb7fca2b-263a-47c5-aad7-05db1a4fcfab", "comment": "Malware payload (Mirai)", "value": "89fbb8142de1692366ba5f15c359a28cf01dadc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763856698, "uuid": "c1bbfabf-94fb-468f-ba04-a54ccc63e808", "comment": "Malware payload (Mirai)", "value": "3fa02f036d3325e0755db613acc15c273a392b6c23f7a7577e960fdcde8d58d02c3269952474ce3c09d38e007c6aeb62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763856698, "uuid": "7357ee8b-1e9b-4e10-ab60-bfbd14b28f04", "value": "T1CFF36CC5E783E1F6EC760570507BA732CA76D63A3229D981D3BDDA39E826001C627E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763856698, "uuid": "6adc35ad-2fb3-4bb6-9909-0a7c8def95f4", "value": "1536:G45oExkp11BLDfq/fzsNxbMIt9aQKE/7ZhpyftkuzId5xfpB0VDWSourD/BIrIUL:t251BPpx7uQr7j01ktdbpWvln/vC/B/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763856698, "uuid": "53fd78a3-2cc9-4e2a-95b9-e5e10eb12645", "value": 162344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763856698, "uuid": "3c263e18-b037-48f0-901a-48882c6221aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763856698, "uuid": "d65b5880-b832-4f46-922a-13b9dff3fa9f", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4b2333-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889473, "uuid": "bfc39364-46ca-4bf9-bc19-146d6a98caec", "comment": "Malware payload", "value": "25cfa97cacae7c0b83c4f920b8755d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889473, "uuid": "02bbe3fb-fe82-43e9-befe-4c26ca0e87ed", "comment": "Malware payload", "value": "15d16242977d1bf062350cfddf8f993473e575ae8487767f32ecbbea81fe15d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889473, "uuid": "bdb160e6-5d4c-4325-9bca-e4580580a80c", "comment": "Malware payload", "value": "c5df4411577482141273df783bcd6d5c223c2f58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889473, "uuid": "38ca1839-158b-4800-949c-5b5251b50f4c", "comment": "Malware payload", "value": "18ee48a170e87721b968404f9df3a79a4e3f0d82fb2b22acf57150e79ce5d02bab3ec81b95e4e05bd6a8822ccc5c6dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889473, "uuid": "787496a4-03a2-407e-93b1-dc15a22e52bc", "value": "T19C65332379D090F8C88A5D36009ED7B1DBB2ADF626B56566BFFC087A1C314919E4FE04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889473, "uuid": "fdebb24b-c054-4b80-9a99-31b26697e23c", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889473, "uuid": "e64e5a03-4c42-42da-93a2-af3b4afbd265", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lANCPrHQMHyXUu8j8x:7E2lVL3Ze+/F5ndjFWmrjyx1cmbbOXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889473, "uuid": "fb437a76-1074-4196-b023-4e489b2a5bcd", "value": 1448505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889473, "uuid": "c76006fb-e28a-41ce-9d61-e09edea8282e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889473, "uuid": "598bc953-d2f5-4d8e-888b-6392a6302332", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4adb425e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1763889474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889474, "uuid": "f3e90190-0ee8-4203-ad7e-dab22730f7b2", "comment": "Malware payload (Meterpreter)", "value": "a896794bdf377abfbe3239f568c02a34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889474, "uuid": "2320403c-a12e-4a39-ab12-8adc7fb60593", "comment": "Malware payload (Meterpreter)", "value": "15f58b4063e67bad03c38cf0e9e4969eaea91f9f15d352e9fa891918fbbd06e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889474, "uuid": "57579ec2-2301-4b96-9b3e-56b472885aff", "comment": "Malware payload (Meterpreter)", "value": "de69786c2a495db9e988698e29199ed8fde55a8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889474, "uuid": "09d572c8-b9ab-45dd-8973-6b4d2272c68d", "comment": "Malware payload (Meterpreter)", "value": "31a725570b664f76e44c1a58b212847e5ae94b27ae9067e3aee32eaf6e24605d3fbe738a255e83390f497de9a48eeab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889474, "uuid": "11446e36-15c1-463b-85bb-5e446486ab3e", "value": "T126E175233B184EB6D87C057C46E7FCA7B2484E292F3B52B58D180307397222469F4A08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889474, "uuid": "c8bfaec9-1016-497d-8792-3cc98603d8f0", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889474, "uuid": "1b484bb7-c27a-4371-9a77-05282a3db454", "value": "24:eFGStrJ9u0/62YHnZdkBQAV9cNq9KZq9q0eNDMSCvOXpmB:is0TYjkBQps9q0SD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889474, "uuid": "d44d4afc-1f7e-43b6-b99f-4ace48d933a1", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889474, "uuid": "d5b8f7db-d1c2-47ab-8af1-35902a254d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889474, "uuid": "2b0c2e7a-d37a-4c0c-9ed8-43eef6cfba8d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6a376a-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889475, "uuid": "b4ee26b1-e237-42f9-b2ec-c5311cf92a13", "comment": "Malware payload", "value": "7a0231dd425d614c8f377a053eabc07d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889475, "uuid": "97cd4ebb-86e0-4628-81f6-4f8849cc0dd9", "comment": "Malware payload", "value": "165ab1c6ae1e6cc5cc1a614a9c626d037c2eb8575e20d99a132ab5c6fceee850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889475, "uuid": "daa1525f-a7e1-4e60-972f-b721c112156d", "comment": "Malware payload", "value": "77944bf403e232cce99d29835f1772c3748ce204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889475, "uuid": "84f12f0a-33ea-4a66-b83a-04540c81b7b6", "comment": "Malware payload", "value": "075d018091593b5100072d18247c1d831a8d99ad5b33c59757b50990bc285e75afdcce065aaf5c90391875e3a70de4b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889475, "uuid": "240f953d-e191-40f1-8248-c2511b238ce3", "value": "T14AF4235ED2DA95E8DB211438036B267FD9BB37C9081A1BA3D268CC60F514321EC136DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889475, "uuid": "59aa221f-1ead-4b58-ae18-520e63ef2871", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889475, "uuid": "ef3aadc9-8d58-4cc1-aa43-5de295295830", "value": "12288:fz9wDwwMLkOCCnd6gX5NcX6dAtKc9numhz4qU9JJ:78RZ2nMUrrCccZlOxJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889475, "uuid": "0fb4f53c-387f-4295-80fa-acab7eba88d1", "value": 729984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889475, "uuid": "42967517-26c0-4f71-9a03-e154cc93cfd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889475, "uuid": "43d6190a-8fa5-483f-b79d-be09696a00a0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfb5555-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889476, "uuid": "2db6ebd1-806c-4b8b-a12a-595ff075554c", "comment": "Malware payload (Simda)", "value": "e7834b88c7240eba89cfeb78f7891a6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889476, "uuid": "b0ca7720-0396-42be-a804-ec2da818f379", "comment": "Malware payload (Simda)", "value": "168ad18cfd1a72b60b43311145a51cc070a38ff0764fdd062b221bdee094d2fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889476, "uuid": "122f2b42-96c9-418a-b58f-22994a2b7ec9", "comment": "Malware payload (Simda)", "value": "a907b650b5075a07eec188c8e03f46e97ee99e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889476, "uuid": "790dc520-bd80-4189-b88e-75fde5c02db9", "comment": "Malware payload (Simda)", "value": "235d82204e225859a04e7d0c79b8512899743002fd877049d90db7f64da5277bca4901cf9bacdc44ae433356b2dd07d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889476, "uuid": "27eae875-0066-460e-aefc-0bbe6f1178d7", "value": "T1EE14127313098DA2DD120EB741F1D74219FAE638A7E0D18B6625058B3D56BA33D6CE2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889476, "uuid": "53a8255e-ffcf-4ed4-ba60-d6c51ba82d20", "value": "98aa7065495f35513795744857924eba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889476, "uuid": "99c90764-d7bd-4b9a-8e6a-076e64f178a3", "value": "6144:Dt++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:4+cff22qZhZcKYhc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889476, "uuid": "50872ae5-b738-408a-8b58-78fdcdcc895f", "value": 206648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889476, "uuid": "18d69149-ac11-4cbd-ba94-7c36650dafca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889476, "uuid": "e0251e61-3de1-4ecd-97d1-0849bf60bc03", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8e741f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889477, "uuid": "18cb5ca6-3728-4641-bfd9-9cffce2a57ca", "comment": "Malware payload", "value": "bfba5daa52e661efc86734314fdeebcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889477, "uuid": "2bfc1050-d3d5-474e-a3bf-67874428f826", "comment": "Malware payload", "value": "1691b4f7b294513e6a5e606a28f7b1d305248d9482e2d873605fcabcd276b5e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889477, "uuid": "1b6c1f2e-9796-4214-b6b5-b5012e3c8275", "comment": "Malware payload", "value": "ee48a1ea4e52ff9d4fa5be704b92097f2637350b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889477, "uuid": "78750d80-b5b0-45b2-89cc-2ec19cd45226", "comment": "Malware payload", "value": "bfab1b9d17cb17fae32284fd10359d6228f9b216f445eb7432aee8428c11281ddd37f93fc164afeb6506c29707ef3a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889477, "uuid": "47207b89-e23c-44cf-b9f1-e02d1a60f1d0", "value": "T135235B18ABACC65FE1EF0E7D64631A21127293911303DBC64ECC64FEACAB78406257D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889477, "uuid": "0562e033-31cb-43de-98fd-1942a86c3d68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889477, "uuid": "e0c76746-f3e8-40f5-9f8a-68223f71cb03", "value": "384:+xiHABz9q3FxmHu+JjOdb4oL3FRCOHu419awgncpMQiW4zmkZXOfq1aK2rkLp9iN:+CIFqb4i3TCOOuKXbOfq1ck+ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889477, "uuid": "215c9d84-8651-4007-b29c-51d66dcf287a", "value": 49164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889477, "uuid": "971fec9b-9c6e-4f35-8432-016409a8675b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889477, "uuid": "78a01829-b587-45ea-b5c8-47d33b51354a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2be73e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889478, "uuid": "fc54f7fc-fb1b-4a37-a115-14c08d3505c0", "comment": "Malware payload", "value": "3b9a8a584595424f3d93d8ca5282fa65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889478, "uuid": "fc70e19a-7e91-4a5b-a140-8ef846771da7", "comment": "Malware payload", "value": "16c7473220378c0a1244988347740c2ab7e358c1548f154798d0279a848ae161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889478, "uuid": "ecefda21-96b4-48e8-ae24-c9562705543b", "comment": "Malware payload", "value": "82ea8ebbd2c1c547c738bb05c377e33115117334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889478, "uuid": "643a4293-61cd-432b-87af-b5029e49535a", "comment": "Malware payload", "value": "8ff94dc18e08d83324272715d5aa18a601ad5f19660eefa1ee6c43603131a4fbac124ec7dc794feb08921f06ce8e669d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889478, "uuid": "a200e9e6-56c7-4363-bca6-c8ab42057c10", "value": "T1CF93E84BF61281B9CA38C537A561C1B21F253E75AA63CA3F31513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889478, "uuid": "1a6df532-f8ca-4df5-af8a-c24225b06ae2", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889478, "uuid": "f785b3ea-4ff5-43f4-9b81-fc47b3335c60", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdr:41bC4Bk6lMTOWw4PkRAPos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889478, "uuid": "49452a58-00f8-4168-9c1e-7fecbde1ec40", "value": 94261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889478, "uuid": "52f809af-277f-4649-a221-f7088e81497b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889478, "uuid": "6f7bff66-fde7-4824-886d-b769680059c3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcd81f5-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889479, "uuid": "2f96f1f1-d9e9-41ed-8115-bf11985c364a", "comment": "Malware payload", "value": "c2290c557b76ad4432889329f1df2c1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889479, "uuid": "55b6388a-448f-4364-a105-7cac1b09a792", "comment": "Malware payload", "value": "17254304b05527506853ec59263cf162ff53a9b4d6e18cc8dc1b9171c4c7ee83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889479, "uuid": "66abc19d-b4e3-4213-95db-0ee1effa1366", "comment": "Malware payload", "value": "f67aebea8d3c02b66c88012d0dd8315c9d3b1dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889479, "uuid": "3317c9df-3128-4add-9588-2cad9340ab3b", "comment": "Malware payload", "value": "03bc41bd3f1e11e6f2272fa329287b68859453120a0c1c43a73a0e4a838d4ef15d687dafafd98b2df94e34574f475e06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889479, "uuid": "49656de0-dbeb-4541-b459-a9b2131ea11f", "value": "T1E9441A13BF11593BC1698DF08CA6D2B97A24AD692BF16D4B23C0BB5A25701077DF630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889479, "uuid": "f65d6bbd-5570-4b51-89e5-a1e5233b7a60", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889479, "uuid": "956bcf20-ef2e-4a61-a63b-10d70f946aea", "value": "3072:AygCullUQN7gsBh1L1QygCullUQN7gsBh1L1j:ARleK7712RleK771J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889479, "uuid": "b6479841-2e5b-43fc-b73a-d04c8ffcbbf2", "value": 266863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889479, "uuid": "58d633b8-85e7-4a3a-8d6d-a30c2f6aa3c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889479, "uuid": "f4381af9-4026-42db-a92a-f4dcc427275b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a91085b-c867-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763900667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900667, "uuid": "1385eb94-90af-4e3f-8520-cd97e94c7d5d", "comment": "Malware payload", "value": "1af0bb832186fbef859bb6d0ee04efd4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900667, "uuid": "14043de2-d90f-4957-9a0b-89d5f84feef1", "comment": "Malware payload", "value": "1808958d30acb0c1418166fa75ef8210cd6bc264a3a57cc54da72c4564e70394", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900667, "uuid": "c2405464-9ee2-41eb-ab96-72f72a522912", "comment": "Malware payload", "value": "15a0b267cc5660e3b3c63b90e0a8d00b147d3687", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900667, "uuid": "819f56d4-27e5-49b1-b710-9d92baad4d4e", "comment": "Malware payload", "value": "156a8047e14b53dc0df08636c0aa0785755a2e54f44ad618946d1866aa51de84c09a28eca83d22a6b3e2e94e9beb4b71", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763900667, "uuid": "02231835-3dc7-4cea-9328-cf18340c0e77", "value": "T1DFE612B3F3285D2FD8BB01710CAAB122965A5E11CE53E34B690877AC79779D41F88BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763900667, "uuid": "22bf9fce-a876-475b-946b-2295641688be", "value": "393216:JFGxtwJ+llL93VAEzY6xkyS2BST5xNZ2SPGEdIUj:JOGmLlphc2BcKSPGEdNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763900667, "uuid": "0304332b-7273-4edc-b7f4-c5965621f969", "value": 14162453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763900667, "uuid": "e681fd82-dffe-47a8-a12e-f916e6f1aa14", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763900667, "uuid": "a5c041de-d97e-45ad-8568-7ffac82a5061", "value": "taptapsend.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f428dff-c857-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763893696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893696, "uuid": "8c5f0967-a480-441f-99f4-ada548c7ad17", "comment": "Malware payload", "value": "c731b616b124e786e07a7b3e46a8bfe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893696, "uuid": "2580b202-d274-4204-bc9e-090f3cdf1978", "comment": "Malware payload", "value": "181b6cca0fbfaa2c5403fbb0320c90e1e69d9add79da0330bbe1cbef9e60a077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893696, "uuid": "68b8a052-1212-461f-b65b-d91b9a7641c9", "comment": "Malware payload", "value": "49e70570b9bc9f201e255c6987acbbebc5f8842c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893696, "uuid": "0c67610e-7c8d-4f84-9683-92acb90436a6", "comment": "Malware payload", "value": "4ec7d2fec035f3f418abca95ebcc5f8cfe9fb29238205c1e18309a1f03698b8458aa70585c1a5fffb69a8406cac81f3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893696, "uuid": "39ee98c9-f90b-4d75-bed5-db6944e33aeb", "value": "T18C35231F32C262B1CE49133107871A982E73A67F2BB0941BB7D895072DF29447F79B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893696, "uuid": "a8b3119d-5f79-433c-976f-18c04823b78b", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893696, "uuid": "fa798ec4-bab6-42b1-9bb0-d4290c136159", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1BP3:qE27hQs7tWVToP0Hs0/htDHiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763893696, "uuid": "caa9676d-a1a7-48eb-a67a-273099dc6e8e", "value": 1126832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763893696, "uuid": "5131c79b-2b9e-43ad-9a67-c09bc0db7cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893696, "uuid": "7dde2cdd-d70f-4a01-8a15-00627ca8618b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e70902d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889480, "uuid": "52a94bf5-b021-4c14-b045-94dd42e52fb5", "comment": "Malware payload", "value": "542ff15297064b007cb8b7d53d3107fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889480, "uuid": "6febf921-f62d-4299-9de8-6b6dd96f9f04", "comment": "Malware payload", "value": "1838f46d43c545ed04ca2ce3d8407954377f5c268338e35f518de479b97a27ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889480, "uuid": "03a23773-ebec-4bfd-859d-423bfc0f215d", "comment": "Malware payload", "value": "26d2ae2c7f67290a4e10d2cc95837c0c39f401f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889480, "uuid": "ba0e52fb-0ef5-4be6-ba70-259c51f2ff91", "comment": "Malware payload", "value": "31d9015981481b66f4ad53f2c20b50b5c0c4c0bd48308176b84e0e9772a545e96963f4460631a4dfc46a6608fbf8da97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889480, "uuid": "62cad86d-1249-45cd-8d1c-ba9d74aa73a7", "value": "T1FD55230B33C15B71CE89133206472AA15F73AB7D1770E42AB7DCA5071DF2948AFB86A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889480, "uuid": "7ad02b15-6b1b-4582-bab6-74e4fb682115", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889480, "uuid": "2c09756a-10d5-4246-9b04-be1a2d386796", "value": "24576:a6Zv2ivhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mD9m:aE2ivhQs7tWVToP0Hs0/htDH3pGaF5+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889480, "uuid": "182ec4c8-7cbf-4ffe-bb2a-fd0ab6becf49", "value": 1284575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889480, "uuid": "f729f41a-e4f6-4bd7-9120-e1fc814a9556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889480, "uuid": "756970f9-de5d-4242-91dc-b68d4edf1861", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1d036a-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889481, "uuid": "2cf2bac8-b777-4fab-b09e-ad7d4c3861f3", "comment": "Malware payload", "value": "0427cbeddd37b7a98a46b9def21c8a26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889481, "uuid": "c9084375-0f32-45ec-bbcb-e87ef118cfea", "comment": "Malware payload", "value": "1862d4aef402913a474230b22859a028cc66c03cab79a5e5908a987c84a20050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889481, "uuid": "2d290181-a439-459a-8d5b-40ba9b670f33", "comment": "Malware payload", "value": "71ca9aeca612ee56124aefd66efa3d5fac9bcafa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889481, "uuid": "25635bb8-0c25-4c5f-96ac-33edb2be68bf", "comment": "Malware payload", "value": "d4098837a44e67450d958c0575eec33c0552dd8909c4f7c8f4c6a499a64eac61380d2f83ee54d1afc4a2e9394f024142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889481, "uuid": "b2aa0e8c-95bb-4188-aaeb-b9b4afb59d95", "value": "T1EF55D08E14CB41F5DBFA39BFA4D1F0A03246590C7CD91EA69594E260A9CFF523E1BD02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889481, "uuid": "ac2beb63-43b3-4265-8fa4-5f6146e32e99", "value": "37c6c0cc4d20c311c793c6b743da8942", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889481, "uuid": "8bcd3029-056e-4615-9b3e-c22b004fc27c", "value": "24576:9SZ+J3rtih2XY/vK2Rk4stL2KEdAlzOev0X9bgr4xXWx:eKrsh2r2VstL2vdAVOevyxXWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889481, "uuid": "98bacbe2-8f4b-4f15-849e-4d7c57fcc05c", "value": 1385547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889481, "uuid": "fd3b78e9-5d29-410f-9a39-e526ff714538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889481, "uuid": "ccc1da39-4ab2-43b5-bb0f-7e4e65404b44", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb28538-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889482, "uuid": "463b396b-abed-4b2d-9f50-24342bc7d171", "comment": "Malware payload (Worm.Mofksys)", "value": "4995eb8901e41117831ccbf6df7d0e34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889482, "uuid": "ab718821-3541-4370-8035-5129d2556363", "comment": "Malware payload (Worm.Mofksys)", "value": "186bf47ef9da314efe6908e3360df9c48a7f65783aada985aff914ce34146cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889482, "uuid": "f450fcd4-1a0a-4735-877d-fc609de404ea", "comment": "Malware payload (Worm.Mofksys)", "value": "8de401c439557e574535e3d4515fbed666b0eb3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889482, "uuid": "e11ae779-99f0-4b3f-90b3-0c0bf15237a3", "comment": "Malware payload (Worm.Mofksys)", "value": "a509e042f5d2f78fae57001218aa73acfd45b4790087b55388647ae5dbfb552adf1d01f367f26da1cb764a0c43df5d27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889482, "uuid": "c120c152-a759-48fd-80c0-d746249ab578", "value": "T18E73D0885856E60FF7CD8EB07A3B0A3801759C9465FB97B7D10836E06E03DBE9209973", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889482, "uuid": "c332579f-9748-4734-9914-1a17d429fbef", "value": "de3863888c83837b13b7c1a90a18d46c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889482, "uuid": "5887c0fe-ccb2-4545-b921-6e6212e2e675", "value": "1536:EqmwDnVOwg24L7US5n1AZjzlwBkW1hm5bK2HMEb2yK3mS:+w7VOE4keqzuBT1hgHtCyK2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889482, "uuid": "6191dadf-c22f-473d-a0ce-799fa44b53fc", "value": 77532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889482, "uuid": "85179c2a-d0e8-4a54-84ca-d2e77b1cd672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889482, "uuid": "852db5ee-f2d6-4ad5-b670-5731e2f1f2f2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bbe1bc-c891-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763918617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918617, "uuid": "1bf0229f-96af-450f-beac-db7f22581aad", "comment": "Malware payload (Mirai)", "value": "d6692667a4e5618f8ab7cbec4c4a4237", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918617, "uuid": "b6c60dc5-49b4-4eb5-94f6-2a53ac6a6a02", "comment": "Malware payload (Mirai)", "value": "186fbc5c93697df7604cbdbe840439f8089302279147afa0d4eeb0aecbdc6682", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918617, "uuid": "05b3d172-87a9-494e-8284-c3f0e08bbbd3", "comment": "Malware payload (Mirai)", "value": "1d2133927fe81b50476af77e789fa1c9994f4b79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918617, "uuid": "6372c133-6a15-43d7-867d-1967fb26e538", "comment": "Malware payload (Mirai)", "value": "ee8b991e666d1d9b0dceffe32ddceb8a7ff11e02095ab90150f1ff62dbdd727ef97193f2e1b2cd4503ca3d5ebf86a58a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918617, "uuid": "d07aa64e-a72f-4df6-a54c-04d049b63214", "value": "T1FED3F609BF614EF7E86FCD3746E9070521CC655A22B83B767A74E82CF14A24B1AD3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918617, "uuid": "1ba032d5-36e4-498f-8418-e8a3327c8f83", "value": "3072:zgPxu/2+dkjCGjshMXEFi8S3RUWp0plbfJ:sQO+d0CGjshMXKiV3RUW6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763918617, "uuid": "50bd2ec4-fcb8-490a-9f26-6501c3bf632e", "value": 132136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763918617, "uuid": "4b2b6ccc-ce28-4310-b9c9-08be6cfa0142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918617, "uuid": "1c559ec8-6109-4ee8-885a-c805a9571ade", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50582d63-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889483, "uuid": "48ebd318-e8f0-4fd3-b198-30b2fd8f522c", "comment": "Malware payload", "value": "6087a2c2cd6dd603e798cf8347857405", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889483, "uuid": "e997423a-f4c8-4bdc-bd78-121baed7e6dc", "comment": "Malware payload", "value": "189ab70ac1d5a20943cc9c7525e11fa3f272e20431eacddac8ea6547132501ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889483, "uuid": "e504d2a9-1dbd-4441-a209-4831cc8a2184", "comment": "Malware payload", "value": "0fbb21c1705275d481301d3d7bed474b76bbca7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889483, "uuid": "01f352c0-b137-4dd5-b11a-068ebf6aaa02", "comment": "Malware payload", "value": "9c515cfadadd6d1162595fbd1c8f8c62661aecf512ff0a5f5999591be59175dd25fc3471971f2785d2479d6d378cd775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889483, "uuid": "d4616da6-7650-4622-8f6f-f33f438e97c0", "value": "T123A5D06BA9D3D9D2DC2582FFDCAD306212ECE85CB412C5E428675EBAC45107E43BE364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889483, "uuid": "acdd9332-e712-4aab-a2a5-4af0a202ec58", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889483, "uuid": "3961feb5-eb4e-45f0-b868-597913cdf5d6", "value": "49152:uEJGsPtEWWBsgoZVbD8OGSK7qKmgy0BKW6rKn:DVEWWBgZVbDVEeKmX0k7Kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889483, "uuid": "b4fb612d-fed6-4cea-ae08-6236a60a8955", "value": 2131080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889483, "uuid": "7ec126f6-6357-4a17-a425-cd586914cf6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889483, "uuid": "fe775120-ffb8-455e-9b04-e52efba169b5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986073d3-c856-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763893469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893469, "uuid": "33ec993d-1fb6-4428-98d3-25e5c80fb43f", "comment": "Malware payload", "value": "94693964c63062e1d6c0368b04866932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893469, "uuid": "4f8e77a2-37dd-4ea0-b38b-d3f2106b95f2", "comment": "Malware payload", "value": "18d4e458dca82e7094a897e34cefd4c0e920d3d757ee2da5eda07441595c0d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893469, "uuid": "559d18f6-06b5-4eb2-824d-32b22817b257", "comment": "Malware payload", "value": "c2eb8124205dd8c62f155f5f6f1697850764b828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893469, "uuid": "9f4157ad-0405-46ba-a359-266040adec86", "comment": "Malware payload", "value": "36a57917d74554211f0682ab3b6c8ec878ce6f60dbc27103aa7b43b0bd7def859f59f1adbb48d53f7cf2f7200957663e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893469, "uuid": "43d94d1c-b1f9-4039-b205-38aa3cab0a65", "value": "T17945233633C15EA8EE4A4E31020E5F214EB1D36A1F7EE411FBE86D1369705C2BD6A761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893469, "uuid": "3c0148ae-f0d1-474b-8818-fb7260129ee3", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893469, "uuid": "0720ad5d-7275-4116-8c57-5ae1d3ad19dc", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVv2n:qE27hQs7tW2zku73bFgVlRlbN015CoVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763893469, "uuid": "f3563780-0fe7-4bef-a7e5-521543b41066", "value": 1240458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763893469, "uuid": "0ee79601-c845-41a8-bbd2-4b74bf1af9b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893469, "uuid": "85a2078d-cbed-4199-80a3-9e4df3bf3d06", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511d54bd-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889484, "uuid": "b0fefc88-1ef1-48d9-bce5-2f5df540e6bc", "comment": "Malware payload", "value": "75c11e8117f1cbafc28963bd010052e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889484, "uuid": "043e63ad-2daa-46cd-b419-686ce8299560", "comment": "Malware payload", "value": "18f28d2663b614b80893369cc5481ecfbe9c0cd19418929bf1d1b1e57fd5b211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889484, "uuid": "c053972d-402f-4136-b20d-8ee5c623b4b0", "comment": "Malware payload", "value": "f85a98ea63b7ec2d69cd0b7b536435c6e47bc94a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889484, "uuid": "4f05f31e-b61f-46e1-84ce-c334017c0905", "comment": "Malware payload", "value": "1e131120bada5601d035bab9154db1ed8f0384d9b1c90126199df3f6f6549cd083285846cf203d006395236b9adb1812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889484, "uuid": "95a14ef6-952c-4bbd-aec5-4cbeb97c4470", "value": "T1B235334E18C23646EFBDA7764F8718C8386327ED1B61542E770CA08B23F35899DB956C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889484, "uuid": "e85ab368-8bd9-4de6-abf3-9d07b8ff5949", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889484, "uuid": "9b70224b-613e-4252-abd9-c111a6bdfe7a", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1ZcAQwab:+YhQs7tWVToP0Hs0/htDHi7HQwab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889484, "uuid": "164201ff-d63c-4b0c-bd73-12cf2cd11bfd", "value": 1061553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889484, "uuid": "eb5efc40-bb94-44d5-9b4e-22269a8e7b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889484, "uuid": "d06f4ab3-b211-4ea7-aa3e-6bdc8097d8cb", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ca4843-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889485, "uuid": "5ccbe7fc-48c3-49a9-9270-df8fc1b090d0", "comment": "Malware payload", "value": "e4ea8a3bd61fb47ac424949da4d5fec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889485, "uuid": "ae3075a6-5740-4f83-9ac5-0339e8a51783", "comment": "Malware payload", "value": "18fbe2b7ecb3a8ba4521d8e0f107a56a12b58d077df04a5765f5151599320fcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889485, "uuid": "27ec2046-be27-4524-87b5-2e5449430e2c", "comment": "Malware payload", "value": "0ede618cae660986a886592e14b5c64f8ddc1300", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889485, "uuid": "cf900afc-22d2-4c53-8381-f3111fbea0db", "comment": "Malware payload", "value": "1f2b911bd60c8b8d2b342abf47e10e753d0767ac5d052653c99224198a1f15d79b227361efc26a43cbbb044f62051f1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889485, "uuid": "5fd42793-7350-4328-8d12-dbbe329ea84d", "value": "T16835334D16C22B59DFBDB3B64E871891297337EC47A0BC39770D908A42F35096EB846E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889485, "uuid": "168ee911-ffb6-442b-b174-bcaf56e80c02", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889485, "uuid": "4b2d8f43-7c42-4808-9eef-8c73fb4b0652", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFD2h:+YhQs7tWVToP0Hs0/htDH3pGaFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889485, "uuid": "cd8813e9-0773-4dca-85bd-354e69a8eece", "value": 1087715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889485, "uuid": "6a79a41a-85df-4f4c-b946-7f10c522893b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889485, "uuid": "17fe37b8-2e2c-48d0-a472-4cd80acc6dd1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52691b8d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889486, "uuid": "3e8836fe-2001-4387-bbcf-905dbe68b79c", "comment": "Malware payload (Simda)", "value": "0ee421df4be1539b5576c12dfd71088d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889486, "uuid": "21be7cc0-96af-46d6-a03a-68f6143b5cb1", "comment": "Malware payload (Simda)", "value": "1906c8121bd71381056ba5f18c3a88de5af82caecaf7a83bbf937d06cfff868d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889486, "uuid": "e3ed87da-e9a3-489b-adbe-c3ca2b995592", "comment": "Malware payload (Simda)", "value": "4517c9e25ab2c8d123aa1d8e4ce7d4479dc7148d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889486, "uuid": "2c24b24b-06d5-4b8d-9a2f-299551495ff9", "comment": "Malware payload (Simda)", "value": "b154d896bcb56b1afec0963b2e3218b2af5cf92cd3c315bc831f16dbd47ebe579a50522dfaf317df7503483197a86036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889486, "uuid": "60ef20f0-8360-4d67-84ea-8d93f098b673", "value": "T1BC747D61A0408177F3F8163425FA7B6F25BE6A6403DA19DB27A86ECC29741E2713D1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889486, "uuid": "e610a88e-2a7e-4505-9ba4-53e9a80c20f6", "value": "a29736d96c1bb5330d99576cd94e80e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889486, "uuid": "fe64afc7-1c69-4529-b20b-d9b6828ac0c7", "value": "6144:fExz457S77IQi8Dq+9fXphN2LfjEcYzaWqr57Q7Xwxc4SQjWvvf:V7S71Dq+pcYWWqtfxvSQj2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889486, "uuid": "4c661720-c529-4600-a647-3b6447434b3b", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889486, "uuid": "007e4ad8-e985-4bfd-8155-d0ecf9251e9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889486, "uuid": "3231feb3-8981-4003-a160-620336668a4c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eda0fae-c858-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763894259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894259, "uuid": "f141a4a2-7522-495c-8c08-42c66262f49d", "comment": "Malware payload (Mirai)", "value": "cff596bdbf5133e1cfd2d447dc316a69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894259, "uuid": "ef24b5fd-6d14-4024-8296-3d64f7dbaab8", "comment": "Malware payload (Mirai)", "value": "191d712d104cd27cf4ebeef15e97e84865fcded1dee4af48bb1532c98859ea5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894259, "uuid": "5a4f2e9b-45d7-4776-9b5b-35a43ea27da8", "comment": "Malware payload (Mirai)", "value": "586f285d8388d3b945c5e508b2ab1b6980c6d69a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894259, "uuid": "52abf4c8-4763-448d-bb90-c51149165262", "comment": "Malware payload (Mirai)", "value": "3c46a73522b9674a5ea54fd6bf3247a978e17e7a1149d6766d42a02206e75a1c3b8b853769917e9e181d9aca7c9b2385", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894259, "uuid": "d968d332-ffb3-402c-8219-1abda9437339", "value": "T110A3D71A3E219F6DF778C63457B74E30975833921AE0C685F16CE7095E2424EA42FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894259, "uuid": "f796ef4c-c3db-45ad-b0d6-f75a3378d6a5", "value": "3072:LmPAeRJEJBHrdytOeAoaEW5sV1Ff3GEyGihHm2ZnHAz:LmPAeReHwtOeABh5sV1Ff3GEGfgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763894259, "uuid": "39a10709-12f5-4134-a63c-f8d4ced96e36", "value": 105648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763894259, "uuid": "a177c5c8-c5a6-468b-b5b6-4a6019009911", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894259, "uuid": "474528b5-5b49-453d-a286-fff3e5f87251", "value": "umips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5313cab5-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889488, "uuid": "90d9c25e-c4a5-4a93-b261-f063981f6ba1", "comment": "Malware payload", "value": "2cd6791d0927633e07edc9abafb4f081", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889488, "uuid": "a4c47f86-075b-4342-87c7-8bef64a80020", "comment": "Malware payload", "value": "193363611cbf7416ce1573154c7be43263a1a6d7ee993b53a783634a503c4cd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889488, "uuid": "749d5244-6fff-46ad-989f-8f6e99e478c9", "comment": "Malware payload", "value": "43bcfb0870ea09e695930589d25231994e97638f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889488, "uuid": "7e396713-738a-45ab-ad55-840ea5945d7a", "comment": "Malware payload", "value": "ab53c7ab057348dd49341db99c0f5694af1732abeee786e39b68474a2148eb80bbd32a5723cbcb1b1617c98553c89a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889488, "uuid": "0dbd2c2c-1af5-4a14-84be-f478a53acee3", "value": "T174C5D025A0523D1EC5728833EEE3A275AB921E653132974355571E90D8A8FFECE30FE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889488, "uuid": "63048122-9fa6-4a12-a160-90f16e308cef", "value": "b672bf4528e2ef8904397d0b17905606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889488, "uuid": "92db8abc-4e02-4ecf-b9e8-b15f5db8123b", "value": "49152:CxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxR:Cxx9NUFkQx753uWuCyyxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889488, "uuid": "e4a4e215-fcee-417a-a4c6-f88a9a572266", "value": 2673133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889488, "uuid": "2a012aa7-a9aa-4479-9a0b-df09c27821f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889488, "uuid": "26f56134-e0d4-4bde-bcbe-49d15837ffba", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539e3391-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889488, "uuid": "6abc480c-bb43-4953-8273-a31da8476167", "comment": "Malware payload (Miniduke)", "value": "b6b8a8d3133972282a9544fd6f342beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889488, "uuid": "b68f295d-bfb3-47ee-8c73-5b1b6f582240", "comment": "Malware payload (Miniduke)", "value": "193502994d8aeaa126a9e51da8f35b6d3ce6c0123dd9ea315694c6f156b3c5a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889488, "uuid": "a055de16-091f-4e31-9bff-81850b933c09", "comment": "Malware payload (Miniduke)", "value": "40eeb6c7883e9f1f215cf7b89539104a8f6d6d85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889488, "uuid": "ec17bd56-b53b-4b55-b5e2-349935c951c6", "comment": "Malware payload (Miniduke)", "value": "dfdc6ad2550ab972a3cf58f31d7bb6389f3dcb9306997919c82e70832f22b681aaedd02c7ba90dc25e64b56ae94d30b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889488, "uuid": "d9a75c44-2b7f-4727-9ec8-81c8dc764901", "value": "T14B249F3132E1C0F1F55315B47E71AB268A3A7C54C635C9CBABA81E6E2EF4681823D717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889488, "uuid": "282e26fb-517f-44df-9a1e-e22a317a02e8", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889488, "uuid": "65861377-3b32-4a3e-b589-f6144d70824f", "value": "3072:cqp48cj4RgzILuE/eiidChB0I73GHtmMI+TyIWJpt5Se:5p48cj4Rgzg/idyB13GYSyIW3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889488, "uuid": "660643fc-ede3-488a-be43-79349668b9f1", "value": 228062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889488, "uuid": "ef4e02e4-e23a-437c-a8c3-d0bf20de1e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889488, "uuid": "d7a70b10-2265-4b27-b350-6e784d0c9c2f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54423891-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (CosmicDuke)", "timestamp": 1763889490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889490, "uuid": "d4e1e044-d287-4cb5-83b3-5a47ffdad366", "comment": "Malware payload (CosmicDuke)", "value": "917f9ddebfe98d868094a11da982c641", "object_relation": "md5", "Tag": [ { "name": "CosmicDuke", "colour": "#8489D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889490, "uuid": "24593f50-6b5c-4701-bbe9-5c85815c09eb", "comment": "Malware payload (CosmicDuke)", "value": "1936043f5cfcffbee69201b5d3c77696d3a1a017bf401b5093f8f10b27339f86", "object_relation": "sha256", "Tag": [ { "name": "CosmicDuke", "colour": "#8489D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889490, "uuid": "a24f5f18-becd-4ff5-a835-2ec9e3385484", "comment": "Malware payload (CosmicDuke)", "value": "053f8751edaf4f0677d368623c4b9d275e78b513", "object_relation": "sha1", "Tag": [ { "name": "CosmicDuke", "colour": "#8489D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889490, "uuid": "8f224924-d686-42e7-9266-64c816b2c223", "comment": "Malware payload (CosmicDuke)", "value": "09138470d6da32dd8bd4bb3b51b5f3b53f8d78814b62b4a93c753bb9fa89a90f90a645e1297dcc0c78cd9d90818f2308", "object_relation": "sha3-384", "Tag": [ { "name": "CosmicDuke", "colour": "#8489D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889490, "uuid": "e091b7e3-0464-4233-83d4-a58d32670653", "value": "T1B8A5AE3832D94071E0376178CED6E365D6B6B47117A225DF2BD0867D4F26AE5B338B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889490, "uuid": "e85f9fdb-e04a-401b-86e2-7e737b6bfe74", "value": "98b62dfdc3e59f86e2d70c4065393d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889490, "uuid": "6625c807-6c60-4e14-8833-f02213a49c3a", "value": "12288:Ve6TfPaGw/w+xoJ8D3/5xg1tKwcKJkO01Zj03k/75P:Ve6u/i8D3RSxnAhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889490, "uuid": "10947de9-1888-47a3-b236-c3b59b47f012", "value": 2090899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889490, "uuid": "a46ca0b5-d4fe-4b6b-a902-f41d7611f89f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889490, "uuid": "88ece334-235d-4ca2-b53b-8b96208a0c6a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d7fb2f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889490, "uuid": "6e46bbf2-cda4-4ccd-8932-8e10e853adbb", "comment": "Malware payload (Worm.Mofksys)", "value": "09c5de4b68b9f7f0685995080ab00ee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889490, "uuid": "adedf847-dc9c-4c48-ae52-cf6460a76f37", "comment": "Malware payload (Worm.Mofksys)", "value": "1937626692f5d27911e9642c6df0e18d814ea11a8977562d139f51583d577df2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889490, "uuid": "5a80fbbe-e671-4751-acc5-ee0abc414bab", "comment": "Malware payload (Worm.Mofksys)", "value": "4a24bd6994bb772b2adeaab24b1d850105128157", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889490, "uuid": "4b516da5-82fe-4f8b-8781-e249e252690d", "comment": "Malware payload (Worm.Mofksys)", "value": "dd25882482a8b1fa375d9721df3e9122a5a8f159007f4bd6aea9c5e62feedf186fb855da8ab6164a2694b2377295f435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889490, "uuid": "94813cf5-1032-4c75-9676-11f262274f0c", "value": "T19F24EB3AFE00602FE85749F16816F5A5BA352D320F91AC0FA3916B493872543B9F532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889490, "uuid": "7300baa6-638d-47a9-926f-4b92bbb98345", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889490, "uuid": "13524f44-21a4-48a2-b079-01958ef5c33c", "value": "3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unX:+vEN2U+T6i5LirrllHy4HUcMQY6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889490, "uuid": "cb35c20c-c872-4cd3-a55b-a54a2228f63c", "value": 211850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889490, "uuid": "9bfa9692-311f-4d7d-9261-a6e9bca128cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889490, "uuid": "0e6fb936-8f9b-4de9-bf47-febdf65a4ead", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5573f69c-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889492, "uuid": "a068fb95-08f5-4334-8e83-aa59459fcc7e", "comment": "Malware payload (Simda)", "value": "c3cfd895f61ba665983a302482fba6a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889492, "uuid": "bb926790-0463-498a-9fce-138460a56b56", "comment": "Malware payload (Simda)", "value": "194cf65df50b8698fb1ebf5b9e4307af66ab176f34296f9a5ebc1a95a2a455b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889492, "uuid": "d2cb357a-1d35-43d3-9f1a-304530ed9cb0", "comment": "Malware payload (Simda)", "value": "eba28827eb1376088fb94f06fdeec7a45ff178f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889492, "uuid": "eee38994-67a3-4b84-880b-a4331479a5d4", "comment": "Malware payload (Simda)", "value": "740d7a3bbf488adc9c13ae5c676db7eea40effd76b95fee8718c4b6c204a859172170628bbc8b3d93c562476b87dd132", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889492, "uuid": "e0a0d160-7bec-46c7-9013-eb275f62a495", "value": "T10F143926E04544B9D5E0127C65BD3B9240BF6D74972C2CE37394AAC91DF82E37AB831B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889492, "uuid": "d105a1a3-dd85-4f12-b9f5-f9e54c1557d1", "value": "cb59e9f2348b37e98c5e9c617c66b271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889492, "uuid": "a6259679-703f-4410-bea5-56662380a136", "value": "3072:d+ku5Ss6yYsAq/C3RCzgJHvNA1PpYfFL6zU+BEfi:4koSs6jqahUSPe1SZ+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889492, "uuid": "b8bb7de6-ccd4-40c3-86f7-2dc93ba4826c", "value": 194280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889492, "uuid": "27636213-7316-4e11-a467-05a9527c98a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889492, "uuid": "8b437cf9-8f39-410e-9049-c8f2e6c07540", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5612fc67-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889493, "uuid": "01dbc0cd-d0ff-47de-aa81-0d44eddab7a2", "comment": "Malware payload (Simda)", "value": "f450c8a02490c21218f8983c03dffc9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889493, "uuid": "2f8eead6-548f-4f2a-9a8c-414a2d307859", "comment": "Malware payload (Simda)", "value": "1958ad830c697392c00bd4ce5cd4c4344450ae70a04f5c117ada33507dc89ffa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889493, "uuid": "a2d6e222-d165-46a1-9cf6-8688ff1d0d45", "comment": "Malware payload (Simda)", "value": "5c9646656d53ce4ea5a8fa9f4ec6987428439442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889493, "uuid": "0ef016df-2274-41b7-82ad-3e65314afdd1", "comment": "Malware payload (Simda)", "value": "f91d8eaa7f15c6fbcc728bd87373d1643a2147a8c8935d01de17533b755be4709b8bd5474bffec87a6addf21b26c9841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889493, "uuid": "db2e8120-e044-43ee-991a-35065778ac83", "value": "T19A34020676A601D9C52AA5BBC4F76311EAB4389D1332C3EF4B304EA91FA36F47536784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889493, "uuid": "f0290e4d-7b8d-499f-bae7-cf7ec64a0984", "value": "616d060f84174fbe550615d295f4ce51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889493, "uuid": "b8fb3e7d-8e67-4a9d-92ba-fe71b331e09c", "value": "6144:qzHnMLm5GNGxHUhtnkdpHqTKzhh8r6cb21u:qf58GxUh5kHyKFhW6cb21u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889493, "uuid": "3cdab601-8f27-4937-8795-14233f4d6d1c", "value": 237980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889493, "uuid": "575d306f-4982-4d1d-875e-5d02dfb76676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889493, "uuid": "6957cb51-5d5d-4924-8973-324635b8ccd2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a82444-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889494, "uuid": "2da2b459-ce41-4820-8ae4-ac4f3bcbb95f", "comment": "Malware payload (Simda)", "value": "08a9931001ba1f7aa43a889f7625335b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889494, "uuid": "8f9fe196-1111-4ee6-9198-dcab3971bf7f", "comment": "Malware payload (Simda)", "value": "19b249c8c048de11213666ae13cc1c62635dda37cf2a41b696dc0f946362cacf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889494, "uuid": "bb87c457-e1c3-4c3e-a580-b8c4eac12c57", "comment": "Malware payload (Simda)", "value": "8af262b21443a18208ee11997527637cecf20811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889494, "uuid": "97f877ce-4f61-4cf8-b3d0-f32adbcca6fb", "comment": "Malware payload (Simda)", "value": "c241e106a87e7e929492dce1a37002ae23013b9587bf45d7cef86654312f0e341444e6479f6336611558b843039450b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889494, "uuid": "f2d28317-d7da-4403-80e9-2f7cb15ceab6", "value": "T1CC241222F8D217F1C0664E7C49A3E705DB7BEEA33D395B9603C10607AD87065A6736E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889494, "uuid": "082cc4dc-fd18-4882-890c-e155d99e1a7a", "value": "add9e90fe8cc1a6d600a60e22be53bf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889494, "uuid": "9fae9cf9-4fec-4aa9-99b0-1949635c269c", "value": "3072:d5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:dLexkuRaX41xoyJV65gzyZko+uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889494, "uuid": "b634bea1-c32b-40ff-a97d-b82a8a78d079", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889494, "uuid": "5a14f87c-3f8f-49c6-99d8-29ff7a253cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889494, "uuid": "f93b8d15-c6a6-499b-b3e5-7e817a40cf0a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5759610b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889495, "uuid": "e73645d5-12fd-49cd-8e89-80af5925774a", "comment": "Malware payload", "value": "5a51e11ab00a28a03e62a04c6827ea30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889495, "uuid": "ec3d7d36-83ff-4ab6-aaa5-2961742ebd50", "comment": "Malware payload", "value": "19b2ecf9812c832453808febb2797ad68b4396eda35f8d2b36aeea7f9ee636a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889495, "uuid": "172009c6-7c42-4065-8d6b-bde2da7e043e", "comment": "Malware payload", "value": "24479a9d82a1dbab3c529df622600476edd2aad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889495, "uuid": "6d713b21-a52b-4344-9766-87843e653504", "comment": "Malware payload", "value": "c5c54db3ebe35911d2e6fa28ea70322cde8351beb4ed7bfce9a21c021f5bdbe8c9f403dfd79c1a870105c90fc988cb00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889495, "uuid": "9378225a-2ef4-49e8-be67-811318fc1923", "value": "T198241234A6D21AEADE9DDF3115B15B78F3FDC7DB5426C2F8F48301A431F292086A8664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889495, "uuid": "bc177564-5b6f-4787-971b-4d725d5f9854", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889495, "uuid": "d1401f34-fc2f-42f9-a7bf-6cfd97c979ee", "value": "3072:MRAhhcsxgAJuK7bZD01GoI0ONtNmlngmx5MOYg0Y1mhuue04+IovZPakTLHm:MRAhhJxX7bNIFlygZ7wI+ZHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889495, "uuid": "32a6d331-175a-43e3-bb7b-8fd4827b1781", "value": 220310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889495, "uuid": "c27a9918-f1da-47b9-b8d8-5012032b2771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889495, "uuid": "5287b691-4bfe-4918-98ce-5bf5d44359e5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8dfc00-c885-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763913715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913715, "uuid": "b440f21e-2401-4eb2-90bf-a60eae5e0a6b", "comment": "Malware payload (Vidar)", "value": "93c2bd54db83cd885622c8baaa18b72e", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913715, "uuid": "fc183d8c-e002-4142-8abb-43607c1f13e2", "comment": "Malware payload (Vidar)", "value": "1a01b4ec04503af3b94b8703d77b0659d10993f006532a4c92799772748f7631", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913715, "uuid": "82ef66e9-f760-4b4e-9b8d-ffe2fd7e7079", "comment": "Malware payload (Vidar)", "value": "bc12b07d5d7158bba4dcb68d9542940d9450ac87", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913715, "uuid": "4631889f-9f8c-427f-9a9a-152280ad252e", "comment": "Malware payload (Vidar)", "value": "eee6c8751b17f40bbce9426a15aeed5d07262c9358fc1dca13627a2281349a281e5f4083a0babe0744ef2a2632acf74d", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913715, "uuid": "44344d90-99ed-4a05-b5c7-1f13aecb6964", "value": "T1FAD57C237D90C4A9D0A9B33499A65297BB20BC289B36F7C31F913E347E36BC05536B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913715, "uuid": "a70e6347-4ec0-4bfe-8bd1-44f662bab649", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913715, "uuid": "8ed1109f-c7c3-4579-9b3d-8426e1472d77", "value": "49152:Wyo7g4z8I9QgWpNjyctBHbywnfk2EqIho+Ol8:WROHGw5Eqx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763913715, "uuid": "c8f8523e-4f16-4055-b467-ee3fd244aa83", "value": 2851328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763913715, "uuid": "54dec6af-1e5a-4118-bf24-e643175ab9a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913715, "uuid": "47c89fb6-ef7a-4300-b106-949b2f08e34d", "value": "download autodesk fusion 360 full crack_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581d3052-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889496, "uuid": "f907934f-db71-492b-8fa6-b994ae89b51f", "comment": "Malware payload", "value": "ea42d1de7fe84131624a32d3f7e6e02d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889496, "uuid": "7696cc87-3fc7-4bc1-b99e-ee8e3fa5cf33", "comment": "Malware payload", "value": "1a0419e32435ff40756fead4c1daebf7de8bb62bfa06f9e5ebf8b48cf64b9145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889496, "uuid": "107b0eda-7b14-41ed-8bef-cbf7d99c2304", "comment": "Malware payload", "value": "d5f2ab8095b8b1302487fb16bbcfa403a73232d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889496, "uuid": "badb235c-704d-475d-ac21-e763dfc0293f", "comment": "Malware payload", "value": "de5b09fada958816c843299f4c02a80d2e7ffef05a7385a51912bdbd2322f25c4abfd350a32265aadc4f11c6527d27b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889496, "uuid": "a426ab0b-e9cf-46a1-b3fe-cd14e7c9b779", "value": "T1EC35233A32908CF0D8951A310B4637B55FB3F376361148666FD41B272E7229CEFA971A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889496, "uuid": "ca441b70-3c94-4d03-9812-07d490a76693", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889496, "uuid": "8675ce83-b760-42c9-9dc6-33916e766c58", "value": "24576:v6Zv2WqhsVn57hqQeKUP581L9k+4EBtXMRSkqJZY:vE2WqhGtbUPuVt4EBFCSkqJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889496, "uuid": "037c50c8-a7af-4872-977c-52f6b5a8291f", "value": 1151479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889496, "uuid": "a11b4ae9-ac96-49ae-a17b-921488ed8a5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889496, "uuid": "6fd9df9a-2e11-4401-b362-67bd237e443d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ddccef-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889497, "uuid": "2e55b625-e1e1-4dc5-9a80-25fba0084414", "comment": "Malware payload", "value": "4c443b6931dd3bcaed3b0503432721e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889497, "uuid": "54177071-4237-4cba-b259-9b10468c69be", "comment": "Malware payload", "value": "1a5273d306e58a1fab2dd0c66a1832875363b07ee190272d979d33739c4037e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889497, "uuid": "42b21721-0533-4b06-ae20-39042984fef0", "comment": "Malware payload", "value": "5459395425639f368c1851802a919a5c90873aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889497, "uuid": "096025dc-79e3-4948-b0db-0bd368ee1bde", "comment": "Malware payload", "value": "b1aecd934152819a7bc77ab28061db79adb94fa984229007d234fa184deac7ce7203a946b1249a7b0b69e57e99b71826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889497, "uuid": "b8432209-a27b-483d-9c70-67590e22265b", "value": "T10135330D16C22B59DFFDB3B64E871891297337EC47A0E839770DD48A42F351869B84AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889497, "uuid": "770565c6-fc16-4c48-ba14-42d675486041", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889497, "uuid": "31a70938-1eef-49f1-aa60-4fb9213ecf4e", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFD2b:+YhQs7tWVToP0Hs0/htDH3pGaFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889497, "uuid": "e5d4f7b0-6ac9-4780-8036-4917e50bbd91", "value": 1094708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889497, "uuid": "b0cbf38a-9f55-46df-a7f9-973d92412d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889497, "uuid": "ffe8052e-8ae6-42a1-9c68-3bb5b33736d6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5972b18d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889498, "uuid": "a64d8e2c-0aca-47d8-9343-b56bc62a2a9b", "comment": "Malware payload (Simda)", "value": "bd0b3c60dc9d04bd7fcd94da0ba8dd65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889498, "uuid": "87ceeb9a-437f-418b-a08f-a348d10457eb", "comment": "Malware payload (Simda)", "value": "1a5330f926728c43c8e020616d36fefe7f2df921192dc5e71a118990984825f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889498, "uuid": "f71179d6-6dc2-4510-8131-0ef10f79c41d", "comment": "Malware payload (Simda)", "value": "bc4ad8e575fbae2f2945cf1e4ff7fc321878fe55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889498, "uuid": "77e1ab20-1a93-48e1-b5b8-d20396cff37c", "comment": "Malware payload (Simda)", "value": "7558514a21eb397922dc4703063354482b707b4e31aecb99aec8fbf780d50b83156b7751b6c3329aad55adda2fe3660b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889498, "uuid": "1f8a2224-515c-4374-8b88-65d94d3b2c5a", "value": "T10234120FBB010F93D9B75E7BD8F2DF156A366087AF66C36F9B3010400E82682795B995", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889498, "uuid": "e9f39bf1-046a-4195-a372-be97949f4f79", "value": "70527f2eb8f7c61d13b2009a3286b536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889498, "uuid": "996b515a-c407-4c05-b66e-2a400a30370b", "value": "6144:w7HI/0S6GcV6yabg0OLe//fRD/uzc+8fJpgY08gA:qH6b6GcV6wq/fJ/rDfJpgYEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889498, "uuid": "188a6adc-3e82-4d97-a1c4-55886f8f2411", "value": 250906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889498, "uuid": "c5ab07f1-ddf0-4e36-bc69-021c6bf36da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889498, "uuid": "579c829d-3abe-4af6-936a-4b8319534de0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0f55e1-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889499, "uuid": "222f6f23-d326-4267-9a1e-820dc9aa8b50", "comment": "Malware payload", "value": "efb90d90b60b749ca816d1cd6a9fd047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889499, "uuid": "f2332033-5c2d-4c52-b613-3d73a1de3b1d", "comment": "Malware payload", "value": "1a5727f488882f771cffb583e2d7ab4da77357248e9b7ec046781a4325587a55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889499, "uuid": "b9130014-26b7-4b1f-b144-6938e5c0e637", "comment": "Malware payload", "value": "ff63650a2d55067d94f3d70db3dc2cb1576e887c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889499, "uuid": "c6870df0-d69f-4bee-b16a-90613f404e5f", "comment": "Malware payload", "value": "f2e900d05cfc4a0145080554b097740bcdb8a21facdb6c92ba7a667ed433f75dc7210d84653491c25a6350b223261511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889499, "uuid": "d0882338-efa2-4a83-9d65-d7f410f986e5", "value": "T10835E05636A82CD9E59E073D5C92A72B8CA0FEE41039D13848C57A9FDEBD793083C361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889499, "uuid": "19e90ac5-4a24-478f-8377-8ceb5c7e2da9", "value": "68c8b6c1c34258010d37b2cef4172345", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889499, "uuid": "82da8409-00ea-4c3e-bb23-f97b0e06b947", "value": "6144:Wew4u+mDea57gv3V0hi90WSyuE17xstY9t1zq1swHbcMAd1:Ba9De00+hO0WSyh17xst4t1zksAbWd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889499, "uuid": "bc98fa5f-49ef-4acb-b728-be9a8e104411", "value": 1150019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889499, "uuid": "567e409e-f863-4978-ab69-cbfa03d08013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889499, "uuid": "65b26c0c-6c68-45cd-b930-20c3a94e2b3a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa9068e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889500, "uuid": "b5ccf938-b2d7-460f-a699-64b124d6ff1e", "comment": "Malware payload (Simda)", "value": "f6027c9bff20a9cef430e9378a85a085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889500, "uuid": "3a31bb96-c90c-465f-81e7-dceae3445e93", "comment": "Malware payload (Simda)", "value": "1a6664719dbf77c2c0b1ebdc467d8558584f9373b0c8825024463ff9e58fd75f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889500, "uuid": "3d0bc802-bfcd-45d3-9256-a0fda94797fe", "comment": "Malware payload (Simda)", "value": "6591365bb0d32c0bd9f15ac24623f36e87fb9cbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889500, "uuid": "1fa305ae-dd79-4564-a450-ad01aa55cf8a", "comment": "Malware payload (Simda)", "value": "163f1fd9fbd7674794e49927ba0b22d69592ed98e6f09e9d20a0fa1cf31b10d835f1fe7e742fceb371d859fc57847aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889500, "uuid": "2af8cc80-f966-469a-9c3a-2ee6a4a6a26f", "value": "T175F33966A40944B9E5E0227C65BD3B8240BF6E74571C2CE373A56EC81DF82E3767831B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889500, "uuid": "edbd5d05-66e5-43e5-9561-b543984c5b24", "value": "010cd00be12caab1cb6db908d85a08da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889500, "uuid": "0f63b6fb-2a96-43d4-b816-c4d216dba53c", "value": "3072:pkvB+OOUYjo0i2JdvIArAVMBWfvgfJYraeL/qHQl:EB+Fo2JxeMw3g42HQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889500, "uuid": "d86bcdc3-0566-4b09-b769-4475d34bc0cb", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889500, "uuid": "3c63020d-e117-49d4-8cfa-af9dcbf9eba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889500, "uuid": "662b6bcf-0393-46a1-ab87-e09dd12063c8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef2b4a3-c8c5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763940967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763940967, "uuid": "104cb97e-4d52-46b3-8ed2-8d670016c371", "comment": "Malware payload", "value": "e021492dbd146394c23abc8783f577d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763940967, "uuid": "23082d6e-449f-4a13-9689-b0b3e3e83f85", "comment": "Malware payload", "value": "1a7a6d1da9e10f09b320a22868c3bb1c32e65f7b4ee2faaab95e8ad13162264c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763940967, "uuid": "7fdee190-45d6-4ef5-a8d9-a50995cc9e3c", "comment": "Malware payload", "value": "aa70cb19d1164a388f2b83d1ba79f93c6c6733d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763940967, "uuid": "4fcb46a5-037e-40c1-9e0c-7b84117a7c15", "comment": "Malware payload", "value": "757f1f0b52d28bca1fe15cbc3ca687fbd26f0dc6eb0392c2756a27fb4ed69a942eada438dd96e618e1e688a4de8e2b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763940967, "uuid": "4e5a2020-ec43-4ff6-b800-d7dbee2f295d", "value": "T143F46DBDE75882A4E4F3DA78DE028413D6F27C0442B1554F07C25A9D5F277A1EABAF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763940967, "uuid": "64b97f3a-3964-4a22-9084-f1685a1577f9", "value": "28921ba37567a8c5a8749ff9d237c8ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763940967, "uuid": "dad0a42d-c31a-42fc-bcc6-cdd9007767d0", "value": "12288:CbxyC/XjORuOAI0KXZkAmOgr/6l3Mm0w1+DG9k6NJ3t5bZgAjXd:AYC/Xpzf0PmOgr/6qmP+16NJdjzTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763940967, "uuid": "a79f4f48-1a22-4ea9-baa1-1c00797f327e", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763940967, "uuid": "b81ec4d8-6153-4fab-b610-87f5b7395ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763940967, "uuid": "3c92c042-6dde-4e7b-bf3a-05b1f17c32f1", "value": "SecuriteInfo.com.Win64.MalwareX-gen.77477444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b56aeeb-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889501, "uuid": "0932a5d4-7b54-4b79-85b7-1e19ac8bf5bf", "comment": "Malware payload", "value": "60fa21b56c4cd32d1b9118f6f9e4ba98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889501, "uuid": "11ff6723-1824-45d2-a398-38b953c1bc0d", "comment": "Malware payload", "value": "1a9e7dc6da45968e9efa1116fc966dc5943ae2edd3f97fad973daea88b53a8ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889501, "uuid": "5c09b9b0-8c7d-4509-bd28-c1123ba61dce", "comment": "Malware payload", "value": "b32385ce9901c882d00174a75415aed0c8a8cca7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889501, "uuid": "d09064da-c885-40b0-8938-b39b79ed4219", "comment": "Malware payload", "value": "f9fa32993e6c66c0e39edb52d9601b791271c8876b443a61eb4416b9efbbca87875a9986b9267038032d6f833d8f4ea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889501, "uuid": "3e5d5a1f-da47-4cf3-9924-b02fc76dafef", "value": "T18B8533600EE2047AD413283E32AC1377D4AFB7754924DE978398CDE8E437974DA94ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889501, "uuid": "4acea675-c14b-442d-bc32-cd7a95b6d782", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889501, "uuid": "28289c1b-0d9e-41e7-a9a5-7e06d5de7fa4", "value": "24576:LuGtcjN3lRfEyB9MBhavuS5iavgJKUdeIhRHq9aR5iP3QtbMDynPll8w+VaMjPPH:fiB3ffDBvd8BRJO/2nPcTjXkAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889501, "uuid": "cd5aeff3-9952-4d34-84f8-9fcc9ce0a0e4", "value": 1719200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889501, "uuid": "3d1320dd-e06b-40fe-84fa-257d6755c19b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889501, "uuid": "839cfbbb-a6eb-44b4-a6d8-c07246ee8ea4", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf846ac-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889502, "uuid": "f0a24623-b5de-49dd-95e1-490b4e50834b", "comment": "Malware payload", "value": "08ad7236a4c77bb74630da843309b69a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889502, "uuid": "f3713549-f4a1-4b23-a38a-85f3e7711f8d", "comment": "Malware payload", "value": "1abf5c5e621167afe5abb13799ea67c7a2f31eb2aafb47bb6609b738a8490861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889502, "uuid": "5b71f162-f1d4-458b-b770-20e693915ee6", "comment": "Malware payload", "value": "fc09f498d57141a0ed95d8a40ad2754df81c85f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889502, "uuid": "a42bcd31-a218-41ec-b9c2-5937052feb1d", "comment": "Malware payload", "value": "f7bb8b31277c9e7996084c6aa531fb31d65fbe03f8841d42c8f1300601196ee2090c864b66956dc741a3db0cb77155df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889502, "uuid": "ebedbf48-d8ab-4f18-a87a-5c36e61e4249", "value": "T1CF74D07377C08DF2C84606300667AB768EB3FA3A15724457FBE46B1B6C35A507E2AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889502, "uuid": "bc2d651f-9a53-4851-bf34-3f5186d9db3b", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889502, "uuid": "49aeb798-0906-4423-a618-01e1e986269a", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5Tw/oPQ6DHs:BtKe6YiDdv3m3mgKHDjSeL46zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889502, "uuid": "ea5c1e72-042e-401d-ab2d-b62a1f33e84d", "value": 344351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889502, "uuid": "87730683-7f72-42af-b61c-7dd552912e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889502, "uuid": "4264077f-31bd-4194-83ed-9c2b036c1d37", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc15ae2-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889504, "uuid": "583c1988-07bc-452a-921e-df2fdb33a820", "comment": "Malware payload", "value": "477b37a9d1e3971be4787e5f71d978f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889504, "uuid": "4437a2c3-64a7-4c92-903b-77252578b184", "comment": "Malware payload", "value": "1abf63f45fdf7a30939ac72550572239febded2a0d67b6f59c3581dbe6ca4e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889504, "uuid": "d698806d-3a37-4329-b2db-81b68c48c417", "comment": "Malware payload", "value": "a1bdb2a6c3021d9f77e1f8db1cf828ea4f2f30a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889504, "uuid": "e33dbf49-4337-458c-9fcd-f693a8ff1b3e", "comment": "Malware payload", "value": "a7877b818fe900ca5272d780f8245737801699120db7c1079bb9a81ac042df922e0459b6d9571b5b351600a2b70f43d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889504, "uuid": "b6d17648-7824-480e-9da0-4c572acc6aba", "value": "T134C5E0E0677902B5C8790EB9303D8ECE7C2167FCCE36665ABC18707B7654A196EC894C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889504, "uuid": "00044bc1-acc7-46fb-a25a-321b4424ab8a", "value": "b672bf4528e2ef8904397d0b17905606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889504, "uuid": "dad6b346-272e-4481-af43-01231323d7d6", "value": "49152:QXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVt:QXzhW148Pd+Tf1mpcOldJQ3/Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889504, "uuid": "a363aeae-04ac-4df8-9760-27daba0a4a4e", "value": 2710778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889504, "uuid": "ff2cf2d2-2512-438b-bcc8-531fa82d31e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889504, "uuid": "14f8df03-7923-4932-bd07-dcbd7d7494f4", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d554cca0-c8b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763934803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763934803, "uuid": "097264a8-9bc2-4a27-8fd5-08757b0fa8ca", "comment": "Malware payload (Mirai)", "value": "e3d84bdc0feff55ab68b3611cdbdb4c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763934803, "uuid": "89dfd94e-3c2b-4912-8e7e-8b3776ee9ad3", "comment": "Malware payload (Mirai)", "value": "1ad76c837935535dcab64e5b868e154ead29aab26fb6cb415d2a6d3574b61416", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763934803, "uuid": "6132bd3c-f4f2-4834-a6f7-8da2d8c7da7e", "comment": "Malware payload (Mirai)", "value": "5dea806f033ffe5d4c4bc97ae5c1017eff45268c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763934803, "uuid": "6dd34305-794b-42da-8b18-e9df12b9f6f3", "comment": "Malware payload (Mirai)", "value": "d07931f2b01b612120fe3435c8aeb4cb4b4d14757bdafc15510939dbc9009b412df997d61e56f667845ee31dd36d3a08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763934803, "uuid": "baefd11e-83b1-4e04-8faa-8b01a84d2551", "value": "T123D3F609BB610EFBE86FCD3706E9070521CD655622B83B7A3A74D52CF14E28B1AD3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763934803, "uuid": "cb6a26a0-f1de-40ca-a1a9-cc9550cfdbcf", "value": "3072:ppyNvt7KPQslSavgweuK2FesVciuTe+Ey9tJq5L5j/k87QQjzEkrQuTsp:aruPQqSavgweuN17QQPx/sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763934803, "uuid": "4e790214-ade4-4d72-af75-ef1fa3608156", "value": 131256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763934803, "uuid": "ce4c1097-cca9-4ddd-82e1-375fcb8f9144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763934803, "uuid": "112db968-e432-4533-9ae3-8e09e639a0cd", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba74022-c84a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763888213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888213, "uuid": "83e5678c-bf34-4539-b236-38ddee99d1c3", "comment": "Malware payload (Mirai)", "value": "0c329eb07f7157ae034293e603e36145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888213, "uuid": "cebf5ff2-2244-4927-9fd9-4115075524f0", "comment": "Malware payload (Mirai)", "value": "1b1a2fb34139cfb426301a7077b6e56bc116cc559fe67aabb83d2e9682bed69b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888213, "uuid": "64154cd8-0781-41a7-9e50-9006487c850c", "comment": "Malware payload (Mirai)", "value": "f18396b1a791e2a8f30b0a906695657d6e744690", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888213, "uuid": "27544bfd-b81e-46ea-88b8-32b846bada2c", "comment": "Malware payload (Mirai)", "value": "7e3360bb9c288202a0cb7c6db72ed854e75883451bd8735367b9d8f965f1ca107eaf530a37dc39c8214b003ab397b55c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888213, "uuid": "44ff4820-8d89-450d-9c45-f22b2b429c04", "value": "T11E63F14465D97C01BE2B3E356FBD86D9BDE82C70D8F57127890D982FAAC980173E4A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888213, "uuid": "2a44a024-c793-4ce0-9b21-fe8c1c61e4bd", "value": "1536:EyFcV6n+uUIW65NIGX98FzwO7YXTHAE2OSuXDizU:EyFcVsTUIW65NIU8F8X1tSuTiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888213, "uuid": "b3ccd23f-6671-4d80-86c9-c729332bb168", "value": 72084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888213, "uuid": "2b1837da-c424-4389-8a5f-d0e67fcdf522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888213, "uuid": "164735c2-d53c-4042-b56b-723065c43d84", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5b72d6-c880-11f0-a129-42010a9c0007", "comment": "Malware payload (AZORult)", "timestamp": 1763911627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911627, "uuid": "e3372122-5e19-417f-96a5-275e2a7282eb", "comment": "Malware payload (AZORult)", "value": "f729a999041afa9376b07d5cb0cff67b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dnlgu-ru", "colour": "#9C96EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911627, "uuid": "2a262870-3fe7-4d1a-ae22-127bfd9fef56", "comment": "Malware payload (AZORult)", "value": "1b357f661479133d97cfd89fec1a6852f78c3ba86cde9c8325c6e5c91a437695", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dnlgu-ru", "colour": "#9C96EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911627, "uuid": "c1107057-3fa6-4798-baa9-fe50f419f22f", "comment": "Malware payload (AZORult)", "value": "6ea15d00522a272b4ab371a044f1e0fd3930965c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dnlgu-ru", "colour": "#9C96EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911627, "uuid": "dd056f30-7a7f-4320-bbc6-f557909eb049", "comment": "Malware payload (AZORult)", "value": "88cae85bd19ed5f4897fc595e60f4cbe458b13f5d922239136e51092b4a97dd719cacb20dc7169ddada16a30190e8ab4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dnlgu-ru", "colour": "#9C96EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763911627, "uuid": "6f08e6d5-45d5-4213-b172-2d3a47865cae", "value": "T152B32A6EF7C19277D02408BDCD45A1B9907975302E391822F7E64F6CD8F96C2AA6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763911627, "uuid": "77ca6d23-85e1-41b7-bfd3-133ea3b0aae1", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763911627, "uuid": "1e639c81-7cc9-4f4d-a203-98d63a8ca539", "value": "3072:KExRaX6raoCoCyz6/mqv1JR+yBtGOeaeWgizq:faZ1tme++wiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763911627, "uuid": "c99d1823-6c2e-49aa-8e53-67b2e00a0612", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763911627, "uuid": "31fd66ed-756c-4b2b-b310-20e0619038fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763911627, "uuid": "a398a992-cbcd-4bc4-b4c9-453d115bb3bd", "value": "keygen-step-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37e449f-c854-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763892736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892736, "uuid": "b08ba750-cd46-4456-b844-5e897ca87375", "comment": "Malware payload", "value": "d8a1abc4556ebb4d2805df9af428ed1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892736, "uuid": "45967d32-1454-48d8-ab0a-70684d044891", "comment": "Malware payload", "value": "1b55798d1dd005481aaab71bb7de0a6cd25352450e84ac0287e4725711431218", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892736, "uuid": "7757187e-4596-48d4-b1ba-6ec2a88397ef", "comment": "Malware payload", "value": "52968a525be2f1a4bdb3dd0ea825b79bf9afa500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892736, "uuid": "7cdd07e8-3bd3-42fb-99e5-552f12aa8f9f", "comment": "Malware payload", "value": "fe62f263f32d56418d8013c0cacbc988147d2c61e014ef16e927bbe03792f9b5dea57b5c117808b57373fc15632e5043", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892736, "uuid": "288cfe3f-34f5-4b3f-ac77-991f80b9a80b", "value": "T11E35236333C259E1DC49927203876369AE73FA7C17B1D42AF7ECCA0F1C70910B6695A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892736, "uuid": "2028412c-bf66-48ba-af13-8d152410693f", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892736, "uuid": "9754fa3e-17ef-46eb-afb9-54414c8d0ecf", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuNpLk:qE27hQs7tWVToP0Hekxbl5TuLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892736, "uuid": "f3d319e3-22e3-4135-8744-c868289cf62f", "value": 1137942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892736, "uuid": "f3890e20-7bb5-4380-ae79-1ab13fa93e19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892736, "uuid": "ea3d9fad-01fa-4506-82ce-87d61ee29179", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5b0869-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889505, "uuid": "e2f5204d-9e23-4090-9261-fc5c4153e4b8", "comment": "Malware payload", "value": "5ffe73cbeb0670886a66b61e62028d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889505, "uuid": "b1fe60ee-f3a7-48b1-93c1-d8d86139490d", "comment": "Malware payload", "value": "1b6562683318ce7d204e4da4af3dd03d8600193667ebfd22e25af338dedf4bdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889505, "uuid": "7764099e-f816-4f01-848d-e273ef7f4d85", "comment": "Malware payload", "value": "afed782f37a8547ac93383a8978d523a613dcab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889505, "uuid": "c3d95462-7a7a-4cc6-b1df-544d33a380ed", "comment": "Malware payload", "value": "125d7a3a60d1c47d900f99ce12b5e9091a5342ccb7c81842bd6102c1dfa12d809b3d83ca38cabde94dc8aa8f7c156048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889505, "uuid": "264f439d-060f-4adb-bc60-7e4e0dc846fb", "value": "T150D3F8277E50602FD81589F27861EB3EBA215E3A1BA1AD4733927B1135BA64371F430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889505, "uuid": "41bd3939-bb0e-460d-a8ec-5e1032a8f80a", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889505, "uuid": "1123a7cd-7bed-405a-b882-146f700ad3e2", "value": "1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVX2XXXXXXXXXXXX/:UVqoCl/YgjxEufVU0TbTyDDalRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889505, "uuid": "b2db80c4-abc8-47f8-9282-7baafd109b6c", "value": 138405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889505, "uuid": "0a048380-fbd4-4328-9621-48656bdb2473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889505, "uuid": "64f79b80-1be2-4261-adfd-fd39ff865919", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df9394e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889506, "uuid": "27c4b9d3-fa32-4f31-8d05-710e2c22f1d1", "comment": "Malware payload", "value": "6f41ff0c5bb5fb25c543a263ba360083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889506, "uuid": "4f46f5f6-466f-43eb-8792-ba73d075e38d", "comment": "Malware payload", "value": "1b809e7a8fb5268d7465b9ba36d28f24a76f1f26082a8dd8e131dd96d07f6423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889506, "uuid": "ede76b36-1eea-496e-bd25-0ef19d316772", "comment": "Malware payload", "value": "6923425b4d8ded611b6d54034899fea1f498a13a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889506, "uuid": "0649c21a-b46b-4099-b77e-be8537a63a4a", "comment": "Malware payload", "value": "3d5891219e6cd0c5a5cef4947043df4dd7d9981cb74d7b0a38dde188bdfc6a814555616434b98a709cc907e301fb637d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889506, "uuid": "b11262c8-db96-47a7-a1b5-2a3c70e91def", "value": "T140653323B4D090F9CC4929370199E7718BB26AF726F69275AFE81C6A1C314A17F1BF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889506, "uuid": "21c6aeef-f017-437a-979d-eb2a4366eae9", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889506, "uuid": "6ea258dd-9b27-4854-bf85-cbc8fd2c58ba", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lAN2kwSk6Ye17l9k:7E2lVL3Ze+/F5ndjFWmrjyx1cmNk7YKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889506, "uuid": "395a26c2-26ca-4baa-a5f3-adefa757fad7", "value": 1419940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889506, "uuid": "67c34054-2bb8-40c8-ba24-53b834ec72ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889506, "uuid": "9ca31b93-162d-42c2-a1a4-a8a186b29664", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8ea4be-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889507, "uuid": "e0eaae77-2353-49b0-b9c6-faf65ebbcc61", "comment": "Malware payload (Simda)", "value": "05f930b452c7632020739e75f2b55493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889507, "uuid": "dac24289-2708-4784-9fc0-0cc00cb634b1", "comment": "Malware payload (Simda)", "value": "1bb2da09029526b71ad43ac6b569c65fa9b1fa1bd3a5679416a390b463175aa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889507, "uuid": "bdedb017-20f0-492b-8510-5b897b325443", "comment": "Malware payload (Simda)", "value": "15226bdf71b9612cbd79075209322041e67926c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889507, "uuid": "3a2639e6-f58d-43bf-b316-8a71f6752973", "comment": "Malware payload (Simda)", "value": "f634a8d9f1253fedcb4dcd1467dd89a7467f854a0ebefb17ea2b1defab5e65242c5faf8b15bd7397915e64fefd3d3152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889507, "uuid": "0a935af3-b3c3-4d8b-86d1-25e421eec435", "value": "T13F34120FBB010F93D9B75E7BD8F2DF156A366087AF66C36F9B3010400E82682795B995", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889507, "uuid": "b6a364f5-8944-4814-bf29-2be7de422690", "value": "70527f2eb8f7c61d13b2009a3286b536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889507, "uuid": "c8ecaebc-cb99-4bad-bca9-fe559c35463f", "value": "6144:l7HI/0S6GcV6yabg0OLe//fRD/uzc+8fJpgY08gA:JH6b6GcV6wq/fJ/rDfJpgYEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889507, "uuid": "b1f134a7-b35b-4944-812a-8a44a9232289", "value": 250906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889507, "uuid": "9e74ab66-c618-42af-b350-f869f7808d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889507, "uuid": "c0ebf0a3-07c6-41fd-b189-ea097e054482", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc56137-c84b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763888725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888725, "uuid": "4803b63f-e0b8-4a46-bbe3-39f856c2ade1", "comment": "Malware payload (Mirai)", "value": "249bcbf97ad77c7a9167b7c125b6f7e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888725, "uuid": "5dc3ac6e-86c6-47b7-a6ea-f4c22aec15aa", "comment": "Malware payload (Mirai)", "value": "1c0329f89241d49944a32012adee4b2eb5b66f94935a39b9a999b1ce171029fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888725, "uuid": "2909fa95-38e1-4233-9a9b-2839284acd37", "comment": "Malware payload (Mirai)", "value": "c2b9f44e8eb4c2690a47a42ece36a859ba38fb35", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888725, "uuid": "c772f63d-bb7a-4bed-81d7-99263a784cbb", "comment": "Malware payload (Mirai)", "value": "e84e795af7dd4ec3eabf715479be1e83747fab5583f88719c9d9974570468b70534c961bb292baa3149658481d567da1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888725, "uuid": "65cec580-de3b-44e8-893b-e2d8d03349be", "value": "T161217E8F559A1AD303098F6BB371D2D8E808C38F20E3E644FCAB4C318E959A53614E17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888725, "uuid": "dd7fc1bd-f64f-4c89-96a5-e780d77d4253", "value": "12:Ifzp2fIdzGSSXaex5J2NrV/w2zheR922/j1G52012WNOHs2IOrhOl8S273HMDo4v:i2a6MZy71AJNODNN1Mku10+VlmPSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888725, "uuid": "bbb706d5-5de6-4a8e-92e8-fe33ff6721c2", "value": 1385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888725, "uuid": "dfc71446-a8cc-4855-a77c-622d42f15185", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888725, "uuid": "3ed384ea-20e7-475c-9caf-31ac1674c9ac", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1cbe52-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889508, "uuid": "35b270ea-8d03-460b-ae4a-4a30f356e4af", "comment": "Malware payload", "value": "d6a328568dece8234b7ed54328c4b03a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889508, "uuid": "3f138b79-e63f-4550-8e93-88651d896ea9", "comment": "Malware payload", "value": "1c95b8cbf6c4a63e784c02532f9dd033bfc8697cf95373ff9e14ea07706e24c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889508, "uuid": "f9c61f87-7056-40a5-9a25-dee0874f0d8f", "comment": "Malware payload", "value": "cbb6d5f5945fcfce9b57f44bc3132dbee118180a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889508, "uuid": "b0d8a4f9-d1d3-4852-a9b1-68f53cf48560", "comment": "Malware payload", "value": "3360b39b195d44a61b26b5b2ffa3bcc671fd68032fcc7f1c0ba37307461afa3b6f2dd72d8adbfec4c9d70e2c00c91e7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889508, "uuid": "05534a95-8a60-477a-8d7c-3398ba2bc5b4", "value": "T17D74536A1A48050DC5FC9771B0711A88D4DD2E1BC57AEC347ABDAFCC0B3370A5AAF256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889508, "uuid": "0fd9e081-abc9-4c62-bcfe-d5e9bfa9e3b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889508, "uuid": "d7c6d3dd-5520-415c-ada4-efae800b1f13", "value": "3072:pNjum0ydDKqX0LOUpVOKWP3re+POJOTOhOnOFOzOFOwOuOIOBOnOhOTO9O4OmOQ5:4ydbs+P3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889508, "uuid": "5dcd237d-6e4f-42c9-9ade-5faef1cc249e", "value": 342639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889508, "uuid": "2dae69f9-4087-41af-9c88-0ce267a008d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889508, "uuid": "2d74793e-743c-404b-a8e6-131dd9d2e447", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b330b481-c87b-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1763909406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909406, "uuid": "947b9028-add8-48e4-811b-79997de2e50b", "comment": "Malware payload (DonutLoader)", "value": "55b6efd1986ba93ba64b6f5222a5e0f9", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909406, "uuid": "5175ff63-917d-4e5e-8846-4a03d5b8cdf8", "comment": "Malware payload (DonutLoader)", "value": "1ca9b7e7740770ca5f710193adcc9db9f7c3a1b5b5b188cfb21b8c1d1c1acb85", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909406, "uuid": "d42de166-24ad-41b5-a47e-676debc0c9e9", "comment": "Malware payload (DonutLoader)", "value": "cc4b8dc50a43707d9f43bafad473a8ab0a15b49c", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909406, "uuid": "6fcea629-3c37-4ed6-aa15-a0e4835c0543", "comment": "Malware payload (DonutLoader)", "value": "57a4117c6a6806eb655848c56b6f02436e6a497d28fa146cf8a82c636e2039d08b4dc84873c9a3cf11f32e9eebe7a72a", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909406, "uuid": "2f18edf0-491e-4fa9-9e42-efb648c1146e", "value": "T188F36C5773A820F9E077C17989920A06E372B87657619BEF03A0477A1F376D09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909406, "uuid": "b74b4a5d-b496-46bd-9d84-e98d19a26e4a", "value": "efeb5d2e785b956a774e5a38aa6509fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909406, "uuid": "944f1453-7bea-4410-bdf5-f451afcaedef", "value": "3072:wDNnXHDSLs+FF+gXWrzDwFakFIixQO/nH7H/1JSA:wDNXHD+zdAqaYTHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763909406, "uuid": "fba1caeb-a0d2-456e-b931-d6f8d7ac5bd4", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763909406, "uuid": "fc229874-f577-4c8c-a735-0e0cbe35609c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909406, "uuid": "92767e3f-9deb-4c2e-aa8d-2aff5a0cae2e", "value": "Crystal.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbb095a-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763889509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889509, "uuid": "138459d4-91f8-4e47-a092-cb649eb92b35", "comment": "Malware payload (RedLineStealer)", "value": "de5109b4b192a24ce4e20d4b640228b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889509, "uuid": "e6d40b90-a1f1-4bbb-a269-fd271d8beb7c", "comment": "Malware payload (RedLineStealer)", "value": "1cc6e4982cdd8f1fbadf0626917592fedc6e423b6411aed0f2bad4cc108ba424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889509, "uuid": "e0c53bb2-c31a-4a45-bfa4-6bf215dd1f4b", "comment": "Malware payload (RedLineStealer)", "value": "c4133c1f4779a542c1cd30997e706ba868599d9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889509, "uuid": "58a9503c-0fa8-4b3f-9bea-1f4459e7e1b5", "comment": "Malware payload (RedLineStealer)", "value": "61ac580e93e0677d08573d1e8f2a0167a83b6671bcf5166d4cd0df200811e61b9fdc993821464189e9cc34cd31d0c11e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889509, "uuid": "23b1fddf-5ecc-4056-b8ff-3a0902043c72", "value": "T1A354E02071C0C1B3C4BA103545EACF399A797471477A96E7B6DC2BBAAE113E0A7352CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889509, "uuid": "76b25360-73e4-4aea-82bc-72e718b5c0d8", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889509, "uuid": "84f830f1-1c95-4b69-92af-f5afca205dd5", "value": "6144:IDKW1Lgbdl0TBBvjc/KYWdG5WkZVwCgABrB9NUDIc3:Oh1Lk70TnvjcC1s5WuVwCTrUkc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889509, "uuid": "5db2050d-4d12-40d4-abdf-f8bcce4626ea", "value": 291960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889509, "uuid": "23f7c906-673a-4e0f-b2a4-a4df5b892ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889509, "uuid": "91294932-cf5d-4b29-8df9-6aa78b6257c6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60518c7d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889510, "uuid": "598018b2-0bbb-4905-ad85-f4c59014a24f", "comment": "Malware payload (Worm.Mofksys)", "value": "131927998d55f68769e68d569c3b3103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889510, "uuid": "2a038df2-44f1-42f3-9e09-25bd116c1f2d", "comment": "Malware payload (Worm.Mofksys)", "value": "1d2acfd7f8566cfac5d87bbd85193cb63c47f40589061cbb8cb245c9a1c94e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889510, "uuid": "1736c5f5-bdc8-470a-a80b-c3ea9a0f74de", "comment": "Malware payload (Worm.Mofksys)", "value": "629091a41d400ee81880e05114bb00fa6cca93c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889510, "uuid": "e2e012d2-3e6d-4591-b2d2-972001246152", "comment": "Malware payload (Worm.Mofksys)", "value": "f69f5a349a01fe8d80c437ca7e27511894fca05c0f4da220762bc5013892e310df5a6d12870ecc801b9747de497da002", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889510, "uuid": "83d1dbf9-d579-4157-b9d4-eda34cc66e7d", "value": "T19B24E92BEE00702EE863CAF01926A1A6B9255D351B90AC1F27D2AF873475653F5F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889510, "uuid": "886842fb-2dc4-4de0-a8df-6062c3322b51", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889510, "uuid": "a4b8f718-0b6e-41a9-9a82-16de347995a0", "value": "3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un+1:5vEN2U+T6i5LirrllHy4HUcMQY6x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889510, "uuid": "1b625248-a357-446d-9623-a6ee4e8dda76", "value": 211865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889510, "uuid": "73c33b3e-5ab5-42e3-81b5-b8caf9f59207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889510, "uuid": "930fce71-4978-4770-af4d-d9e80317eb6d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e3ba79-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889511, "uuid": "6b1037f6-12da-4097-96f9-ad1e898b43d2", "comment": "Malware payload", "value": "61c8ef7dcc40daba54782019eb7d4624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889511, "uuid": "3d0289e7-6410-4d17-930c-1de540ee4dff", "comment": "Malware payload", "value": "1d75053acebc7856bdf16c66da8a60d525a6589dc1d9818f537eb6b9ffcaa415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889511, "uuid": "13142531-03c1-4828-87a8-cf23cfbd173b", "comment": "Malware payload", "value": "a57a807bfb44443c16b552e6216cdd28e04ba87c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889511, "uuid": "a05cd681-39c7-40f3-84b2-c03de56c900a", "comment": "Malware payload", "value": "f0e68004967a634645435fb16629bd9ccc71be7d33c1d5ba2ea8132e37f791983c009b1981b577051bfb45552bc8897d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889511, "uuid": "98518e8a-687d-4e19-9e90-6de25d58ac73", "value": "T19693E84BF61281B9CA38C537A561C1B21F253E75AA63CA3F35513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889511, "uuid": "ddbfe2ed-f799-41c3-999f-046eff9213e7", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889511, "uuid": "d6d4a1f5-05e1-41e7-bffb-b56cbadc812f", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdl:41bC4Bk6lMTOWw4PkRAPoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889511, "uuid": "4cc5d02f-1214-48fd-afa3-93ca3a5cbd48", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889511, "uuid": "221f69b9-7faf-4e2d-a48d-91060cff7dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889511, "uuid": "d2043d8d-c893-473b-a27b-72bd5dabbb82", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618fea25-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889512, "uuid": "d20d2932-2ba5-465a-ba32-6c0000bc90c0", "comment": "Malware payload", "value": "531d6d00b4f2231bb540dfb0eecbf9b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889512, "uuid": "c835d30d-920f-4f55-9d90-51ac8fcc92f1", "comment": "Malware payload", "value": "1de2f50c4c96e45723259d5fb749b40b8d28e2b55a8692ee6161316cb6c29f19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889512, "uuid": "59958bb1-6c36-4474-ae52-53bcec7c76c1", "comment": "Malware payload", "value": "52d7dea17e45d2c7d6c393f88e1d49b3c60551e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889512, "uuid": "d33fcf9b-a51e-4aac-86b3-9286307a07a6", "comment": "Malware payload", "value": "eae1c3678a24b795708c6ed1a010343102a6519222897257445ba21fd64d47a3cbddd96643f4a8f4a9559f759279c330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889512, "uuid": "61bf58b5-35c9-492a-a422-fe4914dbcebf", "value": "T1E1E56C17B284183FC06B173A4837A7549D3FBE216A269C1F57F078CC8E7A5817D2A64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889512, "uuid": "2759e1f0-a9d0-4cfe-a9f6-9f09acfaf9b6", "value": "3d349bb1fedb23758a6e397e5d691576", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889512, "uuid": "dc8fbeb9-252b-4659-9ee4-c8e3f2d65857", "value": "49152:ZUuBTOjZwS1Ihk+hy7iHuaRZnt+NTNLiG97K:ZXRO0hkr2Rxt+eL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889512, "uuid": "1e5cde4a-4d9e-47cd-aaba-957831a7be7b", "value": 3299862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889512, "uuid": "db9b92f3-5e09-4a9e-819f-d37060402bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889512, "uuid": "d9f667e5-0369-42c4-94a0-505763779cbb", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb91ea00-c88c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763916748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763916748, "uuid": "963e1a88-2063-4e79-8237-5af5e179df97", "comment": "Malware payload (Mirai)", "value": "09c6c435105d5a5ccc7991e1a06edf3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763916748, "uuid": "84bae2e8-dc40-45b9-94eb-3772929277dc", "comment": "Malware payload (Mirai)", "value": "1e8f3cf5b4d3f882baf522d62bf9fc105fc34ad3562f0d2dca48dad26f5e2b26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763916748, "uuid": "b6def1a1-fc4f-472b-99cf-ca840aaaaf66", "comment": "Malware payload (Mirai)", "value": "de47383e4aa4c19324ddae4b4e27cbd6215792ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763916748, "uuid": "61a3ffed-8360-4633-be8e-0b59f49ba5ae", "comment": "Malware payload (Mirai)", "value": "4cc21082f5df9f45039f750345b6c2530dfe6c423cbce6dcb07f26178a0fb6e08c4a0e3530ddff6912049080eaa7feb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763916748, "uuid": "fdf414b1-7dbd-450a-a43c-31eb8a87101a", "value": "T14624748ABF903FFFD85ECD330295DB0A129C590A1294BFB62A34D504B68B14E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763916748, "uuid": "d2ba7ed4-3f38-4d08-b806-2907bac6ce17", "value": "1536:3l0Ch+9UJRq3iLq2A9209ZzeH4IobDrTg+pFT+zTG0EwBPbo8y8ElsQn5asPrpx9:3Bh+qJRqrXsH4lt2+oBPbo9n5tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763916748, "uuid": "ab71ba59-49a7-402a-b667-d5ede0fcf4ee", "value": 219976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763916748, "uuid": "d505acde-3fc0-4e91-bd4e-a776713bf6c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763916748, "uuid": "662a0fcd-24f1-4fe6-b618-547eefa66fce", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df1321a-c885-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763913558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913558, "uuid": "be1b941b-b497-4538-93b4-9988f69900a6", "comment": "Malware payload (ACRStealer)", "value": "1a62a7f18d9c8bb15f8c1ff4dbb37afd", "object_relation": "md5", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913558, "uuid": "1245cc53-3f18-4e7f-9015-26008e7cc643", "comment": "Malware payload (ACRStealer)", "value": "1ea96c42a1c5ff0caec5dc8683ef24de3c74da1c29787d787bfd0de639976775", "object_relation": "sha256", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913558, "uuid": "f3d3f704-b727-492a-b1e8-95ddcb80eff1", "comment": "Malware payload (ACRStealer)", "value": "5099a5d6c977a1dc6c3b1c66b9737f734625fb05", "object_relation": "sha1", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913558, "uuid": "fe1b36ac-871f-4f12-a37a-8b2ac732129c", "comment": "Malware payload (ACRStealer)", "value": "0056ca1b54c6391c558d5390e395f55fe937410c89fed52f4de06a700ca3f323c0a96e68a2fbaaf41811a5b319d9a863", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913558, "uuid": "630f4d27-a4c0-4862-ac36-b38a0ea13ad5", "value": "T19B650232F07FA383D96941F125BC6E8316771779EC033722CE60919E975AA8AD418EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913558, "uuid": "abf1ef71-fbcb-4cd4-b56f-234a14c90f8d", "value": "24576:apDZq72T425DO1QNDPUYCl6PeVRAHSd6q94dvnlRMdEWi:apDg72k2EQN3C8sKyd6qidjMdEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763913558, "uuid": "3757435a-1f91-4aaf-bd88-2079abec2f26", "value": 1508893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763913558, "uuid": "c14cd287-7479-48ef-96d2-672409c5432c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913558, "uuid": "76892eef-b3d6-4074-94f4-cda2d770b608", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621fcf27-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889513, "uuid": "5bc9e66b-684b-4523-aca2-b1a2de99a978", "comment": "Malware payload", "value": "4cbc78a2777edc53c77212b9a9462a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889513, "uuid": "211ba73f-89a2-4055-89db-fa32742f712c", "comment": "Malware payload", "value": "1ebdd9674e1442c666cd916d8bf2ffaceb173c5b8088206cbeeb590c26b0e2d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889513, "uuid": "fa6f17e4-f12c-45c1-b043-c13713152cd9", "comment": "Malware payload", "value": "3f313be40be788025116bff343c00d8851bb3fe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889513, "uuid": "fecbf0a1-90ac-4ae9-bc80-aa40800954f5", "comment": "Malware payload", "value": "618883a89b9fc63981b9639740e9a85b73e8ebb772f687ac43bdf65b3063624d55182b53e4bc3fa6fa06ccc85ba950c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889513, "uuid": "dd25c660-f543-425c-93cc-349e38ed716d", "value": "T12793E84BF21281B9CA38C537A561C1B21F253E75AA63CA3F31513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889513, "uuid": "55a3e393-0e78-4d01-bab3-63afeebfe0ff", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889513, "uuid": "8bf5e158-3ed5-47c3-b013-4b6aa547d774", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSd7:41bC4Bk6lMTOWw4PkRAPoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889513, "uuid": "e0f61e06-6967-4ecf-a2d6-e3cca39bdb7f", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889513, "uuid": "6274277d-e56b-43fb-b7e7-7c6eb5b48c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889513, "uuid": "82267242-c02a-441e-a1ac-d8ce83f6f6af", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b4a97f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889514, "uuid": "0d82a1b8-86e6-4fc5-b382-39ef8fb45c5a", "comment": "Malware payload (Simda)", "value": "c3edba0df511eb6647dce52a1d8b6e84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889514, "uuid": "445b8dd8-b930-44a1-b7c7-3233ee953701", "comment": "Malware payload (Simda)", "value": "1efedb414b879c08a4bbfa50efc8b2842886c4d4a6105f6ed8237639a7955eec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889514, "uuid": "5f493589-7eab-43f2-8b30-69d87aa76ae1", "comment": "Malware payload (Simda)", "value": "ce64b63b5b65aae49eca33b3b667bd79d2f8c0ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889514, "uuid": "6db2bdb3-97c4-47a1-a733-66f5782cee51", "comment": "Malware payload (Simda)", "value": "b8709546d7dd284388282adfb396b6f2f6629f463b3a5a35751edfaf71a024fc8b29ddeea4fac7e705f2d79bb102ff6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889514, "uuid": "20d6a774-8720-419f-be93-9eba3642b98b", "value": "T157848E21F1C08079E4F5157096FF7A5B247CA9B6472838E7E7986EC928741F27A3C287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889514, "uuid": "5d0b50a4-5524-490d-9c4c-18cdef9648e1", "value": "173abfa8f7d7adac2a90a2e42625b7d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889514, "uuid": "6d4d8f9d-f1fe-4680-b843-16aa0044086c", "value": "6144:bfEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:QmWhND9yJz+b1FcMLmp2ATTSsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889514, "uuid": "4f5f44b4-1fdb-4d18-9844-2251a75785be", "value": 387484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889514, "uuid": "5b15ae9b-e471-4e1d-be2e-326e66c36879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889514, "uuid": "0737f11f-6a24-4ea6-8cfb-0df8d98dff03", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524271a0-c8a6-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763927711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763927711, "uuid": "41905821-80d1-4813-96a8-236fa016073a", "comment": "Malware payload (PureLogsStealer)", "value": "b728b85589ad6ceac8b91f7a8c1d646b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763927711, "uuid": "432d38d1-1576-4fca-a92c-cf89f01ed031", "comment": "Malware payload (PureLogsStealer)", "value": "1f520651958ae1ec9ee788eefe49b9b143630c340dbecd5e9abf56080d2649de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763927711, "uuid": "d7ee3e99-2134-4ed0-88c7-12ee5f278d03", "comment": "Malware payload (PureLogsStealer)", "value": "1ce19a630cc8aa5311377aa4ab2c9e845ccbb99b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763927711, "uuid": "40eefffb-fe6e-4788-92a9-6511398877c0", "comment": "Malware payload (PureLogsStealer)", "value": "f23c3acfefb483f516ccb18324be03507fa89b00ad45df8e840b8d62dd10c5aa066f3e0e985d3af583a503d9aa6dcf89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763927711, "uuid": "7056c692-1db2-4046-90ce-8afd95b0f006", "value": "T1A675232813D95B44F5FF5BB42864905186B1B702EC17CB9EF6C0614C8AB7F46E732AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763927711, "uuid": "97d83189-9321-46a0-b3af-ce7cf7bd2544", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763927711, "uuid": "32c6d470-2537-4a9a-9805-b1d014a140f0", "value": "24576:WR+JEfJhZ8j53sY1jCeqm6qv80MaooQajSMpHYWOkEfW5EQJZrUVvsgMYHQgdUU3:u+a5csqCeq08moPajSQY5HYryHACWns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763927711, "uuid": "2ed29cc7-05b9-4ad7-8b4d-eea6ae60d448", "value": 1598464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763927711, "uuid": "1f9f7d39-9cf0-4d08-b059-0355c8af4f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763927711, "uuid": "45fbc142-4f09-43c2-be08-860d6e4f7bb2", "value": "1f520651958ae1ec9ee788eefe49b9b143630c340dbec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5f8a82-c893-11f0-a129-42010a9c0007", "comment": "Malware payload (Gamaredon)", "timestamp": 1763919464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763919464, "uuid": "6989f14e-9459-406c-9652-1845bb40c074", "comment": "Malware payload (Gamaredon)", "value": "f308215cc6b4586d48ccc791947c437d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pteranodon", "colour": "#8B0774", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763919464, "uuid": "f871c2f5-ab90-4241-9c63-25d9e213a12c", "comment": "Malware payload (Gamaredon)", "value": "1f8a3ec047e0f44f1f21e1e3f8af5ea32749ecac3e2bef4fc2ba1a2006934581", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pteranodon", "colour": "#8B0774", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763919464, "uuid": "d5cba387-b184-4b0d-87e0-b55856867665", "comment": "Malware payload (Gamaredon)", "value": "546fe4df4e2fc95a88716e472b37a89821fdd50e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pteranodon", "colour": "#8B0774", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763919464, "uuid": "757fc46a-c33f-4598-8dee-ee32ac193972", "comment": "Malware payload (Gamaredon)", "value": "cbd7b18575d457704dd318710145e077fe9587385767f12219a5386ecbb10a0f434d62666edbc8f26a5d13a26ab8d25c", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pteranodon", "colour": "#8B0774", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763919464, "uuid": "1f366bd4-c91a-4e88-aa57-442f2450678e", "value": "T196047D669E8932248BBA570295DF3C8167D6530BB9721C8EB50C90CD82FF5E4E6CD0BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763919464, "uuid": "5b7240f7-3790-4d62-8c5b-02b073d003b5", "value": "3072:aALnsl6ItI/J0E0Rxz3zZOPkgVXf/8ptbq/AYboQSlxwZht:aasl6ItI/J0E0PzdOPkhptsAYqwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763919464, "uuid": "05774c1e-55fe-4bbc-8d07-63296b953828", "value": 173317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763919464, "uuid": "fb9b9e24-701e-4881-bc20-b8fb29515794", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763919464, "uuid": "5989e6ef-43de-4db3-8d1e-458ddb135d46", "value": "darted.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634590a0-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889515, "uuid": "276b0c5d-ef35-4c40-b9f4-b96713c1c61f", "comment": "Malware payload", "value": "659d738208a580b86a21cd9cc3ae3492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889515, "uuid": "4c504a06-6521-425f-a02d-0aefaa5b2764", "comment": "Malware payload", "value": "1fdff9879cebe94f1aa92b65fbe5b2b336b6c9af77fcd5afea581dd9831c789c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889515, "uuid": "bb3fe33d-62b9-4dc6-884a-c09fbcfa4606", "comment": "Malware payload", "value": "0e870f784636ec894e3dce79a6f4f5331a3893e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889515, "uuid": "37fb3569-02a0-4d81-a7df-c48f33ff9bf0", "comment": "Malware payload", "value": "21b2e507c2b1ae20f5e783fe10af1dfbab88d5893906d0d6edb7317e80cda69989a68525189ceb5449ac77609f6222f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889515, "uuid": "55c4a30b-1c3a-408a-a0b4-197799026891", "value": "T12C923A1155E554B1E0F10A346DBE3272D6B2AF36183CE78A374AC92E1E30903DF366DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889515, "uuid": "1eef5a2a-0523-45a5-84ba-29b9b8f3c05e", "value": "58e185299ecca757fe68ba83a6495fde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889515, "uuid": "bf20326f-674c-4418-af65-5379442d8f5d", "value": "384:KRYCtA99NpcUmO4lMMGBMAh6ZdywgFUOLg2JfvaW9C5bW9odW:bp037MtBh63y/Fbfvaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889515, "uuid": "541c274d-71a5-49ba-872c-0aaf1857e5c5", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889515, "uuid": "970b0b96-96a0-4dda-b00f-36cd1bf258be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889515, "uuid": "07d13987-1f1d-45f4-b9ed-2c36dcb623e9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d6df09-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889516, "uuid": "bd770b60-d054-4b04-a26e-0359b0887a22", "comment": "Malware payload (Simda)", "value": "7f7852decfd464ec410b6381d417aa6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889516, "uuid": "9db470a8-3199-4771-928c-1077e6462b0c", "comment": "Malware payload (Simda)", "value": "1ff3b686268fb31afae4ff1347cf8a6246b2ff01dd6f51b2fd2b450437e7dbd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889516, "uuid": "67f66a25-1035-4f7c-8a47-aecdc411fcd5", "comment": "Malware payload (Simda)", "value": "a48b42e958989297d29120a93b21db6d0e5cb7e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889516, "uuid": "86667ac0-5822-4998-b4df-d609bf862ee9", "comment": "Malware payload (Simda)", "value": "7266dab4ab2ca103ba1f35468fd6faa2ef6520d151bc39ed88d9c9ab1ba1742cabb521f682a3f7d744860f720899be77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889516, "uuid": "48f93d7d-44a5-45b6-b630-ae5f8973d0e5", "value": "T18B141203B26418FED1E189FBE861F302A62EF5161950CAE38620973E1DE58927E7F171", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889516, "uuid": "b6af0af8-3381-453f-aff7-e276e9315eb8", "value": "e13e40bbe88a0b0f403e1860e4c9a9ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889516, "uuid": "8910ead7-464d-4155-8c78-9e570029fdfc", "value": "3072:3kEVV2akVeCq+jTG+gKF66PQGWjWc7unJLrTKzsJt4ofNlPgw0L2+SC9a9o:0EVVPx+jTG+Np67uguNf/PfiDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889516, "uuid": "9e138eca-b5b8-46c0-83d2-d3896652f83c", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889516, "uuid": "79e9b698-776a-482e-bb6e-5572778756da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889516, "uuid": "60c27efb-f0ca-43c0-b275-8380b59c55e4", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8558d2-c884-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763913312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913312, "uuid": "941d1d8c-8ef9-4d13-aafc-d6cc26111fd9", "comment": "Malware payload (Vidar)", "value": "64dd51957b79aec96d32c02dbe2b74cc", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913312, "uuid": "fb9e8b4e-817f-41fd-a491-d5e701932fbe", "comment": "Malware payload (Vidar)", "value": "2072d44596690890bf4e9d297296f81409f82346b8e2e91c55d628cb35c54d4a", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913312, "uuid": "848826ad-db7c-4932-8a90-8bd8e6c32dbe", "comment": "Malware payload (Vidar)", "value": "429a04995310c8b4c8ad05a71090d68453f87748", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913312, "uuid": "2780f584-33ed-4c4a-9043-a6d959109352", "comment": "Malware payload (Vidar)", "value": "a3d8cb3e4dd1ca641555ae44ea0b38440369eab5c72d7eee9fa64743c7353854fd9204d615bf9fc15300c39544a75690", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913312, "uuid": "cfc33a19-2e2b-4404-8563-1609e953d098", "value": "T18A36ACA563A33066364B0801867789BDE6321FCB20D45FE5E9476134C7DF2B46BDA32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913312, "uuid": "b10fa404-f270-4ab4-abad-e80f7a4e99e3", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913312, "uuid": "17492702-cdcb-4491-a93c-bea222ed895e", "value": "98304:Ia3dLksY9cD6FHgycGXLGUb7hZV+r99PqF9n/wOj6t:VBYlHgy3GUnzV+ng9nBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763913312, "uuid": "69ed951c-eca0-47f8-b3ad-8c965491b2f0", "value": 5255949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763913312, "uuid": "21bb8bdb-5ed1-4712-aaf3-ce68e26b63a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913312, "uuid": "cb6cdfa3-03a6-408c-8920-be6744f42b38", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85075a19-c8ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763936386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763936386, "uuid": "73ed6bce-ba40-4079-9ce2-0e40852f4f11", "comment": "Malware payload (Mirai)", "value": "0a0445123c0d12528f8e761141a25b81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763936386, "uuid": "4d05e68b-48ca-4565-ad18-76d72fe97351", "comment": "Malware payload (Mirai)", "value": "207c44dc24b64ccb863ffd5a2678512115891ec6645b18e74f3804d872f9d381", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763936386, "uuid": "cc2d38c7-06ad-4a1a-8f71-8ba30ea3ca54", "comment": "Malware payload (Mirai)", "value": "1dffafff118f18b513b4520348ae095e013f6270", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763936386, "uuid": "e4644a85-1bb0-4747-ab5a-8b528cbc5ae7", "comment": "Malware payload (Mirai)", "value": "5e059d2a6b425b388cd132030e0a16999732b905e961c2ef2c578b42aa39f452954a0106fdbf6f34e224f0b2bbb94d51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763936386, "uuid": "aca9c511-4572-4845-87c5-b5b0a94c885c", "value": "T1E9836BC5E747C4F5FD660178623BE3368A32E5391229DB4ACF64B8369C5A602F21736C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763936386, "uuid": "862184ba-7a36-493b-ae52-a1ce8b4c47f2", "value": "1536:T/qeJqJMbGIKrZErVohdmHMBVqT//PMsCuMbmmXsvHE6C:T96MbGnZErVmdmHMBVqTP1XgZXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763936386, "uuid": "b4e80aa6-54b6-4ab4-b0c3-1a9b4471a3bb", "value": 87028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763936386, "uuid": "14fcf9c3-a0ac-4650-a322-a34fc47217d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763936386, "uuid": "503b2cdc-8603-4612-aa05-36f6e97346ea", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64822af8-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889517, "uuid": "9c301c02-7d93-439a-9251-b56f23126202", "comment": "Malware payload", "value": "13cc3e045a226183330c5f8c5f8317d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889517, "uuid": "e4e527df-ef7a-4666-9afc-d8b19a8c665d", "comment": "Malware payload", "value": "20e2f9925559f5ab9ce76fff8a430d795bdb44e19e6c51dc306909c9316b2bbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889517, "uuid": "a5714c09-ce34-432f-879c-0b88e42fee10", "comment": "Malware payload", "value": "b4c1dfbb017c1c93168f1ee9867885028ebbbe40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889517, "uuid": "2ed3b1a1-e320-4262-b64d-999779bc351f", "comment": "Malware payload", "value": "8175aa5f65aaa7e4c36e725a787eadb0039c359c3d0177d6ed6a98638784e0a5656f727d48b477254c66954a12784a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889517, "uuid": "f307f97a-8689-4e16-a7f5-859a4dd6b833", "value": "T19F35233A32908CF0D8951A310B4637B55FB3F336361148666FD42A272E7619CEF9A71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889517, "uuid": "91c80eee-8743-4b67-b226-90298ebfdd67", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889517, "uuid": "e1dc2163-b6b0-4acc-adff-bf9be49bf11a", "value": "24576:v6Zv2WqhsVn57hqQeKUP581L9k+4EBtXMRSkqJZ1:vE2WqhGtbUPuVt4EBFCSkqJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889517, "uuid": "e5cdf262-b77b-44e5-98eb-69fccbde3d5c", "value": 1161431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889517, "uuid": "7c576ad9-575e-40a1-bb52-e48f777b6abb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889517, "uuid": "34617aca-a199-4f34-9a27-6601058e5254", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65177cbf-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889518, "uuid": "f70ebf53-b3c2-4f39-97ae-0ed08512238e", "comment": "Malware payload (Simda)", "value": "3a14289c9eb0b06838f445844792af49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889518, "uuid": "fbec1c40-8d4f-4b02-b0ee-475b312e1eb4", "comment": "Malware payload (Simda)", "value": "217d3556de75c6ae83f565aad46e73a7ab892f1cbe3d2b55aa70d2112181e110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889518, "uuid": "addfa6da-2975-4927-9e22-a01baae48b10", "comment": "Malware payload (Simda)", "value": "be6e1ea00af5b8f6a6f816118d928574ef382f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889518, "uuid": "3d0cfd22-3294-4371-b2d0-3f2eafd41775", "comment": "Malware payload (Simda)", "value": "7cc3fb6615ba10d31ab7d8c70cbd649608c81bf07039399f084b83d556f5f126968a7f6cdde2370f1af9f9ef7332300d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889518, "uuid": "22affe74-b179-43a5-bcf8-d5459efa942b", "value": "T13A841213ED55915DC0710132BCB6DBB66D7FD2B9166202FF290C160A2EEC6436CE9ACE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889518, "uuid": "01ea9fb7-00ca-47f3-8486-3dd92154c576", "value": "562bef84679104f4bb60284c80d2d238", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889518, "uuid": "2ee7f356-b11e-4977-b101-26d2098f3c7e", "value": "3072:/OJM8BUIyMh/fuGk4SGkjyu3wMD32onjlWnrBJke78ilZHMOke7QezadcarPCYpx:3IU9MheRXngMDmgV2Mk0JcRYenA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889518, "uuid": "56a0e990-b4f3-49c8-b2dd-49671a6bb9ea", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889518, "uuid": "73a79302-71bd-492c-ba92-04d1b7c567de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889518, "uuid": "c46af5c9-3120-47cd-9e75-0a35ce2ef509", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f48c68-c856-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763893432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893432, "uuid": "dae02493-5309-4b06-9902-43bd2fbf0376", "comment": "Malware payload", "value": "a3acd4bf68506cb14151ba68d5c10bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893432, "uuid": "131f06b0-6f1b-4c3d-9171-ee7ac991ca30", "comment": "Malware payload", "value": "217eaf1bc8bd530d3ab9f56b8ab2ac3b4f9beb329e77a7927162c049661b7c4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893432, "uuid": "15d2d8dd-5c27-4726-9e23-357198fc0dd0", "comment": "Malware payload", "value": "1224de622437ecacae19d7d234c773d02d3ca3de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893432, "uuid": "fd7727ad-f408-47eb-9739-5d4a78a37c1e", "comment": "Malware payload", "value": "52d9cb822d75b948b1a9de1274c4fae260348096799543400338b43f67817401471fef50f39f91e0e6675a904cd7f4ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893432, "uuid": "c6e19fb7-11a6-4591-b9e1-b558a0d38506", "value": "T1F435232333C259A1DD499172038763B96E73FA7C17B1D42BF7ECCA0B1C70950B6695A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893432, "uuid": "01319e4c-8247-4997-8dc8-d1c62377e27f", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893432, "uuid": "34296504-66b5-4d0c-a780-126af7324f64", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuNpLR:qE27hQs7tWVToP0Hekxbl5TuLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763893432, "uuid": "47e64f0f-0d26-4a90-8197-823c1754c91d", "value": 1122115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763893432, "uuid": "9e3c9aee-3d41-4aa1-b5e6-c190c25b907d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893432, "uuid": "4a628898-c795-4a89-8a6d-9a127fcd0f1f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65dc37dd-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889519, "uuid": "0d3e769d-5139-4d4b-a19a-e5431233fb71", "comment": "Malware payload", "value": "7f7c25b3a6918facb21b983a49ccac67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889519, "uuid": "bb581060-7257-46a5-be7f-459a724127bc", "comment": "Malware payload", "value": "2189142d436418a6893b0c7c08529eedb67d5f8aa36271eac64193f6f4af354c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889519, "uuid": "aa7bc3ed-c95c-4edf-b1e8-e4ce06173073", "comment": "Malware payload", "value": "4ba5d8a559d724fcfa5f4147df220c8c64619f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889519, "uuid": "3793e02c-b661-404c-8c84-1339fd9055a3", "comment": "Malware payload", "value": "cc4c291ee853794bb35a8009425c0079d69e3ed8ef4b27ed27a953175c6d030b0a88c0cc3fa2623ab77f7ee1da6550df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889519, "uuid": "112896df-4729-4b6a-82f1-76561490a446", "value": "T1CC86330572B508F6E9B7D179D1938B22EAB2B85A0375C3DF73A482642F237F45934B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889519, "uuid": "41f63389-bd05-42a7-83e7-6ec8a101277e", "value": "a13403e04830e2f126c322c493f63e68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889519, "uuid": "8c129280-7a40-4ecd-93ee-6808e5c40f92", "value": "196608:tD5tA1HeT39IigFeE9TFa0Z8DOjCdylVSE/GoznzZBW0C3O:tD5m1+TtIiRY9Z8D8CclsSGorM3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889519, "uuid": "2826a1cf-eab0-4903-b7d1-dca0c146f6c6", "value": 8230144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889519, "uuid": "313b06d1-23cb-4d22-8b63-193803543645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889519, "uuid": "33f00dd4-f34c-449e-8719-f5a4a3efa18b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6679454b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889520, "uuid": "1f318ee7-37a6-4a74-9db4-187ec27a33c7", "comment": "Malware payload (Simda)", "value": "67699eca3f15dac953dc736199439d32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889520, "uuid": "29bc2bd6-24bd-422b-b664-7e5b11c49b34", "comment": "Malware payload (Simda)", "value": "219ed7646617e2b16991bf87f80fc1d13ac7c7a7947c9c2ea75e931c1ea3bee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889520, "uuid": "0f2284e7-fc83-44f7-8540-871102ec4d17", "comment": "Malware payload (Simda)", "value": "699c8d462e7f9bfda5ad303db00aad53dc4771c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889520, "uuid": "6032b9a1-4ed5-4c2b-843a-37efa5cab5cb", "comment": "Malware payload (Simda)", "value": "cf0b66f8052fc8f97de5f7964e42dad6c43ec107d5e8d27718cb5efd1cb380cb99152e120e90e96cb04fc822f6586c99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889520, "uuid": "ef4bbd10-e383-4d05-9034-d0b18446e166", "value": "T1BDC4122B1B2C9933D6550B3B8EE5EB3461BFF5516733D6D30B00999DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889520, "uuid": "d958b85d-1440-4212-8c23-9546c6e4102a", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889520, "uuid": "c0b3f410-53f6-4129-bb8e-3d3d011c95a1", "value": "6144:WZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:0quCuygMQjd5vJIBP1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889520, "uuid": "13a8184e-75ab-4f26-93e6-ea18472d82c9", "value": 574490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889520, "uuid": "d82b5238-ea1a-4a91-af36-00c9fb04b27b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889520, "uuid": "e97b9118-396c-4d03-a871-7d77c25167b7", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92123427-c861-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763898183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763898183, "uuid": "dbf5299b-1b3b-44f6-a171-4a849171335d", "comment": "Malware payload", "value": "300e543d7f0f14b723ca1f7e215b3e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win64.DllHijack", "colour": "#B7FCBF", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win64.Loader", "colour": "#66D2B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763898183, "uuid": "1639cb33-51a1-43be-b9e1-dd0ed3ebb8e9", "comment": "Malware payload", "value": "21cf25785e0ef7789bb7ad3b57399a8e1f159158ddd281d6a78c6f3c5dad97b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win64.DllHijack", "colour": "#B7FCBF", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win64.Loader", "colour": "#66D2B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763898183, "uuid": "20581eb5-bd10-4773-98bb-d54ca31ba4ac", "comment": "Malware payload", "value": "d4df0125369a6e2bfb79f942371b698a3c640327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win64.DllHijack", "colour": "#B7FCBF", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win64.Loader", "colour": "#66D2B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763898183, "uuid": "3000956f-bc6b-427b-8508-949e2014c6b1", "comment": "Malware payload", "value": "ba37c3a7bebbfa6f21a8b08c48a0c5a08aee1727b23ee06be286720d16c468ee8ce9c27f15ee240cb2fc5ae8be2abbc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win64.DllHijack", "colour": "#B7FCBF", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win64.Loader", "colour": "#66D2B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763898183, "uuid": "6501328d-4a46-4ed0-a956-aebf149eae1e", "value": "T1BE1833552315063DE6E9B134EBEA5339E3A02E85024798CB23D0BF673D3B4136FE9259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763898183, "uuid": "65b0198f-3db0-4d8b-a2e9-0671ab3442cc", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763898183, "uuid": "2e5bd707-481b-4b9a-91c7-11f6867ff79b", "value": "1572864:050dJKrzDYDr2KYV6uIGjOHNcwUl8kHsLqNDZaeE0C2IEyD5q9jGF/S7Chu:0ydM8Dr276u9SNcD8tqfaeEjsWV9hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763898183, "uuid": "0850cb58-42a9-44ad-b4c8-32c955e613b1", "value": 92629088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763898183, "uuid": "8f7c767d-653c-404d-8cf6-07af446fc3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763898183, "uuid": "639a35f7-dd49-4fd9-9882-4e70390bb223", "value": "SbieDll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6710390c-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889521, "uuid": "2ffddb6b-806d-469b-abe4-101dbc065200", "comment": "Malware payload", "value": "8aa239a8015f8b445dc9244642da36c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889521, "uuid": "8abc84c5-406e-4048-aad6-657e81118100", "comment": "Malware payload", "value": "2259e1e5d94a484e4fcc306ef36b7b1bd2b94871e8737541b1bbb4391b28d7e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889521, "uuid": "7f349a10-c457-425d-b059-0f80de59e64c", "comment": "Malware payload", "value": "468c967ee5a5af79466497b29ee7ce316ad9f0b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889521, "uuid": "37609ee2-aa60-42af-8ea5-4c7ace6de54b", "comment": "Malware payload", "value": "54e77639897ff7418548a7fdad13e101eb1b7db28e9eaa55a709b1d686e5dd9cbda581c1f3c14fd87e4e154b0d44750f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889521, "uuid": "b9a2daad-d9d2-4bca-b80f-0fea3f88ccb1", "value": "T1B4A36C41F3E142F7EAF2053100A6722F973663389764ACDBC75C2E529913AD1A63D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889521, "uuid": "1f680be5-bbed-4513-8efc-e8b97bfce16e", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889521, "uuid": "21711ee1-30f2-49ba-90b7-9ec542980e5c", "value": "1536:17fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIffwYnOX:h7DhdC6kzWypvaQ0FxyNTBffTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889521, "uuid": "43e969de-efa5-481d-be74-261d009c88d8", "value": 105108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889521, "uuid": "89c5d028-1689-4d49-92a8-60da9a784ff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889521, "uuid": "bf02932b-6b3b-4efe-b670-4d3b8a9be374", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d77d35-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763889522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889522, "uuid": "234b96c4-898e-43d6-9478-3d3263355946", "comment": "Malware payload (CoinMiner)", "value": "d40edead6955594d8de1c4efa3dbb79e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889522, "uuid": "6e09650b-c3de-4498-ba01-80621e64a468", "comment": "Malware payload (CoinMiner)", "value": "22646cb0bff14e0d069273d9a65356acf22468677f1972edfd134102ac3f7fed", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889522, "uuid": "ebb61d20-023e-4f4b-853f-ab665bd9b6bc", "comment": "Malware payload (CoinMiner)", "value": "05669308e1382da9103989b32052dca5881da39f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889522, "uuid": "85279727-a625-439b-b5cd-426de707cbe6", "comment": "Malware payload (CoinMiner)", "value": "42433f1f3040d0a9597b2e37f6a3d097c301f30d0eb64971c3db35bcf678e06b7803a1738524b076d237ea3f19c82803", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889522, "uuid": "844d1831-8715-45c1-964c-c6ab26a6917a", "value": "T1AD569D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889522, "uuid": "5e63b9d5-aec1-4fc3-8d34-e5928c6a7d3d", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889522, "uuid": "13587cfe-5a91-4047-be3a-ab134e144248", "value": "98304:IvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650P:I/II/6aYXdFD22VatktKpEEd1Qi0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889522, "uuid": "10d9d6ab-fb46-4c6d-a306-fe36f02c4b17", "value": 6440220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889522, "uuid": "92bd7522-af69-4578-9ab8-7fe1d329c302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889522, "uuid": "f0b75d77-0c13-47af-99e1-6e597a06fc8c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ad6f38-c854-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763892631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892631, "uuid": "cc34718e-2ca2-4ca1-abcb-9ef03498469a", "comment": "Malware payload", "value": "e512bb11e413484a81101e7f67473f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892631, "uuid": "31a92980-df32-4968-81a4-cfc4763af294", "comment": "Malware payload", "value": "23210e75a10c1a6ddf0a65a9325e8e1078b0b0cbfda02881c3511d7ea92c1345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892631, "uuid": "d55342f9-0492-4236-aa76-1025a014a379", "comment": "Malware payload", "value": "4da08532514dcbdba10ce917a56b995ecfba35e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892631, "uuid": "780f1782-e1a8-44ce-89a0-ddefcd7c53f7", "comment": "Malware payload", "value": "7615c82881a50b0b6bbc8a3918816a766b6886fbac9dc64d222d06496c71bfa0bbc8faf378338c94c51a9bd586f0d5ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892631, "uuid": "a534e9e2-3a7f-4538-9226-33eb186bc25b", "value": "T1CA45334B33C252B1CE861331054326B15E73A7BD17709839B7ECA04B1DB2A54BFF969A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892631, "uuid": "a2318919-1d89-4e8d-82c3-7af4041f05c7", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892631, "uuid": "2be2c7f3-f608-4a6c-bdac-769d2c7de40c", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFtiE6ALmOt:qE27hQs7tWVToP0Hs0/htDH3pGaFPiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892631, "uuid": "72e4c421-2075-4b83-b1d2-a80f63a81189", "value": 1187604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892631, "uuid": "b81c5ab1-d12a-416a-bd26-adb067168e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892631, "uuid": "adf18b71-c1dd-4c8a-92db-7e987791ddf1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393da390-c80b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763861097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861097, "uuid": "59f95a0b-4910-46d1-9cf2-c61317cf2760", "comment": "Malware payload (Mirai)", "value": "bd45d8ca98333d27b2cc7295a87c660d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861097, "uuid": "af6e9a9b-5804-4d6f-8c9f-da1d28ee05a4", "comment": "Malware payload (Mirai)", "value": "232e47352a536344e627fe78fe4a21e75fd815a5007504bedc0ec4569e5da8b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861097, "uuid": "8149c9e9-7ecf-44e3-8251-669ffe163f6e", "comment": "Malware payload (Mirai)", "value": "0dafd9bd8791245cff1b96c41ab7a6a111685313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861097, "uuid": "6a9cad44-539a-489d-bb5f-80567b1e3c0a", "comment": "Malware payload (Mirai)", "value": "19c0df199c0699b356affb9488ee48588900f83c6559c13763684e161acdfc30176a8bff78d5e0e2a8a09d105c8c9e69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861097, "uuid": "a6e47671-9629-465d-911d-90eb07255f85", "value": "T1D8E32A85F8405E17C6D216BBFF5F028E371957ACE2EE720398246F65378A95B0D3B206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861097, "uuid": "fc79a552-ac1b-40af-bddf-28e8eee6ae73", "value": "3072:2dfiZSwGhRqO+B2B4XKww614hC84rPI/2oTEA4qGp8Pg:2daZSwGhH4awt4I84rw/2oTIqNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763861097, "uuid": "86baaa0c-e78a-46bf-bced-9346a6f4ab69", "value": 155500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763861097, "uuid": "9f6cccd9-eb62-4298-8c73-f886f7932b81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861097, "uuid": "f709a97d-b24f-48b9-8261-f05fb4e81670", "value": "ngentodluwh.arm5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686f3b05-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889523, "uuid": "d97c5506-9fc9-4a5d-9e28-c7993355d8da", "comment": "Malware payload (Simda)", "value": "56660975af0a4082f461b2b725fac995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889523, "uuid": "aaabdca8-b422-4395-887a-9cc4c35f6298", "comment": "Malware payload (Simda)", "value": "23785dfa8ca545ec5ad7f2c84d83f62645703e6a8780d6dd1d7e3629e60caddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889523, "uuid": "58e3b307-849f-4bdc-8dab-c1ad11be0590", "comment": "Malware payload (Simda)", "value": "b912e61e027abd11839e7273378d070a49f760cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889523, "uuid": "2acc83a5-ae4d-4a31-9be8-fce5b0c82b5a", "comment": "Malware payload (Simda)", "value": "3876781f13b9ca92e82b36d86ecdcd171ba33ebdf747cf5418908f15074ad7caacbadb511137fa1886ab24327c4bb295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889523, "uuid": "c60e4027-90cd-4c93-9fbe-66db5137ebd1", "value": "T17D14120636492A56D3A11CBBB1CABF52D3B9C64497B1E32BB850CC3C2FE17A07D21467", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889523, "uuid": "76dc58c0-b190-4fde-b7d5-e91fda29c1f7", "value": "cda83d02709aa3122667a945a10f311a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889523, "uuid": "9cdc69a5-5fef-429a-8d25-4c705b7e1088", "value": "3072:iQcjk9tVRNIcjb4Ryfjijjx14hdeCXHKPJFo9zpE7Di0X0JuLL+o7BlpF9e6:iQh9tVRm2kh34hdeCkcG7DEALLlnNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889523, "uuid": "b27d2536-be3e-4773-ace4-71cc3b5b8e01", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889523, "uuid": "65d3370a-52c9-4189-9d86-3ce572ef38d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889523, "uuid": "b42b9e56-1dc2-44a3-bc06-aa6f347713a8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690a5090-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889524, "uuid": "5722df95-61b8-4362-8755-a6c2a3ff8c2e", "comment": "Malware payload (Simda)", "value": "f621eaec4eede9204be552b1a62270a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889524, "uuid": "83161799-5545-4a8f-ac38-73d9076c025f", "comment": "Malware payload (Simda)", "value": "23a073322962dec9204b30e2e8dbb7d9a2563e8003053bbea912c05df3b0491a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889524, "uuid": "56b6306e-980c-4740-bb47-892663f1abe5", "comment": "Malware payload (Simda)", "value": "63936051c862157c1186f5ece4670a8ab5fc8983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889524, "uuid": "ddfdc5d1-f586-41f3-8cd3-f8786418cce4", "comment": "Malware payload (Simda)", "value": "c537d447d4184738986691168d1d1c346e1f524b45ba07bbbee99f7f44f735357b41440bf72a520325fc33bb610b4891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889524, "uuid": "674fd95a-a91d-4006-a818-84efabfe470d", "value": "T18ED423226D5D4E63C6A714BB1BF6FF552326E598132BC7679C00420F0C756C97F3AAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889524, "uuid": "e78b7dae-086d-4211-9bb1-da60eb476a23", "value": "088303a3216315a2ba8d66c94c7b80a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889524, "uuid": "99ef0a88-d0d6-4e41-a126-655fa5d15cf3", "value": "6144:nmKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3s:X71YpQiU/RcO1VQInVobc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889524, "uuid": "2ece0e6d-3172-4827-a154-9ea0dbe60edf", "value": 631738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889524, "uuid": "25a2d32a-d303-44f5-b9a8-533b60768caf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889524, "uuid": "755492a7-14c5-409c-a76e-cf764807c849", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ba6a2f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889526, "uuid": "1dd88c0b-f914-49cd-b0d2-6f475db92616", "comment": "Malware payload", "value": "6bd9cc9cb7e9ead49bf46dcee2b96022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889526, "uuid": "df259261-723e-4321-8824-6893ace42a74", "comment": "Malware payload", "value": "23af0216ed319a16cb63df81c52c38fd438f4df389c41f709fafee6f7d706f67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889526, "uuid": "994b7909-2115-450a-a4b0-4b25b02be772", "comment": "Malware payload", "value": "7d17a30d9af3aab196989c862d6927195293656f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889526, "uuid": "d52dfa18-d806-4803-bff5-8b726c582db8", "comment": "Malware payload", "value": "89b2760736734db62a01214e1a8a3bc0e1d3400196cb4be7b7c55d4e8caa5507cc2b3c07bde4ab89839fdd290f0fc2ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889526, "uuid": "a439de63-4c22-4436-95af-7b0842de30d5", "value": "T10F45332927923E8CFFBD9FB982095E115DA012C95F6EF811BA997C5293921C3F876130", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889526, "uuid": "2b173da2-14ab-4ce6-8e7d-c817a16d9cf0", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889526, "uuid": "64cc1329-ae1d-4491-9803-508ca958c7cb", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVv2JW:+YhQs7tW2zku73bFgVlRlbN015CoVv2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889526, "uuid": "52dd1093-262c-4109-bcc2-94b1704a8ace", "value": 1197459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889526, "uuid": "71aaebd1-0c38-4c00-a0b3-1d43fdeef920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889526, "uuid": "02aa001e-2211-4135-9866-5b03fd482baf", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5994d0-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889527, "uuid": "8bed9054-689e-4ed6-8897-e135eade8971", "comment": "Malware payload", "value": "af6102403de845c5ad9a076e529f65b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889527, "uuid": "ab57e46c-1632-4f92-b663-7bdd094592a5", "comment": "Malware payload", "value": "23afb600ac973fdc0e6be973f823eb903adde3c2d94ec81cc2c2c2f8aabfdfc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889527, "uuid": "22aa6447-9378-443c-9758-480fe7e509de", "comment": "Malware payload", "value": "a66f5a54be608d7d32ecd01752e94a70f42979f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889527, "uuid": "1add303d-0d2e-4353-b60c-5fe34620c483", "comment": "Malware payload", "value": "c761291d78ea57cf35a06a52a8e5d3378159ade73c57ed9a064a4d1f2ce61ace0c4e739ee9ae71810fe2793584093eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889527, "uuid": "6d6c948d-2238-4635-8b9b-064e3efc3340", "value": "T1B213E1409FECBD39E8C329798CB50D035B35EA17D06AC357A0E061CE99B594398373A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889527, "uuid": "32ef2fdf-59ab-4b51-9b39-2f2099afb7c9", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889527, "uuid": "0f721901-c7f6-49f8-912b-6c6da107468b", "value": "768:gyz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D88888888889:hzOCay4wV339rPjzbpLwRJ9pSdoIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889527, "uuid": "163f3ded-be38-426c-b623-a4d5164f0b1d", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889527, "uuid": "d2672d2f-e3a8-4068-8ca8-d3ed8a7bf3c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889527, "uuid": "c376c9a7-f7a2-45ae-a003-22b796bce1d9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a010df-c82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763875070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763875070, "uuid": "e0f429ac-9876-470e-b764-33e319422d47", "comment": "Malware payload (Mirai)", "value": "6a8e2c8326c59b851f03460216726175", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763875070, "uuid": "93576199-92ba-4137-afa8-f732a9031e65", "comment": "Malware payload (Mirai)", "value": "23e236b3f9f57e650b8cdf4b14ea9fb2c42e2838ec1d86735f19f1b4abb2bf38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763875070, "uuid": "d62a8037-5955-42c4-8a86-4d522fc51a92", "comment": "Malware payload (Mirai)", "value": "19e478ed60b4830375e3a760bc8548da1a1d0174", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763875070, "uuid": "be4763aa-d683-4564-8367-1952bae01e44", "comment": "Malware payload (Mirai)", "value": "d23f78ace1837b812359e7be27c60f74566ddf424e349276fbd152fe94f3dc145ad6df39e0aeca85200c388319f9e7d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763875070, "uuid": "02da4cec-5ff1-4e03-9456-02d4b667f2e0", "value": "T17E13E18FEAB429C889BD7C3BEBC507F14EA57A5631CAAF502B2899CC736510B350D534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763875070, "uuid": "a317a592-d0d7-4a7c-8dd4-6549a8af7e32", "value": "768:xmTO5i8H7j+D0h6NvgBm9RLb65iTy/m0GBHhgEWy:x5i8b9MFN9Rv65iTuSBgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763875070, "uuid": "46455844-4200-47eb-be27-2b9c83f939af", "value": 44076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763875070, "uuid": "4b0290fc-38cf-4ba9-bf56-7fbb31e19c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763875070, "uuid": "54e4465f-33f2-4fdc-96e0-ebf088309228", "value": "Labelloperc80.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af2aae9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889528, "uuid": "bc441463-af02-49e3-b85c-c37346088b30", "comment": "Malware payload", "value": "75e598938230ba9e22dbf842dfc2bd09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889528, "uuid": "049f346a-0331-4f56-98d8-f8df4b0fe000", "comment": "Malware payload", "value": "2435d0af82b2d55fb0c94d4e65d4b72f9c01944423b389c8e320e27daf43d63e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889528, "uuid": "1928adf0-1a49-42bd-9a40-8ca2d102af50", "comment": "Malware payload", "value": "94d482573bc7cf513615f112420a23baf61157a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889528, "uuid": "c57e0fb0-c689-4d68-b92f-0afb94c322c1", "comment": "Malware payload", "value": "e5369332da2d2191d7b15b3def788975e359c0ce193ccb44f4eba1c20a9418153753b5cdea67b116a2839971497e68c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889528, "uuid": "dffdfffb-ae68-4269-a761-060174f9113b", "value": "T1C3442A03BD11407AC5B8C8F198A6D96E7A629E7D1BF0AE4B26C0BF5568705077DF220F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889528, "uuid": "dc68c7fa-d24c-4b73-a836-e1a6d068ff1b", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889528, "uuid": "bd7dca62-b50e-4c96-b35b-d190cb8b45dc", "value": "3072:AygCullUQN7gsBh1L1QygCullUQN7gsBh1L1x:ARleK7712RleK771L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889528, "uuid": "983fb1aa-9641-48d1-8d0e-2578857c7506", "value": 266889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889528, "uuid": "62d3a039-0dc4-4733-8181-e19804950505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889528, "uuid": "d9518844-c5cc-41d8-b632-3893e6ad9961", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb0f536-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889529, "uuid": "81e6482e-2af5-48dc-9045-db6cd68189cc", "comment": "Malware payload", "value": "a095e40e027b82971f4b951233072baa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889529, "uuid": "061189ec-6b53-4681-a0a1-5f1b6a9acd6f", "comment": "Malware payload", "value": "2484ce64734d0852c2e595c7605af9048bb4a9b95453c5420e53c30e54e6dc73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889529, "uuid": "121aeb54-f3de-4bc8-952d-e3e5fc90806b", "comment": "Malware payload", "value": "2afa417aadc0b9c5df4f2b9db8b71798ee8590fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889529, "uuid": "8c868176-7608-4336-bee6-010df0b5882b", "comment": "Malware payload", "value": "ec93536daa88d6c1ea85cb344796b1eb2c68e9d3abad1e06463d43f26fb3727633eb5bd50dd3eb943abd4dfe0d0317a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889529, "uuid": "3f47950f-d677-459b-a35b-d2b1390da38a", "value": "T11F15237336C4EDB6C5062670018A77718E77CA323E715522B7E8172BAD3A990BF47A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889529, "uuid": "532dd4bd-968c-42ca-8f9d-7214e6c2230e", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889529, "uuid": "dbd773b7-7d12-436e-a04e-2ef537d191eb", "value": "12288:otKe6Zv23YnTjp0Wn91decvPRciwwJFvu0jlt5SKCoZdxI8vREDcU7n1+:K6Zv2KOWnowzwwJR1hdZdxI8v64anY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889529, "uuid": "90e929ce-0a06-4366-90e2-999c399cc925", "value": 904608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889529, "uuid": "2d61fabb-8eda-4383-9278-7ab1fdddd728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889529, "uuid": "8ef0f7c2-ae58-43be-bd50-f3c7580b0650", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6c3238-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1763889530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889530, "uuid": "5cb5bede-b5d4-4ea0-8b1f-3292b0d5393b", "comment": "Malware payload (SheetRAT)", "value": "c0fe3c1ce546ca7fcecf8b86bf8f2fdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889530, "uuid": "b7a36424-276e-4c62-b410-c33e225c5ba1", "comment": "Malware payload (SheetRAT)", "value": "24b8fd3106936570baa9738d0cb983d3e04b4299ae05196c0aa18ee0224e10b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889530, "uuid": "05c31fa5-2621-4c54-82a6-7bc2919e6be7", "comment": "Malware payload (SheetRAT)", "value": "33b56fb71437dbb925884a29afb92f76222f9f84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889530, "uuid": "3b996023-d291-4f44-b948-1a591e60f34c", "comment": "Malware payload (SheetRAT)", "value": "0bde9a4ffa47cd683f74f1eee86be8397bd712ccb910443991573e7c0053ed14c7fb28c9f61b24e0eab28d616e20f904", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889530, "uuid": "8f52b28b-0c55-46d2-a460-6bb4d55a6d4e", "value": "T1C2B4C60CFE91E80ADF1F3DB7CBE915000F7162C22E1185562259AFFE9B6537268A257C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889530, "uuid": "db25c53f-3c30-4f02-889c-8f27cb6b50a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889530, "uuid": "5ce95ca2-a21d-4468-a02a-d03945520b90", "value": "6144:vUrlV9TkpmJdVM6zjYaaGce6VlWT8b9o0jQjRVY0JsZjK3vaVsadA0bbuhXad39:8rld4PVle8GF4i/vpjUJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889530, "uuid": "5f4b73ca-e7ab-4403-b08c-66a8e62eb8d6", "value": 538600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889530, "uuid": "d1fc7429-2793-4354-95f1-5d0a3c69e8a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889530, "uuid": "09be0440-4f0e-424f-ab81-45977e598de2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0497cf-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889531, "uuid": "3e736a79-5cd2-4352-b51b-137afb528e19", "comment": "Malware payload", "value": "88aac3ed84ab10f05ddf151f20c11b13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889531, "uuid": "db3e562c-2a7a-4d79-b10e-28b40ea5de95", "comment": "Malware payload", "value": "24ddef70932f85fb34a8f82a9df5c59b7c64a8d2025951b0b7d627f72ceadbb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889531, "uuid": "0bccd614-ba29-4214-ad79-50414b59a997", "comment": "Malware payload", "value": "e24b19412e470e7e4de3348de77358082e546292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889531, "uuid": "aee44221-d7a3-4a5d-a2f1-38bc1b6a0a64", "comment": "Malware payload", "value": "9993accd8a3678cf89844e79c38979b4fa561d92bd47b2878f09b300e5c97f21886364449b0a5cdb128ef65279f7ccf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889531, "uuid": "ca0efec9-b24d-4c97-bd6d-63dd42bef394", "value": "T10D74E17377D089F3C806053002976B768EB3FA3A15718857FBE8671B6C35E517A2A782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889531, "uuid": "983cc92d-d34b-4b07-9306-b86eb64e17ad", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889531, "uuid": "242471df-a62a-4e6a-ac5d-9e1eb20a5c01", "value": "6144:BtKe6YiDdv3m3mgKHDjSeL46zMIwzH7SfTo:BtKe6Zv23YnkICH0To", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889531, "uuid": "09c57d8a-963f-4d9f-9a26-207fac778df1", "value": 368774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889531, "uuid": "ff498e03-ee5c-4fba-9093-2d2d36ac9d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889531, "uuid": "4aebac1f-fd75-4741-96ae-7fecbf8d3247", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0f2a23-c865-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763899789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899789, "uuid": "418f2064-e566-46e6-ab35-f425867372e8", "comment": "Malware payload", "value": "5149d4844da2b8aea11d9fb1822567b6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899789, "uuid": "cad2daa5-249a-46b3-9790-84b3ea1be374", "comment": "Malware payload", "value": "24df05a93864e241fd8440b72d8529c0efb080a472170538dd4e92ebad0559c0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899789, "uuid": "136dd565-1c2b-4f05-b763-47c6f4a02bf5", "comment": "Malware payload", "value": "b59f96ef14ec5275c19a6243bb9ac812d47e86be", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899789, "uuid": "173c255a-1159-4241-9d43-b3d11acbacb9", "comment": "Malware payload", "value": "f4ea11ab9e0f0d75548bb1cc53440761fbda24d03b5c3ac3049d2398160512415c2fe564b9261fc6a7a164a764cc7864", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899789, "uuid": "2fa490ec-a6a9-4769-98e8-4cff8f66d1a1", "value": "T1BAE6239BFB3D883FD9B709738C6A413136B64D158942A71B2684763C6C7378A4F49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899789, "uuid": "0f2acc27-9226-4d95-9e8c-a27daf62d056", "value": "393216:n2F2Ql++axwl3YQ7QP+lu0Xs/heHoVeGqnrRAcHBI6wvC+:2F2QOwl3d7az/heIVeT6cHkq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763899789, "uuid": "67ba9191-b77c-4a67-9393-847f569f84a4", "value": 14444203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763899789, "uuid": "c4955d46-0412-40c3-a4a3-92b5349334b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899789, "uuid": "862024e1-c8b5-4f0c-9600-8e71479fa210", "value": "shipin_stable_1.2.8_202511120950.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9a23c1-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889532, "uuid": "9cfc979e-2a80-4ea4-a77d-0b2c43137fce", "comment": "Malware payload", "value": "ea18e41cf69e66221fa81727c7ef93a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889532, "uuid": "88315804-2a10-41ea-a8af-035cd8ad9164", "comment": "Malware payload", "value": "2505464af587a6a1f7c3e9f30065e38dd2e63fcf63fcd367d67dbbbfa6cfc41d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889532, "uuid": "a17f37aa-4f24-42de-81a7-57e3ed270c1c", "comment": "Malware payload", "value": "4aba6a62395930849682d10431695ed195d4dd8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889532, "uuid": "e0fbbad2-c026-4e47-9038-3267ecf246ae", "comment": "Malware payload", "value": "e44b8c3c999e2be3192584aca4115177e39cb0a4b4d6a030c7c7b4b6f112c38e0fff0c245fe9b9f9e6d9bbb62c7eba11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889532, "uuid": "ca6b7e0e-2509-4fcc-a372-94e724dc633f", "value": "T18F235B18AB6CC65FE1EF0E7D64631A21127293511303DBC64ECC64FEADAB78406257D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889532, "uuid": "7f6032d1-3f39-41f7-b998-88e669ab241a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889532, "uuid": "d944cb49-75fd-49f1-9df5-79b816527c02", "value": "384:yCxiHABz9q3FxmHu+JjOdb4KQVFRCOHu419awgncpMQiW4zmkZXOfq1aK2rkLp9Q:3CIFqb4xVTCOOuKXbOfq1ck+DL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889532, "uuid": "801e5511-c32b-458c-8a9b-676ea1550012", "value": 49164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889532, "uuid": "333ff502-6f15-41df-9a3b-872bafa33004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889532, "uuid": "60fd1f70-a4d5-48c6-8fef-b9e5d5e6baf6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f1ebab-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763889860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889860, "uuid": "2ff6a7dd-3511-4974-8906-400d1aac5e0a", "comment": "Malware payload (Mirai)", "value": "563081287b1dc69a64fb51efd27387dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889860, "uuid": "3eba3bf2-d446-4b7e-9335-f29cb0d70415", "comment": "Malware payload (Mirai)", "value": "25225f825f92ff88cedfc216369a2dbb004f78f13e75fc60b0e36c2bd125e2b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889860, "uuid": "d7ba4de7-eaa8-488f-861b-3f23dc2dc961", "comment": "Malware payload (Mirai)", "value": "d50de224de03d3f0502a68031628a523cc8a84cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889860, "uuid": "4de95574-f0fe-4c8e-bfaf-b206d75ab66d", "comment": "Malware payload (Mirai)", "value": "664cd2c06d0d2e70f2e43c7a2019c29684f551ebaf99295406795434bc303520c5823bb71e40edb1fba0b788f2cb9d09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889860, "uuid": "a9660188-aaa6-4fa5-8b96-3a1b4a8a55e5", "value": "T102242C46F9929F15C1C112FAFB5F414D37132BB8D2DA3202DD14AFB4778B89A0E3A616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889860, "uuid": "fc7be5ed-32bb-4f23-81a2-a7e00d3560b6", "value": "3072:GJXkh9dHiS2XL2B/IMGiFXZjR2UaGihSDHxLSkhi5j+vlLjb:GJKgqIMvXJR/aNgNLPuj+vlLjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889860, "uuid": "de071bb2-bedf-4f8c-995a-5979818dd97d", "value": 229512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889860, "uuid": "44efbaf3-0e1b-4325-ace1-29da758802fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889860, "uuid": "adfc6ed9-4cf2-4ed3-8c7d-8cbdfb34e12b", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3222f0-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889533, "uuid": "06b5c0b8-5ac5-4ae4-b2ca-86cdae9ded36", "comment": "Malware payload (Miniduke)", "value": "99af3a3d14c919fed07eb78ce5f1858f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889533, "uuid": "0ede4b79-6134-4efd-801b-c77e0a254a3f", "comment": "Malware payload (Miniduke)", "value": "2528f88048a8862e116a96318889abceea295abdaeecb379f3f7948a545fcc94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889533, "uuid": "9e5a572a-3627-45b8-a1e4-6370bff1ee34", "comment": "Malware payload (Miniduke)", "value": "7ba31aa5e9f8ebcdb425fd7986ff395050917ab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889533, "uuid": "2465f6e1-7d8d-4b24-a86c-eccef3d40e0c", "comment": "Malware payload (Miniduke)", "value": "471f73ad161e34cef3ee2137ff5e9d8f5ea4d23ab5a564c80a2086d0f714368606e9f6079336e2bc00bdc2ce3e0ad95f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889533, "uuid": "019febed-3bbe-47fb-aa13-232c9ae761fb", "value": "T17F049E3533E580B1E53316B46DF1AB729A7EBC384A71858B9BA41F5F2E346918339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889533, "uuid": "9e91af4b-0342-4b17-90c9-e9d8a34400b9", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889533, "uuid": "767f2382-69a6-465e-b67c-d69c016f2e3e", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZMYIWJkHy5Se:+/LhS0rKE/FLITo9mpIWWHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889533, "uuid": "4d1ab523-d8c4-4af7-87fa-2c06f2712a2b", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889533, "uuid": "83ee7942-3211-439f-9166-6d4bba57b434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889533, "uuid": "9177587b-7a8e-4324-ba65-c4a0555c5ed4", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63063a9d-c843-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763885219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885219, "uuid": "b5cb3e6a-c098-476a-94b8-f5dfadcafaee", "comment": "Malware payload (Gafgyt)", "value": "9f4216333f9b8b692b6f3c6ac5ec52b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885219, "uuid": "37e82259-b162-46f0-99a1-9973a362123c", "comment": "Malware payload (Gafgyt)", "value": "2559906f912d9fef2aabf41401fbc6b1b648a8753f556900fda92cd7d73ca10f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885219, "uuid": "a341da56-e6d6-4376-93d1-93d42a306e01", "comment": "Malware payload (Gafgyt)", "value": "0957dad0b7e76938f90cd35232372c22cf4fc514", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885219, "uuid": "2506760c-aae8-4ec7-b863-84fa443c495d", "comment": "Malware payload (Gafgyt)", "value": "de02667f190ff54b55c31af191959a0873d1190e0fa41a4eb94f87d7686365a246d0a1378b62938244b17bb52871dfbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885219, "uuid": "17449428-7701-4f29-9a16-80679d3e2324", "value": "T15AD3956EFA12EBBEE16C863107F76F70D39531A22AA1D341E16CDA181E7125C2D4F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885219, "uuid": "43ade8ba-df45-484c-a2d6-579381b22a8f", "value": "3072:jGTyrDxJWwAfr9f3yJddxUEJmTDmjOrWcpu3NJFARtRVJhGvaZqhZYiDhB/ZZ9BK:C+nZSZwnJeUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763885219, "uuid": "ac01fc6f-d70c-4b36-847e-2045febe1177", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763885219, "uuid": "235ac290-0fdc-42ab-a45b-74c614238970", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885219, "uuid": "e7ec8dfb-eb31-4c99-8a89-5f59a8dcf932", "value": "m-i.p-s.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec861e6-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889534, "uuid": "5c29f149-e607-4695-9ac2-105a31c9087b", "comment": "Malware payload (Worm.Mofksys)", "value": "fca0df9ace70f47fd489ad963c8aa72e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889534, "uuid": "b52af7b1-4f94-4538-b35c-43c9876fcce1", "comment": "Malware payload (Worm.Mofksys)", "value": "25861a8996c470c9defc2cb5e7ac2d45e60f6b896df725fcef9d42d022f3674d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889534, "uuid": "2188c51e-4752-4365-aab0-67f18ee23eaa", "comment": "Malware payload (Worm.Mofksys)", "value": "84c1e9271aa39d1263f0da3f8ce383a4750623a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889534, "uuid": "bd0ad8b9-6055-4857-8459-8cd6b05a8143", "comment": "Malware payload (Worm.Mofksys)", "value": "9f478d8599f5050c08ec38e8598cb631d1c70f4dec63e86372b6784d4e05769499aeb9954989d638c6f9c13d1f1d0acd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889534, "uuid": "55881eb4-15b3-4d54-aa7d-0a74d0eb2083", "value": "T14424F86BAD00702FE5A38BF01436A6A6BA253E250FD09C0F66D16F8935B1553B1F931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889534, "uuid": "d4b1d9d1-aa76-48e8-9b07-699af7cbf24e", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889534, "uuid": "0e7ec628-3ec6-4bd5-9c8d-5ceaf9f15e57", "value": "3072:lvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unf5x:lvEN2U+T6i5LirrllHy4HUcMQY6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889534, "uuid": "48164dc5-636d-4bd9-bf33-73bc2a7721f0", "value": 211890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889534, "uuid": "7c1730a5-fd0e-4f67-a918-3df77a47caef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889534, "uuid": "10ae39f3-3d93-4710-9775-ba4abd8b7402", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6117cd-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889535, "uuid": "1f84c64b-0e21-4b6f-b7fc-3d05e99fffe7", "comment": "Malware payload (Simda)", "value": "8c049f6395e1719a94acfbe97955eaab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889535, "uuid": "8407a532-50dd-4788-9363-402bdb1cfa7e", "comment": "Malware payload (Simda)", "value": "2592990b0849e15d4de9d19ee6e5cfbf99a5dd04f64f233dd5c3aa95f49ecd8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889535, "uuid": "e8ed2efc-4fc0-479b-ba90-c0b085b0cb00", "comment": "Malware payload (Simda)", "value": "4c9d3877302e872263d4b2c4363d491e231cf7fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889535, "uuid": "07bba4d6-5869-45de-ae2d-2c25145774da", "comment": "Malware payload (Simda)", "value": "d66126efd4f4827d9a0011f6fefa90c630095cf43cf52e0a39cff5a7fb7c51ab91b4ccfcfb1b578aef1c5253ec703aad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889535, "uuid": "0d844636-36da-4b80-a557-a8f54b024522", "value": "T1D7C41211CB7009E3D1E65F3B89EB9B064967E471CB26C69B7604639DCCEB681BC30365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889535, "uuid": "8c2375de-eefb-4c77-b695-4eb70a751bba", "value": "fc5c1aac18a83503e3cae0c72797cbed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889535, "uuid": "2e545aa8-adf3-48a4-9253-15b95a458dac", "value": "6144:dc6BtUaNMtLLowRg4uLhuMXUk4m5xnt0Ve:djuaWLJgzLMkvoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889535, "uuid": "4bfa6bc7-b387-4570-9d74-67f6ad3e539d", "value": 562170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889535, "uuid": "712b0980-10c9-4600-a2b5-4b69424cd6f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889535, "uuid": "ed2fe5e8-e4c2-4a04-a4c7-bf5b3aacffec", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7019dc67-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889536, "uuid": "f5f4c98d-ae5f-451a-bc26-66f0bd046183", "comment": "Malware payload", "value": "2762a503544cbeb7396baa1ec4ce0f34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889536, "uuid": "2b31c5f6-abc3-4d5c-bf7d-72b73f5247b1", "comment": "Malware payload", "value": "26082bc73177c8df006343302d1fe5179848731e0cfdad1ed21b16fc7104acc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889536, "uuid": "cbfbb8b6-f0c5-4d93-8999-b08c1bf98d35", "comment": "Malware payload", "value": "27afa2e082861d32af9f78652a8922075a1bae7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889536, "uuid": "ec72d651-8d5c-4e9c-a8d4-1bfa130600e6", "comment": "Malware payload", "value": "40790d6b72af60b6f066ef5c8bb11f72a80d22a7565ef10668db029911ff1b92e030100487ffc4a32cc74ddbd41f242d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889536, "uuid": "a62fc376-ccfb-4bf1-a52d-9f12a437c436", "value": "T1D665237373C2E4B3CD480B3203852FF42EB2E43927B5883677E559561CB45A2BDA9786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889536, "uuid": "57e1d57d-4325-4b31-8e96-e69f42b239be", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889536, "uuid": "28b49a4b-f540-4f93-b7cd-031150434fe8", "value": "24576:P6Zv29EhBVnFys7wuVW2r7o4VvM7L3gTLl2PuT5UgZq/Lr6HjdMlMR:PE29EhQs7tW23RM70t0ufcLYWlMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889536, "uuid": "0b481d74-372a-430e-8b04-e83364aaff04", "value": 1464066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889536, "uuid": "ab12666f-10c9-4908-923d-afbbe3e76a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889536, "uuid": "afc6a3dc-6ff6-4c1d-a2ca-a2584a0a8624", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae91fc4c-c8ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763930443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930443, "uuid": "f556f59c-cd41-42e0-ab64-267da5d35359", "comment": "Malware payload (Mirai)", "value": "25136ec6481e818f6fb7c0283c2b9bb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930443, "uuid": "185a9f80-d2e4-4da8-9e73-1ec51f5b8d6b", "comment": "Malware payload (Mirai)", "value": "261ebc0a8084076064155e9b148c702f4505878c795b4e20ff61be50f54dce17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930443, "uuid": "f849778d-a4ec-459d-a11a-83acadd26fe2", "comment": "Malware payload (Mirai)", "value": "8e4c58134445a3c35a18cfefc0e6ec16cff2e4a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930443, "uuid": "d9ccf47c-6dea-4e1b-bf60-e368f5c73fca", "comment": "Malware payload (Mirai)", "value": "2533cb20826d0b45b42e289d67de12246a652568b38320b8a67c37e2d2b43c15fd50e52e54326765267eab8822a1f0b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763930443, "uuid": "d9c52d34-5fe3-4a8b-be45-fd0e10725858", "value": "T162A67D4BF5A358ECC09AC430475FD663A931B89442317E7B3694AA342E77E305B6EF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763930443, "uuid": "be23c0a2-d8b0-4c1c-8554-0e6c0d9f89b3", "value": "98304:ns+BxDrBIe6uK1JcVb28DTYtxeOmJosFNQ98s9PEqlWmEfpIawQW0OZkG4ckRUaG:nsCwuKpE0SUa3Gn8gMB+5qNnIFzAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763930443, "uuid": "7dd70dec-23b1-4193-8bb2-cbeb23d82b49", "value": 10150600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763930443, "uuid": "259fffde-e27a-4980-956e-e1694247dd41", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763930443, "uuid": "c695d4e9-3c19-41a2-a7df-2d948103cd50", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b42955-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889537, "uuid": "50231c2e-cc50-4aaf-953a-704d95579c12", "comment": "Malware payload (Simda)", "value": "9e7b6cce55184b1c2e4cb6dfec197a24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889537, "uuid": "1c4ab4ef-3857-44be-a09d-0477b403660f", "comment": "Malware payload (Simda)", "value": "262d59902b60ee1bd615184d98dfe29e2e97756234f6b0b105c9ed248070139a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889537, "uuid": "4f46c64c-751a-4397-b9b8-2b77a2f1f87b", "comment": "Malware payload (Simda)", "value": "72df318ca6e9ccd9ddbb698982f50eebb7adb215", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889537, "uuid": "12283081-8f3b-4461-b88e-91413a8db21c", "comment": "Malware payload (Simda)", "value": "32b8615b0ca0b8c18a20e72cf20dd0bcca8fc50404df75942de97d3687bc60d9b67f8415b67cda4b15c5a503aace2f74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889537, "uuid": "3c55f035-c13d-44bd-8b9f-07148bcef19b", "value": "T18724123266C05A23C4B5097B55F3B34335AE83888326C5AB18499AD63EA72D7FE35770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889537, "uuid": "f267ea9f-ef45-444b-ac70-e61372e707d1", "value": "3ce7105d1e904763c53a96a44fc006e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889537, "uuid": "0c7e758b-54ad-4c0f-af59-eba0c0b90fae", "value": "3072:Mg/T01/NkSp48GzFoMVZrjB2+4M9eOpssvSX4FzU5chdhGulEV5SCmGFkInV/0at:JErGjVqiFPGYrGZMCrCIn6aQdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889537, "uuid": "fd249aac-d4ce-4ada-89dd-8f0187de8459", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889537, "uuid": "93a242f7-a3a7-4768-937a-36a831561f22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889537, "uuid": "75b5024c-5061-4001-a4fa-729a63cb29b1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71458d86-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889538, "uuid": "558e5d48-b3ba-4f4d-a607-0ef114eb169a", "comment": "Malware payload", "value": "3a3863f82458ec46f8f6c852dd6dfcf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889538, "uuid": "c12ef3f8-ead1-4355-ac36-00ddfdf4b045", "comment": "Malware payload", "value": "262e584443e5dc874480845caa84381245f8f7e75f6d968d953d72594b4640dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889538, "uuid": "5573e61f-fae1-4f2e-af0a-6f2239cf8172", "comment": "Malware payload", "value": "867e8974bde49f740db468674ee8a3ac99013a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889538, "uuid": "e8bb4591-e911-4220-ac2e-7cd942f14aa2", "comment": "Malware payload", "value": "3c4ff75bcf891b2f4819f87ac34ecdb904f952e440fa68afea481f0007118406fdab1df3f6251cbf351e862557453e5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889538, "uuid": "5f5c2ef9-7a86-4459-b729-ad269580a479", "value": "T15084D17772C04DF2C842063002ABAB768FB3FA3A1A714857F7E4562B5C35A507E67B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889538, "uuid": "4eaeba3e-7287-4cfa-b3bf-199493ae4f71", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889538, "uuid": "2879a2d9-67c7-486e-a5cf-bcb9afcd6802", "value": "6144:BtKe6YiDdv3m3mgKHDjSeL46HBkbEG8xLhPgl:BtKe6Zv23YnDGSxLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889538, "uuid": "43eb9814-c6cc-4d6f-9daa-516f8790f34c", "value": 380502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889538, "uuid": "d34d5f34-d382-4c49-a331-7f32f2d92ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889538, "uuid": "58ba8355-f421-4a7c-aeb2-e57cc53c7d2b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b139195f-c851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891363, "uuid": "8c7bc722-8101-4234-a530-bacaf9cc2ddc", "comment": "Malware payload", "value": "5298ce6908832f4787af74e40ea2169c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891363, "uuid": "463d9db1-2ede-4cac-945a-0ddbd347c5b8", "comment": "Malware payload", "value": "2672a7aef117a550805f42bc263dd8900c8c0af23465ed35ef8b57686f2b5184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891363, "uuid": "1b31581a-fbf2-45e8-a5dd-4cc3e3f5eaf1", "comment": "Malware payload", "value": "c2c37f71213efa419362c9a992f99c970aa6ac09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891363, "uuid": "661ce82c-a281-4ea9-ae0d-c57061679c9d", "comment": "Malware payload", "value": "66e8bbd14502053e954bf07eeb57a374a81ea6104b8cd0c2ec74848c3af1c579fc5e9ad728b075cc863d78aaafa85f2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891363, "uuid": "72607bf8-ed3d-4b7a-a9c4-9094dbaf4e20", "value": "T1BD45233633C15DA8EE464E31020E5F218EB1D36A1F7EE811FBE86D1369705C2BD6A761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891363, "uuid": "bbb59b2e-13c7-4d60-9c55-d8a2888989d3", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891363, "uuid": "8dc23ab6-defa-496b-b553-71095464b1d4", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVv2U:qE27hQs7tW2zku73bFgVlRlbN015CoVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891363, "uuid": "c3a5ec01-10a1-46e7-8a2b-49c4f8109497", "value": 1245136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891363, "uuid": "23acb1df-e572-4b9d-b9a3-34068d8e75d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891363, "uuid": "96040415-9a12-4899-8031-743841678fa3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72616169-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889540, "uuid": "2147300b-7509-42ad-9aa0-961e0180b4dc", "comment": "Malware payload (Simda)", "value": "d3774b871ca7910bb7b42d05efb3ae9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889540, "uuid": "44f6f469-da24-4c1d-b5ca-c27aa43336ea", "comment": "Malware payload (Simda)", "value": "26bdbd9c884ae13849ba21207ed7b670a7c9873c7b0bf26917e3fa6c39d84ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889540, "uuid": "93585e0c-27db-4d3e-a9d2-9c4b7e1bbadf", "comment": "Malware payload (Simda)", "value": "bfd332ed1a50edde4d14ed012315dd6d15dccd87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889540, "uuid": "952fffd2-cad4-41b1-99b2-4bae680e4f3a", "comment": "Malware payload (Simda)", "value": "105eb075896ea8be060c3cd860c69e5c7c4ca5210f4bae701d84555170d30ecbe16b53cee6728a0dda408a50334236f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889540, "uuid": "2776c078-ca0f-49bd-88df-27693cef5617", "value": "T100947D61A0408177F3F8163425FA7B6F25BE6A6403DA19DB27A46ECC29742E2713D1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889540, "uuid": "e29dd712-81ba-4cd7-9904-8b54d45f6b4f", "value": "a29736d96c1bb5330d99576cd94e80e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889540, "uuid": "2ff814a4-2d24-4bc7-9f13-a07945d77c0d", "value": "6144:IExz45uS77yQi8Dq+9fXphN2LfjEcYzaWqr57Q7Xwxc4SQjWvvf:iuS7XDq+pcYWWqtfxvSQj2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889540, "uuid": "541a4e86-1c88-4b01-a7bb-ed155c28e840", "value": 421540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889540, "uuid": "ed78f79b-db1d-4548-9457-101063e9e820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889540, "uuid": "37f99edd-d132-4610-b0aa-ce09053fbb98", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ee0449-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889541, "uuid": "4c60ca5b-9119-4197-ae40-7d584a64478a", "comment": "Malware payload", "value": "2ae4d7601e4130e070391d270df0f5a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889541, "uuid": "190f22bd-a16a-41e8-9bdf-54f2e38cd2ff", "comment": "Malware payload", "value": "26de22d2fa772734bdde8996c0db4370489058e9b448eb983916d88579dc3dca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889541, "uuid": "919d8e81-b44c-4a71-a79d-6ce6cbc15bf4", "comment": "Malware payload", "value": "cf42b843d0a875adb1a1e05baf692cfa4f51267a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889541, "uuid": "ec32aeef-d778-4720-8847-8fae101b095e", "comment": "Malware payload", "value": "03798d29c5021ce60d36d45cec0227c5eded68e7474190b1adf095260ea5cbff8588cff19fa302ba21d04664241f8796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889541, "uuid": "093b730a-1493-4d1f-9e30-c6d4880ade66", "value": "T1AE937E176590CAB6C6951A7C16FAE52511BAB7BC0357D4EF4D80232F2C33EC6093BA70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889541, "uuid": "16e1a8ad-5fab-43fb-af13-eacb96628729", "value": "088303a3216315a2ba8d66c94c7b80a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889541, "uuid": "fe149fa8-d79f-40d6-8030-3225b83856f9", "value": "384:1A+wXyB4Uw17yq1eeiQzB5kUkwHQ60ZL1ofxW:rwXYvwdhiQzbkUZwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889541, "uuid": "2d3faae5-3512-4f9f-bcc0-f05c7333b1e6", "value": 92820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889541, "uuid": "20236283-1c80-4570-a748-b961e3d5017f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889541, "uuid": "3eb7b849-c503-4b31-9c3d-0d503a411d52", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ab24e8-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763889542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889542, "uuid": "3e424c2b-6b90-4798-9802-0e43e850f37e", "comment": "Malware payload (CoinMiner)", "value": "c177348a44b9a72a117fdd64c5f92dbc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889542, "uuid": "3e1cf898-d733-47df-a71d-9c94a6bed179", "comment": "Malware payload (CoinMiner)", "value": "270ecf0abcbea63c0ee0cb33c5a431021200ce330e79c56f2b4754b88f78d55c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889542, "uuid": "25778bfe-6cfd-4ef9-830c-534276f44d22", "comment": "Malware payload (CoinMiner)", "value": "42720e85a424e099ced5749aefb583ef155bc0d3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889542, "uuid": "6e640d84-36d0-4aa9-8f18-924917c63d04", "comment": "Malware payload (CoinMiner)", "value": "12216296d6c59fa9b16f62bcc9963cdcb591efe3ed9291e184045c93a2fabd30df8dbaae62786005e785ff40e9273d20", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889542, "uuid": "782de6d9-33f9-42f6-bb99-56187482f170", "value": "T1BA569D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889542, "uuid": "fea7ff09-1467-4719-996b-f2cce4228fc4", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889542, "uuid": "22aec685-7144-4ae1-a047-595ec32d4426", "value": "98304:IvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650O:I/II/6aYXdFD22VatktKpEEd1Qi0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889542, "uuid": "0d04f589-fb8a-48a0-a132-a81b398973dd", "value": 6439290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889542, "uuid": "7637b899-c683-4ff4-b333-ad1d1f086c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889542, "uuid": "82c30654-804d-4278-ae09-7f15d069c5fa", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74473ea1-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889543, "uuid": "d1bdc003-aba5-46d6-b940-4537be69d579", "comment": "Malware payload", "value": "12ea55e8781fd82838df7498297966e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889543, "uuid": "582bce48-7ef6-483e-ad79-47ba7531b6c8", "comment": "Malware payload", "value": "2724321f6d872f3dcdf14fd1b6db3bbc66da2eddc530e74d85c7bb6d4994f771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889543, "uuid": "050f73fd-83f2-4ed7-9592-44df68f5baa6", "comment": "Malware payload", "value": "42ad5786197edaf85895134443a87cd5c402eea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889543, "uuid": "49b13ada-4d0e-4f5e-9841-90a7ca6a0399", "comment": "Malware payload", "value": "dfa62ad9177c138ae6546f0a547dc4d1681024a896925b36078d09ca866c073d6b33f686ec6998039071359e6cefb3ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889543, "uuid": "8e0f390b-1c87-47bc-9507-a62a72909850", "value": "T16225234E07C22B59DFEDA3768B461891256337EC47A4B839771CE08A03F36595DF80AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889543, "uuid": "e4944e4e-cafd-4594-8e8e-62487a851d18", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889543, "uuid": "cca7e966-3f3c-4be2-a5e6-2c9cd68f03d0", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFyjtx:+YhQs7tWVToP0Hs0/htDH3pGaFyZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889543, "uuid": "261453ef-a068-4450-bc1c-75c43acb3b1e", "value": 1044486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889543, "uuid": "39ddfd59-03e8-4424-a542-02888e8c5812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889543, "uuid": "df87f885-2fb6-40a7-a3e1-ad2925c27e70", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75034975-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889544, "uuid": "4d0f6a63-4e13-45f6-81a7-8ef19045b9ff", "comment": "Malware payload", "value": "78022974b3c49a03a8cd3608673140a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889544, "uuid": "b3491a14-1823-46f2-a0d6-37579029c9e6", "comment": "Malware payload", "value": "273d26bd5bfc835f06824928967724d50d75e6e9c5393695bb0b8b9d0d611e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889544, "uuid": "0f1d862d-df6e-4bec-959b-b1def8cf652f", "comment": "Malware payload", "value": "ce4dfffb5fc7463b4b3c21a36eb0d0b4ecac6a89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889544, "uuid": "0d30c432-63b4-4fe9-937e-c84f85fbac3c", "comment": "Malware payload", "value": "5dbb954bff254f66856172894d90e5993f66910006f9134480e9d26f5e3c293765fcadb1a6eaf2288c1224c142d6b632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889544, "uuid": "b6fcc51c-0000-4141-ba5b-b07677193bbd", "value": "T17B95E12522D9E300F67A03BB056C852C83F9F507ED6AD71E2AF72C9319D6B44DB1522B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889544, "uuid": "4f8fa688-8d2e-48bb-ae5c-bee51101516a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889544, "uuid": "f9902dbb-4f72-4340-983a-f74cde482f52", "value": "49152:TyBtz3+RkPQSxIgmEdl0QqFzGluxauw+K45mT2V5nRI:WBV3+OQ+VmEEQu6sxHHK45mTyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889544, "uuid": "e4f07c6d-bb73-4d68-adbe-71ce3d6fe460", "value": 1960448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889544, "uuid": "5211d403-2b67-4766-9b30-b72cc3d8ba0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889544, "uuid": "1da521eb-ba3e-4bbf-b483-f1e209ee3d1a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759a3c7b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889545, "uuid": "d489f13d-fb6c-496a-be68-91e25d69edd5", "comment": "Malware payload", "value": "de790d54350caed568e51e8d4f7ba174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889545, "uuid": "ee83cf1d-bac5-46c1-ae34-239c48286d68", "comment": "Malware payload", "value": "276499a6850528d75f3e3959d0eb4fc7d42239bf48c20015e7fe8ccc6d1bd431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889545, "uuid": "685895e3-209e-4d65-979b-838ac9fabbf1", "comment": "Malware payload", "value": "26d5915ceb001fb648ec25511f1d5c0b5eae7abe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889545, "uuid": "ddc71d92-2aa8-46f8-984e-daccac28d3de", "comment": "Malware payload", "value": "ae54d8f98ed9f74c30ab12b60346ee6f7e0d621e40d3e1c6162268898f62304119d12d580b03ed18ac660343d00e0d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889545, "uuid": "87958963-bbc7-4a1e-9fc0-f368f564ee1e", "value": "T1C0042351457BA2E3C89D017F04AC6428ACA3DA4EE21DEF5771486127C8B7E74F909EF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889545, "uuid": "5841a386-0ea9-4063-ba60-1721bd3df017", "value": "fb358c17affbef55d1136872c19d4fec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889545, "uuid": "04662bdf-5095-47fa-b5c7-c41ca9fdad59", "value": "3072:7N/CRCapAVMh6l6YCtFBg2fUy+hCuxigAC5d+UZduez9YA4IkKeRWeout:VyCapUSe6xF8vVx7AMIEduG9YDxKe1oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889545, "uuid": "58724500-8bff-4699-bd6c-5e53f3194196", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889545, "uuid": "444255cd-f169-4238-8c25-d469e1df47da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889545, "uuid": "b96c2048-420f-4b5b-a49c-3ee7e768088b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f65e21c-c879-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763908326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908326, "uuid": "758d556e-e4f0-434e-bba3-429b1d874798", "comment": "Malware payload", "value": "baadb917c44d5d8a160f0eacbeb6c267", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908326, "uuid": "ee19d495-99fd-483b-bc83-5f2ce9838b9e", "comment": "Malware payload", "value": "27bb5c34e13f01182aebe3cf2074494576d82a29d94e5207bc52726fe1003952", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908326, "uuid": "c653d48f-d27e-4758-927c-64a82aafbf46", "comment": "Malware payload", "value": "d9c2515819434380a30820a9e75e4fafe7f3469c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908326, "uuid": "8fa8a5c1-d969-4da7-bdc3-44a3138f1b74", "comment": "Malware payload", "value": "22dd1a12789cf7fae66bb224d94cb73f3f75e2b8f0a1aa6b6dc2c2a70b130a79f7f86a0ca1e476b29d4add1d9e42d859", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908326, "uuid": "6999456d-a2e4-4b11-bbe4-0cefa4cfc7b6", "value": "T1BF56337601C13D87D09AA3B67877C6044A50FDB16F0E2379B16FAA7482A124EDFF8B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908326, "uuid": "12a4ecf3-052e-49d2-a608-67d139500cc2", "value": "9ecad17161342c5ed0725c6d520c5009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908326, "uuid": "691b7159-f956-4430-b8c5-59bcfe42d789", "value": "98304:mWr94UN8/pZej+Y7VCitf/BqoI+UNLyba9WEIzSpqogqneG/+FuozJlgy7KXK1:mMyK59//Ihma9W3zOJFFG0K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763908326, "uuid": "637ae9dd-1a1b-41e3-ab51-70366cb354ec", "value": 6049816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763908326, "uuid": "f01b1928-d8d2-4479-9067-912c1ecadf1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908326, "uuid": "e6539799-3bb0-4fd3-af51-3662b13230e6", "value": "SecuriteInfo.com.Trojan.PWS.Banker1.37780.11117.13055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763d5732-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889547, "uuid": "8679b904-7a95-4068-a2fb-e48445d384b2", "comment": "Malware payload (Simda)", "value": "66423674a0b7ea5e589354086b37093c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889547, "uuid": "16d59b27-56fa-43d0-9f4f-7aa21d1698d0", "comment": "Malware payload (Simda)", "value": "27c58e4c2d22b565cb7f798ae7536535ceda2d9ba3e51bcde2484595c8cd6766", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889547, "uuid": "c5024b36-dcf7-4042-8989-96591c2894e0", "comment": "Malware payload (Simda)", "value": "431b3a90eb394c0e31c5eaa80182aacfe626ead0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889547, "uuid": "f13fd21f-5017-4273-800f-5532859056dd", "comment": "Malware payload (Simda)", "value": "563daebfb7a86736eb6a8534f2b1380ef40f60ae8dc7d375437520605017f3ff9bb6ad59a150b4ded44201bc4fd1f057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889547, "uuid": "ff9a0c86-9e9f-4552-8e6f-79d38626fc01", "value": "T1DB24124B478E11A5F8131B770AFB0B4773B881A5378AED7B394AA3706C536C7B8A1354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889547, "uuid": "7fe45aef-07fb-4c1c-b4c1-1f75923a5979", "value": "2a1bb0c52b45268a32bea7c08363145b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889547, "uuid": "d514fd3b-ab45-4d5a-a0ac-223a328f8ab4", "value": "6144:kBsKFk5pfANiDyJ3xF4JYK5wf6t0FU29HUYo:k3ijD43xFAwf6t0FUmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889547, "uuid": "0af9b945-8014-4b58-a852-31e913d8bf9c", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889547, "uuid": "f0f3194d-7b20-47de-893b-f31ac135cad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889547, "uuid": "ed80bcac-e35b-4c10-9718-c6ca8235f0f8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d99570-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889548, "uuid": "5bbeceb6-b3f8-4a65-bf52-da7accbb3948", "comment": "Malware payload", "value": "c70886a58566b18ebc12e4557b0cd30f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889548, "uuid": "2f148989-bfdc-419f-8640-b5285ab488ce", "comment": "Malware payload", "value": "27fecaf2cd7ce6037a76cfad760485a059fcf00ed2b176c8df9e2264003dddf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889548, "uuid": "6ba3566b-fafa-4ae7-a898-bcd44ba2a0bc", "comment": "Malware payload", "value": "656cd9b4e19b1b8dabceed5d1e5e33a5f880a1c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889548, "uuid": "f9532bd8-016c-41dd-9daf-59a587bcb244", "comment": "Malware payload", "value": "6a1c65a9fad0f65c0d4b0ad23157c5cdcd7abda8cda04b593554a42107e4a2997f095686c1de5a0edf25c0d590aa7027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889548, "uuid": "b3c5f2ee-17ab-45a5-83c1-9a0d82511ac0", "value": "T16D75231637C29896DA065A3001566E74CDBBDB3C09792409F3ED07077CB4DA2BF5AF92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889548, "uuid": "12622963-d6c0-4729-b530-577155f7adc3", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889548, "uuid": "96fcbd76-b611-43ea-8eb8-534e02fdf125", "value": "24576:v6Zv2ivhBVnFys7xP86LXtqWJ/ej0umQf8/+1gFDsHLAgDmfluSsttObPIDXCRU:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxsTOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889548, "uuid": "0c7445e7-e92a-4516-88c8-cd37f61ba6f5", "value": 1566186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889548, "uuid": "5a7942ca-8bea-4b33-9ef4-0fc682510455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889548, "uuid": "2f982879-16cf-4afc-a25e-b332d369db84", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778ade3a-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889549, "uuid": "d438c6ac-7c99-4917-a5f1-6145ee65a38f", "comment": "Malware payload (Simda)", "value": "1135ff05de8af4aff97869c40d7c9eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889549, "uuid": "463745fb-3b05-47a3-8288-9cbbcf89563d", "comment": "Malware payload (Simda)", "value": "280dee8d9f0561787e299661c728f30c03549845d76d3bdfcba87173cead60e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889549, "uuid": "3f687105-173f-4a02-911e-a0c5ca36bd86", "comment": "Malware payload (Simda)", "value": "9ba190752dedc78c520b5aa89a6088e626a2c7c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889549, "uuid": "642c01a0-dc6f-4d7a-a555-f60d83b52190", "comment": "Malware payload (Simda)", "value": "4eaeeef202ec71de1328d383db9f542fb7f73467f7f69e010bc38a00a77609eaa257cd524f0924a29dc16bbbcac9ac32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889549, "uuid": "792dceba-f19e-4e69-9eb6-9b51cdeb33d9", "value": "T194D423226D5D4E63C6A714BB1BF6FF552326E598132BC7679C00420F0C756C97F3AAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889549, "uuid": "68c51b59-375d-427e-b614-87e57868f33c", "value": "088303a3216315a2ba8d66c94c7b80a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889549, "uuid": "5feeb411-97c4-42f7-84f9-e16e75af36c0", "value": "6144:QmKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3s:a71YpQiU/RcO1VQInVobc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889549, "uuid": "ea89ebca-6a49-43af-8cdc-9dbb88e927b4", "value": 631738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889549, "uuid": "14b9ee1e-6cb1-4ea5-b209-c96d75319739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889549, "uuid": "773eb0f6-3626-4b43-97c8-8ea743e9e9ad", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7826db36-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889550, "uuid": "38b8ac25-4398-4093-b4bb-992cfb572e2d", "comment": "Malware payload (Simda)", "value": "806bdfab1173f8aada9ac10d8cb29e04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889550, "uuid": "46d17f90-29f7-4132-9ad0-ba153cdf5071", "comment": "Malware payload (Simda)", "value": "281eced5dcc571bf7752573b6083f64e359ff5fdf688c7b5417bda8ae4201c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889550, "uuid": "2ed341ea-a1c4-46ad-9d7e-bc22fb1a7112", "comment": "Malware payload (Simda)", "value": "5558b33bc022ec29fad3bed8f816c0ca5afe515a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889550, "uuid": "84a01e26-b0f2-4859-bd5f-16430effe43c", "comment": "Malware payload (Simda)", "value": "95db3a9f7c0e34cb9dab64e0c98fc9765d52cad684ebb13dcb8f84a8e4efcbf85143a1e05a7eb71f384b103f6d794bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889550, "uuid": "8b7f0e20-cf0c-4e35-bf42-88e273af0655", "value": "T1D3C4122B1B2C9933D6550B7B8EE5EB3461BFF5512733D6D30B009A9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889550, "uuid": "4295c3e8-7580-4f59-8772-f178e3dad85e", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889550, "uuid": "5b84e984-1134-48f7-8647-9c856bf82fac", "value": "6144:cZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:qquCuygMQjd5vJIBP1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889550, "uuid": "ceb7bc33-89b4-4ab2-864e-4f7c209cb1b1", "value": 574490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889550, "uuid": "8bb85fa6-aba9-4546-928f-cc0ec79130fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889550, "uuid": "26dee959-0974-4cdb-a72d-2d2afa28e61c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6364f5ee-c854-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763892521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892521, "uuid": "9125a2e1-c416-421d-b0a4-374f4234b1be", "comment": "Malware payload (CoinMiner)", "value": "c11c8769d1728d9d143da6e46ea0df52", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892521, "uuid": "081fb50a-7b99-40eb-942f-f8ecba020513", "comment": "Malware payload (CoinMiner)", "value": "2842a36f783d2b7fec0afce7619177cd352b93e225b356d0b2766f88142443fa", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892521, "uuid": "b21fecd1-0354-47bf-b94a-00c693e98d62", "comment": "Malware payload (CoinMiner)", "value": "4671fcdda13d4ac77e32f3b4f78846b7efcbd18a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892521, "uuid": "486a0f2a-b84c-4d88-88b8-27e6671b917e", "comment": "Malware payload (CoinMiner)", "value": "d4badc7680d31c5889f3dccd4e5c7dc7beea3bd2714979ea76cd9146bbacfae2924f42f5212758411d0cc8b46054dc1d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892521, "uuid": "870621d7-67b2-469e-8e81-311c8915d21d", "value": "T154944B4CFA4790F1CA534870C6AFF67FBB316609C0A5DEB2FBD84B05E9A39215A1D250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892521, "uuid": "f8bec316-3aea-4b85-a443-c6b1150bed01", "value": "7e2775974e6e593008a8e80b1cbe159e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892521, "uuid": "ccd2701d-6763-4f4c-a4c4-7618f7ab9666", "value": "12288:1DpPOexl8M4eBR2DakqphmW8PDIEIY4tco1D:1Vzh6ahphmW8PDI7/tco1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892521, "uuid": "40cdcb1e-66b8-41f5-813b-7f333ba4952c", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892521, "uuid": "11d0467d-6278-4fa3-8c05-0c320d6f676c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892521, "uuid": "e390342f-9bc8-4f50-b36c-ed67266d5b3c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7a55c5-c879-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763908319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908319, "uuid": "1a4324f0-2318-4693-979e-637c5e39134d", "comment": "Malware payload", "value": "75b2875ca243751bfbe0346c332d4bfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908319, "uuid": "6e63581d-42ad-4658-b7c8-9028b8f662a5", "comment": "Malware payload", "value": "2864be4707b6fa463b39d6a336169c4b821f118d2252fcd4199bc40f16e5529e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908319, "uuid": "3fb84142-6485-4bdd-8c75-83f36e14e687", "comment": "Malware payload", "value": "526034ee70f877c4af468ca4b639ad57554e4d8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908319, "uuid": "59a3d49d-a3ff-4fd4-b8d7-6b34c1893783", "comment": "Malware payload", "value": "e32941a5a24198e92e680af3fdf3cc5b73db45efc128fcef6511b64ea3ecdfba35cf0e20f2d0f5493e2b45e6abd8da34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908319, "uuid": "4fb81893-2f28-453f-b0cb-9526f6b0062a", "value": "T15E5633631980B9C7C961437ABC62C4488C34FD358FA15A72F49FA7D6827A14CCBBD6B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908319, "uuid": "ed8b42b9-090e-4050-9541-e3db169cefac", "value": "9ecad17161342c5ed0725c6d520c5009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908319, "uuid": "f963da46-c5ec-4acd-900a-9578177fb0d0", "value": "98304:Ih5EgU3Vuz0qSmvW8c5iHRAxQ/W4pJD25et1yHHEMLuRhf12s:8EzRqSm+8nHqxQ/N1gnEief", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763908319, "uuid": "721d3a07-983f-4695-ac07-72fa6d1e5302", "value": 6132264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763908319, "uuid": "da7c15b2-bf84-404c-b971-ebff81875b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908319, "uuid": "ebd8a445-039d-4d6d-9e2e-37a378c65e3b", "value": "SecuriteInfo.com.Trojan.PWS.Banker1.37780.1739.25938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bdca22-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889551, "uuid": "e3ec8faf-fd4f-476e-af59-6160757d3ba5", "comment": "Malware payload (Simda)", "value": "cb768a3e3f9069ab2545cec400ddb25b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889551, "uuid": "9c6fb244-2466-43b6-8fd7-3f609d245094", "comment": "Malware payload (Simda)", "value": "28aa81b3a6a570c379273db2a0d258fbc1c41b25cc18edfb6a8bba87ce573b57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889551, "uuid": "28b93c4e-01fb-43e1-91e7-b586cf2de9a6", "comment": "Malware payload (Simda)", "value": "18cdf89e78da71281e1cad4e6e1176e46754d198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889551, "uuid": "eaffdbce-80be-4a83-b339-03475df73a8e", "comment": "Malware payload (Simda)", "value": "491657f1a782584941f84edb3ae44f145305e6e30ff97f9ab3bcc5b6aaae7b0c3dcae3c0f423e5ec1e7882aec63850fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889551, "uuid": "bff1fdaa-98e3-42a7-bc6e-e28ea2b4df45", "value": "T1A4941244DA0D51F6C9245F3749BA3F1737B9D0DA834AE6C3A0884568586AFC8FF3A531", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889551, "uuid": "fec100bf-0290-4385-bc7d-61b45de99e18", "value": "93cdf17b0bf4d79b378f492663d563cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889551, "uuid": "86043150-f6cd-4610-bb4c-f601c6c051f4", "value": "6144:XC8okEvTyoZVOgd2QZiw5NLclL5orfQH:SsjCF2QZiOU+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889551, "uuid": "ab913793-563f-40e4-9875-e31b6440a341", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889551, "uuid": "41eb6dd3-0829-45ae-9704-363107493d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889551, "uuid": "6c677501-4b53-40cc-8d34-f38f65ed82b0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf0b6a8-c897-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921503, "uuid": "0b373dd4-10fe-4de5-8ee3-96be6caf032e", "comment": "Malware payload (Mirai)", "value": "68042595150573b6445d4034802ea8ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921503, "uuid": "16fc5228-c700-44b6-accd-04d10b395c15", "comment": "Malware payload (Mirai)", "value": "28ba3f9880e1530c986c241f1de4245ed8c59ee8f67c9a6d9e82f8ccc84fb2a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921503, "uuid": "42bf7bfd-939d-4e0f-99ba-d9756cf9d70e", "comment": "Malware payload (Mirai)", "value": "d140d8adf0dca056c26b28a65a9937ea8a15fcb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921503, "uuid": "532bd0e6-c5e3-42dc-b8fa-b9a366eddda6", "comment": "Malware payload (Mirai)", "value": "6e941fa566c5c9fa2d0fe1a7e5620fa40c4684c864fd56b96e77558e83bab22268e653c046b8703ee6e7339f6d0dda84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921503, "uuid": "d0d063d4-e320-488b-8771-984943c32808", "value": "T13C13E1AC2726A6DBE161C83E19BD03D1195116D3EE025D0F60B19AC3799D4FD34937CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921503, "uuid": "54777187-efb8-4e5b-b276-5d49ace3959a", "value": "768:xKYPJlO0J+8JoLm4eyNfGzr5+4gY3G6Ywno4ZygD7hmUalc3rJgGlzDpbuR1J8:xjlDILm45NfGzr5+sYwo4z8HyxVJuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921503, "uuid": "7dead0f1-9e16-46e1-be11-75b4d89e5544", "value": 43328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921503, "uuid": "40e12baf-c159-4cae-8972-17f21567fed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921503, "uuid": "72e99d11-f108-4ad8-89a7-d7f0038a1601", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4654055b-c86f-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763904069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763904069, "uuid": "2bc118ed-96fd-4433-a971-c80ae051d596", "comment": "Malware payload (Stealc)", "value": "11f5a03d8cd6bba25e90eaef26fc0c57", "object_relation": "md5", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763904069, "uuid": "a5480b58-db82-43da-adaa-eebf6c72443f", "comment": "Malware payload (Stealc)", "value": "28dcbc30cf9ef097c0b631e26d84f6020515a74ecffd1a955688447e78a23d3d", "object_relation": "sha256", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763904069, "uuid": "d3094d20-0564-4c6d-b633-4a44b127b469", "comment": "Malware payload (Stealc)", "value": "21f7b20ccd291fb84a440fad6767279a36a51335", "object_relation": "sha1", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763904069, "uuid": "36c68b58-6d74-4fbf-a860-714c0c1edbaa", "comment": "Malware payload (Stealc)", "value": "a55e264d94413b06d71d777eec2affb08f72cce0f3fcc85beb1cdee555877e94ad95e9d4a4304cf22bd295f67f692867", "object_relation": "sha3-384", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763904069, "uuid": "7196cab4-f093-4989-bde4-589e71b7fce9", "value": "T152566C5A7EADF4B4D0A5A238C4A651D2A6E1BC085B3267C31F703D382D76BC01936FD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763904069, "uuid": "ac4f4dea-a219-4343-b0e4-423155029626", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763904069, "uuid": "ff781578-5556-490b-a8da-1bdee3dde2ba", "value": "24576:/cTvsh262tZlLdgwRTlMEAGnOQ3Z+11as8DNZG2wKNjCTGEzscUTq6o:/cA46alJVRTl7A0OQ3ZM78rGz3O7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763904069, "uuid": "57a22454-89b9-4ed0-96f0-48c5c590289a", "value": 6111456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763904069, "uuid": "f765b0f9-9d96-4b39-bb81-f3819d6b3abd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763904069, "uuid": "15eebe11-7109-42d0-a000-bb2d38c9149f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796447d3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889552, "uuid": "9b4fd14a-a0ea-4972-91c5-c1b877ed90d9", "comment": "Malware payload (Worm.Mofksys)", "value": "259a3aae7a612b9a63cc422733917d2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889552, "uuid": "6be1e56c-03fa-45d3-801c-bb0c461da917", "comment": "Malware payload (Worm.Mofksys)", "value": "29589733de744d4a2d3afc7c7797a2d11633ba0d338d614a7917a757b03f2f86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889552, "uuid": "86fc445d-5bff-4b32-809e-0788b928977b", "comment": "Malware payload (Worm.Mofksys)", "value": "c0dc7cc32c155293a95ccac80cce5b55189ee8f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889552, "uuid": "4f0d9543-4223-4948-9b09-c0376b951443", "comment": "Malware payload (Worm.Mofksys)", "value": "08851bfb0200b5d15d9f5093d6ac135d755be1716697886df87c1d5d1511fe16f164c4efaa96885a4edfbcd77d5efcd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889552, "uuid": "de133975-8562-4627-bd30-ae3bdcf5c311", "value": "T1D424C76BAB04211FD5A385F01573B2AA7A252D221BD19C0F67D1AF8A34B1523B1F532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889552, "uuid": "f18c5dc5-b0d1-48ac-a50d-adb5b6af2a22", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889552, "uuid": "98879e05-6cf2-407a-a61d-65b0cb472986", "value": "3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unP:zvEN2U+T6i5LirrllHy4HUcMQY6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889552, "uuid": "bd8ef590-8ce1-4e35-ab11-d34216b9f185", "value": 211895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889552, "uuid": "abfc50fd-6585-421b-8533-8f857ce16b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889552, "uuid": "112056df-a4ff-4a09-bc98-a7e00cb9a2b1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f9e0cb-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889553, "uuid": "999050da-ea13-4b54-9adc-51a2359e387e", "comment": "Malware payload", "value": "b607d9771aecb28af5e4f8e647ab7671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889553, "uuid": "6d1450bb-5af8-46b0-a17c-9d46e9defde7", "comment": "Malware payload", "value": "29637c77dde946cb0513d4e6d711d104be4267f747e74c75923829a7f5764712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889553, "uuid": "ec6da013-9b25-468b-be76-f7a769fd0927", "comment": "Malware payload", "value": "a824f19a17f3659d878bda9450f5051c2cabaf4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889553, "uuid": "18a104c2-0ec8-444c-aae4-f7ed17e7aaa8", "comment": "Malware payload", "value": "ff40ed63208b2ba04b0ad157451d8c1b047d66c94b914dc5da5f5bff9ced864baafbf35d094197f7fe12edb2a18f6224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889553, "uuid": "9b60ea5c-e3f6-48af-9fd0-fabda0029edd", "value": "T1C774D07373C089F3C846063102A7AB768EB3F97A29724857F7E45B276C749507E2AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889553, "uuid": "e4b3b02f-df84-4d3b-993e-9d67ec38d7ff", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889553, "uuid": "2c3decdd-1f85-4f17-8920-81007b7cc2e8", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5Tw/oPQ6pHux/f0IYRNN:BtKe6YiDdv3m3mgKHDjSeL46pu938D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889553, "uuid": "c93afae8-b03c-40f7-8750-c623d9ff96f3", "value": 366043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889553, "uuid": "1a2c9caf-581f-4a63-8401-c945623c4048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889553, "uuid": "88adcbd9-7ad8-4e8d-97fd-5ac3546f1c9c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8f6daa-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889554, "uuid": "895c6f3f-fd0b-4e24-927c-890b57e959c0", "comment": "Malware payload", "value": "01a18724167da8e568648720864dca7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889554, "uuid": "08da36b7-f49b-4400-a497-0204919f8e07", "comment": "Malware payload", "value": "29a5ad3950e2d9ff4a75a5061525eeeb021723ae554a07b64777a745defde198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889554, "uuid": "8a9c4fb6-d648-4ac4-8d0d-6a80622ad4e6", "comment": "Malware payload", "value": "e6add41956f293fb25d7f39495117bdb7266d6d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889554, "uuid": "bcf5373b-c861-453e-a2ff-1febafce1130", "comment": "Malware payload", "value": "6dd4f193cdedc54e1e39ce76ca6febb4d8df06294242caa88095992fa83d0f15a1ecb7dcf0e174b16da12885bc3b6f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889554, "uuid": "00f88aa2-bd38-4887-8041-db731ee64a96", "value": "T15914E847F60281B9CA38C537A561C2B25F257E75AA63CA3F31513A2B2D79B001D1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889554, "uuid": "1a188376-8925-4bf2-a427-296bd65b76fd", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889554, "uuid": "cd6019fc-e9f4-4395-ae18-980f821b8196", "value": "768:5UKxW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAar4PzpyRAJ7IwnDoSdk:5UKHbC4Bk6lMTOWk4PkRAPo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889554, "uuid": "d7f4cde9-0831-49a2-8427-1d3a2438f315", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889554, "uuid": "f50985ab-4a81-4021-9b0d-6d2bdb1cb44d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889554, "uuid": "fdee16bc-1576-4f20-a82c-053011cf7ebb", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cca9f3-c8c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763941543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763941543, "uuid": "fd073de8-34b0-4ed6-940d-17b52a089df2", "comment": "Malware payload (Mirai)", "value": "521419d2dbbdf8e3b01f565dd4530cf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763941543, "uuid": "02f9c5b3-4749-4fc4-8609-203cfa3a2c73", "comment": "Malware payload (Mirai)", "value": "29a92b02014f4221eb95284af5341d522e02ec8b9dd4687ac03c873342789f7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763941543, "uuid": "4f6c61ef-a368-419d-92de-766f33f0dcfd", "comment": "Malware payload (Mirai)", "value": "7afdea27f7978bf19a8c46d6046b2abb87e94230", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763941543, "uuid": "12d26734-2603-4df9-877f-fd732d048902", "comment": "Malware payload (Mirai)", "value": "8344d1d7cb4228a425cae41b9072faa93f9d046d8ed05387c51eb15d52599a3c1ad06010373a39f9e4f79658bb0f6024", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763941543, "uuid": "34fe09e8-24a2-45c8-83e8-bfe5242eec5a", "value": "T17703184AB9818903C9D46377FA1E42DD3B56236CE1EE3303DE166F617BC792A0E2B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763941543, "uuid": "f428117e-2462-439c-b66b-5e291b03f290", "value": "768:sUvTq0n/p9FKpU9ewoQo7aIFjb97i60aw8wdEOvrxIQD8w6:/vTJ/fQ6HZotbc6jw8wdb9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763941543, "uuid": "08998621-11a5-4b76-89af-5b555128313e", "value": 38540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763941543, "uuid": "065d71eb-82d3-4802-be15-aa4a5b010a46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763941543, "uuid": "511751fa-d6da-447a-b84a-0becb03cb22d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b21b4a4-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889555, "uuid": "033b737f-809d-48a3-b08a-8f6e4df53b16", "comment": "Malware payload (Worm.Mofksys)", "value": "9707557f147e16c10de80f99fd48c1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889555, "uuid": "82d066a2-845e-4edb-b4a7-e64ece1c96b2", "comment": "Malware payload (Worm.Mofksys)", "value": "29d5293a2adab76c0839f0d6af459a7cdd9d1bb0088359548e09c8eac4ef55ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889555, "uuid": "15016efe-e902-4753-b426-ee98302f34a8", "comment": "Malware payload (Worm.Mofksys)", "value": "420c18e6377134ade39a5ed35c3fc2e21f26ef71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889555, "uuid": "3b83cb90-985b-48c3-be16-f6422ae9b9fc", "comment": "Malware payload (Worm.Mofksys)", "value": "58d43a2ccc884078dbd2762787cec5cb60fa07375ad6c94250fdb1038b5c2780986d94d523e2ad1a29866cc9cd021d03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889555, "uuid": "26c7ee8f-7afe-4d5b-8def-08acafea1a0d", "value": "T13724292BE914301EE8A79AF1882271A6B5256F720BD1AC4F67C1AF453878423F5F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889555, "uuid": "2fdb4526-4b9e-464c-b303-9dfd690b3887", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889555, "uuid": "babdaa39-2ba0-4d0f-9253-0544fb72a896", "value": "3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unJ:zvEN2U+T6i5LirrllHy4HUcMQY68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889555, "uuid": "28e65d98-f3d3-442e-857d-a3491bc3710f", "value": 211804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889555, "uuid": "7a096e4d-dd30-459f-b714-3bf7e49107cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889555, "uuid": "92f1cadc-064f-47cd-b7ca-4662f89b1aea", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb5a320-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889556, "uuid": "5ae04bd5-3e79-4bc8-ab70-97355c5b91ab", "comment": "Malware payload (Simda)", "value": "6887676dcdd9ae263372c1bd6a405d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889556, "uuid": "dc5eab18-9278-4dfd-8bd4-cc651d4cbf64", "comment": "Malware payload (Simda)", "value": "2a80c926d5f2ea22e6064c4c16aa37e1ef9ed60e6ddda5a6e724451f68163bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889556, "uuid": "4b04a031-b254-4cf4-8a11-c8e75364a1ee", "comment": "Malware payload (Simda)", "value": "dc91cb48cd867eac86ce7d4fdb6abc430a8973c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889556, "uuid": "0af4ca40-09ae-4272-a82c-4d63e9b7f7de", "comment": "Malware payload (Simda)", "value": "92039fa195807c8cb076cfb5a603ab3ae3e1f49061b91d8eccfe752d931bb64c0273f8348784b53947ee245356ed868b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889556, "uuid": "a0416b87-ef58-4199-ac8f-7de907f36991", "value": "T1AFF33926E04544B9E5E0127C65BD3B9240BF6D74972C2CE37391AAC91DF82E37A7831B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889556, "uuid": "063d57a3-4f60-45cb-a90e-4a84d49e8a97", "value": "cb59e9f2348b37e98c5e9c617c66b271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889556, "uuid": "a35bad45-0004-4d1d-aecb-4916ee3ef8db", "value": "3072:QeLIjyYsAq/C3RCzgJHvNA1PpYfFL6zU+BEfi:DLIjjqahUSPe1SZ+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889556, "uuid": "31cf6f63-d6d6-4819-952c-7d1bc717a120", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889556, "uuid": "d62dc39a-4f15-448b-9daa-63ca8a5bd353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889556, "uuid": "9cc15cd0-ff55-4a5a-9c90-8d82db633a9e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c57981e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889557, "uuid": "021256de-b2df-44fe-8954-c71ea1ee3ad6", "comment": "Malware payload", "value": "0fe4a43a6fc2f990a1e2c24649d6d37d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889557, "uuid": "37e15423-f43e-4de1-8090-d19ba5a7f982", "comment": "Malware payload", "value": "2ab0b0e24dba5cb26822ef6af18b8385d99e8aa8fe515f34a84be7857fe573ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889557, "uuid": "78a3855f-b0df-40e9-90c4-07bbe4882c23", "comment": "Malware payload", "value": "ae124625be62606bc3110b0c63ad79eab4fe430f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889557, "uuid": "021666d6-a178-42e7-b75d-2b856ece07b7", "comment": "Malware payload", "value": "74bad96b0147f8fb176ddc31fa66c62ce740ab7323161bc0d848aabc5a9a47294b639f4efb75229d483fb9cd31816628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889557, "uuid": "b309e8f3-78bf-44a5-987f-9dbc1ae3b38c", "value": "T1C7753315B3D289E6DD07263001516A748BFFD73C1AB92416F3E85507BCB58A2FB2A7C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889557, "uuid": "298a3b55-70e6-463d-8115-8aa7488b5c26", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889557, "uuid": "df2f4407-fc59-4810-8a13-a6e5a0cad60f", "value": "49152:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxTspAe39SV:82kQCN/JT/kgFWLa6v3gV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889557, "uuid": "8d8b9698-c96c-49d6-be10-b3d6bb6f0df6", "value": 1684682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889557, "uuid": "04408a7e-e7ec-4426-bf86-8b70f12680ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889557, "uuid": "a04dbf0d-4eea-4b79-8fa8-866f29b55a96", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf076b6-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889558, "uuid": "d38347a8-f257-4f96-9922-eb006b6614bd", "comment": "Malware payload (Simda)", "value": "404eb39848c54641c6bdfff751268d3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889558, "uuid": "496902f0-e6f1-4a32-beb7-5c91856ca33c", "comment": "Malware payload (Simda)", "value": "2af32e1033a08f11e85a90fb74c4a18394e4a759545278f00f0b90254f47eaba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889558, "uuid": "5df88392-c827-4e86-bdb5-a7fef7dbb4aa", "comment": "Malware payload (Simda)", "value": "e37ee66c460e55f9503765db90c51064cf4df7cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889558, "uuid": "22d32104-79b0-498f-8483-0091b24cfaaa", "comment": "Malware payload (Simda)", "value": "18616e9ac87cf5b0a9c4f9a55fbdd3c92f48be6afcfdcf7547a868e29538954de2caa29e36baa5e47b43140f3c51b4c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889558, "uuid": "e710276f-c712-4f4e-b606-24caac702abe", "value": "T19E84011573D58490F0B00B30227AE9851BAC825616D2937E3EC906DA3FD525BACF3BDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889558, "uuid": "e9b11999-69eb-410f-a773-b4bcc4b36359", "value": "55a510ff3441aca1de0a1cc299b2a8f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889558, "uuid": "56e82190-fd3f-49bd-b5cc-4190aa6479a7", "value": "6144:SJcxlKhSGoqTecGy9+hAu7//QnSrMhcZEp:SS8hbTiyqA4QnSQhcZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889558, "uuid": "93ce8ac6-61ac-4fcb-b6f8-c74973c9dfa7", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889558, "uuid": "ffdfb953-5a26-4680-b148-b15843064e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889558, "uuid": "c35c352a-7eb4-469c-8916-2b78d00ad4c9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d908a78-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889559, "uuid": "94334fdf-d098-49a8-994a-97120e274ec6", "comment": "Malware payload", "value": "1836d57d33db26277e60ab4c8fdefde3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889559, "uuid": "6d4e79e9-1fb5-416e-a3ec-77415797c22f", "comment": "Malware payload", "value": "2b6a2dbbac84f8d68a4b73641da1ece40592425cec81cafc867701166ff2a379", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889559, "uuid": "f0b78fd3-3667-46da-8c0b-6fd5b1bca8c1", "comment": "Malware payload", "value": "cb5a7dc8a45995ad8942ffdf92fdf6cd55969c8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889559, "uuid": "2ddb6ed5-67c5-4d56-8f35-b7731d5287ed", "comment": "Malware payload", "value": "f579d3c4001f62c7e5697307bb64a32ed5e4d2400bf6f0cff16db584f00c2b30412845d1f3be1ad4aec00f199f958494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889559, "uuid": "021e5b61-acc4-4a87-bb19-c5de4441016b", "value": "T1F035334E05C33755DFF9A3B28D8224E5256337E857A0A829771CE0CD03E36599EF816E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889559, "uuid": "30e6d944-3809-479d-bbe0-14a2be95dd41", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889559, "uuid": "dcf4bb08-ee57-4f78-869e-3de2d6662ba0", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFtiE6ALmOC:+YhQs7tWVToP0Hs0/htDH3pGaFPiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889559, "uuid": "edb68f3d-4a56-43f6-8703-d384df384a7a", "value": 1145904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889559, "uuid": "db21741f-0be2-49b1-a723-50d415de7d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889559, "uuid": "24446bc8-0dd8-4265-9ffe-ce6b98d01318", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e231d84-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889560, "uuid": "f66fe95b-b5e2-43da-9a98-2910fae766f5", "comment": "Malware payload", "value": "5f309a8739a8b0052dfcc11a1361c445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889560, "uuid": "237b9ff0-8c16-46e0-a56f-4b2da4d699e7", "comment": "Malware payload", "value": "2b725929f18d5ca6b7f21ebe0d9aec6af7710f07ae4ae4d078c83b4bad6ee3b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889560, "uuid": "e6ee4469-8d65-4ddb-9895-3029178d27c8", "comment": "Malware payload", "value": "547739d3bf6863fb6de44a8e8b4d4a511c7d56b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889560, "uuid": "0b01d236-981d-471f-8abb-1387f8e8d13e", "comment": "Malware payload", "value": "bacac636e463f8351c25031df1ddee07cc6246bd2906c40616bb9ed4e1bb393e3b2161630bc9b60c65e72ef86c0deb00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889560, "uuid": "ad31135e-ade0-45dc-935b-d691596a2759", "value": "T1D4D3E7277B10542ED8128DF068B7EB6EB9226E652BE06D0B7353BB107A7110376F521F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889560, "uuid": "b6038e15-ae8c-4db3-a0a4-2a84406509a2", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889560, "uuid": "89e6b447-8dbb-4c8d-a659-61e2458d6c88", "value": "1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVu56:UVqoCl/YgjxEufVU0TbTyDDalY56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889560, "uuid": "e352d254-dfb5-4cbe-a4fc-fb0a1bbe0b24", "value": 138492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889560, "uuid": "d1ff423d-54f7-4914-b1a3-44a61f4143a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889560, "uuid": "f0d70491-cfa9-4106-9eb9-6fc6e7712357", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2710e2aa-c891-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763918619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918619, "uuid": "a4dea9b8-f795-45bc-bc2f-939f058c4396", "comment": "Malware payload (Mirai)", "value": "1a5ba25adc38db31569cde69e933e3f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918619, "uuid": "d2e005f3-674a-4fb3-9005-7d0e383d70f3", "comment": "Malware payload (Mirai)", "value": "2bd87e9554f51fe80ebf48480ee003c7c3594fe3045256e413d896b86fad8591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918619, "uuid": "23644c75-5230-4282-8eb2-52057faf08ac", "comment": "Malware payload (Mirai)", "value": "7757f7feda9aea14dd11ae6da2dd0e14449c46db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918619, "uuid": "0408cc77-5fcf-495c-a096-774b4eaea98e", "comment": "Malware payload (Mirai)", "value": "5ea64114ee4eafebdece7211963a673a5bedfd3f8e08b5d6da02442c52acf4786b572c5446ab476614a98962e6fbcb62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918619, "uuid": "0e441880-0822-4a32-942c-6a1062cd6c01", "value": "T1F293E60AFF614EFBD86FCD3706A9074525CC559712A53B3A7574C82CB64E24B0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918619, "uuid": "7b50d3ac-db9e-45f6-8fd9-ebc3bedca7c9", "value": "1536:xhRREyTcG+r5SYM8M5BKyjnaV0YZl551T1ZqlIOoCeX01VR0DZ:r3eG+cfjnZY5eIc1n0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763918619, "uuid": "15993237-1b4c-4456-93f0-19937a4f5d4b", "value": 93460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763918619, "uuid": "d5e06a6f-9af2-4a64-a3bd-5da663456e73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918619, "uuid": "963430e1-e9e9-4f55-a325-8a3a41847ba1", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b07b3f-c852-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891507, "uuid": "8f46bf8f-251e-43bf-a991-832a1de75f86", "comment": "Malware payload", "value": "a14f59d62a05e412c6c9bfa80f206bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891507, "uuid": "9b87b885-838c-4442-81ca-1434fcce9ba8", "comment": "Malware payload", "value": "2be8f194309f20711a7d11c90a2efdc83e12ffced7e06854808b8502bbd2ec7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891507, "uuid": "2922fcb8-8b91-42e7-85c7-fb39e21a3308", "comment": "Malware payload", "value": "32b9dd4978675e3918b70c4484730a90d2460f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891507, "uuid": "041ee46b-a4b9-4e4f-8b19-6cb5e2a6e267", "comment": "Malware payload", "value": "82b21a54304b5dfb299ab629ec55684e46bd5c9a23b6b95add8674f9fbaa87ccb282cd06cea22251c38b388fdf6d1567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891507, "uuid": "14367225-4a58-4a83-9fa7-cc674a602afb", "value": "T17355233632D198B5EE934E31020E1F159EB1A7261B2AE816BBD47D2728704F2FC76761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891507, "uuid": "3f358f07-e9df-44f4-b16c-73555e427df2", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891507, "uuid": "603d199a-f358-4fb0-b72d-ae4ebf1944f8", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iWtPWnQKPl:qE27hQs7tW2zku73bFgVlRlbN01TQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891507, "uuid": "2d49b9d0-a241-49dc-8275-9b3602fdb124", "value": 1312142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891507, "uuid": "09ad51e1-6b53-48f5-b3ae-f81c0d6a3d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891507, "uuid": "dc66d6a4-a397-4a13-830c-7a21564acb6b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb2550b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889561, "uuid": "04100b86-8fde-443d-b4f6-a796ad8fb98a", "comment": "Malware payload", "value": "d2b2ec509ea58481b19f7410ea60a2c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889561, "uuid": "cd06b870-e335-4648-be14-b59d1312d1fd", "comment": "Malware payload", "value": "2bea0a674925629c6b289a6002b42f117ca46acc67900254b4edf84d8d87d6d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889561, "uuid": "17eec5b9-dece-4c58-aad2-36e412379851", "comment": "Malware payload", "value": "5c64b33deaee074101d9d5aea05a8c34b2e8de71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889561, "uuid": "9f0c38e5-73cf-46eb-bf31-d4b7bbbe8af2", "comment": "Malware payload", "value": "4daddbd9b68c0bc9fcd084ecaf697967a83615f25458b07284cf569811349a3fa261d55115d6d87dcd4617498c45a0a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889561, "uuid": "2bdc507f-a384-4ff6-ba42-eb785cd92718", "value": "T1FA031A497AA8C52DD67F4B7C75B307200372A30A5116EF8AACCC5DAE2D6772408717EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889561, "uuid": "90eea640-f7a8-4aaf-be4f-a04331d94f72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889561, "uuid": "6edbf0c7-27da-46a2-85e1-df4b6fa4c2b3", "value": "384:txysR3YvGc214dHRjQxqmlTW4gCwL1gb+PiGkxiyVjL:twNdHdi3Iv1gbJ4yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889561, "uuid": "0877980c-a555-4133-94aa-458f9972ae8d", "value": 40972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889561, "uuid": "df863f9f-0f2b-4522-8475-775282c3aec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889561, "uuid": "b3adb517-51cd-4df9-95d2-d80cb4635e15", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f48515d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889562, "uuid": "cf24aa8c-fcde-4af6-9d82-6edf5ecb6966", "comment": "Malware payload (Simda)", "value": "a260f73fe48b57dc591dfb87c2ac2afd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889562, "uuid": "5ced9cb8-ff37-4e30-a5c8-0a5f9e2b6bb4", "comment": "Malware payload (Simda)", "value": "2beb19bcc939377189f8da4748a0e0c9c9a7ffa8ea850a9455c072973e5e62c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889562, "uuid": "0dd1cd18-81a8-40b2-85e2-5b38af250d3e", "comment": "Malware payload (Simda)", "value": "8ac58aafb56c2fc26ced71b321297f71cc6e365c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889562, "uuid": "d41f96bc-16fb-489e-b9ff-3d9c3cf4b06b", "comment": "Malware payload (Simda)", "value": "61e665c7dc881a52cd488e1866e1005185d6250076be0631906b39833c97dfa6f23c2addfaf3e9f0dfe2c05fb27b41b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889562, "uuid": "f98a3d33-98b7-4b6b-9496-90ef56a91d2c", "value": "T17024124636452966D7E15CB7A1CAFF12D7B9C3849BA0E32BB450CC2C2FD27A03E2145B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889562, "uuid": "6e41f087-1c62-4589-acdb-5ca85c516725", "value": "cda83d02709aa3122667a945a10f311a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889562, "uuid": "a3de3feb-9992-4f24-b57c-16e6197db296", "value": "3072:4Qcjk9tVRNIcjb4Ryfjijjx14hdeCXHKPJFo9zpE7Di0X0JuLL+o7BlpF9e:4Qh9tVRm2kh34hdeCkcG7DEALLlnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889562, "uuid": "76df0ca6-a610-4baa-b8b9-d964ec5fed67", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889562, "uuid": "b470f33f-9a48-4c1a-8ddb-e355f26d82ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889562, "uuid": "1babcea1-2e84-4801-80b5-c7ab82820f52", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe241d0-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889563, "uuid": "970e97f5-d276-4dd1-b7fe-3d75776338b8", "comment": "Malware payload", "value": "83f4a9924dc1b38bc32ad38e0ed2a953", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889563, "uuid": "9db28da8-428b-4320-a978-2646dc5b7bed", "comment": "Malware payload", "value": "2bfbf3df08798c87696ea1236cd7d20e1c91819e157d57b17b7a259db510914e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889563, "uuid": "4f165d70-856e-4360-a3d7-1459a14e5844", "comment": "Malware payload", "value": "ba229b1df4a30d7fcb7b291916c8ac4a0147f1e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889563, "uuid": "3e040f87-1ab3-437d-90de-43590c125da0", "comment": "Malware payload", "value": "15f432471ca2516bb6a032e990712f3130d773246432c414bcff62fb50ab61efcc1271fb38f5f1ab653fc66ec5ebc07e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889563, "uuid": "50392b35-1ed2-42ed-9f17-dc2ea93055b3", "value": "T16A13E1409FECBD39E8C329798CB50D035B35EA17D06AC357A0E061CE99B594398373A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889563, "uuid": "569974b4-251e-4a73-856c-d42e54b2b0c3", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889563, "uuid": "1e7e8ddd-fa92-4a23-8baf-8d7b09bac554", "value": "768:gyz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D8888888888g:hzOCay4wV339rPjzbpLwRJ9pSdoIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889563, "uuid": "dd6f75e6-7385-43c7-9fcb-ec76daac14de", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889563, "uuid": "a0cf60db-bf92-46ff-81f9-049053e2f9a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889563, "uuid": "a3de5095-7d0e-4f10-83f4-cbe80d508fa1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c62563-c85e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763896840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896840, "uuid": "0190ea56-e8ab-449f-8034-36d8a164b8b5", "comment": "Malware payload (Mirai)", "value": "47a5f4635df17fa1956b6f6aa015676d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896840, "uuid": "a35966bb-dce7-4464-a2e5-de569b721536", "comment": "Malware payload (Mirai)", "value": "2c0261e6a3590e3554202116c5398637d0d7900895646d0aaf46d117aadd1612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896840, "uuid": "aa71a049-72ae-4127-8d15-7b09a89f38d6", "comment": "Malware payload (Mirai)", "value": "7d91ae727afd1d2e787c6e894a262eadf07dd58f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896840, "uuid": "b393965b-7a05-42fc-9b6d-fc226fe50eb7", "comment": "Malware payload (Mirai)", "value": "509a64c15c6f7ee88640d0e8476111ba13bd949adcbe806940b18173542aa7616b466a81a3a44dd2a0aedb41f334da8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896840, "uuid": "81413563-8cab-46aa-a459-40cdd9e20ed6", "value": "T1C8D43845F8809F61C6C539B6F74D42A873074BB9D3EB72069A245B3437EB96B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896840, "uuid": "a80e49f1-fb63-48c7-81d2-02364532cb86", "value": "12288:dalNCw/CGpBsxr2D9v5iyZCBVZSVhCxmJqoe29daG8pVkC8:QXxCGpBsevdZOVMDCAJH3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763896840, "uuid": "9fb61415-0c3d-4d14-8193-186a23ef2692", "value": 600280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763896840, "uuid": "3e03b9d1-2e2f-40bf-84ea-bddae8be0777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896840, "uuid": "e749381e-5b57-4754-a45b-6f52bd99d91a", "value": "Mddos.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8086c492-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889564, "uuid": "e1e3cd23-307c-4d38-bbc7-63aae32dcdb0", "comment": "Malware payload (Simda)", "value": "6ba3b26d046cf99ac7944192db380a5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889564, "uuid": "3cd9832b-2223-4ebd-9740-f95a4c631960", "comment": "Malware payload (Simda)", "value": "2c2e74c219be5698372888cca337abaed31d50b438596830d4c9043c04d6dea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889564, "uuid": "0448b327-895d-4e65-b355-4aa638231dcd", "comment": "Malware payload (Simda)", "value": "c587abfba3d34535795c09f2aff40f74434e35c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889564, "uuid": "8f4c91e0-7ba9-4e48-8dc9-a647b9be8a19", "comment": "Malware payload (Simda)", "value": "80aa233748bdbb389329bd0d4898e0296a8b2850914d49359a16b7b217ac9f13b14f113d5b3baa39bfb6a5e2d67ee872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889564, "uuid": "c1e5ccd3-3757-4c87-b464-0c422a5bb6cc", "value": "T11F841213ED55915DC0710132BCB6DBB66D7FD2B9166202FF290C160A2EEC6436CE9ACE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889564, "uuid": "d18b820c-d263-424c-b647-21020e63d62f", "value": "562bef84679104f4bb60284c80d2d238", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889564, "uuid": "ca8fb04d-13c7-40e6-b883-4fee6e4cac20", "value": "3072:cOJM8BUIyMh/fuGk4SGkjyu3wMD32onjlWnrBJke78ilZHMOke7QezadcarPCYpx:eIU9MheRXngMDmgV2Mk0JcRYenA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889564, "uuid": "1e4e5ab4-a537-4d8a-ac8a-49dc4ce0c909", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889564, "uuid": "d862c21c-ab49-4ce9-8fe0-e580c9cb162a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889564, "uuid": "6c270d12-8d9b-4cc3-826e-fafcac1e83b3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8141788d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889565, "uuid": "64ffad56-8fab-4d1c-bfc5-8a14f1aa50dc", "comment": "Malware payload", "value": "63b6d8f649c335427cf2f710ff7de33e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889565, "uuid": "3a2e527d-ca99-461d-9708-065c83672e49", "comment": "Malware payload", "value": "2c713482312cc964fb2e67543d841b2b02fc676eece65be7bfb51bcfeb976b72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889565, "uuid": "4de36013-2f0e-4ec4-996a-5cd04d294e45", "comment": "Malware payload", "value": "430aad3319f54eee80f5bb696ea7eca2a02296aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889565, "uuid": "fd889927-a3eb-4e7a-bcc3-d3cf1a44041d", "comment": "Malware payload", "value": "c168711a92eb004c848099016d029fe42f0537384956428d9822220c6ebfdf4ed6838dfcb69d3bb786045b81882b0f5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889565, "uuid": "8a2391ab-f2e5-4b4a-922f-f812e71d11e2", "value": "T1BF75332973C285E1DE1A273101526E708FFBD33C1FA52416F7E91507ACF9462AB6B782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889565, "uuid": "e821d955-339d-4321-871c-fb98479a6325", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889565, "uuid": "168a6bab-68d7-45e9-a209-7c23e76463d2", "value": "49152:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxTspAepbubzz:82kQCN/JT/kgFWLa6vp6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889565, "uuid": "5f8931a5-58c0-4a81-9aa2-f07982b90247", "value": 1652133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889565, "uuid": "df0bad59-e42e-4cec-9bfe-521890b3a5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889565, "uuid": "9f89c3fc-9c66-4570-93ad-2d9e3c9e4821", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e5d86e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889566, "uuid": "fc93ac76-856a-46d9-8760-c201818d2e4d", "comment": "Malware payload", "value": "9deb986831776e64c6315e806b397df3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889566, "uuid": "d34f6428-39a9-4133-b7eb-a5bcbf3d1744", "comment": "Malware payload", "value": "2ca6cefba27f55f3acd61f1a6f508bc0dcdbdd4170280bb8914d34a74e70a879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889566, "uuid": "05987bfb-9500-4870-981e-c21dd27460cf", "comment": "Malware payload", "value": "698a72016ba5951ab82906b8a115c1415fb73dca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889566, "uuid": "ff749e21-c1cd-46e5-8481-0981a5ae903a", "comment": "Malware payload", "value": "a0607557fe87dee0972b4966827b7fd060866d1a75962676e88758cd4521dead550653d9e5d427e120387e749a091fab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889566, "uuid": "c160c8eb-7e94-4bd4-9906-101b86deb91a", "value": "T1D5A5E162E1831935E3C09737C5BAB83693CB339A469BC418D921934348DEBF531F69E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889566, "uuid": "e5fe8d5e-4129-44b3-a72f-dea35e57b36c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889566, "uuid": "37213972-03bf-42a9-93ad-b5e3637050aa", "value": "49152:uEJGsPtEWWBsgoZVbD8OGSK7qKmgy0BKW6rKN:DVEWWBgZVbDVEeKmX0k7KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889566, "uuid": "9111f718-9b75-42ab-9487-03fced001a0a", "value": 2131034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889566, "uuid": "ef03e544-4d85-4187-96b1-83a1acc6cf50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889566, "uuid": "7f568c10-c637-428e-b149-f67702c19d89", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8279201e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889567, "uuid": "d0c85c34-4d17-4f8a-a10d-9040bed62336", "comment": "Malware payload", "value": "42e113b0a53e362fd8740393bbfdb1f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889567, "uuid": "477abcd0-8925-4df1-81b9-8e78f3d63a31", "comment": "Malware payload", "value": "2cb100f47edf3a5fb44aa05ea16efd8f9f8a4be0f5d23a7a0bad285853d7d895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889567, "uuid": "f4f81afd-c9e4-4240-acc5-b4724ad9acca", "comment": "Malware payload", "value": "bc8681b623bdc1d8988fd5d88f579687084cb364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889567, "uuid": "c0b6c63d-5187-4f95-a0be-7f28904a0375", "comment": "Malware payload", "value": "f1fab072e76244b8b02e42fdcfd76a15e0aaea5cab0fb358d0da97b6d931d8fcb42aecac5ac7791ee1dd9d4dd4962b9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889567, "uuid": "d34b6cfe-b76b-491f-9087-35a9185eadaa", "value": "T13474D07373C08DB3C846063102A7AB768EB3F97A19724857F7E45B276C749607E2AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889567, "uuid": "6734c357-e21d-4e51-9722-b1fd38c52a86", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889567, "uuid": "b33a6e02-8705-4f01-8105-01f245062bcf", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5Tw/oPQ6pHux/f0IYRNnB:BtKe6YiDdv3m3mgKHDjSeL46pu938FB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889567, "uuid": "6103b8c0-0833-4051-b976-187b76370d77", "value": 368994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889567, "uuid": "e0ebbc61-4130-4ad2-8053-c1da1cf424ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889567, "uuid": "0f6b21c7-b4ca-4953-8c52-d20959375a01", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8309b003-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889568, "uuid": "fb897414-e317-4554-9c4b-542b53099d6a", "comment": "Malware payload", "value": "6e3d244dceda1643ae552307ae432ff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889568, "uuid": "7b3c41ac-0cab-4518-9513-fb87d6c278f2", "comment": "Malware payload", "value": "2cc328bab1ce95993967e69a1e71961e8e396fa995246d0e49412b8c2dcbd4f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889568, "uuid": "7bd5ede6-6114-4091-9d4c-2c13c1216e18", "comment": "Malware payload", "value": "d36791c81eae71b82ea644d0500766b0b4f81e89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889568, "uuid": "c246d2da-6be6-44c2-b870-3c32533957ee", "comment": "Malware payload", "value": "ee1e4cc681b9748f9468a40c6b31827da42d9cbe39d03e9fba051a38945bf572056c89da2f49d07ee6b4f254c11e3f18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889568, "uuid": "74ae64ef-1ae5-48c6-a83a-c1a1d620ffb8", "value": "T15C14E847F60281B9CA38C537A561C2B25F257E75AA63CA3F31513A2B2D79B001D1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889568, "uuid": "880c6f54-affa-458d-9872-eab4e3e39de9", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889568, "uuid": "c2e024a9-4fad-4207-a675-88aaa91cad20", "value": "768:wUKxW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAar4PzpyRAJ7IwnDoSdY:wUKHbC4Bk6lMTOWk4PkRAPod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889568, "uuid": "9974c7f9-b3cc-4179-9a2e-737c5be77c16", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889568, "uuid": "78280467-009c-4164-b4e0-632e7337566b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889568, "uuid": "303cadfc-375d-4a80-a924-f4e17a23cb3e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8398f9b6-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889569, "uuid": "2568e8b0-4998-4e56-94ee-2634ea83ba3e", "comment": "Malware payload", "value": "aaca01ee3bff31788d85ae50e32534e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889569, "uuid": "eb406f12-aa3d-4e52-87ed-ef1488856c2c", "comment": "Malware payload", "value": "2cd83b6ee1fd9dea9f8b9ee814e1fe1d011010f15035fda7fbf61aac543478aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889569, "uuid": "eac1a760-6df5-483b-96d3-902b04bfbe34", "comment": "Malware payload", "value": "01da38d261d2bbdc280b8c2891c3e59614cf0c0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889569, "uuid": "bb863a91-fb93-4499-b8af-0f6496cbda5d", "comment": "Malware payload", "value": "d1c9ece88610608b070dcdc3a233cfaa688b6688804a2fbda913f50c3c0d3eb79e9744efcff9b4a01792d6923afb396f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889569, "uuid": "aa846830-b391-45d6-8fda-ff30eb0c7603", "value": "T1CFD31923AE90442FE81189F168B5DE6DBA595E760BE06E036297FF1531B028376F134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889569, "uuid": "20bf5979-92c0-46b5-a66c-3adf42633e7c", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889569, "uuid": "55bc678f-ff7c-4099-9de0-f6a128662209", "value": "1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbg5hsZ:XVqoCl/YgjxEufVU0TbTyDDalTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889569, "uuid": "a3d9d83e-9a9d-4367-982f-b3af7a0194e4", "value": 138485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889569, "uuid": "1c7bec1a-b926-4b41-9e67-ebc3608a71e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889569, "uuid": "5fec6cda-757a-4ad6-bcad-643bb55e7ef3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d88fc56-c843-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763885210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885210, "uuid": "783967ee-998f-42c9-921f-f1a4ccf78b73", "comment": "Malware payload (Gafgyt)", "value": "516a972dc97d5f6ca1e433c19d2d199b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885210, "uuid": "77f8a8d7-59cb-477f-b902-d81695ee6db4", "comment": "Malware payload (Gafgyt)", "value": "2d0468eaec68d6c17264c34cd15097ad1f94e7b05b53ba0211ea71ada46767c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885210, "uuid": "15e401c4-2d91-4028-a46b-ffdee81bd783", "comment": "Malware payload (Gafgyt)", "value": "7c95436a84b749fdaac63b1b6d8d3cbafd382229", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885210, "uuid": "048acfde-656d-4baf-bf7e-d2038a49181d", "comment": "Malware payload (Gafgyt)", "value": "c53d81a3dc9a4879f4488bfdec024d76380fd358c6f37ea3074bdac13956e4c02507555daa09e13a7595eb87085b1de2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885210, "uuid": "00c06246-35f6-44db-9a0b-a86e97ed9fca", "value": "T12DF33B04EA808B57C5E227B9F68B424D33239B64A3DB33155938EFF43FC2B995E26511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885210, "uuid": "206a705f-929a-4c70-8b05-af29f167546d", "value": "3072:AdkbJBagqhj7yLWcugMcrSVLnpQEM/9q4MCmpwfFRQfVE:MkNBagqhjWLycr4LnpzM/95MCmpwfFau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763885210, "uuid": "e41cced9-2241-4294-b535-a168da16d49b", "value": 164970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763885210, "uuid": "dc533e15-a824-4eb1-96f1-0dac1a790300", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885210, "uuid": "b073b068-b7af-4527-ba40-cc7024b4a13a", "value": "m-6.8-k.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea6b245-c897-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921504, "uuid": "fde467f4-50ed-4d2e-8e5c-aebf6f773443", "comment": "Malware payload (Mirai)", "value": "00ae6206d332196fd9dccb0b2918315a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921504, "uuid": "f553d0de-4bbd-4382-b2bb-02a7a193d35b", "comment": "Malware payload (Mirai)", "value": "2d125480f55af5c726ab22994bfe2fc32899e738a381cc98827558cbb027953f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921504, "uuid": "5cf14e84-5b1e-4dc2-a61b-51b06e33c7f6", "comment": "Malware payload (Mirai)", "value": "e8670786cae489dcfaf9a15287ccd2df5d1cf9b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921504, "uuid": "04916e3c-4f04-4e9b-8c1a-5e2b6bc9221f", "comment": "Malware payload (Mirai)", "value": "dc1980fe948633118b1d71f371beffbd603c53d5338361f22a0bff6429db479f0ddcd8224eb949e0713eee25658a8513", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921504, "uuid": "ac8ed791-f92a-4434-be9c-ef5ad442406c", "value": "T16E9318C6B401DC7DF80FDABB4463690EB631E2615A831B266757FD53AC321E05927F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921504, "uuid": "8ce2db56-cbae-4b9f-b98a-a5fba915330c", "value": "1536:GQ1JsIO7ywe3iyF1rP8RcUSD+T+sP8dFWqvl1Pj8b4b29wv5tLBo0zzHlplo9K+Y:Go1L8jSD+TcwqvlNLCetdoqOK+tPKNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921504, "uuid": "93e822ed-1f49-480e-af86-aea87891d70c", "value": 96728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921504, "uuid": "9716155c-ce04-4f5d-8561-ea9ac39f2a30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921504, "uuid": "556ac7e9-2b08-4222-b71e-06f368a3872b", "value": "windy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5582b3fa-c865-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763899800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899800, "uuid": "2bab3f31-95a6-41a9-801d-203122a1afeb", "comment": "Malware payload", "value": "2d80c1c3948f95797bbe14e8fc5e2652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899800, "uuid": "2fc48d05-853a-494d-9f2f-f4b856b2323a", "comment": "Malware payload", "value": "2d19814d33cf0770b925104b91418bf364c78e59b1d94a45a62a5fe6a2c157c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899800, "uuid": "59959a9e-3b25-4f7c-8b7a-a939434ca0ab", "comment": "Malware payload", "value": "a4bdd27bb12c7428d0d16e605cc2ed5032becb02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899800, "uuid": "1a87240d-987a-43ff-ad87-1212966d390c", "comment": "Malware payload", "value": "dea1bae03e9160c2b8f36d5c02dd372c3d869923befffb33079356464ce700ba6d0401855132832e6034408d6fa073c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899800, "uuid": "5c39658e-6720-45a9-a6a7-441cb847a601", "value": "T17C951221FFB8C260F2B29036AD715764883BBCB0B7335443E694369EDAB368145D1B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899800, "uuid": "296d3777-7197-4c6d-a055-db251e04e728", "value": "a8cefc9af31d08a6116276a9b43f53af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899800, "uuid": "02e49e74-c308-486e-b590-30bd372ccc73", "value": "49152:tMCvNprR5Fovc9rZaj6BYA+lCv7GIK/b32mheB:2ClxR5FokraHlCjfKz32mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763899800, "uuid": "e0e05f9d-aff7-4a37-818d-77b5b06fec7c", "value": 2009600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763899800, "uuid": "5638954e-5c3f-49d5-9371-7c82376d8ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899800, "uuid": "b1177ef3-cd02-4d71-8384-8a7437b7e105", "value": "fo-wsftp605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6b3fa2-c865-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1763900085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900085, "uuid": "051960d0-c6ff-4a7d-aca8-45f5bd4718b6", "comment": "Malware payload (MaskGramStealer)", "value": "a6dbc43ac46c27171a3bcd5d6f8d3e01", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900085, "uuid": "8a0ed601-4da9-4378-8289-4f8fcf30b4ad", "comment": "Malware payload (MaskGramStealer)", "value": "2d25bb861cbb3317609dea32488f08d39451042c955ea781e244a7c885adf31a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900085, "uuid": "edd3caf1-c562-44cb-ab24-1f98f7fec29c", "comment": "Malware payload (MaskGramStealer)", "value": "24e46d6b9a5da3734700a1679e87d50eceaa3c19", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900085, "uuid": "8de3358d-5795-4a40-a5ee-0e829a9c9cf4", "comment": "Malware payload (MaskGramStealer)", "value": "af151b5af2818bfb9627bac7b930b27153e2909fc4171c0f8a9efe4ab76135edcfa3d2f21d4645072a53b8a8d34e4b29", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763900085, "uuid": "a73a639c-9f94-464e-ac0a-558445c3c442", "value": "T164B55A4BFCA218FAC0A9A27088726195BB61BC451F3123D73E90B7B82FB2BD05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763900085, "uuid": "b7b672ae-8d63-4395-b08e-a90793c0bced", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763900085, "uuid": "e16ffcd0-126d-43e0-91fa-b81a1f3ea198", "value": "24576:kES6k8UM6ZZsK5pKZ1RFCOIjMqVXF/YhBLYLVMfmMWHSGmcoeleTNj4HGu2+oc3u:kESR/MKsKbKrXVIVXRcB3UmPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763900085, "uuid": "7e4ebaf8-2cfc-47c7-8729-a17964d15ebb", "value": 2386432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763900085, "uuid": "95100963-b538-4285-8cc0-38f2cb57ff88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763900085, "uuid": "32dee28e-12a0-447e-83d2-d69444babfe8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8430c6c9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889570, "uuid": "82a3acb3-afe9-4201-8841-5e33e581d597", "comment": "Malware payload (Simda)", "value": "eaa04451663eaebd92879f1d4d8857b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889570, "uuid": "b8f15e58-73f3-4683-a109-76200c1c8b4b", "comment": "Malware payload (Simda)", "value": "2d93d934110ec7d88ed1971be9134681986a0ecf90e605f3facbedb97018e528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889570, "uuid": "a4deb164-a835-443e-9491-f4e1f734ddda", "comment": "Malware payload (Simda)", "value": "14485c30b23b0a13f5c492fb64ca480a8ecd5f30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889570, "uuid": "b64b3aea-7f40-4271-92b7-e2692820668e", "comment": "Malware payload (Simda)", "value": "9ded217991a8e132d23174169c9dd96f87663d350f9a07037d9ea0f2e29527f39b6dc0ec021fe7f05e4e735ca128cf70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889570, "uuid": "44089079-9f63-46e8-8ed0-77160f2323bd", "value": "T135341285DA0D51F5C6245F3749BA3F1737B9D0DA834AE2876088826C586AFC8FF2E431", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889570, "uuid": "2ae7d0fa-96d2-4a0b-9992-733c62672d3a", "value": "93cdf17b0bf4d79b378f492663d563cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889570, "uuid": "db5b6fdc-e9fb-4da6-9df7-5e3e8d462087", "value": "6144:pC8okEvTyoZVOgd2QZiw5NLclL5orfQH:csjCF2QZiOU+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889570, "uuid": "9afa1357-5374-4e5f-bb06-58d8b03bc620", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889570, "uuid": "2ab44220-3abd-4741-b107-6de03ccbd8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889570, "uuid": "5432e894-ab2f-48a9-b088-4d87c26b35cb", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea6f4c0-c884-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763913156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913156, "uuid": "b791f347-5347-45c5-979e-9f608c2117b4", "comment": "Malware payload (Stealc)", "value": "4379ea15bb90b67f4156318203864ad8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913156, "uuid": "24047cbf-d952-4a19-81fd-fe74c1f942fe", "comment": "Malware payload (Stealc)", "value": "2da15066d9ec537d989e21be6cbb9800d0203fc0698029ff5cb68db9a7b0170a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913156, "uuid": "aef8dff8-7917-410f-ba9b-1cd2d2d149f0", "comment": "Malware payload (Stealc)", "value": "49c8d74c677abf27f2a9848d49d680e5a8a3ceff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913156, "uuid": "99634dc1-6609-46c1-9e4c-a8e354c75091", "comment": "Malware payload (Stealc)", "value": "fdcda1ae81a2978def90a5326e865524de4e527cbbaa9c65deac4b306be564639f4c8fcde5e9538009f75a529ebbfd2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913156, "uuid": "2f8d6225-d883-4e5a-a986-512983417748", "value": "T140F48D1FF3E501F8C4BB8278CA565956E77A74561330A68F03E019A63F2B6509F7EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913156, "uuid": "b7ca48b2-95ad-49ed-ba4c-7b4e80791548", "value": "112f19f28f55f461c3d7ad7d3898dd7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913156, "uuid": "89028d25-838d-4956-a720-8c4905d0f4ee", "value": "12288:BwVOm41h6aMIChNqge8bNqDVqlPjzad0H4+dv3YZtF15kjHx:B2eMBThN9eiyVqlPjzU0Yk3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763913156, "uuid": "d2cefaea-16d7-49d6-ab36-6192103bcb47", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763913156, "uuid": "b4e4eb54-62ec-4308-849c-e7c67979e64b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913156, "uuid": "0acc4b0e-857b-4342-96ad-fc13c1975732", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c82726-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889571, "uuid": "5e76e948-ae07-4e79-83b1-58d8cf419bcf", "comment": "Malware payload", "value": "3365141e60cf9da921d9e54fa59ad477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889571, "uuid": "28e2a924-7852-415a-a327-4320edeb3c63", "comment": "Malware payload", "value": "2db3cffb05ccd8442dd9f8ade920a7bc3dc8bb13d689bb1b2e1d663499fa5e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889571, "uuid": "e620d8aa-19b8-44aa-995c-5fed1f991a06", "comment": "Malware payload", "value": "10ff25e15574b86dcf058f22b6ac8031023b2ff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889571, "uuid": "7b9e0e17-3136-4f46-91b6-91e272de2dfb", "comment": "Malware payload", "value": "d8711b16ca35d495651630796d0035d7f7ebcb594653c8df649ee034802d3ffbe74cff4251053425913914ae8350ad02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889571, "uuid": "dbbceafe-1c02-47cc-9750-a1c3c93e206c", "value": "T1BA84D077B7C0CCB6C805063002876B769FB3FA3A25B18467FBD45A2B6C70951BE5AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889571, "uuid": "af9390a2-f1fa-4244-b1df-3cbaabf1880d", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889571, "uuid": "8c0d7257-49ac-48a1-a32b-61c29d26675e", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5TtXiZbdzaxVcYcDqHiVRkB:BtKe6YiDdv3m3mgKHDjSehyyxaOCVGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889571, "uuid": "20668e12-f605-45d9-9262-e28e8d489e49", "value": 371522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889571, "uuid": "e516096c-083c-4fec-b426-28e9410ac11f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889571, "uuid": "042ef114-ae28-4029-a42a-bea865edf9da", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855a577b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889572, "uuid": "5f24563a-3427-4360-89b2-1b7a025d09d9", "comment": "Malware payload (Worm.Mofksys)", "value": "60f8f52d9026dcb92ab7868564a6c672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889572, "uuid": "f4bb21db-6a54-4538-832a-6c01c4ab0550", "comment": "Malware payload (Worm.Mofksys)", "value": "2de26a1460f8f56abdd88bffbbdbd80f68bb2544562e326408c37d8d13701f47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889572, "uuid": "a8e796a8-0426-4e66-a622-b1fd92a80fc8", "comment": "Malware payload (Worm.Mofksys)", "value": "6e4c2d32bb7f09b39783d281aecb3cc7d373c1f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889572, "uuid": "e1e7fbb1-6d70-43f2-9183-1e9ba5dd32f5", "comment": "Malware payload (Worm.Mofksys)", "value": "66f4cf7e4f97d5a321dc802e3b63f2f67f2e0747ef77c49f60ee0dcca7b53f70c2337272ba37729a36ff02dff98fede3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889572, "uuid": "cd698aa4-5a7c-4d52-ae35-4682b6218248", "value": "T1A054091BAA40713EDAE79AF02416A55AB7113E261FC09C5B63E1BF463470923B6F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889572, "uuid": "42b3d6de-d789-40fc-abe2-0c701758a182", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889572, "uuid": "71fd0634-15ee-4f2b-b4b6-91fd0192a60f", "value": "6144:FvEN2U+T6i5LirrllHy4HUcMQY6bbThVcHl:lENN+T5xYrllrU7QY6HThk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889572, "uuid": "5e54717b-3b56-498f-b5a2-f16e24515220", "value": 281010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889572, "uuid": "f54a57bd-5f6c-46cb-8753-8a4b39575001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889572, "uuid": "0d315139-79fa-4b5d-a77c-ebee28637bd6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ebb930-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889573, "uuid": "892857c2-6de9-4dc0-9211-0e651a5b00eb", "comment": "Malware payload", "value": "7c6c9631d014a4c98f868a48e07b418f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889573, "uuid": "7d89e44a-5225-4ba6-b43c-54be89d1769c", "comment": "Malware payload", "value": "2dfd738d4502e311b20388ea6715f12db63774503b88b65e521ca9df07b5066c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889573, "uuid": "e6146d53-3d75-43b2-8299-b1443893e075", "comment": "Malware payload", "value": "e3dd2a2fbe421788f69a4617045b72d6601d2f7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889573, "uuid": "47640207-11dd-4e3d-af80-def5ba0660b6", "comment": "Malware payload", "value": "00e6e9d82e4a80bb74813c3ed2ca831320df3813fb961dbe9efc2a1b830ecd556eae2e2626157d1f570b1c3358278120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889573, "uuid": "27bda2e9-6ce2-4c0c-81cc-2fa0889e13cc", "value": "T1D914E847F60281B9CA38C537A561C2B25F257E75AA63CA3F31513A2B2D79B001D1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889573, "uuid": "d9299936-a05e-4a7d-ba66-da830c9fe5fd", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889573, "uuid": "4e11988c-bbe7-4fe4-8a16-b6abba35c8b0", "value": "768:QUKxW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAar4PzpyRAJ7IwnDoSdK:QUKHbC4Bk6lMTOWk4PkRAPoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889573, "uuid": "ec27f690-e779-475e-8b1a-c15f10cfcbfa", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889573, "uuid": "45df7273-5828-40cb-95dd-4c39e8aad80a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889573, "uuid": "e66f23e2-ffcd-4b0d-adc4-c0e4b7a0e072", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e242c637-c886-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763914209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763914209, "uuid": "52134754-cc59-45c4-a3df-f5ea83a3f874", "comment": "Malware payload", "value": "13e0b1318f1a858854cc93292da65361", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763914209, "uuid": "66fd7351-9c48-4578-adf1-6de44ccc2b86", "comment": "Malware payload", "value": "2e1ea2c2951a63462b24371e3d13c4348e4615e85930924104ce6ea3b7f464d4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763914209, "uuid": "a5c720d6-52b5-4bbd-af47-a2d977cb8161", "comment": "Malware payload", "value": "b530182e9c73a1bd0af038662169e373a8580402", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763914209, "uuid": "41b1f271-a68e-4b8f-a9b7-35e5285f0553", "comment": "Malware payload", "value": "a8e58f9f04006c1b2f24cb89f63655ef493ebcd6a413d93c4bed3ad1022f7e3ff047c21d87dcbeb096ef89e718c36c4e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763914209, "uuid": "d2a26d56-f854-4cc7-b84b-4cd317e15ac9", "value": "T109854C606EC64BC0297C47D269E36468CBDA69BAF6CA3C59128D4515304BFE0F1F4CBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763914209, "uuid": "c4e3f6ec-ed13-47bd-ad8d-0edc20462678", "value": "3072:/u5dqRTdoAlkwu2Xbhl3owhmp0twnpVAXf09p9uWXdut7+RVpxRt3j3oKKCf0hIN:Er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763914209, "uuid": "36142111-07c4-4b69-b3f0-85788b644cbe", "value": 1795556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763914209, "uuid": "7f331bbc-0956-4638-b468-4c99bb2fb88d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763914209, "uuid": "99aba313-f866-43a1-9f96-f3ee1841edcb", "value": "6pcC7wQmpNB9icAWs.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86840cc3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889574, "uuid": "2acba6f7-8767-4a5c-9b2e-e273f99a7b8b", "comment": "Malware payload (Worm.Mofksys)", "value": "241f472445fb240228f7e105079cea8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889574, "uuid": "6f6facda-dc9c-4bd5-b909-f08057ef1a35", "comment": "Malware payload (Worm.Mofksys)", "value": "2e3d24bbd0236f2b6c34ed9887ed3449d590161519ee187785a300df0de7de8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889574, "uuid": "c091921b-4014-43c8-b748-501028e46584", "comment": "Malware payload (Worm.Mofksys)", "value": "a8e237b4a177fad4f9a241b2e4894522b9b1da70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889574, "uuid": "a689998c-2a9c-4d95-a69d-9423573ac65a", "comment": "Malware payload (Worm.Mofksys)", "value": "a289b34c6016a9f3fa4e08b77d24d8bb7148a0faf42ff762e1b60179d6bce4d5edbeff2f5c8b133dbc07bfad4450bf88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889574, "uuid": "a540ed70-1fde-4f96-b245-c34bd3109790", "value": "T19B24F827FA80B12FD8A799F1586AB596BB216D251FC0AC0B63C0AF863475503B1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889574, "uuid": "6b5b04ec-9c0f-417d-9063-268c088bb49a", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889574, "uuid": "3590414e-1ff0-4431-b39a-8aa47d04319c", "value": "3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unMy:zvEN2U+T6i5LirrllHy4HUcMQY6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889574, "uuid": "2692223e-cadf-48c0-94a5-8d76fdf5ee88", "value": 211764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889574, "uuid": "dc3d0137-aeaa-4981-a75c-191aa0f85502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889574, "uuid": "799c0843-1c80-4dbc-91d8-b00bb5da7c32", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8715fe8f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Swisyn)", "timestamp": 1763889575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889575, "uuid": "c8ef95e7-0562-441a-9e3f-8711c100bda2", "comment": "Malware payload (Swisyn)", "value": "1004ca6a8c252baec457f2aa9c341a41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889575, "uuid": "6c56fe4c-3de2-4602-901a-212cf9a4daf6", "comment": "Malware payload (Swisyn)", "value": "2ec980318b42a0d5ef041729828de379ce3706f01cfe6f6660ac7daa0801f3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889575, "uuid": "8cf3d61d-d345-438a-9b8e-fd895eaf2a01", "comment": "Malware payload (Swisyn)", "value": "852a271d134c6817e92be3df5fcedc140286b92b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889575, "uuid": "6e183f1b-eaea-4c35-ba06-3e180859086c", "comment": "Malware payload (Swisyn)", "value": "44e607571f785ef1525f4de92cacf62c87b1f81dc81244ce60a085f9e370a6bf97c479b35e538826e4cb5f9441e19df7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889575, "uuid": "b3ab6c26-02bd-4d30-a8ff-4110a2582547", "value": "T1BA543A16FE61211ED726C8F16CBF952E78216F6613A1AE0322E1FB47257128776F210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889575, "uuid": "e18d45c6-4389-4ac5-a3ca-2500b73e14c5", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889575, "uuid": "6d4a47fd-18a9-44f0-8772-d0f8f0772503", "value": "3072:AygCullUQN7gsBh1L1QygCullUQN7gsBh1L1q:ARleK7712RleK771c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889575, "uuid": "1dd4fdec-74ef-4669-83ab-2ad7a4542642", "value": 300094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889575, "uuid": "f765f0b2-7dc2-4217-8d73-b71ed0f73bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889575, "uuid": "01285d29-4b7f-4d8b-b1f8-43ae9adb7b69", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcd1e36-c898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921768, "uuid": "e2bff396-bab6-4651-aaef-a016f0949910", "comment": "Malware payload (Mirai)", "value": "974e30ebf91b8bee2e06044439a89346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921768, "uuid": "3595da1d-3616-4f05-9a8d-ee1495227528", "comment": "Malware payload (Mirai)", "value": "2ed3880f72300dc1722e2ee0ded57c490ffceaea2550333c65401ddc1b92f64e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921768, "uuid": "d3a94864-8c01-4b8b-923b-7a3b417fa3a3", "comment": "Malware payload (Mirai)", "value": "5615d5735b282d79db7787fe1632f423109b29bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921768, "uuid": "1875f4be-95dc-47d4-83af-c5e4125489c6", "comment": "Malware payload (Mirai)", "value": "0bf34fbf59c0b0d6470e3b3748d0d4ec66709d0f70829e4e74dcba35e91c659989ade368729f578399f96a0d736a463a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921768, "uuid": "73bb94b5-2220-4691-b1d9-8725b9406b6f", "value": "T1D3736DC5FA83D4F6EC130A351036BB379A73E53E2169DB87C3A8A525DC125C2DA1639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921768, "uuid": "eef6bdb5-4ec4-433f-a1b9-06498a891da3", "value": "1536:Ms3y6v3JiRUzydgREdwHE2N5Xekch3K68cS6Z4:Ms333IUudgR0wDN4kM3DZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921768, "uuid": "70945743-aedd-4287-ad82-fed8cd26cd90", "value": 79412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921768, "uuid": "99450210-3068-441c-90cd-6212209856c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921768, "uuid": "527a8eb6-a823-400c-bbc9-c95d9141bcc5", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a52316-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889576, "uuid": "8ba55073-8d16-42ef-9e5a-ae350394c5cb", "comment": "Malware payload (Simda)", "value": "bb8795f63442698549160c97ec2e1b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889576, "uuid": "565a31c2-aeca-4b89-ac6e-366a9beb0a9b", "comment": "Malware payload (Simda)", "value": "2ef62badb31a555ea89d953850b28c6ac0c3839eb11a0d48f6bfd9e4cc09a8fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889576, "uuid": "e6b2955d-f993-42ac-bb5d-5c244385df85", "comment": "Malware payload (Simda)", "value": "9c825516f2313f2a8767bd2de010a8ad2dbee165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889576, "uuid": "8319dcaf-8567-4268-bba3-668cbc35cf45", "comment": "Malware payload (Simda)", "value": "c21dc081d404c292001b352dc5809413432e43b3cf8adafcd2251e5f7ebb4703e8c2e013216f4d6fcb3a64525a7ee428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889576, "uuid": "8f14a27a-983a-4130-9728-617a0e860513", "value": "T143241232330459D2DD120EB348FDD73629A5AA2893E0C18E1535C99F3E56BE2396DE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889576, "uuid": "cc3034c3-1644-4279-9b82-89fd6a94697d", "value": "98aa7065495f35513795744857924eba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889576, "uuid": "c1e6a461-70d3-470e-a609-fa040942ce11", "value": "6144:h7++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:0+cff22qZhZcKYhc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889576, "uuid": "bddbf67d-e2e4-48ee-9723-338b33b5a67f", "value": 218936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889576, "uuid": "072f25fc-ec93-4215-91ba-728410b94ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889576, "uuid": "bee0bd13-7d70-4b21-8888-b7d315085aac", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883b1764-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889577, "uuid": "97cffb8a-6551-4303-9924-4fc167e986c1", "comment": "Malware payload (Worm.Mofksys)", "value": "601994587556ef115a10d4984fed54d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889577, "uuid": "a406b07b-520d-442a-b25c-154fbdb13048", "comment": "Malware payload (Worm.Mofksys)", "value": "2f02b41c82901ce9da24b5bc06f4f1c5af23e07eeb1f58d978898ff214594c32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889577, "uuid": "bbd4aee0-7c24-41e6-8e13-fa0107da1796", "comment": "Malware payload (Worm.Mofksys)", "value": "f660fcbcc94410640af0e7ed5e7ab5bfabacfc82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889577, "uuid": "5a0356e4-d164-48ed-bc5f-b312dc4d841e", "comment": "Malware payload (Worm.Mofksys)", "value": "4924312608fa9101052523a9e50fe3d5218a249015054d590534ada249d3d60d2a8beff60b0ea5886ebc537d9ee4e779", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889577, "uuid": "b23c7cca-e29f-4f9b-814f-a2748f9cbb4a", "value": "T1EA24E62BEA00602FD4539AF05536A7A6BA252E321BD1AC4F63C07B493471A53F5F631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889577, "uuid": "81ef5fc9-447d-4901-abb5-40ea1fa78f79", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889577, "uuid": "446fe37d-366b-4f4e-9987-3b510b5b40c5", "value": "3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un9:zvEN2U+T6i5LirrllHy4HUcMQY6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889577, "uuid": "b000e29a-3d3c-4bb5-a0d8-aab1b36fbc73", "value": 211835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889577, "uuid": "ded0c51d-8e70-439f-9356-9aaab4113b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889577, "uuid": "8e8c87df-c513-4148-baa2-68d1e0319084", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3486b90c-c80b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763861089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861089, "uuid": "ff5d7534-5e54-4459-a5fa-cf78c8449dc0", "comment": "Malware payload (Mirai)", "value": "12049a7074dc5beb62b684e762539611", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861089, "uuid": "5bfc4502-56b4-484c-ae00-d0431f83c54c", "comment": "Malware payload (Mirai)", "value": "2f119e5940e3dc40f5a003db0af1620475f21e427cee12533b304288d1b861b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861089, "uuid": "f7058418-b8bb-4940-a840-2215fa70e80c", "comment": "Malware payload (Mirai)", "value": "bbe29f763ea6e0bbb91fbd263b110ac08eb2b112", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861089, "uuid": "41b44d63-cf28-4831-806a-b0ea039e39f4", "comment": "Malware payload (Mirai)", "value": "89bf40cd73a61067de1fb46728d6a720a3f3d91ae31fece7c7c3cb86942874da1207cf69a769ec24e99909d21f271532", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861089, "uuid": "9a1d31ce-0cb2-472d-a1e6-06aed869eecd", "value": "T1CDF35B0BB5C480FDC0D9D1784BBEB53AD871F06D523DB26B27C4AF262A4DE201B2D665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861089, "uuid": "94ee66ea-3441-4386-91a9-360898b23463", "value": "3072:2QvNk5bNzvMD9r/vDZ8yiMhfBoN5XvGK4z:Vk5qV/niIkvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763861089, "uuid": "9ff82ff0-60d7-41a7-82d7-87252c8c3b05", "value": 163944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763861089, "uuid": "bf25ba1d-3116-4545-92e4-9ad3a9b95113", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861089, "uuid": "a7cba661-561d-49a0-a26d-5fde5a2f382b", "value": "ngentodluwh.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dfc4c4-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889578, "uuid": "ce8f4a99-d9b2-4283-81ae-5f838db3072a", "comment": "Malware payload", "value": "5246c9c276c047011d30573c50a8c7e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889578, "uuid": "c00ccbc7-f104-47e2-bd6e-46986cdb4110", "comment": "Malware payload", "value": "2f12bd68231f9e4a36748277787b33aa2569e3ba223118c1bf635f62602ab09b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889578, "uuid": "401f4a66-e1ae-4db4-8556-bd95cbacf11d", "comment": "Malware payload", "value": "f5b527e3993ce7edd6bbde1df85515f41d862824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889578, "uuid": "2ef2c666-7783-4e1e-bc38-add762928688", "comment": "Malware payload", "value": "863f04c9c939a4e5b5fda0178f395ac55d47b5f8e86a9def28e793dfd60625583dbb0bdabaa53ed3641b3d51e405ed3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889578, "uuid": "d5b97a1a-0c63-460d-bc80-677eecb8741a", "value": "T18B1523FA9FDC1AE7FF60403D03852639F0B3B14E46245CA76B91FE22A119615ED1B709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889578, "uuid": "ebae5589-d5a1-427a-9039-dfd621c2404c", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889578, "uuid": "d07b9eac-5c74-401a-87a1-ec3483d68769", "value": "12288:fz9wDwwMLkOCCnd6gX5NcX6dMkyDkTXBGrpetqWAyOhj+MpEdT1buh9axZ:78RZ2nMUrrpywTXb5kyKh9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889578, "uuid": "303ed6b2-c276-458c-97bc-73805db08774", "value": 954016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889578, "uuid": "aa051310-e885-4439-8595-6ee5610f1204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889578, "uuid": "05d2e07a-a200-4de1-8be9-c5f21b4e5074", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89776a87-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889579, "uuid": "a37ba538-b510-4bda-ae48-6a504106e43b", "comment": "Malware payload (Simda)", "value": "4c0dd4db03f3890870c0786bc7c0b225", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889579, "uuid": "44e57a19-a349-4a5e-baa3-19e6bd0b9d18", "comment": "Malware payload (Simda)", "value": "2f4045740d2e0ca3f5a49c0465a466888e85aec48055d6d38e687a1634f9a1ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889579, "uuid": "3b4aac5d-2b4e-4f01-bc11-4d6238907247", "comment": "Malware payload (Simda)", "value": "a0a3af74814c79d650eb1d9e45857e8dcd089c92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889579, "uuid": "b668780d-d769-4025-a5d8-71835dab12d5", "comment": "Malware payload (Simda)", "value": "0b7e84e577a66a5cfbc1c2114d9f324cec29b62517498806bdb443b66de026dcc80ef0917c45a198b79860119a3c7697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889579, "uuid": "eae8e3fb-3605-4775-8536-ac662dd6bec3", "value": "T179D4123173099DD3CD120DB71CFD973525D99D3883A0C24E5936C99F3A2AAD2386DE2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889579, "uuid": "aa087fb9-5c64-4bdd-8823-4a7c3ea61e75", "value": "98aa7065495f35513795744857924eba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889579, "uuid": "4c5f5fea-8fd9-417b-be9d-4cdab5a94748", "value": "6144:F7++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:o+cff22qZhZcKYhc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889579, "uuid": "ebb695fa-d433-4153-abfc-540d2c87eb1f", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889579, "uuid": "eb9c804a-ee00-44bd-8332-8d8c40548cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889579, "uuid": "bf2307e5-3350-4416-b6bb-ef80f3d455a4", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a56f42f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763889580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889580, "uuid": "9c471eac-7a44-41c6-a18d-910ac7a19fb3", "comment": "Malware payload (SalatStealer)", "value": "a195c8bfe33338070149074f504b2613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889580, "uuid": "f5bb3bb9-2ec3-4513-975a-9d69d93c9a96", "comment": "Malware payload (SalatStealer)", "value": "2f49b12713e04402d11c6c76e32f3000235dd95ea2f53d8f28d00321911d3224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889580, "uuid": "cb674e04-b1c4-4858-8abb-f2df93826b1e", "comment": "Malware payload (SalatStealer)", "value": "feb76324f0c2ed5068992ad7e490fff58badcabc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889580, "uuid": "0ba41253-8d06-450c-8a4f-f20db8836b40", "comment": "Malware payload (SalatStealer)", "value": "d363b198fa268f5214560ee74682eb45553bfcc492b8fe14ecc23539445ab3c1fb99ca50f3a1cc1076e6e7f74b8b879f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889580, "uuid": "11d622f2-a767-4dda-8549-afe4ab3ca45d", "value": "T186C63323E047E84CDB1880B53962BB9C86877B40ED3F87429C19BCF569C949E5E73E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889580, "uuid": "5ac800e5-d9b2-4e5e-9a23-e94b01513210", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889580, "uuid": "20f34239-6809-4c9d-97ca-a59287b0c78e", "value": "98304:Lrgs3dhGflBVBx1h2xNt/QWUSqU7MNIOebJ3ev:os3WHVyQb1wMNIjbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889580, "uuid": "a6ef8e70-0d5c-4909-bc6f-eeec34a9da90", "value": 11862016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889580, "uuid": "4e050db3-be46-4035-9770-edc31ced0329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889580, "uuid": "7550b314-0650-4268-a531-5e0bddf14996", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0069ee-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889581, "uuid": "5ec5fc2b-d244-490e-ab2f-d14b33b7ee99", "comment": "Malware payload (Simda)", "value": "51525ee47ad66e304a357a42a0932b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889581, "uuid": "dea53896-e345-41be-af24-eed792f34a58", "comment": "Malware payload (Simda)", "value": "2f9de2636ee5679991cc5de5cb86ff747ccf453b9690792f6f6edb352bb174bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889581, "uuid": "8c3d7e5a-9dd4-4464-9188-551c34629bcb", "comment": "Malware payload (Simda)", "value": "5944160f49eeb8474da49b854b34132b2f941fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889581, "uuid": "bfa69dbf-86f3-477d-b902-7065a48d7f06", "comment": "Malware payload (Simda)", "value": "047f29c0649e8abf8b30cc0b596f12420ca311043a5dd4bf85f1f492b1dc14b29a1af0245ea88c1285b152c1663bff5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889581, "uuid": "3a3484b2-6c71-4a9a-ba93-1d72ba33787f", "value": "T1E1647D61A040817BF3F8163425FA7B6F25BE6A6403DA19DB27A46ECC29741E2713D1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889581, "uuid": "79910203-b95e-4c39-ac4f-14a8d035e6b9", "value": "a29736d96c1bb5330d99576cd94e80e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889581, "uuid": "914e957e-a9aa-4594-aac4-a428ac78cf65", "value": "6144:SExz453S77yQi8Dq+9fXphN2LfjEcYzaWqr57Q7Xwxc4SQjWvvf:A3S7XDq+pcYWWqtfxvSQj2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889581, "uuid": "ee609109-8c64-4242-9f31-ab2324b1914e", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889581, "uuid": "c5a5c38c-fe88-491f-8bc1-159bb056a8e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889581, "uuid": "dcf272cb-c70d-4169-b3e5-00678e1ac0e1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b96f498-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889582, "uuid": "8a787357-0115-4e99-af9b-e79db1671d98", "comment": "Malware payload (Worm.Mofksys)", "value": "b990f59b92ceb5a67aff032c945ac2d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889582, "uuid": "ffc43e30-c98d-46a4-bf0a-804268b315d5", "comment": "Malware payload (Worm.Mofksys)", "value": "2fe24b3fb8049ae7da57eb78ae15044336ffb89c505f72b856f5f7b1f59362a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889582, "uuid": "3fd18836-613b-4c5b-8631-af3d49f0de80", "comment": "Malware payload (Worm.Mofksys)", "value": "210ed1b67cbe56032840ed53ae26b0d9749f7a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889582, "uuid": "31335c3e-8711-4e12-b3cd-39ff4494e141", "comment": "Malware payload (Worm.Mofksys)", "value": "d4719de73b2698df21674a92e1b21a88b711c5635b3ca44c1a6c1c9a6c511be794d468a4280f47ab30ea1182f2bae3e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889582, "uuid": "c11ad102-0300-48bb-b2bf-2158d039fa34", "value": "T1B624FA6BEE00702ED5A386F068267666BA256E351BA0AC0F37D1DF4634B1643B1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889582, "uuid": "ef61feb4-0726-42c4-879b-135bd27aeb0a", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889582, "uuid": "0877820c-7ac6-42af-9a17-69ed366216fb", "value": "3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unk:5vEN2U+T6i5LirrllHy4HUcMQY6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889582, "uuid": "66583a6b-bb4c-43fb-aa49-364fdf71147f", "value": 211739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889582, "uuid": "5715704a-2dc5-490e-a61c-86a9f893d953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889582, "uuid": "1e277a10-42b0-4f81-9c61-b511c3248adc", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442aeddd-c84b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763888604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888604, "uuid": "96a50a39-a16a-40b4-95aa-f44b60182dba", "comment": "Malware payload (Mirai)", "value": "942c6f934e35a576516197c62e6002fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888604, "uuid": "aa0b812e-7110-4d22-8dd6-84d5e3160b21", "comment": "Malware payload (Mirai)", "value": "304780cc651bebe053d8ed919f1241a1677be6a12bd4087b9918f21b49d83dd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888604, "uuid": "5883a360-f267-48aa-892b-a4950fbf112d", "comment": "Malware payload (Mirai)", "value": "38cea7b4b2014a44e311e118e1b6d303f9a798c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888604, "uuid": "935bd44c-13ed-4fec-b314-02198221e7f0", "comment": "Malware payload (Mirai)", "value": "b80078f6bab5d58d33831bdfeb61aa30f1b7df2a92184273e147d54500834824b7aad187c48066bc38403f64d4bf76b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888604, "uuid": "8bfa51f7-d858-4590-b1f2-cedccebcda40", "value": "T1CF156D88EBC794E1F25300F1068FD7F71924A2265053F6F6EB4C2A977432B526E1636E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888604, "uuid": "20ced178-c999-4cb3-955d-433be57f8554", "value": "24576:EagziqDwhakhPLDahVXZGsuXGyvpO2DWHt1GQVmkBp7ZMg:0inhakh6LE/GyLDW7tMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888604, "uuid": "9a5a8f7d-e3ef-41d1-8560-a37ed1c7a270", "value": 910428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888604, "uuid": "daad070f-a50c-48a0-89a5-4703d87a6822", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888604, "uuid": "f1d4dbac-cdb9-4a3c-8dee-5008a6e8819d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7617444d-c88d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763917034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917034, "uuid": "28d11e56-6352-489e-afe0-05a02282e1f0", "comment": "Malware payload (Mirai)", "value": "d6e75fecd533dcf20fedcd03c84dc2a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917034, "uuid": "37af562a-294d-4b07-a279-1b115442a445", "comment": "Malware payload (Mirai)", "value": "30691e285bd453a9072abc193bb818c871a05d4fbdf351f0258d9ab780d1101b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917034, "uuid": "3cbecbf5-b27d-4952-9a41-7c0bb8a35939", "comment": "Malware payload (Mirai)", "value": "36644d7f99f600c46940d0e168a2474f501184ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917034, "uuid": "3d895577-4829-4069-914c-b1d31b77c0e6", "comment": "Malware payload (Mirai)", "value": "450c98cc689823e4ae1c945ce67928775ad218834ee6b1a40a285abaf36d09f79de2d25996e77bb542d65d49d8e4dec2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917034, "uuid": "87b074ab-f0a1-4719-9944-a05514605d9d", "value": "T186D3C75E3E324FADF2A8823447B38F35E75823C626E1D585D2ACD5151E7038E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917034, "uuid": "b6dcfb19-1cff-4f6a-9ebd-bc6533be06ce", "value": "3072:Ph4jrgsE8u5AU0YTxE0H9xSTdkVxKotpy04ZXz:k2hTxNHHygootpGZXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763917034, "uuid": "4a6ce5a1-7758-4264-af92-6cf9b2240611", "value": 131256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763917034, "uuid": "8c38b6d3-d27c-4c5f-857c-0654ab72b408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917034, "uuid": "1bf1e054-b561-420a-8f61-1808bbf8dfc2", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8f4077-c858-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763894260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894260, "uuid": "6c8bd497-edf8-47b9-a07d-aea6c85ee792", "comment": "Malware payload (Mirai)", "value": "2452c8b5927e2ebf5e9e7dccbeadc9cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894260, "uuid": "cb72e85d-3f76-4994-97d0-3a61f4139d53", "comment": "Malware payload (Mirai)", "value": "307f4a7e196a88fdfcae5a971d64b9899428b390e78f595392c7624797cbc01d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894260, "uuid": "27f71c8c-9b36-40ac-a787-c814df26008f", "comment": "Malware payload (Mirai)", "value": "60f845dbe58e71ff772477622c3d71334fce3658", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894260, "uuid": "61fcd36d-1a62-4df5-86cc-537bc07e1a9f", "comment": "Malware payload (Mirai)", "value": "7bdff50bf6ca648720f4f0cff5b35f54501e4e4006144f8d3bd4ce1b8f1065437b9189245246b9eaa832d0bfa7029140", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894260, "uuid": "32c037bb-aea7-477a-9be8-dcfca46c7f7d", "value": "T1DE836C56B8919A13C6C252BBFB1F829C371613E9D2DA3203FD155B6D3B879690F3B240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894260, "uuid": "fd6ebbcb-2936-4c4d-b9b4-d77baaa25e58", "value": "1536:11aj2UG/tEVmKcnHTiVx9QSnpaGcOUWTPcMzLGg8avZk0zWi0:zUqEYK8zWJnpaMPcMmkZlzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763894260, "uuid": "28a97f07-b156-447c-81d1-c5f5b0b16c14", "value": 83392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763894260, "uuid": "0194fff7-2280-40de-a026-92a7fe467cd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894260, "uuid": "f1c3237b-ce53-4b84-bb1d-97b739b0bceb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c42b72f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889583, "uuid": "bf7c9c89-b7b7-4e3c-a7b0-e961ba11c3e4", "comment": "Malware payload (Simda)", "value": "d30748a5696790f40b33c6f0a236df7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889583, "uuid": "b0be1347-490c-4f08-84de-24d9472171dd", "comment": "Malware payload (Simda)", "value": "308bb95277f7eca9d891e7cfff895376ee065a62e0cae76b3ff6df25cb5ff80c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889583, "uuid": "ee0cf3b8-80c4-4b2d-8174-b2f56509cd9d", "comment": "Malware payload (Simda)", "value": "62e16694ed848b7c1d5820ced81d768021ebe210", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889583, "uuid": "66cb5fa6-885f-4c4f-94b5-e60aeea61cd4", "comment": "Malware payload (Simda)", "value": "97d9ff5b6e191782cd73ab760b087d96944db9674ee45ff25b4562c528ce48760b3c330b514e0a80a95d1b2ccd1cea7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889583, "uuid": "79534341-1f02-4808-995d-a3edb205bff7", "value": "T16C849E23F1450176E4E514F1E5FF3A9A106C6E26471C68E3E790AEC929782F77A3C287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889583, "uuid": "66d53f5b-b896-4b10-b949-6080b426b31f", "value": "614b67a6e9f2f6744843319be05d107b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889583, "uuid": "b085b09e-ab2a-42ff-8648-2b1b4295bbe2", "value": "6144:NDCmWoza0a1IMVVEb3uqRpwIUV9lMYmFQqZRRphLuVucfb8ehbjN8wS21bKRTw4W:4mWQa0a1IMVr9eMqbRzLuVucfb8ehbjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889583, "uuid": "145d8ff3-81a4-4a94-b8d4-e6c922a4441d", "value": 375162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889583, "uuid": "d4bb5daa-e67c-421c-a47c-9563cac33c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889583, "uuid": "35437e6f-28a2-4c13-8129-4505463d469d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b0e8eb-c885-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763913592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913592, "uuid": "cbe4ec90-43c7-454b-8b71-63937dbbbe53", "comment": "Malware payload (ACRStealer)", "value": "4aa8041ca905a9b3d5dd5ef0ee3fa02b", "object_relation": "md5", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913592, "uuid": "708cc020-a943-439b-8c49-a31ca595c066", "comment": "Malware payload (ACRStealer)", "value": "30c51e07b720eb37cd081c34a0308d78df20a90495058426058ff92441766219", "object_relation": "sha256", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913592, "uuid": "b08a8ec5-336e-4927-8983-918da3ebc208", "comment": "Malware payload (ACRStealer)", "value": "4ebbedd3b5764e130c15cf554a4656a241a43cc3", "object_relation": "sha1", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913592, "uuid": "2b774825-0982-490a-a40f-114de9103a7b", "comment": "Malware payload (ACRStealer)", "value": "cf93a9caaa29eb4355cd22815cb89dd7610278cb0ac4fd893b5a4291f7c31c71294f823fac2a36112fef5a48cceb31a2", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913592, "uuid": "e9b11ca4-9e68-4393-8db3-77651dc62312", "value": "T102A576C1DB5CE295E17E0A7B79F38009C13A135E394E218D4B85BC9607B6B66C602F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913592, "uuid": "a133fad6-f073-4f42-8b8a-65ce24d226fe", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913592, "uuid": "4d55e79e-88c4-4e63-9e63-27dd4a0067dc", "value": "24576:N/yMimyW5bzQT5ZQwufYBs5bA9Sxi8f2djhldc3EmFWy:QZWZQTZugs0gxi8udlc3Ek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763913592, "uuid": "b711d3e1-dcb7-4f68-9955-6356081dd5d7", "value": 2078208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763913592, "uuid": "4d4b13b7-68d2-409a-a851-6c41aa5230b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913592, "uuid": "9dc35f66-fb9a-4e11-aedd-28611f04f600", "value": "Setup_Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce26f7f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889585, "uuid": "d12492ed-896b-4cb7-aa20-0ce020145838", "comment": "Malware payload", "value": "b210e5b1bcadebbe4790b844dc580c33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889585, "uuid": "c000e188-e5c0-4ec3-a8d4-9c34eb810c46", "comment": "Malware payload", "value": "30ecec227c63e0e5d5e0cedb12127f539c52f68e3b6d1cff82995821f82f4897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889585, "uuid": "dc660c32-a799-47b6-b8f5-097deb18596b", "comment": "Malware payload", "value": "fb2ac7b8ec0a7d21a4abd02cfd0afd8e05acfb00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889585, "uuid": "8306b811-afb9-4c83-88a0-10ac2d1eb66f", "comment": "Malware payload", "value": "e54696b8dc9d87689025bd2dd7b799e517565a50bc8b24b1b190d492ba56d719050ad78862aea51cc415bde3cd07755f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889585, "uuid": "f747831a-04c3-449a-9fee-a034022444f7", "value": "T11D55230A33C15B71CE89133106472AA15F73AB7D1770E82AB7DCA5071DF2948AFBC6A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889585, "uuid": "75b22a06-dd36-4d2d-bdc2-62617087548d", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889585, "uuid": "641ef331-0a26-42d2-9144-998dd1bc64e4", "value": "24576:a6Zv2ivhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mD9i2:aE2ivhQs7tWVToP0Hs0/htDH3pGaF5+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889585, "uuid": "05ad0e3c-c95b-4ac8-a153-a63d20621556", "value": 1299001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889585, "uuid": "70024fbb-85f6-4cc6-88cb-f270d6a80d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889585, "uuid": "4be6e3b1-f01c-4ab3-a29d-173469d5baea", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a4ad74-c87a-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1763909005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909005, "uuid": "64459a56-c897-4642-9401-445ff00721d1", "comment": "Malware payload (njrat)", "value": "f75d31f867ac16b922fbae9794a07c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909005, "uuid": "cd03d76d-e412-4dba-a699-80207fca6b36", "comment": "Malware payload (njrat)", "value": "313955f5b54228bff9e34d2c4302aae5bdb1a89d494ccb57bf94e808788e577c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909005, "uuid": "b5d2ad22-ae8c-4f02-ab19-62a3bf58f714", "comment": "Malware payload (njrat)", "value": "919c14bcfece57a792ee053fd9f2a9967b13d98a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763909005, "uuid": "82b19bb9-760c-4519-aa8a-a23856464e41", "comment": "Malware payload (njrat)", "value": "0eeadc720d1f6a9a9a4f002be1593c16d152b2bed7714b7d1d327c582c3c62aed4006f1f840b08f6a6055d6fa2e7fb36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909005, "uuid": "eeb321a0-2845-473e-86d5-8e42f57ee100", "value": "T1EB25C09173F4850BE1FF5B75A4B248494BB7B9529A36DB4F0C88A0AD1EB3780CE10797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909005, "uuid": "62747033-03a9-4c23-b5f3-855a58372702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909005, "uuid": "6510b48d-ae12-4d9c-b1ef-ec1727f49e61", "value": "24576:0F/p7xJzck+uGW/yFoBkkAQHZjhE6J19oZwA:0F/p7TYjqqanT9b9oZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763909005, "uuid": "4dac2c6f-9648-4342-877b-11d039999353", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763909005, "uuid": "02e83219-dd6e-4f82-b28b-b8894edbe8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763909005, "uuid": "afe79af3-1882-4ad8-a9d1-8e8fdc33b086", "value": "Pulsar-Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6c5de8-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889585, "uuid": "9e13ec4c-265b-44ae-a788-4e2d8a551228", "comment": "Malware payload", "value": "4f42c926044bccc33ee786f803de5658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889585, "uuid": "6e372782-9198-4207-b19f-0e3a26576f3b", "comment": "Malware payload", "value": "31442a6bccf84f999705cab049ddf81e25a372fe4bf4ce4e1b759d5f0266cb36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889585, "uuid": "4ec58dc6-dce1-4b5a-bc2f-9889e91dee11", "comment": "Malware payload", "value": "21dffa4c0deeb032d3d198465e766fbf36f14a7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889585, "uuid": "58cb6b40-9c6d-4a4c-9098-7e3adb007fb0", "comment": "Malware payload", "value": "0d7e75c11a19e029eeb62261b423a0fc9e3072e55b54ccc6036dccfd6fcf0d0a9eef952e0b48b3465cd3f464993e1dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889585, "uuid": "7e536592-2f81-49f1-9050-9bb22401e68f", "value": "T18BF2076B5891EC7AC8A211F026BD0F66C376C9B0B854E58ADBC43D6B75A01D2F1B431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889585, "uuid": "b7648332-e3f4-4098-871f-66041b00a423", "value": "d7401947d3623a2199a2114d62923cd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889585, "uuid": "38b9f985-022d-48ef-b21f-0e3ef1ab059e", "value": "768:EkOumhaoDu3hAyNw5/KTSZHOTb/Kc6HmaFc6HEvT66vlm3GWBkXhr2Ci6oCmV:hmQoDu3BNw5/r4byc6HFc6HcT66vlm3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889585, "uuid": "ab66f472-1540-443b-b45f-0814faab523e", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889585, "uuid": "d4696d1e-e70b-4f12-8147-3609fb425a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889585, "uuid": "fb38340c-3a9d-415e-9ab8-65fd4cc88133", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfa1494-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763889586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889586, "uuid": "68c81690-5faf-4699-9fba-eb01c6315765", "comment": "Malware payload (RedLineStealer)", "value": "45f85236996400374386fc38ea6b93dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889586, "uuid": "4160aa40-6a3a-4731-9449-552887f61ed7", "comment": "Malware payload (RedLineStealer)", "value": "3156a9c4a5b3ec2b074d21be003eac19dcd8c1e15a7ed9592e219d36a971ca8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889586, "uuid": "56bfbbd9-d919-421b-95a9-b58ed20d5a40", "comment": "Malware payload (RedLineStealer)", "value": "6a5153d046bdd50b60c0ec89b80c73a9ced883aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889586, "uuid": "9377e539-d961-425b-9a1d-bcae13be9948", "comment": "Malware payload (RedLineStealer)", "value": "963f539a6eddd710843f24d00579c77ceb7864aeb1aa60dd41db725d53c677dda2eaf9ad8dbe7a92e2b20eeacef71bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889586, "uuid": "9d56ee67-cae3-4131-a134-2785a68f412e", "value": "T1ECC40224B1C2C173C4BA053044F6CB659F3574220765A6DBBBED17BAAF202E5A3762CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889586, "uuid": "106d7837-ef04-4071-aad8-3b598c4d1ad4", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889586, "uuid": "cd963459-b344-4a6f-a7d5-311f4da92e58", "value": "12288:Fh1Lk70TnvjctIKWLbv7uXP6EO4NTxEB0BB1+2zYrYz8OC+w7T2mrXkn2A5U:Rk70TrctIZbv7uXC+RxyC14xOC3nFkny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889586, "uuid": "973f55e5-34bc-43f2-9bff-f482a27ea029", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889586, "uuid": "5d98ccbf-fffd-4f17-8ad5-236ae1920adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889586, "uuid": "ea87fb02-21e1-43ca-b67f-6babcbcc1179", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48e4ad7-c853-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763892309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892309, "uuid": "d6c56c38-7982-4d7a-8b6a-7cb372600548", "comment": "Malware payload", "value": "0b516e986f2083d4c0b6c2d07e6a4241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892309, "uuid": "317915f8-1c75-4b77-ba8b-0f76532b3844", "comment": "Malware payload", "value": "31d201e01156258e9e90c44e0f92cdc07d7f4860f209b541eee1e1760c6a07fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892309, "uuid": "2b6fcc10-4f3f-4d75-8e3e-899141a79560", "comment": "Malware payload", "value": "bad9019d9d8832b8fa456607c80917980385c434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892309, "uuid": "823108d3-c521-4aa4-b5a0-067eccba3661", "comment": "Malware payload", "value": "ea0b99a27052ad2e4b49a39258abbc261b3ea3fcc2606a4d159284e7146f815c67ae50cebd0af43bddb4de6c86561eec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892309, "uuid": "be46a6a7-8475-4993-be83-23ac7786d764", "value": "T1E035230B33C155B2CE8A533107472AB11E73A7BD0770E83AB7E8A44719F25447FB969A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892309, "uuid": "b90860d1-371d-4fd7-8192-06cbda76437a", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892309, "uuid": "2423360d-a573-4afe-9b62-db8cc9c5f401", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFyjtv:qE27hQs7tWVToP0Hs0/htDH3pGaFyZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892309, "uuid": "c9673cc1-e91c-46c8-978e-9477f81a0b7e", "value": 1093398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892309, "uuid": "0ed19d83-467c-48c2-86fa-b10815e690fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892309, "uuid": "d49f8479-cc5e-4fd9-a99a-fa5a20e269de", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d60ca2-c850-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891056, "uuid": "faa8a8dd-cac5-40f6-8e95-b6628272f8fa", "comment": "Malware payload", "value": "6d6d28048af44c532c57a0596a263de3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891056, "uuid": "9772da2f-3797-4a80-9ffa-5688826520c9", "comment": "Malware payload", "value": "31fde54c76f5a5e0b3249ba3736cb34036c7a7d97819a1f2e3042d6a0e662a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891056, "uuid": "060020a0-8878-408c-acca-c1f80c9e997a", "comment": "Malware payload", "value": "520fc75a4287599e607707ad419fbc72453e2213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891056, "uuid": "8a1f3985-e83a-4530-8e5f-8403355750ed", "comment": "Malware payload", "value": "395a4b0a87a966a0f25de3216897f1a93a511e5f4d7994d5623bfa1d1c6aecf3e31e249b5ba2f17f252d0cc8c6131bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891056, "uuid": "dc1ff7f3-1cb8-4e66-aa6f-16494bee168c", "value": "T1D045233633C15EE4EE4A4E31020E6F218EB1D27A1F3EE815BBE86D5325704D2BD66761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891056, "uuid": "63387e78-d335-4015-8134-ff0bca6c10c2", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891056, "uuid": "6c61148b-7b91-4634-85dc-7f569dbaa0dc", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVv2WqgI:qE27hQs7tW2zku73bFgVlRlbN015CoVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891056, "uuid": "106699ff-6f09-4427-aef0-fafc042c398f", "value": 1253909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891056, "uuid": "6dc8b352-e25a-4ac8-b3ef-5beeeb808055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891056, "uuid": "048f945b-2bbb-439a-97db-6532623f1aa9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f4870b-c891-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763918784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918784, "uuid": "5fbc2585-6364-490c-9837-f7b445d164ef", "comment": "Malware payload (Mirai)", "value": "a76f03ba92b0507c24a6885c09f9d066", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918784, "uuid": "a959139b-8b89-4769-9490-076992573e74", "comment": "Malware payload (Mirai)", "value": "3273f921b59c98f024bfe386fd054f20e40e200c16040f09760549b8c1ff6751", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918784, "uuid": "01c07814-0587-441f-ae6c-12fdc3a88393", "comment": "Malware payload (Mirai)", "value": "eba3805ccd6130acc6833186092e5d05f0bac908", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918784, "uuid": "534961b2-c2c0-479f-b475-1c4e1264432d", "comment": "Malware payload (Mirai)", "value": "11e70aa3d1744959fe9d3d7cde59fce2c78effe6f19a3d05e4a0cdcd7e464b3e23dcdb0e3807a4da12277f3b129405ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918784, "uuid": "cecbade6-263e-41af-9fde-6a944eee51e8", "value": "T10F633A81FD819A13CAC1567BFB1E428D372A17B8D2EA32039E255F2137C785B0E7B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918784, "uuid": "9474cdac-1430-4550-a77c-8eab3ac6cefd", "value": "1536:Qzs28dvdpdkM2s21a6B3lvQTdk36TUoVdJgRQBDLvwN:Us2gp2dv1xvcA6TfjN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763918784, "uuid": "c1972184-c35a-4e17-9370-524c19646fab", "value": 72280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763918784, "uuid": "b9e3495c-4a0a-4ab0-b675-60ada157dc9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918784, "uuid": "1daca235-6440-40a8-8202-1a8cb0a769bd", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8f1efc-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackNET)", "timestamp": 1763889587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889587, "uuid": "95070e9c-95e8-48a5-b189-8c05652c90bc", "comment": "Malware payload (BlackNET)", "value": "dbd7dc791a0b3439a4d7d5db66764d2b", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889587, "uuid": "a96b17b5-d949-4657-8dbf-d2bfa916c906", "comment": "Malware payload (BlackNET)", "value": "32a883773b2ed1e4ca6f22441d5d5a905d9feebfb0b2b3d686a4200923d5f3fa", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889587, "uuid": "4130a9d7-2d88-4f76-afa5-a8f6ed8d258e", "comment": "Malware payload (BlackNET)", "value": "0e83db3395f49ddcabb9e4fd3923fe4167926cad", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889587, "uuid": "d67d4966-9419-475e-a406-37c6582f41de", "comment": "Malware payload (BlackNET)", "value": "3e6951f1e3ff28853b6afbbc2bb9234967d7635fc257b381557ea479f1b86ddf740b77e5a41c8c9e25177f00b50d2e7e", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889587, "uuid": "fb5aacbe-b10f-4abd-9575-f38f1080384e", "value": "T101A3F94237E84919D2BEDFF8E8F1610846B4FE2B5D22D75D4DCD109E16B2B818D90BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889587, "uuid": "29f414ad-9da8-4740-9325-0aee8808281e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889587, "uuid": "a63d119f-56dd-42a3-aaf7-4a1eb152668e", "value": "3072:szT+P1Tnsug5IoyeMrm8Rwhq0beoEqjr0Y:fP1TnXQSRT0bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889587, "uuid": "c32511a5-f7c2-4373-a26e-080a728acd58", "value": 106508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889587, "uuid": "9b55e999-f123-423d-ba5e-2fb875f4b6f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889587, "uuid": "23c1c520-8485-48a7-b6fa-e7640abfa797", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2ddaef-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889588, "uuid": "fde4bcb0-98d3-47ef-a84a-9b2b8fe8d7e5", "comment": "Malware payload (Simda)", "value": "86b74369f7c79ed73bc962f231cf1069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889588, "uuid": "6d5dfa9c-5b40-4619-9d02-de5df5771f0a", "comment": "Malware payload (Simda)", "value": "32f480cdc582aa6c992368d22fb3589e0d16c5b05f631dae244ddc39e49d81e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889588, "uuid": "e5fc5517-e908-48c6-9b08-9e80ed95ff7c", "comment": "Malware payload (Simda)", "value": "250d150a364406681d948f32c04ad31e80333999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889588, "uuid": "f854990b-b7a3-40e1-8b3a-1f625efbde35", "comment": "Malware payload (Simda)", "value": "b155d3532a07b74c36723b01cee4ac719b4e2ab93fc8903368d3b7e0b655dc7e20111cec13a6f3ccb39c22dccee4a088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889588, "uuid": "309eb4ee-c254-4feb-8153-8836829de87d", "value": "T1CD948E2AA4504176E4F4223050FA7A6B2DBD2E6447DD28D337A46E8D6C742F372392DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889588, "uuid": "58932d8f-abec-46b6-b45e-b6a5e7d53624", "value": "257ea21f64dde694bae577e3a7755e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889588, "uuid": "1f3a9274-b6ff-4e50-8b69-3049dab16124", "value": "6144:cM7SwQSEJ28R/kpM3kRaWV/wEsNbqw8QlRTFiPurp+EStS3sth:wSET/kBubqw8vm+EKS3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889588, "uuid": "bc0cd96f-8ec5-4b04-8e72-9096af6f53e8", "value": 430558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889588, "uuid": "73d42c15-13a4-417e-9527-b79c701f14b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889588, "uuid": "3ed44c91-5626-4a17-a60c-6055a722ed8b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03142720-c84b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763888494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888494, "uuid": "94fb2497-89c9-431f-88e0-9dc5daec3dbd", "comment": "Malware payload (Mirai)", "value": "9f27c2a0ad46afb793982f851da398a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888494, "uuid": "8ceeb9fd-dad1-40ef-9df6-879b5191099e", "comment": "Malware payload (Mirai)", "value": "3339faf67987890993a0384bd854e14b8f4d1965072cb347456267865fde4801", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888494, "uuid": "ab1fd1dd-121c-4834-a8ca-60e905e6f26c", "comment": "Malware payload (Mirai)", "value": "b57f2e2b7fbf07a40f8349da8e6046c5672e66cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888494, "uuid": "f4b733d4-f071-4cfa-8f95-797079e74c41", "comment": "Malware payload (Mirai)", "value": "882802b5260a46fc4b32d19c7f4f7eb6d822d4d8c1e11aeedd4731bdfc44c259ae82126719d472b7dd4cf27adf0a119a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888494, "uuid": "67a244b7-804b-4386-81c7-9099f85b1093", "value": "T1FF045D85F683E6F2E8150D345027B7328A73D53A622BDA82E3FDD635DC12A01C52B6DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888494, "uuid": "eeb0ce41-e995-4df9-962f-da5fb16eaf21", "value": "3072:k3f8+2pVDD+X2RGhH9sSfCTR6YFuKWgcEjvLTCNBPM:k39m1cswV9AvLTCNBPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888494, "uuid": "4e9cf436-2fa5-4827-a68f-1412792a6abc", "value": 179496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888494, "uuid": "f3d07d26-8286-4b27-ad5b-8f43d9032282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888494, "uuid": "de75ed94-530f-4d1f-b949-f14006b3197c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbe74f5-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889589, "uuid": "5bd72f12-300e-40e7-bfcc-a7514958ab4d", "comment": "Malware payload (Simda)", "value": "321ac9a2774d9e7d1afb40c011134baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889589, "uuid": "e12dd7eb-d87c-4704-9210-fbff11ac7157", "comment": "Malware payload (Simda)", "value": "334fb2af66eedf9b8fed6248fdc0e43c2b63963c7aedb16b6175f8ff9a930885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889589, "uuid": "a5cb114d-adad-4e23-9802-201ddbcacae5", "comment": "Malware payload (Simda)", "value": "77cba8be0b097dc75fce6316c026e6ad0b069bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889589, "uuid": "95334b8a-692a-43d5-948d-570b4c1350f0", "comment": "Malware payload (Simda)", "value": "63c1fde564ddfcf9cab74ff808ed679e0cb824f15eeebf4c4d7f6d3961dcff03b0aaebd45d42b25da1ae4bc1413ece8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889589, "uuid": "b3bf21bf-c72e-4536-8c09-38ec78a16aba", "value": "T16394124C6B6174B3E65203399BBF79D53A389D99480D2C420A7F28373B765B39208DB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889589, "uuid": "9a73b815-a5c8-4f84-b414-63e9a4c03178", "value": "7ec179fea3ba0cfb69d21d330597a106", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889589, "uuid": "87032154-62b3-443e-b7a9-4dc0f46e1ec7", "value": "3072:PTJXLESylV534DNujdXwtrUHioF92L59QvPJvzxsx8ME:PtXLESuV5I5ujNHioajQHxzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889589, "uuid": "686bf610-410b-4309-8e8c-5c1e0381bcdd", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889589, "uuid": "387e4f2a-a5a1-462c-9d7d-a42a0b849c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889589, "uuid": "0af5bf5f-1370-4ecf-822c-f404e343a670", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c46f5a-c88f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763917765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917765, "uuid": "6761a83b-c8bb-47fa-92b1-a54f6a0871c3", "comment": "Malware payload (Mirai)", "value": "f8fea5486a2f43ade06f7ae931545a4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917765, "uuid": "7590d003-00c5-468c-8ec1-279d87384e68", "comment": "Malware payload (Mirai)", "value": "335208b24c0118edc0acb164462355dc87c124a4a3cac095aaaed49576c7f1d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917765, "uuid": "c7ad5a07-6a0b-42fc-b374-7afcc2a59f76", "comment": "Malware payload (Mirai)", "value": "fc562d2bb7f8ffd22615e001cb8232f6dfe7bcf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917765, "uuid": "bfbab742-5b11-4e3d-b5c1-08b162c5305f", "comment": "Malware payload (Mirai)", "value": "3756f1c4b0e69b7dd2c5f0e755f818b606f841cb6d6562ef3e1ff8d504f6b2a025efed88f8738bab5a2d34fff377a004", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917765, "uuid": "2b37f886-f699-46c2-90eb-2a0db562d79d", "value": "T1A373A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917765, "uuid": "88c674a1-f94b-47cd-bdb6-2e14e30751d3", "value": "1536:zJPEBmW5iNWqcGT8wIVHZ84OK9ZerEStW:zJPEB8NWq9hDK90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763917765, "uuid": "6367b54c-84c6-45b3-846c-9c898077adf3", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763917765, "uuid": "3e0910d7-be3e-495f-817d-b26a5fafb59c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917765, "uuid": "07abe8e5-33a3-4825-b360-56bbd14fa98c", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9051e2c9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Swisyn)", "timestamp": 1763889590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889590, "uuid": "ac280a97-a8cc-4c10-a87a-01f18847cedd", "comment": "Malware payload (Swisyn)", "value": "f17f46dd1b6c4a3d06951539c957667d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889590, "uuid": "673ed64e-c616-44b1-876c-73059109b9ea", "comment": "Malware payload (Swisyn)", "value": "33edc4fef74be1f724188e0ce6769abe70e24a8e9b0a6dff5b137a58259bba46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889590, "uuid": "e1f85ea3-b687-4a89-b802-c0b0d09e9d24", "comment": "Malware payload (Swisyn)", "value": "c1225c33e02ec1e74cd37b97e4d4506b0dc8783b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889590, "uuid": "7d0582f8-db5a-45ef-95bc-493676a1e2c7", "comment": "Malware payload (Swisyn)", "value": "430ec7ccddfbc9306ad41a9a6d82c30f551fa4b06a03d47553802719676ff139b708b507a332ae88619fa81653a83b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Swisyn", "colour": "#50863C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889590, "uuid": "a085081d-a0bd-4fd4-9ef0-4f3a4ba51fb3", "value": "T1E3442A03BD82541ED16ACCF0C8BAE675B9319E781FA1BE4763D0BB59697010379F620B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889590, "uuid": "48562f23-9996-46f9-9855-3020655e0750", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889590, "uuid": "f1a96883-9be3-4605-ba52-b5a52f338af0", "value": "3072:AygCullUQN7gsBh1L1QygCullUQN7gsBh1L1E:ARleK7712RleK771S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889590, "uuid": "aec61dc2-99fb-42b7-9127-4379e65bc07c", "value": 266998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889590, "uuid": "aee4227f-c3eb-4a1b-8da0-b906f12d30c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889590, "uuid": "f0ec2d08-4373-4766-8cdb-c16d5fa73e0f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f200f2-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889591, "uuid": "2eb90392-c5b1-4f82-bca6-e4f4e2e5ef2f", "comment": "Malware payload (Simda)", "value": "3ff2806400a9c314fb114c31aed10402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889591, "uuid": "49984cf0-6de6-4d71-bdb6-2d52d5b63816", "comment": "Malware payload (Simda)", "value": "33f9d9169dd0398af4f3a25f3450b412d3dbf10f8db51afa9aaa584b5d2f1a50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889591, "uuid": "cc2b9539-26e2-4010-96f6-f937f9b38282", "comment": "Malware payload (Simda)", "value": "6896c00eda2b628c53fdcc906d4d3d152764852b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889591, "uuid": "6c6938a6-8cca-4e52-aa24-97e47a6bbd75", "comment": "Malware payload (Simda)", "value": "a8727486aa56e65ee010df959bab320eb6f47e84223d8afff0240bd698b52e0b358c91c134dd7609b9b8b5d6c27ea0d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889591, "uuid": "5b79e0af-182a-46de-a783-2a4867f33be4", "value": "T1E12413226D5D4E63C6A714BB1BF6FF552326E5A8432BC7676C00420F0C756C97F3AAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889591, "uuid": "efe0efc8-ea95-4874-b5aa-517163227cf5", "value": "088303a3216315a2ba8d66c94c7b80a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889591, "uuid": "b27f4142-2cab-4dd7-80fc-2ec775b3ac66", "value": "6144:MmKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3:W71YpQiU/RcO1VQInVob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889591, "uuid": "03a9bc20-86d2-40ec-b6fa-656e942d0b09", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889591, "uuid": "90ff8cb6-c2fe-4e91-a1e4-7fdb5a24fca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889591, "uuid": "dd47c394-6267-4585-b7e3-cab9c9bc5948", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918aad67-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889592, "uuid": "2f6ca499-e232-4af0-ae8c-035e95a5240b", "comment": "Malware payload (Simda)", "value": "212c14d1337fb996c80ee611ac078323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889592, "uuid": "a706b184-69af-4998-bad0-e58dc49429ed", "comment": "Malware payload (Simda)", "value": "341988e78071d47b805ccf5ec2d032da3512ccd7c8c4dec30124511a8c5026e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889592, "uuid": "c9bbbb79-be84-4641-a090-d7398d5906d6", "comment": "Malware payload (Simda)", "value": "0056a36a6f3938e130c3ad47a429b79fe9e4ce2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889592, "uuid": "55ad5693-f2c9-49c7-9934-f7d5a6c44340", "comment": "Malware payload (Simda)", "value": "5087f8ad9394032ecc813805add85edb50f99a1ad11f19aac4c5d958da2b85e0e50a6d785aa4e61d822466baa1217a2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889592, "uuid": "0b5c5a0a-abdd-4e1f-9260-27428a1626f0", "value": "T11A24022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889592, "uuid": "7dc15018-40e1-4fdb-a004-65232ce94d0b", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889592, "uuid": "efd3fd38-514a-4f6c-b7e0-664415b375ff", "value": "6144:VZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:nquCuygMQjd5vJIBP1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889592, "uuid": "47e917ea-ff77-43a1-90ab-fbd7a54b0b1e", "value": 213054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889592, "uuid": "22da51f0-44ff-4c64-bd01-6499398fe968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889592, "uuid": "c3742206-c452-40b6-b045-77fe61577d53", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922c23f5-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889593, "uuid": "fd741b6c-0d2a-41ff-abdf-5ded5312c190", "comment": "Malware payload", "value": "780c362d696d9be8f767f6448991ae07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889593, "uuid": "e6d38b99-7042-4072-828c-becbd582d15c", "comment": "Malware payload", "value": "3422f6b21a96881ff91caf12627490133b8344eacf566e75112fc3f9779ad4c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889593, "uuid": "cedd78d1-38b4-4623-9448-9c4dc7cc97e0", "comment": "Malware payload", "value": "e56a03a9ca020fa5c1249687546a2c7c160d0063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889593, "uuid": "829afb0c-cfdb-4f6d-84b5-be0ae24fed16", "comment": "Malware payload", "value": "5f714b0b8e86cfa186378bf66fdbff0a134f4b0d373b9447d46f04f1fc24df72300d90cd4ee1a0a563896f285d895b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889593, "uuid": "42286aa8-0b43-4484-9283-baddfb2ce9a8", "value": "T12F25338606C33944EFBDE3B5878637A939BE2F8853A2583B7B4DC14F41B151D79A40AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889593, "uuid": "b2a5b6f7-13b1-476a-af1e-f998a79e4ec7", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889593, "uuid": "827aa8cc-8a5e-4ec0-aa8f-4b3afdcc7fb1", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuN2b0zAu:+YhQs7tWVToP0Hekxbl5Tuob0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889593, "uuid": "037d52b7-e0fb-4e28-bcc8-e5ad14087007", "value": 1053180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889593, "uuid": "e86ccfd1-71c9-4fc0-9a7a-58b4061c6912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889593, "uuid": "4812b115-2dbb-4e61-9cf5-fe445b50f9df", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c3b5c9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889594, "uuid": "9115a2cb-5d52-41ea-a42b-cd01d48ade37", "comment": "Malware payload", "value": "ac70de42c1427ba9fbbf095d9533e3bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889594, "uuid": "18b9ab35-5de6-4fdb-a053-5fcfc7bdbb05", "comment": "Malware payload", "value": "345d0c362239a33ab0df56b854560cf5e09281121f06046eb2a326eb3d4d4fbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889594, "uuid": "6c0385f1-7015-408d-96e1-cf7c5cf17583", "comment": "Malware payload", "value": "250714af20c420cf8de92003f85d83f01be6c827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889594, "uuid": "2bb0e91b-b544-4919-80b9-a300ed9e96fa", "comment": "Malware payload", "value": "75391be3b3c5fd4616390534d3c8eaf50033d083acc8459955f300fe9995ef39d1eedb1d52a3c2d776fe07ac902ea7bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889594, "uuid": "0c0d3c73-89eb-437d-9181-e0a80fa6fba0", "value": "T11A552323B4D090F8CC452937019DE675CBB26AB726F6A175AFE81C6A2C314A16F1FF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889594, "uuid": "c46f7a01-2780-49a8-bf3e-71bb1e13844e", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889594, "uuid": "72c14f47-3645-48d4-bffb-2d252c7aef9e", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lAN2kwSk6Ye17lD:7E2lVL3Ze+/F5ndjFWmrjyx1cmNk7YKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889594, "uuid": "1f895a1d-a4b9-4226-a6d7-fd0fff3eea65", "value": 1403405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889594, "uuid": "9f7c5a99-2726-4ee3-8ba3-d4b355c41a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889594, "uuid": "0d247ae8-c649-4156-9c79-1281630c8543", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935cde9b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889595, "uuid": "268608f4-a654-4557-aeeb-21e8150e8ad4", "comment": "Malware payload (Simda)", "value": "fc9d44430303e48581b15b291b04f8cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889595, "uuid": "a2b9f896-c515-4f43-ae14-51bbf0096243", "comment": "Malware payload (Simda)", "value": "345dfac095d740c73c578f5cb0120014018ed9a51e433954a7ed52722c71d5ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889595, "uuid": "d113d2b6-3ca7-459c-9b1f-0b00ffa64c49", "comment": "Malware payload (Simda)", "value": "d088bbadd655165fa40e08a43dbcd1a3ef1aed2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889595, "uuid": "718e9ab7-8ca4-4237-b068-eb32acf28610", "comment": "Malware payload (Simda)", "value": "36f4bbb187fb638380b9dc2cc78f9a2b022f0d2dddf7bb86e613da2473a92b8ad20ef70d7c25153afb20e2447dcfb316", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889595, "uuid": "a1183921-568e-4576-ba78-d79b9759c7b8", "value": "T153749E23F1450176E4E514F1E5FF3A9A106C6E26471C68E3E790AEC929782F77A3C287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889595, "uuid": "abb9cb25-4d2a-41af-b51d-7d2e70557a62", "value": "614b67a6e9f2f6744843319be05d107b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889595, "uuid": "87573012-6528-4020-adc5-ed2947fcddae", "value": "6144:2YCmWoza0a1IMVVEb3uqRpwIUV9lMYmFQqZRRphLuVucfb8ehbjN8wS21bKRTw4W:SmWQa0a1IMVr9eMqbRzLuVucfb8ehbjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889595, "uuid": "04792ef3-b0c9-4d58-941b-c2a261a4068d", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889595, "uuid": "ea275ee6-be2a-4500-9517-296afa716e18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889595, "uuid": "b53a86e1-5c3a-48ae-852e-5744ac947356", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72301739-c858-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763894264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894264, "uuid": "5305e99e-e94a-413b-8760-2b37c98e2797", "comment": "Malware payload (Mirai)", "value": "9aeb314276a5a7a148c94e041fc887d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894264, "uuid": "7d6f5094-9066-4cc4-8dda-e134965c388d", "comment": "Malware payload (Mirai)", "value": "348821fb9bc381b4bcda43574446adf9041ce123183ee169dc943e74937e8352", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894264, "uuid": "8c75d5db-b7df-428c-bc3e-dc64302d82e8", "comment": "Malware payload (Mirai)", "value": "59a6c727da8e1310062de27aac5ecc29a857a821", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894264, "uuid": "1960ba42-5e6d-48c2-9fd1-44bc94aef85c", "comment": "Malware payload (Mirai)", "value": "fec8f870f083cb2b8e452d8cf113921f65adacf818f94388dc67ab569cca87a08a6857ad0df0443d86c59c232dc84eae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894264, "uuid": "415a2abe-0609-418d-8073-e7a9bba8e2fc", "value": "T12F734982F84B80F5E817887099ABB33F9731D9144131E66AFF59DB7DDA23A41661338C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894264, "uuid": "29b4c672-69fe-4dee-8cd9-89d8cdc3284f", "value": "1536:sKKBcBbghKYfLPrgMgqcmxCfwzIfR8W/aPuL6sOk0h5VC:sKwsmnwqcmxCfwzyvCPunOlvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763894264, "uuid": "b1f10cf6-ce54-45b7-8a29-da7202f6f7bf", "value": 75744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763894264, "uuid": "d5c90ff9-1c1e-46c5-8328-f4228a2d42af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894264, "uuid": "c7de8490-7e12-42ec-8793-aafc1410e6ce", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f05c824-c853-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763892058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892058, "uuid": "7dcc7529-dcba-410a-9444-666a812e45ff", "comment": "Malware payload", "value": "df866a100b0a5444fe0bfe1013c1a0e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892058, "uuid": "8392a76b-044c-4ddf-841e-f03b73d1c4fe", "comment": "Malware payload", "value": "34e206c3523c6c162c21e462be8dc41cc6402cf533144d2d485591500b5f590c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892058, "uuid": "85e382c4-cc14-4988-8373-a2bd995c8323", "comment": "Malware payload", "value": "5c2fbe13415aedc6a55d2d2d54b45ad29ca16467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892058, "uuid": "212a6fdc-c98b-41cb-80c1-37bc40f0ad73", "comment": "Malware payload", "value": "12636bb3ec6be5ca9813d4aeea0a7df2e8644ca703dfa9f7c5a8310986084d3874fe061aa7404831f6f4cb5d6f47d28b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892058, "uuid": "9121478b-dd8b-462a-bf07-b97815a5c206", "value": "T18045230B33C156B2CE4A537106832AA11E73F7BD1770E83AB7D8940B1DF29446F79A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892058, "uuid": "cc92a7e3-796e-4702-83ce-faa871f839f3", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892058, "uuid": "37cc8af4-3c4e-4549-bae3-007ad90ed62f", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFDrtox:qE27hQs7tWVToP0Hs0/htDH3pGaFdox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892058, "uuid": "62db5f2d-8f24-4e15-8c23-de18e311e2fe", "value": 1178092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892058, "uuid": "76335c40-b451-450c-bd5e-a83284e37a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892058, "uuid": "90a4d93f-abb8-4f91-bb8c-54929f183883", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94263ac5-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763889597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889597, "uuid": "2afe5b64-ddc1-48fe-99de-d592fe944213", "comment": "Malware payload (CoinMiner)", "value": "d91ea9fd7686c015dddda0bbd2bbcb3e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889597, "uuid": "bcbc97ef-0d05-452a-9758-89ed7424e068", "comment": "Malware payload (CoinMiner)", "value": "3526771a4ba06720c1a23eed0b042bcf4870e93fd602ccf92273b541db68a781", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889597, "uuid": "6bd29b77-150d-4488-8f1e-e33b4789bfc0", "comment": "Malware payload (CoinMiner)", "value": "326fa746f264dde06d4341e20865b40974450ae5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889597, "uuid": "54c149a1-e968-4e03-a260-80d779679543", "comment": "Malware payload (CoinMiner)", "value": "bb6fe921a0ac6c29bfdd5e7f3ea66e0b57578ef9ef9d478ba38ebace348792460ca2e498f0a99d2337e113ffe819c5a4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889597, "uuid": "4965318e-5408-40df-bcfc-d25a8391abce", "value": "T1BC569D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889597, "uuid": "87706a2a-f477-4e10-a8d6-9e77552c5136", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889597, "uuid": "9170fb3b-b76f-4d18-80fb-e718365ee91b", "value": "98304:IvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ6506:I/II/6aYXdFD22VatktKpEEd1Qi0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889597, "uuid": "d6cd746f-bddf-4139-ab01-ff2c66c85b9b", "value": 6440079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889597, "uuid": "45e9ef12-ad82-4840-84f9-84b4a50e1ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889597, "uuid": "cf36d930-3085-483e-9bb2-9a5c3ff9d161", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f866f9-c843-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763885216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885216, "uuid": "d64fb358-8c1d-4213-bd1f-6d98d1a24797", "comment": "Malware payload (Gafgyt)", "value": "bdb190844cab0805434fd97298b55b7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885216, "uuid": "daf30e60-8986-48e9-8eac-7d9e9d1c6efd", "comment": "Malware payload (Gafgyt)", "value": "3532d395896f767950d5986c405d5b7ff9631c9870085d4faa160c9cedae4a4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885216, "uuid": "f64be833-7878-4986-95c1-82c368891ffd", "comment": "Malware payload (Gafgyt)", "value": "37fae72f662f364de34708f47b7144333755aa74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885216, "uuid": "9429bb16-ae3b-4eac-8a41-9036e4f87697", "comment": "Malware payload (Gafgyt)", "value": "28fd5639fccb20f85bb2f1f6f8d8a8ede0b2fc16a9f0356b912eda12dffb7c1e90b2c74715da4f5d882aac69fc23af5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885216, "uuid": "8546b0f4-fb3e-4020-b782-08ad3cbad65b", "value": "T18FA31744F8448767C3D327FAE78E439D77351A6457DB33116A39AEB42BC2B982E29130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885216, "uuid": "a6a11c12-2192-43c3-8d07-08c0487d1059", "value": "3072:Plf1jKRi/VYf84Y/k7XTRUmpEqQ45vVXY0X:vjdVC7Y/k7qmpEqQ45vVXY0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763885216, "uuid": "df97d499-d9f4-4454-b216-e8b5f9e548da", "value": 105111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763885216, "uuid": "21b0fb0a-3a02-4ecd-af7d-58122ff86eaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885216, "uuid": "be976a04-40dd-4372-88c2-58c6b5000957", "value": "a-r.m-5.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ef54c1-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889598, "uuid": "d60b82dd-0d3d-4997-bba0-7331bab695eb", "comment": "Malware payload", "value": "28842dbdddab0ea34a361c9cf43fbcbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889598, "uuid": "b1049878-63ad-471c-8151-8d4870173850", "comment": "Malware payload", "value": "353c782ea38daf5586dd4da33bd1dc77b6f2638e7360b0a65427babb3eb4d82f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889598, "uuid": "01f6ef1b-c019-4a7c-a3ac-48b894416670", "comment": "Malware payload", "value": "237312c281d804ad89bcf0c9832a12005d121c34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889598, "uuid": "34edab09-f4e0-4f52-9470-904d2ec26cb1", "comment": "Malware payload", "value": "db5aa0bf7c8b15e8136a44e04b4410a11543b65a72b44d9e810d7a36ab1f597b629e12c31f5752565e60e1025ba16326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889598, "uuid": "771c12a8-386b-415b-b8ef-f7d4fc223fbd", "value": "T15486128D73E4E6CBAD6009300E75E875FCE468B49CD46AECB316D12F0DB66007E6E994", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889598, "uuid": "de3937bf-3bb4-4e6d-a986-90a78acc1098", "value": "95ca9bd9878465227c91ca2aefe2bfa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889598, "uuid": "28b2ffa5-a837-4eb7-bb8b-251ff8f0823f", "value": "196608:zgxGQ02MLXDzkLA7IBtV6jBn3xc60leuJXOe9cX:zFL2ewLAsojB3xBncOeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889598, "uuid": "9a35b31d-fb9f-400a-ba5c-cf798c2ae0ec", "value": 8301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889598, "uuid": "07c1ae40-bc5f-459c-9731-3730eda60e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889598, "uuid": "3831fcef-1fbc-445d-99a8-a00b5ea5dc9c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db499dd-c829-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763874017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874017, "uuid": "6d2099e4-2c19-4f94-993d-6d934d0297bd", "comment": "Malware payload (ValleyRAT)", "value": "c9cbc42b3f912834a3f6d0f71c31f555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874017, "uuid": "fa2dba24-fc69-4c57-abbd-cc67c8ae45cd", "comment": "Malware payload (ValleyRAT)", "value": "356cb3251394d86db58de7b279f044c36159f0decd98b8ef8f9b1117795ab495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874017, "uuid": "2f06dd64-65c3-4dfc-8cfd-ebf4215d3c1f", "comment": "Malware payload (ValleyRAT)", "value": "3b081b6c531c7b429a587f9098fecd31a517825d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874017, "uuid": "7a1f6fbf-86e0-4b77-b781-1671b37ae2da", "comment": "Malware payload (ValleyRAT)", "value": "fc1da1880a5b32d3c7c317d534810d1dbeb4c2d84bb4f83a46fe33dd701283bfc4f33dc0e63e13388c95dbfeb03a961a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763874017, "uuid": "94619aa8-4363-4d5d-a06d-ac4de98a73b6", "value": "T1E0E4E00AB3B555E5E933C53DC9428A06E6B23C561B35CBAF13A0565B3F233609D3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763874017, "uuid": "2ed37e24-ff7a-4ce0-88ee-b0698a05a26b", "value": "e2a1496c94d52a035fe47259ee6587b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763874017, "uuid": "45fc15a8-7f7e-4229-815a-84db81194618", "value": "12288:u/B9kScNAGL+BF/hp9vk83y+d6rrWT+tJvY6eqMQkABIddKJyG1E3kWUy:u/LcN0BRhp9vk83y+d6rNA6fM600B1EJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763874017, "uuid": "11e2071f-491a-40eb-8e50-8626c6c6cffa", "value": 674682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763874017, "uuid": "123b5d8f-fc82-4da1-8f2f-6c43fffe5777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763874017, "uuid": "4036965b-77bb-4ef5-9408-5772f27e3078", "value": "356cb3251394d86db58de7b279f044c36159f0decd98b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed9badf-c898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921666, "uuid": "f9f06074-cfd2-406e-b3d3-e4be79fa5e90", "comment": "Malware payload (Mirai)", "value": "a242c0a90639e97116ed663d2cd83760", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921666, "uuid": "377e4fd7-7d2a-4f78-a00f-bcdafcb97d2a", "comment": "Malware payload (Mirai)", "value": "357d5b31d3a00a1907e06904a9502feab02e2a6387eca4eaf1aebef87f1dcb14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921666, "uuid": "06cac80e-822b-4285-8425-fd79c56ddf74", "comment": "Malware payload (Mirai)", "value": "29c9565b3d4ba39179af8e52d4cec21f1d64860e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921666, "uuid": "78c95d2b-e3e9-4647-955b-eae14ead8522", "comment": "Malware payload (Mirai)", "value": "8b84b7958292f230b3a49b7f026a1f138325b9e26b00c716a42da96b0eb16efbbf800490986cb80cad9a2cd8a62e7889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921666, "uuid": "d6fa3fe2-99c5-4658-8724-141b39caf8cd", "value": "T1A0C3BE97F68B24A1CC6146F007C77B9D2E6362119E6BE9E76C0E763B097A0DF09063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921666, "uuid": "1c83dd73-8a4a-4d19-823d-2cc441bc84fa", "value": "1536:/5LQvJrKIEcfzXJ52ZB4xfLaLWq0IijnUclV/wONCsxZJrig0I/LWw:/5LQv5gqrmqxfLetEnUc8ONC4ig0Iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921666, "uuid": "8bcdbfb3-1d39-4cea-9cc6-7ecf5eb3008c", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921666, "uuid": "83d8bc8f-4ac3-4273-8544-b4b0d4a12586", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921666, "uuid": "580a2bfb-17a1-41bd-ac1e-626314b2fd24", "value": "windy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d067a8-c865-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763899772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899772, "uuid": "c24072b8-188d-460a-b8de-a8ac25fbbc63", "comment": "Malware payload (Mirai)", "value": "ceba6ab7782c6e04180d29025bced710", "object_relation": "md5", "Tag": [ { "name": "armv5l", "colour": "#775AEF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899772, "uuid": "2d444a82-dbfb-4741-8e9d-735b5e81e4e3", "comment": "Malware payload (Mirai)", "value": "3582cb544618c049b8fa9bc5ddf2b9faca22acdb4ea51d92c3abcc91674e0a0f", "object_relation": "sha256", "Tag": [ { "name": "armv5l", "colour": "#775AEF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899772, "uuid": "9f06aecf-3977-49e2-ba2d-fd13b3f7c7fb", "comment": "Malware payload (Mirai)", "value": "a9f8cd8c87a9307fc5a7baf6f7ec67c319cfee83", "object_relation": "sha1", "Tag": [ { "name": "armv5l", "colour": "#775AEF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899772, "uuid": "3cee46d4-51f2-41d9-84cb-b12c336e11db", "comment": "Malware payload (Mirai)", "value": "a98c4633b5c99dbd9504c65ba1a034dec71e0526e9c18b62936a86b3e2551aa0e4a1e165bf93ebca300bcd4d8673cc73", "object_relation": "sha3-384", "Tag": [ { "name": "armv5l", "colour": "#775AEF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899772, "uuid": "f4571ac1-8fb7-4078-8e8d-351923f4b107", "value": "T181632A81FD819612CAC1657BFB2E428D372B17B8D2EE72039E255F2137C785B0E6B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899772, "uuid": "d2ab2447-5e8e-4797-aa71-90330bf7f63c", "value": "1536:3vzwXmzDgV1UWM5H2KsGNoS4dozykpEzzyR1sNJqjKN:/zwXmwDUW2no9cykKWR16J9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763899772, "uuid": "a285aa84-e0ff-4e4f-9ea7-c4362ba7051a", "value": 68720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763899772, "uuid": "c73f68ae-0ef4-4733-9933-567ad2f1a249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899772, "uuid": "734e4663-1e51-400b-bd7a-4cc7087f3aa5", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957ffcac-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889599, "uuid": "404129f5-96f1-4ce2-8165-872a52e402d8", "comment": "Malware payload (Simda)", "value": "a5ac1e9f4b3ea453e195562ddc242629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889599, "uuid": "bfbdba22-3cfe-42e5-b91a-bca1d660093b", "comment": "Malware payload (Simda)", "value": "35972590b79eabb7394fa147b3dd64a8f3f7f0bddb82c527d87f345215c00e30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889599, "uuid": "bcc17abd-ecff-45de-96f9-83ae366e75c3", "comment": "Malware payload (Simda)", "value": "b3d74071f7a7991f6c749a14c763f0c116e037a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889599, "uuid": "eac2bf77-3dc4-40e7-bb6c-7854709c23fb", "comment": "Malware payload (Simda)", "value": "b809a5d28d1d6963784131e4e91cd4a5cf6537418e875ea674ce12ce6a2d743fb20932be50faa87883af9eebb11db603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889599, "uuid": "cf228021-e215-4ab1-a23b-684d96be32c8", "value": "T120241223EBC61E42D8650F78858EE046DEFCE48D3FA292368D54CD473E437624E59B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889599, "uuid": "e5fb2149-e67f-43d2-9cfb-c76fac6867d6", "value": "a1477f62efa130779fcb2868cf890b42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889599, "uuid": "dfbfacbd-7425-4a14-b275-3bbd4c813ea5", "value": "6144:wrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:CsTbzu1glovW4EH6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889599, "uuid": "0baa6199-9e5e-4beb-91a2-770a5ecce167", "value": 223040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889599, "uuid": "b8290b49-a2f0-4d76-9fe9-4a3a55e02f55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889599, "uuid": "cfde9ff0-173d-4e0d-bd04-1700571dfbe9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96227448-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889600, "uuid": "37044239-faa4-4708-a1fc-f5d65af145c8", "comment": "Malware payload", "value": "e164b538c255025733d8d34de42f6b23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889600, "uuid": "2df2e527-8b0f-452a-ae01-aa9b9c1ad384", "comment": "Malware payload", "value": "35a6c02594ba4b6feade5992fac47ad6e9e40608e17995c43ea6583abfa6a027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889600, "uuid": "e36581cf-1892-4196-bdbd-9e1ebb31a672", "comment": "Malware payload", "value": "0edfaedc43908c00a9709850efc2f8dabacb4cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889600, "uuid": "9bd4cf62-8026-471e-81d4-db1c3f76b8ae", "comment": "Malware payload", "value": "4aecfa0f7f9017c2c4827657586d95ed3fe11b85ed710a63e59165f6b01f47c579dff6bf040603c5ec18b53ccb3b95da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889600, "uuid": "298b4324-ee4e-4268-ad3e-23633e65b6b2", "value": "T15165233B77948CB0CC4446700B0D3BB94FB7E37622368451AFD91B663A321CDDEA9669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889600, "uuid": "39a354fd-f0bc-42f3-9eef-98435f9d0322", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889600, "uuid": "f9013db9-5fab-48e9-b364-b38b0848ce7a", "value": "24576:v6Zv2WqhsVn57hqQeKUP581L9k+4EBtXdFcmJITfnbDyjEu8N6URcxzHt0vseFmy:vE2WqhGtbUPuVt4EBFdFchT/bmEx5RcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889600, "uuid": "4362bf71-d380-4524-ae1b-6ce8e1bde281", "value": 1518209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889600, "uuid": "bfc2927b-c6d1-43ff-aa35-eaaff30eaf17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889600, "uuid": "dbd3b2bf-d960-43da-b790-8acc4e59be64", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bf57dd-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889601, "uuid": "81caec18-d93e-480b-b437-4ab84e16b677", "comment": "Malware payload (Simda)", "value": "abad0bec4617a50d3f2ba632b5d1aa6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889601, "uuid": "5413fbbb-3735-4278-9c91-233faaa65928", "comment": "Malware payload (Simda)", "value": "35afd034be5c169a9ce512e33beebfc34f8cb9cf564d706a3a6ec5faf2f683d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889601, "uuid": "9014069e-e8d1-4120-b693-a029c962098f", "comment": "Malware payload (Simda)", "value": "dec7bd84438b88afd34274547e19d99c8bde2d4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889601, "uuid": "3e601912-f8cf-4d7b-84d8-64b5b327aa5d", "comment": "Malware payload (Simda)", "value": "4666d150760ed4ee2e73807dd876df8cf1881391245ee9bb1b265824d39bdd0cf38cba03ca161ac6f925a3040c8e1101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889601, "uuid": "e467b0a9-cc14-402a-8b82-0d1bee7d5401", "value": "T1613412C7B18928D5C440067349FAA7815A2DFD551B1BC8FBEF88412DAFAC981BE3531E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889601, "uuid": "63e51b0f-c4fd-4c2c-a446-32c3207e3612", "value": "25724a12bec6f765c371201f99ac92be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889601, "uuid": "4b70efe1-de66-47eb-9a3c-42f1f6bb2547", "value": "6144:+EXlSylvFuWaS54hIAv/QhuA7HY8pPZ0FP6BzxM5Em:zAylvv5YRwh9HYd61xhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889601, "uuid": "a070caf8-d962-4308-9760-3de63f98ad98", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889601, "uuid": "faea43ed-a7ba-44b0-a996-2aa544270ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889601, "uuid": "2aa8c553-0164-4ec4-9b5b-fa8f92cfd793", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9772cd45-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763889602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889602, "uuid": "4c9dc2b2-9339-4797-b965-99985638d6ad", "comment": "Malware payload (RedLineStealer)", "value": "a8feb51a3f0e0f3b499404a1ba9b13a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889602, "uuid": "07350cd6-4586-4124-b06c-e414d1568603", "comment": "Malware payload (RedLineStealer)", "value": "35b2775aa41701dbe69c8f2e983bfeb81b296aa0bb585c0fda8a0011683bc693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889602, "uuid": "8b4b6e7e-6f05-4723-b617-532efdaac1c2", "comment": "Malware payload (RedLineStealer)", "value": "b99aa023a18de94ceae9808a4f8db5db7f9b33a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889602, "uuid": "eb4a7a62-32a8-4412-9579-e9c23f915440", "comment": "Malware payload (RedLineStealer)", "value": "1576ac18ba2181bc3f64900f22d7dc24b4cdae7f991d21564de7ddb89164e7279d0991c215d06adde67edc7a6894278f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889602, "uuid": "2885760e-702a-4441-bc2d-1f4f70166fff", "value": "T1D254D0243591C1B3C4B7113444E6CB399A6A707147BA96DBBBDC1BB96F202E1A3392CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889602, "uuid": "1639902c-4b48-4f2b-9bc1-105a885f7653", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889602, "uuid": "69250008-2014-4737-a6ec-d9c2ad898266", "value": "6144:NDKW1Lgbdl0TBBvjc/JuS2Qt6/JPU1bIINJRNldze0YoO9XFVi:lh1Lk70TnvjcmRG1W/Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889602, "uuid": "dd90ee37-accf-48bb-a5d3-048ffddb42ed", "value": 305440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889602, "uuid": "9ad0d3c0-45f0-44d2-b9ec-405d14c1e081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889602, "uuid": "56e6a923-d6f0-487b-a9b1-9c0fd9a67665", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8253a4cd-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763889567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889567, "uuid": "1e2b4ecf-4f5b-44d4-a790-2532d15e0e13", "comment": "Malware payload (Mirai)", "value": "63d5af2be34068f0ebf96a2363d50b05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889567, "uuid": "4365d13c-0f84-4888-b63a-555ba8f4f438", "comment": "Malware payload (Mirai)", "value": "35c4d18ca800986a7662dcdbc6d2c7865d3567aadb1f08af05cf1e9cf41c1adc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889567, "uuid": "3e6d1101-8ed0-449f-8616-077e743119ee", "comment": "Malware payload (Mirai)", "value": "9557f3ec94eb213ef43d45cf80ae9ec99a485d2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889567, "uuid": "3b6d7c32-8589-4d9c-9d78-a47abbe103ae", "comment": "Malware payload (Mirai)", "value": "60a7857a63a405420856d082621d0b07f372a44b0c34c83aea1c4a87982e2f91f6a879b9e1ce7279031cdd8040a3aaec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889567, "uuid": "1b8aac20-7f7e-43a1-9e55-7a80f8929666", "value": "T1C06302C0A2422B70997C347BEB13CFC126912D78C1CDB5B112EA509813BB4895FBBE83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889567, "uuid": "bbf7f301-8b8f-4a77-b851-020340985ae7", "value": "1536:20+u3u2NW2tYPweJ8CZvmci5wZb6qXD2wX0ss9csA6enXanCSrLqz:27u3vW2aPwe+Ci5WtKwkss9cf6enXnIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889567, "uuid": "fb3a54b2-63b3-4ed3-971e-d55013521173", "value": 67636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889567, "uuid": "117d4019-ecfc-43b5-8a8b-6403b5f95cbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889567, "uuid": "d2256e95-610e-4ac0-a6d4-d461ef208b75", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9823f186-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889603, "uuid": "83905a2b-91aa-4c67-b185-8a517e26e7ce", "comment": "Malware payload", "value": "12030312dc4cf42f388f6a31611b1b82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889603, "uuid": "39da4052-d2d9-4e22-85ef-9bcb17e90425", "comment": "Malware payload", "value": "36024f8f58810ae622491633596fd4957733932bc1c278a2d8b57bf5911610ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889603, "uuid": "c077e872-aced-4d50-aafd-1bd90ca93c39", "comment": "Malware payload", "value": "71efdc8b0a8726f7f36fa66bbfd0493da6fb6fd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889603, "uuid": "70fedc28-41bd-4599-a695-f6293d265259", "comment": "Malware payload", "value": "381264fd25fa24263e70bedb251391b24adbc98f23101f19a51a898d66131a3e42cf59c590c74b3c97586019de242c76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889603, "uuid": "56b678be-55c0-4ae0-9e52-7bc6bd595b2f", "value": "T12664AF7377C08DB2C846053002576B768FB3EA3A15718457FBE8572B6C74D50BE6AB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889603, "uuid": "c9d36427-9d09-45be-9e97-15ae85874b0d", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889603, "uuid": "bf5e6b48-0e36-49f3-9693-9cbde2a95960", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5TKReFq:BtKe6YiDdv3m3mgKHDjSeeRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889603, "uuid": "b039a80c-3dac-4f04-8c6b-a801db8d9e37", "value": 323523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889603, "uuid": "8e102bc3-15f5-43d7-8077-48399b636178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889603, "uuid": "f1ce4cb6-c340-4e6c-9fc6-0f3a5bb1c1e8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f95b7e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkComet)", "timestamp": 1763889605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889605, "uuid": "2e850f0d-fd36-465a-823c-4e98f5d59d99", "comment": "Malware payload (DarkComet)", "value": "3073247e9aaea05d369730f762e080c0", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889605, "uuid": "dbdadcb6-4251-45d2-bcf5-732f5c5b72d5", "comment": "Malware payload (DarkComet)", "value": "36501ff706eae486b28125c1a165f3227bb22104b0f7ed832120cad36ea8caa1", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889605, "uuid": "5fda4e84-0fa1-42f8-8a91-760ec1372e8a", "comment": "Malware payload (DarkComet)", "value": "2eeea698b27225fa74de0ad54621939d830073f3", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889605, "uuid": "401e34cd-ebdb-48e9-9e9e-d7ab464423d9", "comment": "Malware payload (DarkComet)", "value": "859762ac6dc4a382d885e6275000e28e768488e247fc24a4a4db994aa977b47c84b0060002c0c2b79261a689b95419d4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889605, "uuid": "8a423c45-ef48-438e-add5-684a96f82d8b", "value": "T1BDB51260E182E8B4F49639F5482DF8A001473D5A98B1252E2C7EF66951B33D3EDE790F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889605, "uuid": "eafc2b1e-1254-43fd-8517-cd5bdd89dc8a", "value": "a38ad86d74cafc45094a5085e33419e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889605, "uuid": "4fad59a6-4c49-4b96-b04d-12ddab8930e3", "value": "49152:7iRne11j6bgulONn1LS4JtYDGgnjba/c9Hi8fXSE1kICPOLBfkBKv:7iY11ekusi39vYEH7fD1nCPOd8BK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889605, "uuid": "9d21751d-8865-4100-8219-5cc5816fb6a1", "value": 2321920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889605, "uuid": "292f1fbd-aeb1-4ae0-9c30-268bab1754f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889605, "uuid": "d8851398-0b7b-47a1-98d8-123b38f57416", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bce45b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889606, "uuid": "0eec098f-ea2e-4042-96ed-cd840d38ab93", "comment": "Malware payload", "value": "62130e542d780c04b370086e4ae6ec70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889606, "uuid": "e6fbd586-01de-4d25-a561-80cce6d3fc29", "comment": "Malware payload", "value": "3672765a6e0d70bd77fc7ae765b722c5cfdec538c9bf49cebc9ab77ec19e7495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889606, "uuid": "c11637fe-35f4-4c80-ac99-2f36ccc4431a", "comment": "Malware payload", "value": "d80f326f1c02d92e9491ceae1ad6a7a0703c121a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889606, "uuid": "5381020e-7e04-461e-be43-c5a17dd4f173", "comment": "Malware payload", "value": "cdd348ca2e3f21ed823d1ca84b382700b6b07f62bf8e11a45181259f19d0ab73953185303e05f89a5f748b2f6bb17c87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889606, "uuid": "3758d8cd-592a-420a-abf6-df46ac27eea6", "value": "T150A5E1BE8E254758C2F3C2F6CCAC68BA1059913420E244879B4EB03ADD75CE1F95DB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889606, "uuid": "6eb30e51-9604-404a-a0b6-d356c5a863a7", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889606, "uuid": "de511211-45aa-4668-b4e7-9e68818c80fc", "value": "49152:L0V7Su9Msnt6e0EqOh3Ybb6ftMa8fCuzx:LkuExnYEqOheuFMa86u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889606, "uuid": "678ecd72-2bf9-4841-8b25-c9adeeb4c022", "value": 2075831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889606, "uuid": "45199249-1745-4339-8ad5-80e838d39558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889606, "uuid": "fa3279a9-ac45-4a44-b8b4-028bb6882ddc", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86590f54-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763890003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890003, "uuid": "bf12469f-7a51-447d-a7a3-000230552017", "comment": "Malware payload (Worm.Mofksys)", "value": "3b55b1a5437160fafd122c23b955a9f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890003, "uuid": "a431646b-b487-4727-8323-31f33b2154f2", "comment": "Malware payload (Worm.Mofksys)", "value": "3693b5a46d2462187164263c8fbb9f5027967715b7cd65bac72ac1682de644ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890003, "uuid": "342c076c-5d17-4bdb-bd84-84978db8843a", "comment": "Malware payload (Worm.Mofksys)", "value": "a54cf724027830064c0607617af502e980af6eb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890003, "uuid": "aa2c244a-9fdc-469f-867b-e291357cf437", "comment": "Malware payload (Worm.Mofksys)", "value": "41db45abda7f689034b7af7d01b438abb2705dc339103bbfd58dd3f69e054077c999467bb68b67e39dade3535bb0f017", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890003, "uuid": "d6dbdbb3-b624-4083-b75f-681a872169ec", "value": "T12114E82BFA00702FE9A78AF06826A5A6BA352D311BD1AC4B63D1AF453471513F1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890003, "uuid": "16fde960-2d67-4d67-98f5-b51ea5b31297", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890003, "uuid": "360d1c38-6ba2-4548-b57b-6c0b3d7fa38d", "value": "3072:evEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u9N:evEN2U+T6i5LirrllHy4HUcMQY6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763890003, "uuid": "596bddc0-ca2b-4359-946a-23bcd03800e6", "value": 197340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763890003, "uuid": "01517c57-0944-4469-8b20-726373a6d4c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890003, "uuid": "16ae9f11-5e86-4776-be6c-b94e321d5c5e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0600489b-c851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891076, "uuid": "d7e22ec0-fd1c-427b-94be-7ec751445a23", "comment": "Malware payload", "value": "a8029c0e43303be8b9a42f753d374489", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891076, "uuid": "91b86eea-88dc-461c-9e0d-825f0c3297a8", "comment": "Malware payload", "value": "36a20e59f4b74a41eeceefdf5a5687c16d69f4fb44bb65d72d1d64c2ffbe7b9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891076, "uuid": "54f163d4-c4b0-4a62-b076-16dca50c12f2", "comment": "Malware payload", "value": "52e1eaf53b2a75ecf037ddbd2857330be046cef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891076, "uuid": "bcc2692a-d2f7-49b5-a411-0914000579f4", "comment": "Malware payload", "value": "6c25f40335c64d081ee9f34ebc2b7b63d65138515a24003e1acf0049bc484b5416210c7c50b922ade61de21a48e7f1ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891076, "uuid": "b832c9c2-99b0-4b20-86f2-dc8f0c21194c", "value": "T1FB35230B33C15576CE8A533103472AB11FB3A7BD0770E83AB3E8944719F29447EB969A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891076, "uuid": "d7c90fec-6571-417d-8e46-fc3a8a0ba46c", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891076, "uuid": "857792ad-725b-43a1-bd14-365b80966b90", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFyjtr:qE27hQs7tWVToP0Hs0/htDH3pGaFyZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891076, "uuid": "71d65007-9c10-46cf-8663-89f2919e7c80", "value": 1098329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891076, "uuid": "0fbeb71f-6270-4b11-bec4-1bbb77e34879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891076, "uuid": "929102e4-f62a-452e-b13c-f88f91df9b85", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6b04d1-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889607, "uuid": "37a9ba8a-fb8a-4f2a-99d8-ac91e3024039", "comment": "Malware payload (Simda)", "value": "9462f9f14fc09eb363eb24c70a932ce1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889607, "uuid": "e0af0fef-80ce-4ccc-ae97-cd632e73ef31", "comment": "Malware payload (Simda)", "value": "36a98df3dfe6fe0af38ca2e5c8a7ad1503150e81eb1a17ab82680539b2a34de6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889607, "uuid": "9eaa8eac-0ee9-4282-b57a-96998b080568", "comment": "Malware payload (Simda)", "value": "1746d110d82e67b711a2d4d5d4dbf1c0250bdd60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889607, "uuid": "a3bc7f62-1863-402d-b453-d49682b6a88b", "comment": "Malware payload (Simda)", "value": "21d27b674fd25acc8e597200c4738d30ad45955644bffc4c7a99741823323a026f1e5a6148ccf5f79eeda405fc3b97ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889607, "uuid": "15768e46-6e06-4e81-9eb6-6d09177fa7a7", "value": "T1BEC4122B1B2C9933D6550B3B8EE5EB3461BFF5516733D6D30B009A9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889607, "uuid": "0ff9cacb-a5f2-47fe-8cc5-ae3ca2c1c259", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889607, "uuid": "bc1c11b4-861d-43b0-8460-2a134a903697", "value": "6144:DZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:VquCuygMQjd5vJIBP1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889607, "uuid": "b2332c19-b87e-4a09-b01a-19c648198347", "value": 574490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889607, "uuid": "eb40e2fe-5183-4735-acf5-f39f7d3e272e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889607, "uuid": "8114fb39-6c35-4203-b7a3-a776382bd097", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b059474-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889608, "uuid": "ac12843f-0de3-4b3f-9ee1-1a16811a3cf0", "comment": "Malware payload", "value": "ec201d5a144065a293e3c35b1ef6d077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889608, "uuid": "e39e8f48-3567-41f6-8a10-3867b070630b", "comment": "Malware payload", "value": "36ebef1d1310d31760ca9a3aa27d8412ea376b388ee889b98ee2f60ada0d6cff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889608, "uuid": "77e147b6-9071-4d48-8ad8-5c99e133c777", "comment": "Malware payload", "value": "840bba2fee26f527b27ae58c281d900ce9e11c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889608, "uuid": "e83cd907-5631-4617-87be-6cbd4363a2d7", "comment": "Malware payload", "value": "e71438f79b3617d03280d36a5302822c8016a7c12ce1018be43c6755aadc6e9e30ae05f4f8e10a00f36fc8c24f5bdb3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889608, "uuid": "f6d325e8-5885-432b-9414-63e8502730b8", "value": "T10093E84BF65281B9CA38C537A561C1B21F253E75AA63CA3F31513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889608, "uuid": "9bbdcacf-0f68-4ec5-a0c9-b660a11ff1de", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889608, "uuid": "2de34dd6-fcaf-44ec-8de0-6b0888c39c33", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdx:41bC4Bk6lMTOWw4PkRAPoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889608, "uuid": "0e27010e-17a5-482f-9ba8-6e63791bc97d", "value": 94261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889608, "uuid": "d12d75d9-97a1-47b4-801b-65e1386de4a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889608, "uuid": "9b25cb5a-b6a4-424c-9873-c4e819e380f5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89053d58-c855-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763893014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893014, "uuid": "984cc557-397d-4a29-ba83-829333e70e45", "comment": "Malware payload", "value": "d24854a21bd171b9897c968b00b5da6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893014, "uuid": "430eba4e-ecaf-4e53-9171-626c2a8d534b", "comment": "Malware payload", "value": "370775892c0eb965ff4015073539516aa9598aeadd35042cc733d53a9229afea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893014, "uuid": "adff1769-4e8d-42df-894d-ada86614cacd", "comment": "Malware payload", "value": "46b8d162cb0faa4dd12c71bd9758487eecf462c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893014, "uuid": "5d58f584-f9b0-4031-8b42-fbd58c45308c", "comment": "Malware payload", "value": "054f04c1f0b65f2fc3103b5a1e48aa3dbe8a1b261ca7d7eac2e0986814551ad45305ce175409ead3c648591764983c8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893014, "uuid": "ba0e31fa-0143-4661-a022-65aebfd80ffd", "value": "T11645233633C15DA8EE4A4E31020E5F218EB1D36A1F7EE411FBE86D1369705C2BD6A761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893014, "uuid": "529ab9d7-fa1c-466b-9fbc-36ae37add81c", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893014, "uuid": "645fa71c-21ff-46d0-a3d9-362950f98e2b", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVv27:qE27hQs7tW2zku73bFgVlRlbN015CoVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763893014, "uuid": "8c4043c6-67bd-41a2-b3f1-31eb4b898bfc", "value": 1244063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763893014, "uuid": "8b056c0a-48d6-42ee-a71c-1094c5bc2d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893014, "uuid": "8cecf01d-0926-4ba9-9dcf-a5950613efa2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba55b13-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889609, "uuid": "a938f5ab-d0d9-4ddb-8cea-5da600af6336", "comment": "Malware payload", "value": "381881f69659e6318c95a0b025135a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889609, "uuid": "01eecebc-30be-4a88-a1e7-75e71da3eb9c", "comment": "Malware payload", "value": "37238e67a3b1a8f3e583832503695ba1e0b63acb1b823452faf08c171c598ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889609, "uuid": "43aa66bf-4cf7-4aa4-8171-9a4c35b9056a", "comment": "Malware payload", "value": "e91defc563a3957ffc12e528451e68b903d6c016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889609, "uuid": "e8ccaccb-b940-4648-a915-c12c0896bdc4", "comment": "Malware payload", "value": "0856f166a2264ed6d290e76d3113db1cd80e57e49dacd102a5048cbcfbc2f788745771b4659be1227dfff5da993dbcd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889609, "uuid": "ee7fbca5-6321-4d6c-85a2-8ef8d3cd8fb6", "value": "T1EC93E84BF61281B9CA38C537A561C1B21F253E75AA63CA3F35513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889609, "uuid": "d38629bd-f0de-4c93-85d6-68c7a8682890", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889609, "uuid": "84f5c6a8-a272-4ce4-a5e9-d30d6c80e76c", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdn:41bC4Bk6lMTOWw4PkRAPoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889609, "uuid": "46ee7bd0-8550-4645-9b28-0c186c8677e9", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889609, "uuid": "9ee5d88d-34c6-4cd8-9207-94f41698b789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889609, "uuid": "1871ca3f-f724-4149-a001-b298629ce91c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c411b07-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889610, "uuid": "5c643fe8-1459-49b0-9e71-9936a8462fd2", "comment": "Malware payload (Simda)", "value": "56f6f819db6b1d86e62e83a2f4f3f7bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889610, "uuid": "4fa2d7b8-68a4-40fe-b849-92650d8f8553", "comment": "Malware payload (Simda)", "value": "375bab9808d65ab4613635ce3078f090174ebc6e87c6bd51fa6adc0fbea04026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889610, "uuid": "4df68ef0-f9bd-4aee-b727-b01eb76770ae", "comment": "Malware payload (Simda)", "value": "2b3df22f2d477d38dabd70eec47c352ad6be9568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889610, "uuid": "0b9a06a1-1c89-45de-8736-48914ee66dbf", "comment": "Malware payload (Simda)", "value": "c1ee87c380401ac23ef7fe9beb3eb3dfa5101075c6e87560c9a89880e15686ba4507be427fdcad2e4af684b8bb2f902c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889610, "uuid": "98f38ebf-befc-4ebf-b728-6f7e5e661d7c", "value": "T11724123266C05A23C4B5097B55F3B34335AE83888326C5AB18499AD63EA72D7FE35770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889610, "uuid": "0cd985e4-25e4-4de3-b179-fe5718de6481", "value": "3ce7105d1e904763c53a96a44fc006e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889610, "uuid": "be96bc65-9712-4dc9-a6d8-c2f72c0f3ac3", "value": "3072:Xg/T01/NkSp48GzFoMVZrjB2+4M9eOpssvSX4FzU5chdhGulEV5SCmGFkInV/0at:kErGjVqiFPGYrGZMCrCIn6aQdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889610, "uuid": "2e233e6d-9dce-43be-b6c0-34cb668dace2", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889610, "uuid": "12f7538f-b527-4199-ac6a-ea78feca408c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889610, "uuid": "4267d37b-98e8-46e4-9963-d3608f261dd0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f6cd95-c880-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763911642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911642, "uuid": "93b1d532-a23b-435e-9a03-74683f8091c5", "comment": "Malware payload (Mirai)", "value": "8d875abb4faeca23c860d775a6c35d74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911642, "uuid": "b8a9edd1-4957-4f73-ac6e-1c6207cea665", "comment": "Malware payload (Mirai)", "value": "378e534d26dc62c14a99f04b01961ad0f1499ca594fd6d5208e0281b52e638b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911642, "uuid": "5bb96436-181a-4505-9282-f71e226e2f37", "comment": "Malware payload (Mirai)", "value": "7b52d7fef5560a64aaaf1da64d0bc2b110087e4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911642, "uuid": "c211f25e-aa27-4b83-acac-31007a954c45", "comment": "Malware payload (Mirai)", "value": "5e9b4c81f52c21fb0adcbcac1e35e38a9cba1a23a4f5589198c3c6ee1bf784e5c56375ec610c1a52424ba6dc547e525e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763911642, "uuid": "c1179883-1417-462d-bfed-93235b2e0dda", "value": "T15C53029FF0A14862D4517B38B3F077A0269142ACC38565D56BC62D6004F6AE4FBE0FAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763911642, "uuid": "e1892e46-c8e6-40b5-90d5-2f4158332d14", "value": "1536:xiAIjI421JT2Wwjb5N1es8XD45PvW7nNVZL7Zo0ueLqMsSG:biI42DT21Nks8XE5PmNVZL7ZVueLhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763911642, "uuid": "f02e26ba-32fc-4a8d-bbb3-9fa95c073d9e", "value": 60764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763911642, "uuid": "d4fe1db4-1b2f-4401-9dcd-4387d06136ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763911642, "uuid": "c9a0e156-d57d-4b3d-9b69-d4f988cb24fe", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf035da-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889611, "uuid": "4290bdc6-725f-4aea-9bf4-23b3281ac01d", "comment": "Malware payload", "value": "f870da564dd6a159098fe88624702944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889611, "uuid": "dcff8223-e47a-489b-a07b-cf4adb7d7da1", "comment": "Malware payload", "value": "3790e0612ad08cde5e998f5a3ab726fab20c7dede7403aa2957676ffbd5053d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889611, "uuid": "ca253ef3-aa92-467c-88f0-67564df34894", "comment": "Malware payload", "value": "26d18db521db1a9db2f48723d915d0ac4da90937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889611, "uuid": "e2182d19-f24c-4bf8-b7da-ba7cb991f968", "comment": "Malware payload", "value": "a6191bf17aa21b23c7e2fea6bd45a5576cf1669136f920308a9e46ab2905ae66941d55a32e97895bd22ae0e6d5798038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889611, "uuid": "3dca0c36-6206-429c-9b11-740677fde60b", "value": "T13255331B32C169B7D9CF1731034E2F654DB3D97A0AB5D82A77DC65472EB0600BE6A382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889611, "uuid": "9fb93941-915b-43c3-b99a-10616cb19ddc", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889611, "uuid": "f7fa6b00-2324-42dd-8614-71e5254699fd", "value": "24576:a6Zv2ivhBVnFys7wuVWVT0PAW0duYHM0/JTk6/Duy3tt+hq/6XYyMkZJ9Z:aE2ivhQs7tWVToP0Hs0/htDuw+txBr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889611, "uuid": "c2daefa3-4cb0-4a78-8870-11b6e70d541d", "value": 1354549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889611, "uuid": "228a6651-4ee5-4522-8c52-60b47f79770f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889611, "uuid": "b80ab50f-28e7-49b1-b9d9-0d2a5d65a932", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7784d07-c841-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763884609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763884609, "uuid": "cf6a2ed4-d321-4af8-b76f-4bfd097c7e01", "comment": "Malware payload (Mirai)", "value": "1acc4c7da53ae10d26c734acd7e38c80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763884609, "uuid": "99ea3b3b-57c9-4719-94b5-5165376cd42f", "comment": "Malware payload (Mirai)", "value": "3850e949caaa065013d3cd154c5aa29092ee72b5ce68a087e9079b60e89cb2e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763884609, "uuid": "31f3d57f-5c45-4f79-8d3a-48cab1818133", "comment": "Malware payload (Mirai)", "value": "629e4c212af0901dc12a882d6b537ba3279e7fe8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763884609, "uuid": "4b934f90-a616-4e31-8e05-f9a911a5699f", "comment": "Malware payload (Mirai)", "value": "1165782a6a010122a0676adfee717ff048c999c99a3a04bdeeab77c5e5b9d7e213a5ea7b6c996941395408c02b3bec35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763884609, "uuid": "c55c3261-9668-43b1-990f-08ddc9bc12ed", "value": "T19763015F6926A6F9D61C0CBAD1AAA6A22D0052CC26754B3C07708CEC7C1FDA3B3DD11C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763884609, "uuid": "36739a55-009b-462f-93e8-f957f3f65187", "value": "1536:AUCqxhUtMLj6SDDTbOq5E2RL4B28kZUYXcuT:9RxWtMiSDD3h9eBzVuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763884609, "uuid": "3a33921d-eb19-4242-97cd-8fab7626fcd5", "value": 67276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763884609, "uuid": "06caaae7-2cbe-487d-a9d0-4ff9939b7ec4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763884609, "uuid": "b7a92a6b-e353-416e-b512-d3232d27a981", "value": "irannet.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9cc17f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889613, "uuid": "d312b27e-1b11-45b6-b575-515e4fb135c3", "comment": "Malware payload", "value": "6e95d896618bae02d721e4d2c7a3ea5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889613, "uuid": "3850706e-9a34-497b-8feb-5f48f5f531c4", "comment": "Malware payload", "value": "3895880d61968164136102b938961c83c655837aed4b5df499969ca1708f1e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889613, "uuid": "afdfecf0-cde8-4089-a4b2-0de91ed94009", "comment": "Malware payload", "value": "c5309921c2537c6a73eceaf333f9e914109ccd2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889613, "uuid": "01fbd61a-e0fa-4969-a000-9a59e084fc6b", "comment": "Malware payload", "value": "ac145e1028a2732a589c5674aa7d9f4bdac24bdec56b3d3c9f2225c6d4f8caf7418e7b4635fa574c7fc4fc4c1cc3a7a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889613, "uuid": "c2ee722b-61c3-48c9-9f70-b58342af6035", "value": "T1B264BF7373C0DCB3C8461530025BAB768F73EA3A15318867F7E45A2B6C74951BE6AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889613, "uuid": "60d64baa-9e09-40eb-bb86-9054dded08aa", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889613, "uuid": "1c0f58db-d7ee-4d0f-8fcf-8edbd607fc21", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuMSq+ZHGaNzDGsDU:BtKe6YiDdv3m3mgKHDjSEWGGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889613, "uuid": "4ab51283-ae60-4967-b853-53d6e05196bd", "value": 335561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889613, "uuid": "4ccd5824-8bd2-436a-bb84-a05a8333ed55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889613, "uuid": "cfffc209-c9b3-4663-a7f9-a26d45af76f9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4267fd09-c883-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1763912652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912652, "uuid": "81a7284b-e9ac-42eb-8e84-56a71844afe6", "comment": "Malware payload (MaskGramStealer)", "value": "876df5b20db022879660a8ad96c92090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912652, "uuid": "8e92bf75-8f8e-49d3-afb4-3c2aa29dfffa", "comment": "Malware payload (MaskGramStealer)", "value": "38a304ce5196daab20a5d94886c690630628ec22e2d781ab516dcfca32d251b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912652, "uuid": "ce48f27b-56af-4e67-a703-2071b23ad132", "comment": "Malware payload (MaskGramStealer)", "value": "58c0372ba70b1bfbe314d0c29f1337f9922da4ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912652, "uuid": "62db7f3f-2871-460a-8e44-83f5e4e1412f", "comment": "Malware payload (MaskGramStealer)", "value": "191e69be71593aafce6c120a955e2c49e6417a4a87fd2d92d504e475e0a9b6a366cda01e37182327c694d6db21dd5224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912652, "uuid": "c955ad13-e13f-41cb-95e1-809d6aae20e3", "value": "T15234BFEF46A3BBCCF4F8AC7051A02D54E580E9BD9D2ED2F0C576A070233A8CD1D4A956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912652, "uuid": "10885aa5-ac66-434a-9d4c-4102949147ce", "value": "889d7d9bd78af47c7881d69d79690e91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912652, "uuid": "4eedb2f4-8795-4015-ab7d-ea1c2f00650d", "value": "3072:/3YwNcSKjnZ1LiIblgl/ptMdejhW+5Oot7cfs/lYsW3XL0NOvFpJ7Fb8AaEHqBkZ:xcrtiElglRCIhWBts5mFpZFb8nQbFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763912652, "uuid": "5a293baf-02dc-4b4b-88b4-35c03ab291d9", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763912652, "uuid": "65cfb9e9-2c4b-412b-975a-6e48713125fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912652, "uuid": "d87742a5-41ed-403a-a4f3-11df8eb54824", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6319a7-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889614, "uuid": "1cf7d333-590c-4662-8bf8-487a4f224ecd", "comment": "Malware payload (Worm.Mofksys)", "value": "b7b7ef0a220ce8c4b43ecd7b4c3b5998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889614, "uuid": "5579871d-7e59-476f-a62d-4f955c96f43d", "comment": "Malware payload (Worm.Mofksys)", "value": "38cf393ca0396bc471523b8b01860b63857b0f454643485511e637feb49ab223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889614, "uuid": "637113c2-120b-421e-bc8e-0cf5a41a680e", "comment": "Malware payload (Worm.Mofksys)", "value": "48352222f7fc3a60b58f87c1fa3a14ed769daab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889614, "uuid": "0146c95c-13c8-46c0-a48f-2e6854ffd125", "comment": "Malware payload (Worm.Mofksys)", "value": "fda5f61bfcda516913776df8714656c5dd8d53e9ba666a971ad3f3640f30b3b22992e35e61865200cacf47ea5a43a499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889614, "uuid": "4dbffc70-3314-4487-8a00-82ef5a8759e8", "value": "T1E524092FFA40303ED8A785F1696661A1B5322E221BC0EC4B67916F4A3979603F5F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889614, "uuid": "4fc76389-a58f-44a6-ba23-10153100efbc", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889614, "uuid": "de79c905-a2ec-491c-afd9-abc955c132e8", "value": "3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLF:zvEN2U+T6i5LirrllHy4HUcMQY6KF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889614, "uuid": "d643496c-20c3-4ae7-b56b-988636723510", "value": 211791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889614, "uuid": "f7b87f8d-bb4b-4532-9742-208bf7f5aecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889614, "uuid": "664199a0-d125-4fac-8fb9-60acb440c549", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f39a7a8-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889615, "uuid": "91b5f4c0-5710-43c6-8f79-7737ebdf6b21", "comment": "Malware payload", "value": "92def3f39cd2bf11e93d0375292d3305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889615, "uuid": "8b908652-7e49-4bb2-90df-e71dc217bbad", "comment": "Malware payload", "value": "3940ec4c678ff2f271557f0a338914415f25238298512e49b48f63b5f7e1b377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889615, "uuid": "d7c792b1-7ded-4fce-9cfe-01c216052fac", "comment": "Malware payload", "value": "b6524fb47a7f49d1113de012fe768b869d6bdc98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889615, "uuid": "dab865ba-f5fd-4a6d-a4cb-ec07ee958af8", "comment": "Malware payload", "value": "13dbcf4555ea4dd826e54bf16e042c532f40805d22262651a21a5d9ec99b6898ae6b8d743a49c36a3fab2fe5ea76ca8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889615, "uuid": "202d2a3a-5b46-43b9-87c3-7586187c8e4f", "value": "T1D605122376C4D9F2C4421530024BBBB58D77E87D2B22D817B7D807676C79818EB7BA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889615, "uuid": "169d0f68-f987-4293-8c6c-1eb581cff2bf", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889615, "uuid": "3e0e0bbe-b490-4311-bdaf-84c4f48fef81", "value": "12288:otKe6Zv23YnTjp0Wn91PsXeYmJMkaLqGDtlTwSD1uE:K6Zv2KOWnLhGDjwS5uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889615, "uuid": "e66025b6-75dc-4ba2-97f1-f0b5edeab776", "value": 810715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889615, "uuid": "c2568151-74d3-4824-8583-0b66e615b30e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889615, "uuid": "cfd4ed62-2f7f-4166-9d47-1a4dfa3e68c0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe5a669-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889616, "uuid": "519735da-5b97-465d-882f-6d764ebef7a1", "comment": "Malware payload", "value": "a3bd9609e0a86fa53ec1b0cbaa1f092b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889616, "uuid": "f6c4b599-eaaa-488e-abf1-76720d1ed6e5", "comment": "Malware payload", "value": "396c04be9f117f9bb3b73e1c0b45ad0563f7240376783617489e97f7b2b2872d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889616, "uuid": "c24c0c82-98f4-4083-9970-2025c00b88fe", "comment": "Malware payload", "value": "13e840850a9478526c368a5425a23f7d0f309b9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889616, "uuid": "0d458ade-4e03-4e83-8c5f-eab5fca860e7", "comment": "Malware payload", "value": "959be2ee7e60323ef3924ba203cd626c5697460099bd9b0c4bbb5ddd5777fab874dedba26a61199f5d61815a83537491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889616, "uuid": "7e694997-bf62-4067-8c41-67cb4a742202", "value": "T11E234A18AB68C61FE1EF0E7C64631A21137293511703DBCA4EDC64FEACAB78406257D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889616, "uuid": "bf42f7e7-4fb3-4078-ba3a-399a7ba54323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889616, "uuid": "07eb6a34-06e8-48b8-b99f-abfcaa447b2d", "value": "384:DxiHABz9q3FxmHu+JjOdb45NDQxFRCOHu419awgncpMQiW4zmkZXOfq1aK2rkLpn:DCIFqb4vDWTCOOuKXbOfq1ck+V0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889616, "uuid": "b6a8d5bd-9591-4221-bc26-3728a57783b4", "value": 49164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889616, "uuid": "39199afa-7ce6-44d2-a554-74a8e1c5f27c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889616, "uuid": "3b7b174e-8359-41e4-b938-057b7908c855", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052a9b9c-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889786, "uuid": "dce6bad4-ea9b-445d-9ff8-b925678cd763", "comment": "Malware payload", "value": "df5ce5b576e9c9f9893c769a5b2bee5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889786, "uuid": "c92b9c91-9f02-44ca-8699-48276c008969", "comment": "Malware payload", "value": "39a9372d6845b965d2779397a448f215450b4d4dddb802b6124af150f6bf2001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889786, "uuid": "77fdd70e-716c-4e02-8a83-aa5207132493", "comment": "Malware payload", "value": "8eb100e8bc60bd0e3b162e9f014a47b35c750d33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889786, "uuid": "16eecffc-3c1c-4b3e-be86-784a8e03e6c4", "comment": "Malware payload", "value": "893e1dc9a3353b8d5d4709b31b85254668f3f8fde152cd46cd07e0d127902c5b7beeae51716f854d38ca2bded3da94ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889786, "uuid": "79faf460-20ac-44fb-b340-a9307225fa0d", "value": "T1B335231333C259D1DE499131028A277DAFB7AB3D17B1987BFBDDCA0B2830950BB64594", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889786, "uuid": "d9081a43-b31b-41e5-a34b-4b81e77f1688", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889786, "uuid": "1044e28b-ed58-49c8-a798-a91bb1a09cdc", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuN2TNQYNI:qE27hQs7tWVToP0Hekxbl5TuohZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889786, "uuid": "211271c5-b1a4-421d-abc7-72ed16055dd7", "value": 1085005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889786, "uuid": "db5cb90e-a44d-4fe2-a49a-d01c6334ea63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889786, "uuid": "64b792ec-ad02-446c-ba4e-0a42856346e2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab401648-c879-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763908533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908533, "uuid": "c3096f34-6c0f-4984-b746-4bba9cbdab33", "comment": "Malware payload (Vidar)", "value": "74a5c90d6cceed4f98ef9c8aa92fe2b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908533, "uuid": "f2a6104d-1e90-48a0-b061-bbbf3327399f", "comment": "Malware payload (Vidar)", "value": "39cb62755006b0efe593667df4b69807e2f3f04b125ffdfcf946a8a49af98d4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908533, "uuid": "b360824c-8ff9-41cf-ac62-bef7941d845a", "comment": "Malware payload (Vidar)", "value": "f388fbffb697c6ef6b0a337514b112e82f31d709", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908533, "uuid": "12a1add5-c404-45eb-b1a3-495a968bd746", "comment": "Malware payload (Vidar)", "value": "4c5450f5b6b15d85e87a5f3546ca06c04d713cbe059c838166d9e89d1b010e525021116bb12d0b146de870300a97d7be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908533, "uuid": "0a8c78b3-1075-4e31-b46c-0df462e07478", "value": "T12BE55C027981C965D4D993358E757291B2B3BC54073367C32EAB6A38AEF3BC01AB5F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908533, "uuid": "11dc2cba-0aaf-4205-bf57-baddfb807247", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908533, "uuid": "0dc6df72-69b2-4661-bc38-b426ccfe87ae", "value": "49152:JZNssavo077wCi/vYUoTyf22LbJDjY/0HrVlRrGL6XxsU:JmEvPoN2/tFVtsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763908533, "uuid": "ddd7ac42-2915-45ea-b8be-3b259e9b6669", "value": 3079254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763908533, "uuid": "bb649ef3-d434-49f0-8414-3fa19fe2e85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908533, "uuid": "70eaff0e-5c61-4ec3-af4f-188a3062984e", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08bc563-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889618, "uuid": "dbf924b7-f501-4948-99a4-667f009bd644", "comment": "Malware payload (Simda)", "value": "2503651b672c1fe2612d3c142cfe2e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889618, "uuid": "a857160f-a8d2-43d1-8f68-4c392421d75b", "comment": "Malware payload (Simda)", "value": "39f4bde5b8da493d7bb87dea5ee4022e6898e18d5d18ec5515bb63cc21c0758f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889618, "uuid": "ac25a37b-209b-4525-8d7d-c8a29b7e032f", "comment": "Malware payload (Simda)", "value": "414a7e095a80386b76feb661037884d809c6e5b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889618, "uuid": "79e25200-2121-481b-a2e8-ce86e64bef90", "comment": "Malware payload (Simda)", "value": "7bb432943ce441a2746bffa0bba3f2ae5b66192ae349ca5b2b3943f95ca84c42af9cd4cee426b52200fe3a2c5a46925e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889618, "uuid": "8128c87a-ff7b-423f-9c28-e847c2d4c569", "value": "T19424022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889618, "uuid": "e529dcc1-e7cd-4f15-9f87-573f04b2424c", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889618, "uuid": "527934f4-2343-4969-84b5-80d41c6402a1", "value": "6144:uZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:squCuygMQjd5vJIBP1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889618, "uuid": "40053ab1-0865-4a6a-bdb4-7e6437883cc8", "value": 213054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889618, "uuid": "b74de51b-bd5e-464b-860c-dadc01c2b4da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889618, "uuid": "f298b20e-e859-4c48-8696-0f08346254a8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a134b89b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889619, "uuid": "8e0ede2b-be6d-41cc-845c-23c94c77183e", "comment": "Malware payload (Simda)", "value": "8a495bd87c357526f73d4e084769d412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889619, "uuid": "8e2eaf2f-594a-4129-9beb-3611ae2e8732", "comment": "Malware payload (Simda)", "value": "3a112072c451ce35c552674208f1a8d1c23ff15e23432f4b5630970452689cc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889619, "uuid": "7156de6f-2fb5-45ca-86b9-eced312c3c49", "comment": "Malware payload (Simda)", "value": "fd535cce88fe82f12855d0ad6f3e2087b0f7e458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889619, "uuid": "a13857c8-4383-46ba-a8a1-beef752507c8", "comment": "Malware payload (Simda)", "value": "c6713c2ed354aa3f9336c7ed417615a856408016e4af3111af369a4437d017533b1cef6630e56b8bf94fa51ea0b808bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889619, "uuid": "66927b6d-5e1e-49c4-9e93-61d60719342a", "value": "T14824022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889619, "uuid": "a5e44682-743b-45f4-a7c4-da30e4e716d9", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889619, "uuid": "ae96647f-7e13-4018-9c4f-63471400798e", "value": "6144:DZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq56:VquCuygMQjd5vJIBP1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889619, "uuid": "420e2d02-4e88-4bf7-9106-0d45fd1b4125", "value": 213010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889619, "uuid": "105ed33e-79c3-4ca4-a40c-6495679459c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889619, "uuid": "071fcea5-b0b3-43ed-87b6-169f5f6b5ba1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cea2cc-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889620, "uuid": "ccb2fc37-75f9-4d52-b641-827d7280e1f6", "comment": "Malware payload", "value": "1d09984ef88bb67c80262947eb1b176a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889620, "uuid": "dd8401c5-fe91-4bfb-ba9f-c8764fd5e30c", "comment": "Malware payload", "value": "3a1b2be39063bc50e3f39e6b534944964bf72b5bdd8a556255af9eb9a8b84c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889620, "uuid": "5566bd32-6099-4850-bd3f-d8731431e142", "comment": "Malware payload", "value": "cc0653f998f538f4a925248ad36f34d8a22dade9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889620, "uuid": "ed01b3db-af0c-49bb-9229-0aaf979597bc", "comment": "Malware payload", "value": "8ce7e911c2f5beabd962193c889c8dbe5b8cf3dfb5fae931577e948d27928fa917500fe6e1b9ca3bce792e53c55af706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889620, "uuid": "cbf99e43-3ee6-48a2-ad74-d343a20a52f0", "value": "T1F3235B18ABACC66FE1EF0E7D64631A21127293511303DBCA4ECC64FEADAB78406157D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889620, "uuid": "1d81eb70-476f-4e07-8d53-13e4f7c8a2af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889620, "uuid": "3f58ab2c-a5d7-475d-99a8-ff85bc08e2af", "value": "384:sxiHABz9q3FxmHu+JjOdb4WVCFRCOHu419awgncpMQiW4zmkZXOfq1aK2rkLp9iF:sCIFqb4WkTCOOuKXbOfq1ck+f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889620, "uuid": "9971b1e5-100e-4ee8-8def-5b7e1c3d693d", "value": 49164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889620, "uuid": "ffc16c18-5093-4dcc-a999-7fc84d1dd461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889620, "uuid": "9c1836aa-f420-4049-a7d7-f4c2f868666b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a264c888-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889621, "uuid": "10bf51f6-8eb4-4f87-9125-16fc50708e23", "comment": "Malware payload", "value": "59ce36b740ada2db37af992bff8264a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889621, "uuid": "1c5e5766-10de-44f2-81d1-6d86c5bb4963", "comment": "Malware payload", "value": "3a1c452da534908d2c9847993769fe3b73fbcfcbc44fb99e3475d05366dd16b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889621, "uuid": "6dfe795b-28fb-4a87-9922-ca2351b8b76d", "comment": "Malware payload", "value": "894d69d5f34a3d6e92f8e476e3702d7339ea0dc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889621, "uuid": "0e15ca89-983d-4891-a224-123881a07041", "comment": "Malware payload", "value": "2c6fd4e9020f4f1cba25e6f24fd606ec09d0ade1b731ff0ca1701d862f96b3f186efd17ee7c1dc741bb4fd7020a147c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889621, "uuid": "307c46b6-2787-4502-8f58-21cc90305663", "value": "T149F3F2539FD148B9FE6B4439101EE37BE0BB66B5422DDADB5B50CC54BC330A0E9152CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889621, "uuid": "ea40490d-016a-490b-8ea8-55ae30d6811a", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889621, "uuid": "18520a8b-4802-4c18-a9e6-bb345a913ef2", "value": "3072:W++S/lmz9+e++brur/AZCk+XvqJALNMdRSCXFUJWkrCFMCYRNgX72FiviiBv2SEw:iS/lm5+e+UurWCXXSJGBi9XQVilXxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889621, "uuid": "670e3b5b-77b3-4ff9-8bf5-31365d510d6b", "value": 159460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889621, "uuid": "2a1daa18-7eaa-4c28-9a00-779ae5521ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889621, "uuid": "c0784a0c-34e2-4528-ab70-afcaeb99ad84", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2adfc328-c88f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763917767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917767, "uuid": "5ba16e5e-95ba-4a22-87b0-6b1bf49ff49a", "comment": "Malware payload (Mirai)", "value": "46fd160ea93b9fcba70aa10ffc87dc49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917767, "uuid": "9c105055-c130-4bca-b16c-4d738bcfdb04", "comment": "Malware payload (Mirai)", "value": "3a794e3197c5e3d3fb294f9b6d44af49f1ae517f9bab4464a6d823ac46277ae1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917767, "uuid": "15834b2c-8fed-4765-b614-56e08c305ee0", "comment": "Malware payload (Mirai)", "value": "58d11143801429c3cc67879e275d2453d42e2666", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917767, "uuid": "dd843103-476d-4ba8-8156-6a29142e25a8", "comment": "Malware payload (Mirai)", "value": "c58f3db2c80c370f792c665ca53798b89e8ef7197d944fa75cff4ba905a07afb57648fa686e4d6aa33c0c2b5c2894ce1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917767, "uuid": "d523a961-c5f6-4477-889a-6e5727dda8a1", "value": "T1C9431891B8819A23C5D4137AF56E55CD3B2523E8E2CF7217DE214F603AC682F0C6BE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917767, "uuid": "78459a6e-91c6-4d80-b78a-359d4ddfd3a5", "value": "1536:RM9ymL8oyp9vFloWxV8uoUS7XAOImF9v:RM9y0dzFIkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763917767, "uuid": "834f4779-413e-4ab6-b0ee-3e604b5c5d5b", "value": 56264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763917767, "uuid": "ac1ec046-7f73-42ac-9a71-319706234828", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917767, "uuid": "0a09a407-bd3b-457a-b4d3-547602f15cb0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323c2a55-c80b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763861086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861086, "uuid": "3e419eac-fb4a-4953-afdd-da246134fd14", "comment": "Malware payload (Mirai)", "value": "d490752d71b3e7bbd471695d93e38951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861086, "uuid": "05a4704c-2aaf-4e59-b6dc-52f53cd9efcc", "comment": "Malware payload (Mirai)", "value": "3aae6502cf24f476a14849e0e9008508db0c6f3b5e016371fcd3acf9e4630c29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861086, "uuid": "869224a5-18f7-477f-a3e4-b9b3e8ccdb6a", "comment": "Malware payload (Mirai)", "value": "276eb3b4b26eb9dbf8768caad715520a5a097658", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861086, "uuid": "b814b0a8-407d-43e7-a197-45d8b1a2a7ba", "comment": "Malware payload (Mirai)", "value": "238cd8ad93b319461b2c06e86a64c19349f9c9277091bcd169955d8770814e04d7c9a9d95741a75c6340f600744c711d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861086, "uuid": "7312ba86-bfef-49c8-9972-ee5a2cfcf188", "value": "T1B6142B45EA404F13C5D627BAFADF024533339754E3EB73069928ABB43B86B5E4E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861086, "uuid": "444bee08-3557-4cc3-a92d-94762033fd22", "value": "6144:aaJuX+sx69mrsplDKZUXQBKXAVanqX+F8JyvuNKvjrLdYn/MnSs7adG73C/vQM/F:LJc+99mrsplDKZGQBKXAVanqX+F8JyvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763861086, "uuid": "73772ff9-7c9a-4c87-a075-a32b1ef4c385", "value": 209217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763861086, "uuid": "97818d6b-d266-43e8-89e2-6eb901a1e183", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861086, "uuid": "0ea3d01e-dfc3-4281-b9f2-bc9be13ede8c", "value": "ngentodluwh.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb51f37-c880-11f0-a129-42010a9c0007", "comment": "Malware payload (Pony)", "timestamp": 1763911675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911675, "uuid": "e50636a7-2018-476e-8992-ef063581508d", "comment": "Malware payload (Pony)", "value": "8e575f77b71423c36986e15b89f791de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fareit", "colour": "#F9D67F", "exportable": true, "hide_tag": false }, { "name": "file-filecrate-ru", "colour": "#2A3AB5", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911675, "uuid": "d76d982d-b3d5-4d6d-affa-7ab21236daeb", "comment": "Malware payload (Pony)", "value": "3ab0c58f330345f3dae67a4f68a4b1b4e4b8ae975aa82d90f9b013200ed4f8b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fareit", "colour": "#F9D67F", "exportable": true, "hide_tag": false }, { "name": "file-filecrate-ru", "colour": "#2A3AB5", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911675, "uuid": "6eca869c-0a85-417f-aebb-bbe7d3fdeeee", "comment": "Malware payload (Pony)", "value": "ce2d0842e67615be0faa21c17fab4de570a22389", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fareit", "colour": "#F9D67F", "exportable": true, "hide_tag": false }, { "name": "file-filecrate-ru", "colour": "#2A3AB5", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763911675, "uuid": "908e7aa9-cdd4-45db-8a0e-185575b21429", "comment": "Malware payload (Pony)", "value": "3f1ba0bea2bddf740d0a8c7087b0910fdc7f7fa6ce244b3306db356538149fea17da7bb495878a2d9a244089c800b5c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fareit", "colour": "#F9D67F", "exportable": true, "hide_tag": false }, { "name": "file-filecrate-ru", "colour": "#2A3AB5", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763911675, "uuid": "90f9723e-2eda-4e63-b280-43c0bb341832", "value": "T120A30903F881E0F1C1A2177237C16771E3FD9D79BC768D4AEF8D6845A9B2687AB12442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763911675, "uuid": "1c9e5e55-b67a-49dd-82c0-cf3d0fd1bf98", "value": "085f942c74d09a78dcd2b95a4c1c7441", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763911675, "uuid": "a0dd5da7-3d24-41a9-bfd3-35f2ec0f93b8", "value": "1536:vt8UEN3YqiqTLEcW+L9gs2rS+TTYz52kqnjQXyAOrc6neTvXkzbklql/2fqh:Ch1H1W9+eNkdOrDnr0ql/2fqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763911675, "uuid": "f2046fa0-4833-4c11-aa40-c9554e4e5f4a", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763911675, "uuid": "0d6802cd-c336-488d-bd08-c3d279244b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763911675, "uuid": "f1019c56-c106-4e17-86a8-70b42a785ecd", "value": "key.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a302bdd7-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889622, "uuid": "55c28d5e-4773-4e4e-a7c3-698e7da72b55", "comment": "Malware payload", "value": "e9e80c925fd79d9f6eaa85d591dbea4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889622, "uuid": "a8674d9a-61ab-4f69-8485-0f34b43d9c4c", "comment": "Malware payload", "value": "3aebeb2480df6b167b225656a1d107f090d408a7f5ccded350c77c76627260d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889622, "uuid": "41c9fa4c-652d-4abd-a6ad-340f440ffa61", "comment": "Malware payload", "value": "82133fdbb90766d5124c56fbea101cc8010c7069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889622, "uuid": "52d8407f-4bb5-4a95-b8de-7a565780e329", "comment": "Malware payload", "value": "48943104638fabeefea1049a1e18476ded95339c880c2fa8dc0911e59c470e6364724a36a7aa7dc18566159a66fbaadb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889622, "uuid": "828b4baf-b4e0-46a1-94bc-8761bdfb894a", "value": "T1DC74D17377D08DF2C8460630069B6B728EB3FA3916714867FBE46B172C35A547E2AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889622, "uuid": "4082d866-1c51-4e38-a612-d5e2319c1caa", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889622, "uuid": "bdf4c563-168e-4561-a590-97710d80ff97", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5Tw/oPQ6DHfbCw:BtKe6YiDdv3m3mgKHDjSeL46zDCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889622, "uuid": "ebf22939-6fb5-4f4a-aef2-19702a45691d", "value": 361429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889622, "uuid": "dee50153-2cba-488e-a7da-fa4632f29afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889622, "uuid": "82660496-f38c-4d8d-b3f4-744a9fd9de0f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2f88e2-c854-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763892620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892620, "uuid": "11b68f10-34cf-465a-b5da-2f532dafdee1", "comment": "Malware payload", "value": "7de77e832c9ad4e080961e3531b87f93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892620, "uuid": "4fe5c067-47a0-4b10-b69e-4fef430c05f3", "comment": "Malware payload", "value": "3b471ed54ecd91d9515a1148cfebca6c1fae2983398f2711367a5410f805e9b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892620, "uuid": "d4c28480-417e-4e1f-b74e-f30e6bc24633", "comment": "Malware payload", "value": "3ad2c90de4c4e9acebff204861095eda16b183f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892620, "uuid": "f6bb45b3-1867-4696-a319-27698ab6ab64", "comment": "Malware payload", "value": "396766bd5e9db610e1c4bbc6f3ef8f4aa3e5e342afb9d43c333b0731932f99dd9d810deab511b966e3e52377cafa3a16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892620, "uuid": "d83606d0-7d48-45fc-8f2b-6d44ad9ac9ed", "value": "T14345233633D159B4EE860E31420E5F215E71D76A1F3EE812BBE83E126970582BD7B361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892620, "uuid": "a8ca380d-e81f-4584-89a4-2a51f9403b1e", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892620, "uuid": "59db7b18-5c0e-481e-acd1-040de7d15218", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVRHB0:qE27hQs7tW2zku73bFgVlRlbN015CoVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892620, "uuid": "3859675c-5086-4816-9aaf-54448157fbea", "value": 1266559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892620, "uuid": "69ac8243-b57d-4531-95e4-ffce4e7c3a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892620, "uuid": "bba1874e-a933-450a-b8f1-727f55e7dc85", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3aff265-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889623, "uuid": "d8c5f7c2-1fca-4022-b283-e42b0689401d", "comment": "Malware payload (Simda)", "value": "296e8335c38d492bd58a81f8cc5cc91d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889623, "uuid": "8c5d4b59-2db6-45b0-9ae3-3cb3258e05d8", "comment": "Malware payload (Simda)", "value": "3b99d46e75073297874ddfe85ef87c3589aa65ffa9ce29abe4a23f115acbdc46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889623, "uuid": "b4f86a18-f1d8-4fa3-b58e-29b1170988cb", "comment": "Malware payload (Simda)", "value": "e249f018ccd959402cc7cfb17a041c5cb43e7027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889623, "uuid": "fe7c0b79-03d8-45a3-92c9-c13e1f71e786", "comment": "Malware payload (Simda)", "value": "381d4eafbfbb4d5242eb79cb9c25e818b6715998a9e040e184d0617e3d771a9fb9f921b654eec7e184c283bd3de562d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889623, "uuid": "307cc871-87ad-4092-a947-6fe1e1ef1b95", "value": "T153241206B59B418AC90A19B384FF77142BA87DDD1322D33F4E745EFA2CD60A93972984", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889623, "uuid": "94c2eb6b-b899-4e1c-846d-d9449449606b", "value": "616d060f84174fbe550615d295f4ce51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889623, "uuid": "02ed199e-9ec5-493e-8b40-71e7d4669107", "value": "3072:37VD4DUHnNZkfOP6sfIOpJ9C3hPlGxt1UhRkgyankTIzfwAYzWcXCyqT36zhRRKy:hzHnMLm5GNGxHUhtnkdpHqTKzhh8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889623, "uuid": "f120e4ee-5dfd-495d-a6a3-561a5ee286c1", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889623, "uuid": "5fbedafa-38cd-40c3-bece-00da8a51609e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889623, "uuid": "2e4d86b9-cad9-4c1b-88bd-aa841fdde7f3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a447c354-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889624, "uuid": "bf8e98ad-910f-464d-a3f2-765e8a6a98ed", "comment": "Malware payload", "value": "068346e6dd71db480c303dbd0e4d5150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889624, "uuid": "a0175392-cfae-4db4-9880-4e0e6b3990cd", "comment": "Malware payload", "value": "3bce8780ab67e437f0364968ec569336cfdebb37a400e9832a29dd7d544bc79c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889624, "uuid": "d1fe777b-b35f-43d4-a813-795aa2953128", "comment": "Malware payload", "value": "ef6b07837a786abb40bb25a3d542321671ff9512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889624, "uuid": "0e4889d2-cca0-4d16-9a05-da3b236f84c6", "comment": "Malware payload", "value": "217767a7b23f1ead1ad201ef4141993e0874da653123bdf3efb5dc2a0a2c24093a06d8fbe98bb1717934ffbdc5e8a24f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889624, "uuid": "8a2d4904-ac1d-4405-ac4e-dd2676180612", "value": "T11893E84BF65281B9CA38C537A561C1B21F253E75AA63CA3F31513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889624, "uuid": "aa477fc6-c915-41de-bf96-3bfef9bf128a", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889624, "uuid": "98755070-6fc5-4465-989a-f1a771beff44", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdT:41bC4Bk6lMTOWw4PkRAPo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889624, "uuid": "2fcb7f8b-c204-4889-bbb1-d503928bde70", "value": 94261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889624, "uuid": "a7429665-5e3e-40f7-af83-f1eeab1c62a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889624, "uuid": "226e13ba-0cea-46b9-820b-0b7e06b965b5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e73ea8-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763889625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889625, "uuid": "c61f5096-1b91-421f-a1c3-d2b57e7af421", "comment": "Malware payload (RedLineStealer)", "value": "e5f928ac3a688cfb9c34590a5235faae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889625, "uuid": "77bbfb35-c621-45fb-b434-c1f1ae3ae39c", "comment": "Malware payload (RedLineStealer)", "value": "3c1e698f65abf8aded299901bb0a99c812bdddb56fbb4fc514294376424d7753", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889625, "uuid": "a04a8403-80ad-4f79-897d-3c151ca06c6c", "comment": "Malware payload (RedLineStealer)", "value": "73cc570fd24622088afb2886e570d0516530677c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889625, "uuid": "5f5fa77b-0ffc-4eeb-8eb2-30edaec5c327", "comment": "Malware payload (RedLineStealer)", "value": "7a122e71d3006b29db8a4a80bd4e005a504fb498385210b9504165b50234f7f7c7893249321311e362981cafe74b836a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889625, "uuid": "f49b9c43-d96c-4c2f-a359-27d557def266", "value": "T1BC54D02571C0C273C0B7517444E6CB7AAA7A3070477A96D7B6ED1BBA5E203E1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889625, "uuid": "1f979877-6aa9-4e99-a941-2f4421b0287c", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889625, "uuid": "a2cf8fcf-d5f6-4e27-8368-b3f2918f5e60", "value": "6144:xDKW1Lgbdl0TBBvjc/U3w3hN9PR2QGoOgulHmJn0L:Bh1Lk70Tnvjc8AxIQGJgim90L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889625, "uuid": "5431739f-28e5-4630-bf5d-0aabadee4285", "value": 294312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889625, "uuid": "088b6519-5eb0-41c7-bfb7-bd28ab3e99ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889625, "uuid": "89332246-ce3e-431b-b283-7269bf3a2f51", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59c40d1-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Backdoor.Shiz)", "timestamp": 1763889626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889626, "uuid": "4a77b936-120f-4c86-bd9e-d2ec994cc765", "comment": "Malware payload (Backdoor.Shiz)", "value": "75a631ef1fdacb1702a588f9e477d5f5", "object_relation": "md5", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889626, "uuid": "865513c3-f965-4421-a7d7-1fa789cec5a3", "comment": "Malware payload (Backdoor.Shiz)", "value": "3c587d28d613142313dfa2313f07fa9d9d451b2700e7bbd3f22d4a565add8d55", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889626, "uuid": "0f1e8e12-ff2f-4ab9-a9e0-cf84245128d8", "comment": "Malware payload (Backdoor.Shiz)", "value": "c9d8c7ed4a7b8dfd5d8ba4a4097e2fe49e7a21bb", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889626, "uuid": "fc7f1a0d-61e8-4890-9784-b0ceb4a4d7a1", "comment": "Malware payload (Backdoor.Shiz)", "value": "1f75cda3525ffc456ed59895008693c578e66c33037952548e9c786afa3e0b72080d6285ef0c50799ee2684ac9f14dc7", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889626, "uuid": "0d4ae7bd-d88e-4e9b-b07c-0769d4290074", "value": "T1CD1412B27B84411BC95CFFBB466B77040B2CD12B2E51C2270504547C6EB67E27EA7B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889626, "uuid": "770dcd8e-aa8a-4a23-bd04-ac3f7240fe79", "value": "430af33f4ce9475c62e2d9321d894f4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889626, "uuid": "80253f30-eb61-4549-b149-f2415d9adb3d", "value": "3072:cO/6nl92ILkt6i2ox7c39b1a0J86W8xXCKNWOHU/ezYMVWtG4SPUkxbgN:cgFtboVBJtNWyPnYG4fUbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889626, "uuid": "9ec2004f-062e-4fec-9810-315121dea64c", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889626, "uuid": "58f542b1-7642-46e5-8b55-461dff7ac85b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889626, "uuid": "955fb8d9-6362-4541-a2c7-a1decf737b2e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6421658-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889627, "uuid": "a69df6b2-2588-4569-a978-ae66cb819473", "comment": "Malware payload (Simda)", "value": "540c0de47e1f6eb8f7be5ed4de7eb653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889627, "uuid": "71e1e6c7-6271-4a2d-97d0-dddc894fcba4", "comment": "Malware payload (Simda)", "value": "3cb57ccb8fd73dc11d86ed2a46f729fd0f16d9322fff151b171a664122d3bf8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889627, "uuid": "befda471-8ddc-4bf2-bd02-97a93c6d3a75", "comment": "Malware payload (Simda)", "value": "a32f3c4a632b8a7b31c59ade7f38c1cd5ffe5d0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889627, "uuid": "95981aa7-5957-48db-9909-a60579b1f769", "comment": "Malware payload (Simda)", "value": "a42a2ef025148363cc52b6845a6738a1852da47ccd542a2f3e4f26e9e3cac5a164538b2a98cc0ba9ff14de252ee028c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889627, "uuid": "e84fc1ae-98d4-42f2-935c-5a810ffe4215", "value": "T15B94124C6B6174B3E65203399BBF79D53A389D99480D2C420A7F28373B765A39208DB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889627, "uuid": "ca5ac2a4-453d-4434-8803-d828397f9f5b", "value": "7ec179fea3ba0cfb69d21d330597a106", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889627, "uuid": "36c77453-c0e9-4a85-944b-806f09b6f03e", "value": "3072:gTJXLESylV534DNujdXwtrUHioF92L59QvPJvzxsx8ME:gtXLESuV5I5ujNHioajQHxzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889627, "uuid": "aae5d90e-d437-41c6-b8d2-32c6dde31627", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889627, "uuid": "fda759a5-6b70-4450-811a-14ce29b111e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889627, "uuid": "d427c7b6-c6d4-40fc-a6c3-a45321f51fa5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dc2449-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889628, "uuid": "e8dc5f48-7758-4cbb-b9c3-88d120592e91", "comment": "Malware payload", "value": "3a55d5644c9f45d82418c131b1ce0e02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889628, "uuid": "9ba42af3-539d-417d-91ba-c423dc6fd3db", "comment": "Malware payload", "value": "3ccdff8b1d407d0dcb462f4ec1d1c8ece9850874ee86fc8d2b82d32992a9e6ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889628, "uuid": "e349dbca-f98a-48a7-a007-17bccacf46ac", "comment": "Malware payload", "value": "19648ec08cd69eaf58d0ee558ae005f054379f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889628, "uuid": "07f973a3-70ba-4533-a1db-393bca3d14fb", "comment": "Malware payload", "value": "4ad1996f1f6e204f223c22a4c4d82c86ce01444a29ba4b7bffd1904c98ccf1c3320996ac0238a4db99ba07ddba6607b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889628, "uuid": "d5781274-58e4-43a2-9cc8-0f25178839a2", "value": "T14A249E7773C085B3C80615300257AB769FB3E93A26719867FBE45B272C70950BF6AB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889628, "uuid": "ac3eaa08-f6be-49ff-8084-e9409c988cca", "value": "3072:MtKe6LMiDdv3mn37rnOgybD00Lb/hb3Tb:MtKe6YiDdv3m3mgKHJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889628, "uuid": "d39ca35c-68fd-498e-900b-59fde130bd8e", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889628, "uuid": "8c6cafc8-a08c-49e0-8a5c-de02b2de36ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889628, "uuid": "631bcf3c-ea25-4eb9-bde4-f935626ae897", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf2c392-c882-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763912214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912214, "uuid": "020d68aa-2b52-4197-b358-e0a7fe200221", "comment": "Malware payload", "value": "58c29f43dc363a72c5415b88717503f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912214, "uuid": "3ea7f903-d65d-400d-baa9-f70c01467231", "comment": "Malware payload", "value": "3cdf43c4605f319fb4720c39e9575d83a5769705a05e690d745a6483506ecf25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912214, "uuid": "a3457453-ed02-4ea8-9ad5-31275929a6e4", "comment": "Malware payload", "value": "5e2c5dfd170c057a07bc61132e7e87077497215c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912214, "uuid": "756a0e2e-a308-4928-b0e9-4bb0e0dea7b0", "comment": "Malware payload", "value": "952323c370360f100297688e7d0fe4afc53456308673636f6fc9a6360502e80d26fdda8a5757d0dade9dbcdcedaa7081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912214, "uuid": "11e932ed-b286-4c82-8130-64c88082d7db", "value": "T145C623B381817EC3E17983F27D6288858D24B8775F021A3AF02F67A5C19A55DCFB4798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912214, "uuid": "fac3c185-fcdc-4cfa-a699-31821987edfa", "value": "9ae73adfc5cc21a2c662331d6b428500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912214, "uuid": "5b18cd11-71b6-462f-b7d6-9de4ce52f1d3", "value": "196608:RKLPWaePB867VF4wvsmcfCdTYvmfxYYXXLbWUu0WPFE5V7lfbUFxu60HhodbK:QaaEbHqCRYvmJYYHLbWlBPFwfI0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763912214, "uuid": "d13ea3b2-b818-44ee-baea-05b9d96afb74", "value": 11761680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763912214, "uuid": "b11d8b61-8a7e-4f1e-b9ab-5f2f6b755969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912214, "uuid": "6cda4095-9d50-44cf-8918-865a05d7afbc", "value": "SecuriteInfo.com.Trojan.Siggen31.44837.3627.9293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a299ff0-c854-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763892452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892452, "uuid": "af7b9c58-19b0-4d90-855e-222463159f42", "comment": "Malware payload", "value": "e5f74bf7b3a5bfdc2a510fbf8d808b24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892452, "uuid": "01d807e0-55c9-4322-9f21-8cf13431febb", "comment": "Malware payload", "value": "3cee5e2c9f41396a2ae9d8c40d2ada0b3b03ab219130a4c69aaa009e65fd3f9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892452, "uuid": "bcb2b433-f7df-46ab-9696-74e377ec0f3c", "comment": "Malware payload", "value": "8fe7c6f269a9346e2f9dfddfb0b65d9d38bcd5c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892452, "uuid": "88e1ce78-9b8e-410b-b7b1-5dbe837ba910", "comment": "Malware payload", "value": "89091144b602f7c148bc31362d6ae49e9bcd5689448d8a8153ed0ddd09f898a4c0559194b8f49ce48e6c2020f5c41d39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892452, "uuid": "5fb542b7-4de4-446e-a926-43f9b38776ea", "value": "T1EC35232333C259A1DD49D172038763B96E73FA3C17B1D42BF7ED8A0B1C70950BA695A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892452, "uuid": "76f843d1-1b06-4d7e-b596-064e90d33e4b", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892452, "uuid": "31a8b8df-737d-4971-be87-6420de919d07", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuNpLG:qE27hQs7tWVToP0Hekxbl5TuLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892452, "uuid": "40326129-c03d-4079-94c2-ddb1f8fa4866", "value": 1127166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892452, "uuid": "f16e8d18-ee5d-4155-9269-89fc72fd92ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892452, "uuid": "59248707-11c0-4d99-9f1f-9e7cb51bd7d6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7987c14-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889629, "uuid": "d84a0e5a-731f-4057-a356-133237e5d906", "comment": "Malware payload", "value": "f51d4a7034965c19a3b6dc07ca37c751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889629, "uuid": "37815337-104b-4ac4-ae33-61d2f79b9f8e", "comment": "Malware payload", "value": "3d046c382eb44b0d1bd9ca7f9d80e38145d305abe4ea354302f1176215fae5fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889629, "uuid": "20aeebf8-4309-4221-a977-6747adcb0492", "comment": "Malware payload", "value": "a237937480f7035bdf55f75b1d4023cbcef00223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889629, "uuid": "01aa041a-299a-4e80-aeff-c97cd377942b", "comment": "Malware payload", "value": "072aa2a17ad2479d298fa2cb65556ec15962df4c63886821fdd5e66b31f39a007f5eb54efb4b25ba0c094a420e84a64a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889629, "uuid": "62e404aa-31cf-411c-95bb-751cf5fbb90a", "value": "T13F35236333C269E1DD499172038763B96E73FA7C13B1D42AF7ECCA0B1C70910B6695A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889629, "uuid": "ba3386b1-b43c-4054-bfd8-3920128bfc75", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889629, "uuid": "daef23cb-6123-4ce7-8bee-629ee85bda83", "value": "24576:G6Zv27hBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuNpLeL:GE27hQs7tWVToP0Hekxbl5TuLeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889629, "uuid": "eec7c9ed-9fae-4bfb-ae14-67ee27ce5e53", "value": 1137227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889629, "uuid": "0a9cf4a7-967d-4c31-ba51-463d6435d2c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889629, "uuid": "5fe1e2fa-bd3c-484e-9d19-e61dd7b789fd", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55152791-c884-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763913113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913113, "uuid": "22044bcf-a8df-4e7e-8d67-dd0ab523e0e1", "comment": "Malware payload (Stealc)", "value": "0e5701b83b6e64441e1851f3c38f9e99", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913113, "uuid": "4a3daf5b-ecb5-4547-b77b-1cd8fe2037b5", "comment": "Malware payload (Stealc)", "value": "3d05642f97d1063a3dccf3f1ef62c71700800a44bf08fd492d848be6da2441ef", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913113, "uuid": "2438dd88-49a7-4682-9b1b-eb53d64418b8", "comment": "Malware payload (Stealc)", "value": "fa6a9be4c6da8ed72172ccee251ed641ebc35aad", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913113, "uuid": "b427b29f-3959-44f8-a4db-8fd9c0c10419", "comment": "Malware payload (Stealc)", "value": "e3f192535ebdff7fea64184b9b5de242d4e507da60344318bdbc916b835540e2156003a5246945509ef0d0503028a00e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913113, "uuid": "f6448884-79a3-4cb2-a10b-6188dc3297dd", "value": "T14E44129AE2008FFFFA9CE238428BA1339319CB08D49967CE5154F95513E7F7C956C622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913113, "uuid": "155f6ba2-b4e3-457d-8e57-6995b700515b", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913113, "uuid": "14c6513b-fb60-40e1-a57a-8a7617586164", "value": "6144:O6VpQvA8Gs3bZ5rI3vQZXRCmblWfnb0cZ9OEsCTKTm:F76b/I3eRtZ2F9OEspT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763913113, "uuid": "1780a15a-5f74-48e4-bb35-5f65fe0c5078", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763913113, "uuid": "2147c030-f6fe-4c38-b0ab-557aea0de1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913113, "uuid": "4f80cdf0-215a-4445-b8af-2c5e9c091541", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2957343c-c882-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763912181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912181, "uuid": "f3cce7e5-e704-4761-a741-ea8a2479b134", "comment": "Malware payload (Mirai)", "value": "14e15a3fc7833aa5d5acb46b4c87bd15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912181, "uuid": "baa5798d-a5e6-4e6b-8ee2-16324e6dd4c7", "comment": "Malware payload (Mirai)", "value": "3d10174a49408b636f6c3f1d8635ed2b1b57143b90adb4009bb4f0f622a8fde7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912181, "uuid": "514a1ced-2adb-4500-9391-91b9dbe63b92", "comment": "Malware payload (Mirai)", "value": "3d9dd2c395fc0e61579431c114b4bedcfa09f93e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912181, "uuid": "dcf02a9e-b4ad-430a-9082-acf3644be89a", "comment": "Malware payload (Mirai)", "value": "efdce97ca0a5f7568fa61e043e015de15b68bb7125f12cb093de0e7fd4cf98198e16c4a9e2adbd6c264c89c8095cfa03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912181, "uuid": "4655a191-debe-41ce-931c-85410adbf6d5", "value": "T19AA3D040B710EE4AC02222FCB1C50944E7B16DB60B96550B55E3F9B86E7DCD87F06EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912181, "uuid": "8d259733-e2e5-4e95-8e6a-b27b1fc1f711", "value": "1536:QoSBiYmEjeEXNBVSa5qgF/Btmo1/iAe27SGCh75GepUOZ1sRPIsrppKpLwgFGRG6:QFxeEXNkgF/riAeZh751JYRPXrKJwug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763912181, "uuid": "493773e0-c9a7-408d-b0f4-ef2befd0e9b1", "value": 103608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763912181, "uuid": "be1430f2-f385-411d-856a-d6feb991d7bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912181, "uuid": "4e4b8088-d411-4d6b-ab11-400ff9a71369", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82f9a1b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889630, "uuid": "d65a47ea-66fc-4b46-9f88-9c62ed681549", "comment": "Malware payload", "value": "d41ba24c4f31579a4d1bbc2d8e4c8476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889630, "uuid": "428fcbf4-b31f-4e33-88cb-1b59949e34cc", "comment": "Malware payload", "value": "3d5162bbb791eff4e87de0a2ac4340c320f8a88ec91abec6c36d00373e9e3258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889630, "uuid": "612b3f57-2f4e-4ea8-b30b-6ddef1f0dc6a", "comment": "Malware payload", "value": "3dd6b7c7daa2f39faf6bdd8d122af4c4415a4ff1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889630, "uuid": "d95bdc1c-1183-44d9-ab06-11dacccf1f35", "comment": "Malware payload", "value": "ac02c23a8f25b990146271e8684cfb2b13ccb2dd3dc6c6e747ece11d9b10225fd3c0e9bb6fa0256a6c18324f6c0212db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889630, "uuid": "f576ca5a-cdbd-4dfc-ade3-a55c3d1fb2c0", "value": "T15F84D17732C04DF2C942063002ABAB768FB3FA3A16714857F7E4562B5C35A51BE67B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889630, "uuid": "f1399ba8-41ca-41a6-9015-1ccad6606b61", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889630, "uuid": "2c4f5e74-ae33-4a84-9864-0c88a19d281c", "value": "6144:BtKe6YiDdv3m3mgKHDjSeL46HBkbEG8xLhPg1:BtKe6Zv23YnDGSxLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889630, "uuid": "24a4841a-e17a-4628-b3d8-ab5c0d8ecf4b", "value": 379953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889630, "uuid": "6366209d-3ce1-49d9-89e1-3297c7f8e332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889630, "uuid": "202f0596-02c2-4987-b48d-4f18a51b87cf", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d42569-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889631, "uuid": "6fb9e8ac-302a-48d7-9c6a-44afc714235e", "comment": "Malware payload (Simda)", "value": "3008015b8680c38dadb8c7675efd1e90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889631, "uuid": "bb87c310-80a3-480f-a2fe-e56a2db7607e", "comment": "Malware payload (Simda)", "value": "3d8ead919c94d5ab4fc6a4627ceb6b32bc077bf0616bd43dd40a707baf436fe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889631, "uuid": "0c0e9ca8-2628-46ff-bd94-4209f05ad885", "comment": "Malware payload (Simda)", "value": "8a4968575baf5f4f8e06d32cc36c8fa23ff75ce5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889631, "uuid": "f03d95bb-06ac-43d1-bc0f-cec1d4073854", "comment": "Malware payload (Simda)", "value": "3e4a4015f7537729ff2ab98c2df1cc12846b60a25275e184928accf31516ab36bfe92e500167b52d0a561456a2686810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889631, "uuid": "bb9fcb10-c4e6-4731-a6e8-756dc5fdbdbb", "value": "T11C24124B478E11A5F8131B770AFB0B4773B881A5378AED7B394AA3706C536C7B8A1354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889631, "uuid": "8d34e9e8-0c70-40c4-b6b3-9bb575f2a041", "value": "2a1bb0c52b45268a32bea7c08363145b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889631, "uuid": "4fc1ecb2-9e0b-404c-94ed-a0700df484a0", "value": "6144:HBsKFk5pfANiDyJ3xF4JYK5wf6t0FU29HUYo:H3ijD43xFAwf6t0FUmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889631, "uuid": "0b30a9c3-0f59-4d98-bf8f-6c73e218cb16", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889631, "uuid": "18183358-c1d2-439d-b74b-b6a32c8c1a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889631, "uuid": "6d0d1342-5aed-4f16-a823-86ca354d1e03", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97528c3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889632, "uuid": "c020cfe2-4b7a-4122-b6a9-72111d2a37f1", "comment": "Malware payload", "value": "837231250296201d656bc7e3e70e5bf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889632, "uuid": "0c3e6079-dd37-46bc-98c7-339d5bbf05d6", "comment": "Malware payload", "value": "3da7a28a785841d70aadd5d72b14d13286c6faab7dbb64f68276989a5b171792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889632, "uuid": "09f17a15-8521-4035-bfc6-a43e6f571d12", "comment": "Malware payload", "value": "07a57d68e7849c6e15f51cc75ffb593ed3836e99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889632, "uuid": "877e0537-fbc7-4f15-aaa8-5b884e4554ad", "comment": "Malware payload", "value": "37a3ad3d5004522ace23b83fb1d37d51613daadd93166033e0cdd669de94649d7fd1092bf024cbd4cc96509821836241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889632, "uuid": "7944a221-2e74-4ce1-8c43-db72fa7e1cfd", "value": "T193D3E923BE10542AD972C6F06CA9C799BE172E361FD1BD072656BB1832B220376F454F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889632, "uuid": "65ea9325-f107-4dce-a742-10656f2add79", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889632, "uuid": "5b67278c-3e35-4e8d-a117-bc34a616b617", "value": "1536:4fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVFn:4VqoCl/YgjxEufVU0TbTyDDal7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889632, "uuid": "773a70fb-0fd6-4782-a026-5c5e1b474e5f", "value": 138481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889632, "uuid": "12753f1b-3ca0-4587-a196-c22a37839d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889632, "uuid": "a127812a-fc00-4133-bea0-b9a3e90e4b09", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa39036e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889634, "uuid": "b4679b59-1fe4-46c1-8754-31aca8d024bc", "comment": "Malware payload", "value": "0cc064d1ea6978979710b247235891c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889634, "uuid": "76af573d-1ebc-4238-bafd-19a4fc89fc3d", "comment": "Malware payload", "value": "3dad57bc3691c369c8a62dc6aef9e0561c01ffa972e614aef1928f38480df5cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889634, "uuid": "c2c4fc87-b093-489c-a3b1-728d68149d4e", "comment": "Malware payload", "value": "c6a60f1485f7e930eef3be33ac67c448c36fb6eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889634, "uuid": "0a40acd7-5106-4cae-86c4-c2cb9b17d67c", "comment": "Malware payload", "value": "fe7be6c535fb1c4df097482513e30b64e0b997bc9b571661f0563e9c7856833f39d1e382aff6ba01b669c768d85ec917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889634, "uuid": "950be330-616f-4152-b2d1-fe9b34ba6216", "value": "T11175336573C185F2DE1A263101566E708FFBD33C1EA52417F7E85507ACB8462EB6B382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889634, "uuid": "d295a7e9-96ab-45c1-b90c-4def0ebb1f88", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889634, "uuid": "3fd2b948-241e-4926-bf03-9dae690fc1de", "value": "49152:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxTspAepbuy:82kQCN/JT/kgFWLa6vp6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889634, "uuid": "2b3715f8-08c0-46d7-bcb8-3c2011398416", "value": 1653442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889634, "uuid": "19e2bb50-ede5-4a1b-9f0f-3f5915a36d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889634, "uuid": "556e4a8d-420a-44dc-ac2d-4b1c37b82d1b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad40dd5-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889635, "uuid": "6d504ff7-0fe5-4289-ae3e-1322e1fbae94", "comment": "Malware payload", "value": "cf3e7662f7cde9bc0d77a3e724aefbb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889635, "uuid": "0806cfd4-65cd-47f1-b0cf-d5f36de1c5ce", "comment": "Malware payload", "value": "3dc3cdffb9523a69319438cdec0e16838a9421240d62d7aeda693174215a9c44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889635, "uuid": "64ca3ca6-74ea-4058-b4b7-673bfc7c5e0f", "comment": "Malware payload", "value": "a21bc4df0d08e1bfd2e7c45bc43fcff98bd28a2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889635, "uuid": "3c129f44-05e1-4d01-beab-f8ede5654e4b", "comment": "Malware payload", "value": "9a68733d988708657aaade0d8aea8aecdd597ba1a190dcfe2951fc979ba4dc5a56d7062f6418447238066d35b8a5a1a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889635, "uuid": "5e8235df-e405-4e8f-bccd-40cfef9db6a1", "value": "T1344533692992AD58FFF6DFB9420C4E091E9023845F5EF8156B48BCA651A24F3FC76330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889635, "uuid": "66df4330-a9a2-4a26-bab8-464000b14b56", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889635, "uuid": "e4e877d3-018f-4900-985d-d49c5e32db2d", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iWtPWnQKP9:+YhQs7tW2zku73bFgVlRlbN01Ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889635, "uuid": "1d9ba021-b8ca-4f29-9bed-c5659466bd72", "value": 1249822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889635, "uuid": "e68bd122-961b-4107-9a85-6d0aa174b257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889635, "uuid": "1e55b303-7617-4308-9d6d-43a8df16ac23", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9bbc5a-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889636, "uuid": "d9d08b27-f565-4935-95fe-57ae3528e7e6", "comment": "Malware payload", "value": "21b20338d2a20908545caf578a327af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889636, "uuid": "6337ff34-f2f4-4636-8947-62b24f99807c", "comment": "Malware payload", "value": "3deb172d25824017c54afd404941f6c502bf81fc0bd96be67a54ddf87c43a921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889636, "uuid": "8f717e21-692d-4f60-9dc7-adb61dc371f7", "comment": "Malware payload", "value": "90258861c6f400b92ca20bd1dda4bbe4a9ac6756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889636, "uuid": "29003fd0-3ce8-4aaa-a0b6-8775d72e357c", "comment": "Malware payload", "value": "6f8673ffabe356ee93272aca51279ca6a1fc508d06594a9b7f0a9326d0d689d34252f6ba3a946e59e3ef7a382206aec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889636, "uuid": "499926c3-d385-4d85-a72d-2f872a76522a", "value": "T16686330572B109F6E9B7D179D6938B22EAB2B8160375C3DF73A482642F237F45934B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889636, "uuid": "93fd2eb1-a4e1-454b-bdda-06645c1517e0", "value": "a13403e04830e2f126c322c493f63e68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889636, "uuid": "7399bb93-f449-4ac3-bd27-5cd7708c3348", "value": "196608:aa5tA1HeT39IigFeE9TFa0Z8DOjCdylVSE/GoznzZBW0C3x:aa5m1+TtIiRY9Z8D8CclsSGorM3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889636, "uuid": "c6fa295a-f83c-4cbb-9324-23d699b462f3", "value": 8230144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889636, "uuid": "af62dae5-8467-4b1a-85da-2431c2c4ac42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889636, "uuid": "575960d9-29e9-42b5-9355-b2eea371620b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3113f940-c852-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891578, "uuid": "2f34262b-1bec-4921-996d-1e77edeea4d8", "comment": "Malware payload", "value": "08c44c70e30dbcb144290a73689709de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891578, "uuid": "11fdf8d4-4205-4d60-8d5f-ba30352eefb3", "comment": "Malware payload", "value": "3e6b7383042f852ed2ddf1b537e847cbb5c0566e48cee6d8a21922ad60749c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891578, "uuid": "6565d3b6-261a-416c-bb23-436542d94280", "comment": "Malware payload", "value": "2fd0f6c167343d2b8b6a308293be41b0ba31db93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891578, "uuid": "ed553cb1-e0a4-46a4-afb4-7ae69870aaf1", "comment": "Malware payload", "value": "51fec906feefe88f059abe21cc5947de7d63d79b306da3e47f45df583014d5adc26f8406cb470d1d25641e5ad96f24b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891578, "uuid": "1adf3650-f4aa-44ce-a3c9-ba372ee54cb6", "value": "T17235230B33C15671CE4A533206871AA15E73A7BD0770983A77E8614B0DF2954BFB8AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891578, "uuid": "c4f00a9c-1818-4732-af55-4542f5dbbd8c", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891578, "uuid": "1b3c1ec7-434c-42cb-9ded-c4cf7fde907e", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mW0o:qE27hQs7tWVToP0Hs0/htDH3pGaF5+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891578, "uuid": "67b9802f-46f4-46bc-b56b-9a0dc2065172", "value": 1149348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891578, "uuid": "0496b1e2-4991-4ba4-a231-1f98190f90ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891578, "uuid": "b1d7e919-7cb2-4e3c-93e3-59624f1d2448", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac369e5d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889637, "uuid": "0788e640-211e-4166-abf5-7ff870df169d", "comment": "Malware payload", "value": "234394b6b053c4e31806bbbdef4ec5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889637, "uuid": "5cac4c62-d18c-4d2c-8135-b21ccd28c76c", "comment": "Malware payload", "value": "3e871ba389ab70b025363279fbfa32248a160ce2170f208f8ae303db3c9f1d9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889637, "uuid": "850c9def-ab1d-4810-bbdb-e6aa956b24fa", "comment": "Malware payload", "value": "dbc2db2d41fac53c26e75df42f356d9276037298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889637, "uuid": "d9f2b26e-6fd0-4805-94e6-09b5384d0cbf", "comment": "Malware payload", "value": "ff986febbd5b7a25ad86773c5fbefdcefea14a07c88f8dd8f72d64952cb088996020da4ebe17dad595e867e9ec9c8a78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889637, "uuid": "f6412749-6aa7-44d1-b797-699cd10b82e2", "value": "T1A114E847F60281B9CA38C537A561C2B25F257E75AA63CA3F31513A2B2D79B001D1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889637, "uuid": "ef396de0-661e-4ff3-ac35-b991db6116dc", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889637, "uuid": "5e4b26b6-86a8-4382-bf72-9ea6c80b3542", "value": "768:QUKxW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAar4PzpyRAJ7IwnDoSdv:QUKHbC4Bk6lMTOWk4PkRAPoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889637, "uuid": "5beaf10b-cda2-41f6-8fb9-22bab618c358", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889637, "uuid": "a2b28b54-ad62-4fff-a6b1-eae8110de67b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889637, "uuid": "9fe98211-3f1b-40ad-90d9-51ee4346101d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acedd591-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763889638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889638, "uuid": "b558ee26-dd17-4972-b71c-eff6bfa4e5fb", "comment": "Malware payload (SalatStealer)", "value": "1c81c9e1b42acc52d40c4713c4c7575f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889638, "uuid": "d0e72d83-fd9e-4f6b-80fd-6ea73e754b8d", "comment": "Malware payload (SalatStealer)", "value": "3ecb0fccb3118e352b454579bf18f2a96e4ebdc0149adc67dc6507b483191e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889638, "uuid": "1cbb3171-1f60-4489-9e25-cd3ac924ecd5", "comment": "Malware payload (SalatStealer)", "value": "b7fd9404dcd4ebd26cf39b90f0a44918fe079f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889638, "uuid": "4e7f284b-1ba7-4398-81bd-b31171a41847", "comment": "Malware payload (SalatStealer)", "value": "c4101041549068fb30d2f38a8c8beafc19cd60961946a906792aca97021ede1ed9dfdd8d285376a4ef51458a115593c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889638, "uuid": "8eb6b3c1-3293-4934-9cf5-7395675adf77", "value": "T1D2E5338A12ED9445C36E05F2F33DD5B4AC439FB6EFCC040F22368698EED7694A956C12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889638, "uuid": "5c5b329c-0c55-475a-b27c-c2fe7c3ccb2f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889638, "uuid": "5438a9a3-dc9c-431c-b627-1ac214ec33eb", "value": "98304:1tddl/81fB3cc8zHqb6kMU1Q4GUB5pS21oG:ddN85Kc8zK+c6hwEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889638, "uuid": "8d7d4dff-1592-4dab-8939-f9b12d4baf00", "value": 3289088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889638, "uuid": "e9cf9442-c82c-45e9-9f23-2182d04153c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889638, "uuid": "3edbcf19-9c9b-4ded-b884-b7aec18029b2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade7752e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763889640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889640, "uuid": "0124ccba-af97-4095-a2dc-d8824ca941dd", "comment": "Malware payload (CoinMiner)", "value": "fd0c1bce5923870190e4671609c4a7d4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889640, "uuid": "c9f75b4f-c9c4-4576-b63e-711199285e9c", "comment": "Malware payload (CoinMiner)", "value": "3ecd0e03a79afea60b6232c95654832dcc1790c565cca42766b4ac2163109dab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889640, "uuid": "c731c375-ab3a-4516-bbe7-775a621f1c3f", "comment": "Malware payload (CoinMiner)", "value": "f2e65319c4fea68dc5598d7dfe8471e4788fb76f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889640, "uuid": "b0acba90-5e1b-4a66-8e39-25b2a73292e7", "comment": "Malware payload (CoinMiner)", "value": "11863e3388a229a583cf30bf117ac2e171b6bb48eb4c830f801ab983af3a5b657ff22fb0a1117a4eb670750d6699bb73", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889640, "uuid": "fbbe56f8-16ef-40cb-92ef-6508b96f0307", "value": "T124569D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889640, "uuid": "a32ff07c-522c-49be-9a8f-6bc78014c4b4", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889640, "uuid": "2a341301-47d5-4c34-800e-18d522840dd8", "value": "98304:IvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650k:I/II/6aYXdFD22VatktKpEEd1Qi06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889640, "uuid": "926790c0-c517-4a29-8bd4-65ba4468dfb4", "value": 6441039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889640, "uuid": "325c3253-0bfc-4d2b-9de2-5c00de5a58a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889640, "uuid": "76217139-b09d-432e-b23f-0a518622ec2f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8b5274-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889641, "uuid": "4e2a1ceb-6615-4f18-8a6a-94714fc434fc", "comment": "Malware payload", "value": "e77b483981f38ad09a92935bf38d4cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889641, "uuid": "f9c1eaf7-ed4c-4b21-98f1-ddf1207274c2", "comment": "Malware payload", "value": "3ed3ae78d827e77f3947a95e4353ed944c7c8f1ed868e8190bf894a15fc39369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889641, "uuid": "753bdb2a-9467-496f-bb53-920c7a99c628", "comment": "Malware payload", "value": "a0fa680df43fecb231da95e9774275d5b43d39f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889641, "uuid": "779e2c03-d8ab-48dc-8550-60822249c367", "comment": "Malware payload", "value": "9c2697a55f6753b8cafec2b6a782856246dffa5b62ac31d877f95524057291c31c1a8d2c93dbedd6e73105b4801ecd46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889641, "uuid": "579b3453-5e48-4a5e-b881-46a452a45440", "value": "T14D542B03FDA4647BD756C9F1A8BB519A7C319F6A1AA55E4732A4FB46383100336F220F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889641, "uuid": "29eb4d3c-fbc9-4a8e-91e0-1a4ec4990a43", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889641, "uuid": "0d90461b-0664-4add-b45d-f47a6869c297", "value": "3072:AygCullUQN7gsBh1L1QygCullUQN7gsBh1L1D:ARleK7712RleK771Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889641, "uuid": "5be5203f-8ce9-43df-aaa6-9dcd49827707", "value": 299951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889641, "uuid": "f4df1338-a409-44d5-9dec-b0df5e0bf378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889641, "uuid": "31750581-99b4-40c5-b379-4f04a1651196", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2547d1-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889642, "uuid": "6d66b5f9-7673-4559-843b-704dfe0b8e7d", "comment": "Malware payload (Miniduke)", "value": "612e6a62a162858832f9876b7bda545a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889642, "uuid": "ec354b11-1dca-4c5b-9c94-d7bd811f9e39", "comment": "Malware payload (Miniduke)", "value": "3ed875fac3c8dd5edd9b5ce454c5ae718745a374902ee8a234f7529b563312ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889642, "uuid": "a0a51e83-ba14-434f-9f71-974c3b65b673", "comment": "Malware payload (Miniduke)", "value": "9891723c9721d97d54bcb3a0b4ca5e52cb07cb75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889642, "uuid": "a0a70aa6-d717-4f62-8e39-984f28861fd7", "comment": "Malware payload (Miniduke)", "value": "b1bbae77f009ab433b51d1e46f0f03d69f2e13427f8e0c1e6db54626293d70912a00f5b8a4dac632947a47572d88042d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889642, "uuid": "d9c3ed10-1c3e-4bc3-98fa-e4e631013441", "value": "T1A7049E3533E580B1E53316B46DF1AB729A7EBC384A71858B9BA41F5F2E346918339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889642, "uuid": "19e97b7a-59d9-4e59-8021-be9db208aa4d", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889642, "uuid": "70c5c129-5976-4e12-8d8f-1c8d74d58c03", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZMYIWJkdo5Se:+/LhS0rKE/FLITo9mpIWWde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889642, "uuid": "bdf3f89e-b005-438c-a9cd-ba1fb30ae3ff", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889642, "uuid": "ac0cc03d-d030-42f9-b7b1-578f68ea1d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889642, "uuid": "362cd432-3d22-4078-bf81-045b01489681", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc0f728-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889643, "uuid": "cb6c0f7e-733f-4bbf-a27f-2414733ad866", "comment": "Malware payload (Simda)", "value": "46148ee7d72c1534759d2517289e2fe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889643, "uuid": "aaa9421a-0db6-43b6-b887-1b72dd11b7b9", "comment": "Malware payload (Simda)", "value": "3f5c1eedcdf3887b5b400a144d15e1da1d231b3cd270c5bcf661b375e4a857ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889643, "uuid": "160258a4-57fc-4558-8616-c43819d7c9d6", "comment": "Malware payload (Simda)", "value": "473acf8aca7a457c18da4cac74eb26ce4320ba1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889643, "uuid": "8e26ded4-87f7-43d3-bdd5-fe500c5c7742", "comment": "Malware payload (Simda)", "value": "b29ead6ce75eed4cb53a20654da7f35ca021ab58fca03f4eb0c97cc180378e47326240200393c6d7464266b7b04bad02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889643, "uuid": "c3937e42-4373-4fea-8c46-4c425c6db0e6", "value": "T198C41211CB7009E3D1E65F3B89EB9B064967E471CB26C69B7604639DCCEB681BC30365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889643, "uuid": "b782f4b0-2c99-4787-87e9-0ab3b534019e", "value": "fc5c1aac18a83503e3cae0c72797cbed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889643, "uuid": "336fbb88-5a54-4e51-8daf-fea4db6512ef", "value": "6144:8c6BtUaNMtLLowRg4uLhuMXUk4m5xnt0Ve:8juaWLJgzLMkvoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889643, "uuid": "713e2ea1-3542-40b9-80a6-0339a620d448", "value": 562170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889643, "uuid": "7f848792-dbca-482c-b9e4-db525e7017bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889643, "uuid": "bae746bc-b824-46d1-9aac-3fbb476941b6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0628d11-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889644, "uuid": "8223151b-0fc3-4e97-81bc-aece1ca3d7a0", "comment": "Malware payload", "value": "d040069170172123d716857ca9ccab9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889644, "uuid": "662d2476-7ec5-4316-aaac-1f8bdcd0471a", "comment": "Malware payload", "value": "3f7b08d91b3840cd8c1be20f20efd8362e5cb3294683cb660b62cb58d142d3b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889644, "uuid": "dab3bfec-f3c4-4afd-a991-2184b80ec353", "comment": "Malware payload", "value": "af47238f6a6403541f7954dee11f5a20707dd7c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889644, "uuid": "cdd81d6a-b00b-464d-a563-f98ca3f72ae9", "comment": "Malware payload", "value": "6786518d3f2bfc5d8e7b7d788caf3849711c46d0c73223a342fb3a419df84e09b16fb2909676b75168d1dce1106e8e7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889644, "uuid": "49902989-4f67-4fe3-b2b8-d7eb8afa4fd2", "value": "T185653323B4D090F8CC492837019DE770CBB16AB626F5A676AFEC1C6A1C714A17B5BF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889644, "uuid": "85b3b619-3316-46ec-af71-8fa970d2c43a", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889644, "uuid": "e11d481e-0bd1-4932-bd19-5383ec5994e0", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lAN2kwSk6Ye17l9m:7E2lVL3Ze+/F5ndjFWmrjyx1cmNk7YK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889644, "uuid": "d270b744-d00b-42ec-8e9d-43fc1d6bf85b", "value": 1427192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889644, "uuid": "6ad512da-1c5d-48a0-a572-c3c24aa21a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889644, "uuid": "197a4a8d-8156-41c8-a8db-4cba94832640", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f59cc4-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889645, "uuid": "6a8b0a37-9f3b-426a-bd43-4b78485fbf51", "comment": "Malware payload", "value": "e2241c94df512312a8d56e534c214a29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889645, "uuid": "153d9d97-b59e-4312-b9f4-d1762c5ea96d", "comment": "Malware payload", "value": "3fe0dd568ede0ffec41f276170bf26cbb9e54d5bc4c3b5bad01439782b89aea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889645, "uuid": "ec692955-fc17-4f75-87de-d1139ebbff7d", "comment": "Malware payload", "value": "0a1af9fdb0858e70d60e2a87763165d3a5bfd44e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889645, "uuid": "7647f586-e6e7-4398-96ff-8cd634f87639", "comment": "Malware payload", "value": "a854df48060dad233d681f7c81f6301859bdc1f42b1903a9640ed7683cc4a9ca5d5c78564732d047955c3c30136a87ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889645, "uuid": "31bca84f-d068-4363-8901-33f5c09d2479", "value": "T10C93E1529EC048B9FD6B1475202FA37BD0BB7664062DDADB4B90CD55BC33064DD227CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889645, "uuid": "2b3d0d85-591f-4179-9631-83fbe402f8f6", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889645, "uuid": "810431b9-5d8f-4a5c-8217-f6d16b458c8d", "value": "1536:UCr++NMoO/aLB/lmzs0wB2Q0wB2NbszO3uPHT/xiZCk+2YvRecUJUfOELNMdRSil:W++S/lmz9+e++brur/AZCk+XvqJALNM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889645, "uuid": "fc2f8674-bd39-4d8a-a2c5-11b807354791", "value": 92820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889645, "uuid": "bbf135ef-fc12-4bc9-bea3-229f81fc052f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889645, "uuid": "a5fdddf8-72e2-4daf-b8f9-dbf9cca2d5cc", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18ce13a-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889646, "uuid": "d707a8db-c278-4734-92f6-90a030e176e8", "comment": "Malware payload", "value": "1e026fc5e6ac2ba7902b1e8b1ad71ca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889646, "uuid": "4d0ed781-9f7e-474b-b641-b7d03a517adb", "comment": "Malware payload", "value": "4022de78d2c8b6b9565264afe4abc43e2254580748e48da18a5b80cee93ba814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889646, "uuid": "ed082934-1dc2-4941-aeab-bfa517b2d5d5", "comment": "Malware payload", "value": "04d6530e5b2cf90910a4284ef5b0ba73093abcc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889646, "uuid": "85297dac-96d5-4dc9-94eb-ffce10460de3", "comment": "Malware payload", "value": "55dff8bda5de426ee9b0e2a9485c9cb2b5412384f90ef71bd1762dc19f736b3557d60f858da1b50e80cd1e790b40deb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889646, "uuid": "dc101d29-9397-4bad-8de5-d625c57f5624", "value": "T19744096B73532CF8E6AB807586D7E7B1B432B8160324FE6F0694CB332E70D51066DA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889646, "uuid": "48f38c62-abee-463f-92ac-da20a58b3d08", "value": "b7b39d5f4f33395d7a4a007f0cd1b5c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889646, "uuid": "e7e62a4b-a11d-4cb6-ba94-d75e35cb56e1", "value": "3072:BWu4w7QUU7yJcDMq54MHuzs+QAla6LSSfU+ZX91jlh/ZgO096dGdwO3mOIQLDhZo:BWuYQNaFiYkOhptlaIOsIRQUSdA5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889646, "uuid": "53895866-f1db-48a5-94c1-179e0a97607c", "value": 255068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889646, "uuid": "ddf9a908-a32d-437a-baee-c5ca14c2c56b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889646, "uuid": "a14fb540-fab3-4d6a-9733-7b090dc13ea0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2499a61-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889647, "uuid": "9fbf3cf9-195d-4906-bf30-b36789b8e287", "comment": "Malware payload", "value": "255cfa21f15854a62498e8f66c5c87e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889647, "uuid": "13e808a9-507b-4d03-9b7a-2a8902cdb0bd", "comment": "Malware payload", "value": "4029233d20923e772219f585ec5e6461351eba84702223bec78b4e97551ff11a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889647, "uuid": "f0b85133-c4e0-425c-a0d1-8ee115ae0d01", "comment": "Malware payload", "value": "c9e793d8818767b5da2c43ef341cb21c89ac9521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889647, "uuid": "1a646ad9-f7aa-4b37-a790-ec48efe6b232", "comment": "Malware payload", "value": "41fd49b0e99cc749e7a05291c7bddac711a02d34c7de46397bbd32e7d4c276ca91048d3f02bc339819102d6c64fa7612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889647, "uuid": "0b82b40b-8279-4206-8fc1-ee1881b1560d", "value": "T12035233A31908CF0D8951A310B4637B55FB3F336361548666FD42B272E7229CEFA971A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889647, "uuid": "993bdc9b-2274-4f88-8d23-6437962667c6", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889647, "uuid": "a542a5c8-ff7f-4927-93d9-04985b580351", "value": "24576:v6Zv2WqhsVn57hqQeKUP581L9k+4EBtXMRSkqJZM:vE2WqhGtbUPuVt4EBFCSkqJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889647, "uuid": "e43600a3-ea77-4615-8a95-7928ed7758ad", "value": 1156455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889647, "uuid": "834b3295-e816-4547-a7cf-2163cf50e84c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889647, "uuid": "98bf38c8-7ff5-4ed5-a18d-49e9d237a2cb", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d810d4a-c858-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763894256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894256, "uuid": "c94860c1-b8eb-4b0b-9db1-063ed8b3a0a1", "comment": "Malware payload (Mirai)", "value": "0aa8b3ec67473233d354761bc7f7267e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894256, "uuid": "3a94a754-68e3-4400-bb9c-ecf7d4f134a7", "comment": "Malware payload (Mirai)", "value": "4057d50aba1aeda1f359ce366f336e5818faf223fdb81048595a0535e3b3155e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894256, "uuid": "ab7cfadc-eb31-4581-b7ec-57308d70574c", "comment": "Malware payload (Mirai)", "value": "5cd7ac584063e63306376bb89a34125cd1000964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894256, "uuid": "c271ab18-2ef7-430b-8ff0-86baf2ebcf5c", "comment": "Malware payload (Mirai)", "value": "64b70f6ef5ec810f67d10dcc32d4e76f22125b1ac59df23593889b0da95784b84cd36ed79fab18adee5880542d90a99d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894256, "uuid": "69914b9e-b4e4-4e1f-ad4a-f0ae527d575c", "value": "T153A3280AFD819B11E9C125BAFE5E518D335307ACE3EA7202AD105B2D67CBD6B0F3A411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894256, "uuid": "d8691a82-6e6a-4298-bd4a-35c07d8ed443", "value": "1536:TDn+1axmmXbl01kE6sDNkmUmVvmepPjuUz7ll8jiDR6aL2BBY7lYk0zb0UzZ:eAXbS1rD7JVvmepPj+CR6aL2BBSYlzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763894256, "uuid": "cb3b40ee-f230-40fd-840b-df5a150a7b82", "value": 106292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763894256, "uuid": "164066af-a96a-4f77-8673-ad1f978dd565", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894256, "uuid": "d1a52610-8393-4a10-9a7e-711ad39c8b6a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2eacebb-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889648, "uuid": "bd919312-73c3-4332-81ce-a36ef3ab7bd2", "comment": "Malware payload (Simda)", "value": "49029c942821fa41e483c385e2b2ace3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889648, "uuid": "98c07d33-384a-49d7-b8d5-d97004f6f755", "comment": "Malware payload (Simda)", "value": "40f2caa9ade596174379811480ba1f47b7f1edd2a94a15a0523d01716a566af3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889648, "uuid": "698432d9-85f3-4ac0-8e3f-cabefd759a8e", "comment": "Malware payload (Simda)", "value": "b1cb5a51802ab906eba10db98856e9f60d78d616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889648, "uuid": "5704df26-329a-4bc7-b2ec-a8357668efc0", "comment": "Malware payload (Simda)", "value": "e5090c259a1615a2f6abc2bd30ad5f85336ea29ea41b411da61bf652e03134f744f1e13599e796b1844d83bcf859b866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889648, "uuid": "e756b652-6231-4e2e-8f5d-e3e2986c2524", "value": "T19484123BF6A418C3E6B63A3014FDE15829A8952C3552AE3BB40613DD2F662C44FF5B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889648, "uuid": "9701e3b4-5a8d-4f05-bd62-bdc20200a3b1", "value": "a0f41bd5de82cbb844f692b48ffd09bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889648, "uuid": "628382c4-dc39-4a0a-abd8-426bb1f8376f", "value": "3072:foAbvJrZ/CEp1Td3INNAILgwKRpP3fJ2pwLAt/iw1JmWTe1eyfLUH+xW6Lyk:f7vJN/CE/TZINiPPBIwcuWTegi9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889648, "uuid": "fd237d61-5b61-4cc3-b1a6-e0e391510ea3", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889648, "uuid": "8c164855-c965-4ce3-ae35-4d8c529cc894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889648, "uuid": "cb9ffadc-7306-437f-8456-a86bd481eab8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b397508a-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889649, "uuid": "b26f9e4b-582c-4d46-8ce8-618228c6a79f", "comment": "Malware payload", "value": "fdfc023590c28451cd1497a46528b74e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889649, "uuid": "9232c6a2-d9ea-481b-bd28-5401fdeae43f", "comment": "Malware payload", "value": "41233e1ecd444b285a1f5839c6052ec54b7b68ce8a69cb34560bf7c96c125b91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889649, "uuid": "bd168a75-7370-4c0a-81fc-22000d36668e", "comment": "Malware payload", "value": "c3a47ac25aca2ab9c6738dd359e9438a7154a421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889649, "uuid": "2254249e-e9ce-4b20-aa89-8998105e50a8", "comment": "Malware payload", "value": "10118a96c61f9e4b44f0278f84978b5522afc05b1d84a0b59070d19fddc26d36619ae0b276aa1d196d3a6d3880cfa1a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889649, "uuid": "8f2b0341-cc6c-49ce-8f42-f37eb943b3c1", "value": "T127652323B4D090F8CC492837019DE7708BB26AB626F5A675AFEC1C6A1C714A17F5BF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889649, "uuid": "0fd14470-170e-42f7-9a33-3d15eeb7bc6d", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889649, "uuid": "3cb88035-bbef-4567-8136-36b150a775c8", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lAN2kwSk6Ye17l9O:7E2lVL3Ze+/F5ndjFWmrjyx1cmNk7YKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889649, "uuid": "d880e9c9-b451-47eb-b9d1-48869b38dd9c", "value": 1422783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889649, "uuid": "47a3bcf6-fb0c-4970-a966-cb7da3b26ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889649, "uuid": "5231ab25-233c-456a-9485-865a67e56955", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b431909b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889650, "uuid": "daa7c4b9-dbd9-467c-9392-689f758987b8", "comment": "Malware payload", "value": "63b336843ead550dc1e1a053bee5b140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889650, "uuid": "174db6f5-9df7-4d60-bdc6-a8f2f119b5a0", "comment": "Malware payload", "value": "41508b75ac3982ecfb62a3e07bf6cfc9ca437453a98dfce1e85373ab739cd363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889650, "uuid": "e0a7bd05-1d70-4e82-8d6c-4ba2a1d408a7", "comment": "Malware payload", "value": "0aca518b07e9809b70858cb3fb6e8c2d36744c64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889650, "uuid": "d7e02bd6-2506-477a-a390-43ef5cac15f9", "comment": "Malware payload", "value": "8298bee4354086393986833477e4b043ce8aa937f330b596194ef8cf137b9c99d91eb6eccf2cf923f0be81f9f71cccff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889650, "uuid": "5f93b9e3-fa97-468d-a44a-9749e32e086e", "value": "T16045330D16C27718DFBC63FB9786289536B22BEC5794683A7B0CA48713E750C4AF416E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889650, "uuid": "336a4dc2-6fb5-4fc6-8cb9-f846b1cded9b", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889650, "uuid": "2845c803-0ccd-424c-bc2f-68a5a840af65", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mjC/QjxD/ua57TT:+YhQs7tWVToP0Hs0/htDH3pGaF5+EDRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889650, "uuid": "74630c52-1bdd-4d1c-9d93-fa4eb7156d8e", "value": 1225253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889650, "uuid": "74812cce-dfe2-4083-a9c5-88f39822cda2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889650, "uuid": "5d716106-cb6e-4d55-b156-ef62e2903b35", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0229abf-c88e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763917588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917588, "uuid": "41919066-c058-49a2-96a2-c28306c61c56", "comment": "Malware payload (Mirai)", "value": "9f8df4967c9bb4f35020f14bee089532", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917588, "uuid": "2222b535-3548-4819-85c3-888235f1bc15", "comment": "Malware payload (Mirai)", "value": "4159d8e199ee13ea7ec2355317cae2fca4cd49a27c44adea6dc9c0b7a6b52732", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917588, "uuid": "811a97aa-4392-4d43-b05f-74e2a3b4e3a0", "comment": "Malware payload (Mirai)", "value": "88ea2c613ce520f209c8d37a9ea8ac92e7ced5e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917588, "uuid": "4daf11f0-549f-4eef-9774-5444dec3099f", "comment": "Malware payload (Mirai)", "value": "7117a54f95bc46ac7de6c738c49900584a0f676aa071fc1910041d9036079000e7bcbf8871697015951103ff18961fef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917588, "uuid": "8da48760-7941-40fc-b084-2bbcd7f8c81e", "value": "T1A282D0A0F313BE30E774443EDE69C50167A60BB4E4E6F2A014AA0354999741A3BFD7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917588, "uuid": "6f3f2273-6608-4bd7-807b-ab1131789f94", "value": "384:SgAWOuUPTbDPdN/St5csasJvCRUkqV5i7hymdGUop5hFC:5OnrDKtmsas4+bUs3UozDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763917588, "uuid": "46b2cf50-3918-491e-9a06-ea8d1b7ecb54", "value": 18556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763917588, "uuid": "bb927220-7a94-4746-ae1a-49cbb24d49ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917588, "uuid": "c975cc3f-3e83-4f93-a54f-0b40ac1b2c09", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66e149d-c854-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763892634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892634, "uuid": "e57a5eb8-65e1-4717-9671-4e6e46c03a55", "comment": "Malware payload (Mirai)", "value": "8ca423755f88cc1d6da2d2ce5253a46d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892634, "uuid": "51f0dea5-ec8f-436e-bc64-278414e7dfd4", "comment": "Malware payload (Mirai)", "value": "41632af09f181889fae7cc2a7068567db4dde177382780b71e81d69907c763f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892634, "uuid": "48e13857-1349-4713-99e3-925438e7e8b1", "comment": "Malware payload (Mirai)", "value": "e2efd9f569f77ab1e1977b3123b57bb9d97ca81f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892634, "uuid": "63ce624f-ef24-4574-b4ba-f8366cbc782e", "comment": "Malware payload (Mirai)", "value": "566f3f6e2e3519cb23f029036dccc876cb690076cb005314a1b144008c2d3de87923d5c4326a53657b554cc27bd8ee76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892634, "uuid": "376228dc-009f-49fb-ab7a-c586ba2823b6", "value": "T1A9A34C57BD92C613C6C1627BFB1E428D372717E8D2EA72038E219F21738A91B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892634, "uuid": "b857893a-e347-4e94-a98e-d6fa3ff4090d", "value": "1536:P4HyXvCvTWuMFaH+r7Sl8rV5AsLd8OmaYGSLFbG+FTdulnvs7emu:AHyXSjN6WtsL2jaYJbGyTcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892634, "uuid": "39b1be6e-c009-4a48-bbd2-a7136856afd9", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892634, "uuid": "78386c20-6257-4fc9-8aa8-aa30e4896ddd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892634, "uuid": "adc68b1f-4571-4448-ae85-88222d0e8ed5", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b501f391-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763889652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889652, "uuid": "4a45f99e-d4a0-4b0d-9482-cb132efc131a", "comment": "Malware payload (CoinMiner)", "value": "b56417794130defda18dfd1e74f7c1d8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889652, "uuid": "79faa316-490e-4891-a1f1-d8364c965c73", "comment": "Malware payload (CoinMiner)", "value": "41823e8a5a776c2dbab3f06a51e5422bf35bebd87b255ac3318e276ef765eaad", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889652, "uuid": "b8308ac5-165e-49b4-a593-48ceb43e57f2", "comment": "Malware payload (CoinMiner)", "value": "573d355686f04c80963cefc2bd4c2eb1f910fb5e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889652, "uuid": "2002ed39-b316-4591-9a49-ad36d661f550", "comment": "Malware payload (CoinMiner)", "value": "218b38a509702b5e9166010bbadabb9a2ea9f3859c14dfc705ab6144f18745b0c6199f621347f2388d3cd9951b91ef39", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889652, "uuid": "a5e48ade-8575-4cf8-9972-630f9c8eae7b", "value": "T1E4569D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889652, "uuid": "9b5b7fd6-dede-4281-87ed-d2f897714b12", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889652, "uuid": "a69c83cc-3c8f-4bb3-814c-e256e7a3da80", "value": "98304:IvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650O:I/II/6aYXdFD22VatktKpEEd1Qi0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889652, "uuid": "3d61ed91-ee1a-4cb8-9578-f83b112d0249", "value": 6442237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889652, "uuid": "96f42b12-f138-4f65-a83e-db97a218d92a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889652, "uuid": "9721d0fe-6620-492b-a4f7-5ceef9b1349c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b0ff0d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889653, "uuid": "ad67e792-6f8b-4a0f-bc36-6db150192e6b", "comment": "Malware payload (Simda)", "value": "95f46593263b3af74d8645be82eb2abb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889653, "uuid": "63ee9924-2ca9-43bf-91af-4b78f20e1722", "comment": "Malware payload (Simda)", "value": "4186ff44e98f32b3bcef01c4f1636236c239c77d3130f442505fd935b0fb22e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889653, "uuid": "ebe064d7-89cb-4c5a-9239-53f520618db4", "comment": "Malware payload (Simda)", "value": "23c79a16e109ffbed1ae2fac3e614f609c2f5bdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889653, "uuid": "e65e7825-2c8c-4bce-9149-9e6e5001d6db", "comment": "Malware payload (Simda)", "value": "d736fd32d77ba40ed3ff289ed47d4933cf0b6c3b548374a0b46c7ba60f7849201846191924fd24bc2d7384882c50d8f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889653, "uuid": "47b50614-26c3-4abd-a033-45fc5162d03c", "value": "T1ED9412C7B18928D5C440067349FAA7815A2DFD551B1BC8FBEF88412DAFAC981BE3531E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889653, "uuid": "733f7d61-6397-45cb-9417-95a38767cb99", "value": "25724a12bec6f765c371201f99ac92be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889653, "uuid": "9dcb7a30-d9c9-40c9-8979-db0ced12770f", "value": "6144:YEXlSylvFuWaS54hIAv/QhuA7HY8pPZ0FP6BzxM5Em:1Aylvv5YRwh9HYd61xhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889653, "uuid": "fe839583-b3dc-4b7c-b895-451be374ee74", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889653, "uuid": "e3892abd-a5ac-4d0c-91eb-7123a0a8dc9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889653, "uuid": "74ddf7f3-6c0d-42da-bf41-7eb0fc863944", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65033ad-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763889654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889654, "uuid": "70c71037-bfe5-47d3-a4bc-7a42468a119d", "comment": "Malware payload (QuasarRAT)", "value": "77a55d6acbaed6188fd41ed8707f1393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889654, "uuid": "6a0b06c1-f875-4db9-9ac2-eec821c2a7ae", "comment": "Malware payload (QuasarRAT)", "value": "419dbbcea77af753b813fef8cc25f3d67c6366ac52faf86fa9560129082dd776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889654, "uuid": "020db794-7482-40ef-9f07-6460c9ca1e5a", "comment": "Malware payload (QuasarRAT)", "value": "c26fc1eb972ba7c742249f696d2428a0dc5dbecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889654, "uuid": "37e74ed7-32d5-4f6c-9265-88c77456a415", "comment": "Malware payload (QuasarRAT)", "value": "f482c849eb050fc7c2e1db2f9cf55c8dc16c0ad7962ab71034f07017747ceadc6d1e7cc2f11fded3a297e0b90a9c5a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889654, "uuid": "09914bbf-3540-4e00-a639-b1a3719b0327", "value": "T15F75F121B3F88107E5BF5BBCA87315580737F9029A3AC75E598C906D1EE73809E917A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889654, "uuid": "77b6098a-72ba-4caa-bcae-c356395e09a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889654, "uuid": "0964929d-e611-4820-88be-63b5eee87937", "value": "24576:FqXryMUT2oS2eWBRwRR16zhHIPbcNK0KKm77yviUSQaZaOwI55l2S62r9ZrLvQoP:EuXT2i7wR2EgKKm77LrwCB6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889654, "uuid": "37088fd1-29bf-47af-8975-250fd678c9ef", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889654, "uuid": "a96170e3-db11-4dd6-bc9f-f1a9e3477ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889654, "uuid": "e04a24fa-2a2c-489d-8a4e-75eeef388530", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f83cf9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889655, "uuid": "b7b411a1-b1ac-4d4a-b881-ab59455e37eb", "comment": "Malware payload (Simda)", "value": "c846247ea7a08d47f702c2d1ace76006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889655, "uuid": "74c7f203-3933-44a5-ae24-d7581334684e", "comment": "Malware payload (Simda)", "value": "41c40cad40ad7a1ee722bc61a8abfd1cb316b6b0d6a8b0969db1458701322e64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889655, "uuid": "e5ea7c61-e4b1-45f2-be9f-4f605baf9217", "comment": "Malware payload (Simda)", "value": "ddddfb3caeb43cd4d1c2202957bddd6ce8295799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889655, "uuid": "791b2d09-0aa4-4226-b4cc-77d32d5d60f9", "comment": "Malware payload (Simda)", "value": "de2fdd6bef340fadc38eddbfa09f8be5bf8e388398582a15f3e19f2cd5ea5474a9138d6b0a44d35c5f3aa5180755474d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889655, "uuid": "c67ecf5c-66f3-45ea-9cc6-aeaeac367875", "value": "T1E40523FD772A8766F57A47736A43C31FA02EF3A41984E152F69948623C707A33199382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889655, "uuid": "99c01723-2796-409f-b54d-1a929391d382", "value": "846a8dcbd0f5c9ffbf7cfa1fb2e5b31e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889655, "uuid": "db9e5937-23a6-47f0-b7d0-487d1c84c05d", "value": "6144:b9y9VlVACGmxRoyt1SZq1Q9A9ty5bhJcrs0MurPw/c4hd/B/coyXT3nOGX6T:ilVP1FtEZv9qyFhJy56d/eoyXjn9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889655, "uuid": "7f1fbfa9-4b47-49ef-8c7c-2a7cd83d17b5", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889655, "uuid": "9148b9cc-0d56-4a51-9a43-7b589cc87b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889655, "uuid": "1b7cf626-03d0-4db0-94cb-798d8de194ed", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a93342-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763889656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889656, "uuid": "bf1dc48f-43de-4b12-9a61-9a1f6a386dd0", "comment": "Malware payload (SalatStealer)", "value": "be2865834e4820a596d6e74b52f11c7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889656, "uuid": "3d63d6d3-4749-4f33-a15b-10e349e64708", "comment": "Malware payload (SalatStealer)", "value": "41c999c5885e81dfe6de36a058b6699066b6877402b2075775a3af8eb253f1ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889656, "uuid": "81da1337-69d8-4284-8c5b-22e97da19207", "comment": "Malware payload (SalatStealer)", "value": "b04573000902a9a7cf6012a29bfee023eba3a0c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889656, "uuid": "376c2aee-3764-46ce-8333-1c723a92b23c", "comment": "Malware payload (SalatStealer)", "value": "cc4feb7dceeb2dd23e016fb393230580947c09e4a393d602f681ce06e1e89a1a4559bf19faf5175c4d57391d4dfe6e55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889656, "uuid": "e9ad714a-5b84-4d68-9b87-bfb65ba165fa", "value": "T16AF5338AC8FAAF60D15378BB0914EC61D21F323E03537ACF4D422A9565E95CC393769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889656, "uuid": "e721d8ee-4e8a-4311-a864-60a5c6daddd4", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889656, "uuid": "f7a3d2d8-5f4b-4b2e-8c0b-1f6f61ead4de", "value": "98304:3pZalUncocW6cd+Y8a+0h3OvOshLwZOi8jV96AYSHzlnvq3b:MIRjheFLwZyjhHzlyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889656, "uuid": "97468ad0-2bd8-48a2-886d-b458bb09fedb", "value": 3559936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889656, "uuid": "d7eb2875-e7f5-4524-8014-08f68ee6865f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889656, "uuid": "15ce9fa2-c723-4bb3-9005-90e05fa4afc1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84881ff-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889657, "uuid": "346af5a7-9fe2-4236-81b8-868e3570b142", "comment": "Malware payload (Miniduke)", "value": "3bd626e98e0debbc354222a46f198017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889657, "uuid": "98704a0c-0b07-4cff-b394-c9a23957a8b9", "comment": "Malware payload (Miniduke)", "value": "42023c6d7cca789be7411fafa8c1962a5eb1f0a77bee5ddeb301b9dafe2a062f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889657, "uuid": "8c9cfa1f-e987-46c3-960a-22dc8bdd3532", "comment": "Malware payload (Miniduke)", "value": "8087c9e75fac7c522a7b78736e16bb3157768679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889657, "uuid": "3f6f0b3d-8034-4c07-95d8-8aefc2112a43", "comment": "Malware payload (Miniduke)", "value": "e410989ad0ea75aa8af9183a0d896694a9c1af2ad1d1fa782fa25cc9eef11a76fecc891293c40546c93f4d19e99d81a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889657, "uuid": "18eda40e-b81b-46f4-be2b-175a084aab21", "value": "T11695AF2132E1C275E42315B4AE71AB134A3EBC189571E58FE7E42E6E6E746C1C13D70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889657, "uuid": "57b57b2e-6515-4b0b-b41a-0ebbdfaafdb8", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889657, "uuid": "719698b6-d018-4ead-8913-4bb59c1e6b2b", "value": "3072:8UZGSkmqmCyG4WoDfs4g6wC7yTdeKOrbIWJXl5Se:8UZGSk1mCI1fs4g6/y81bIWJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889657, "uuid": "bf025734-a529-45dd-9e1f-10952c57e631", "value": 2041458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889657, "uuid": "664fed6c-4dc1-44bd-8290-3d947f109f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889657, "uuid": "2695f005-7a90-458b-a973-3fe16dc5dcb8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9579b8ed-c849-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763887881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763887881, "uuid": "bd108571-0e9b-4363-9627-d2327c02933b", "comment": "Malware payload (Mirai)", "value": "e1850f655d5088fb2cc4d81cf549e92a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763887881, "uuid": "5a5dc374-4dca-417a-a9e7-504a3d5455c3", "comment": "Malware payload (Mirai)", "value": "42205fbc37645d29c641a3de01bce84d0945cc81baf34b435975449b3f4e9629", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763887881, "uuid": "cdd67ff7-8c09-4c80-9b3c-dd83569ed81a", "comment": "Malware payload (Mirai)", "value": "878fc0a0c4fa90bd44d5776fc74437ec0b8e51f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763887881, "uuid": "b4e6897d-6a88-46d8-8a79-e5dbf43517a2", "comment": "Malware payload (Mirai)", "value": "058714c12f85621d87d1f70877ecbf13d36d910036f54dba76a4a6b0d162466cbdf501ab024cee846e72f7f1333f5650", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763887881, "uuid": "cab495f9-f6f2-4c00-9e55-41e40a6fad51", "value": "T15D044A80F987C1F6DC1B493460A7B73FCB31A965D076C65CEBC99E35DA27A00522239E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763887881, "uuid": "ab444741-293b-44e1-852b-35aff9bcb6f9", "value": "3072:Lx+sJpaMNPDCG9HI/D8mY1xe2wbJi43rPPvRsZXU:sEpaiPDCmIbShGPZsZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763887881, "uuid": "26fc75f4-4e58-4ae8-a388-1b0ad2cde2b9", "value": 182824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763887881, "uuid": "858c1f6a-025d-4132-9730-709e02a7695f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763887881, "uuid": "defbbc00-39f6-44e5-ad52-480daa55de0f", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f6fcf9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889658, "uuid": "cd968ad5-011a-415a-b146-0ec5c21b2374", "comment": "Malware payload", "value": "7cccfa55a68569adddeac882fdaf4f89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889658, "uuid": "22f4ea5c-47ac-48d1-a674-e2aee431f4b7", "comment": "Malware payload", "value": "427d608537f03455a470727ab66e3b56203962669b87a8fe19624e254ba4f5e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889658, "uuid": "8046c86c-33e4-45c2-a875-49e03a3d62bb", "comment": "Malware payload", "value": "71e38c98c6cc034c2f09c9424046563886c70036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889658, "uuid": "6a4ccbfb-b37a-44dc-a3b1-01ae64b2076b", "comment": "Malware payload", "value": "e1b1ea334605cfc327707e0e121fa4474ae4b87aab671cd2ff6e82c006bb6971e4ba6990ca84cfc77610be94bfa18f18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889658, "uuid": "43fa3edd-1ebb-4ceb-bbae-96200056ad75", "value": "T11D74D07377C08DF2C84606300657AB768EB3FA3A15724467FBE46B1B6C35A507E2AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889658, "uuid": "fd1d875b-7b30-4dfa-b61e-cceb1d0e09ba", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889658, "uuid": "16001e5d-ad9b-423b-a886-a3a35855078a", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5Tw/oPQ6DHP:BtKe6YiDdv3m3mgKHDjSeL46zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889658, "uuid": "4f90ee98-84d3-4bb8-a120-7d4e076e6ff3", "value": 344252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889658, "uuid": "58b796df-1756-491f-b145-2facd0d376e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889658, "uuid": "ace1668b-39dd-4295-9e68-0ccc9483fb5c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99561a9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889660, "uuid": "9a1d55a4-8d3b-4758-a67f-0ec799514ce2", "comment": "Malware payload (Miniduke)", "value": "aac8304b015051250da2fb5dcdb78c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889660, "uuid": "69166e65-7720-4676-bfe9-b4b908ce9e2a", "comment": "Malware payload (Miniduke)", "value": "4288929ed25d16695a5499dd03328cb9fad0705c309647d512a7d735e8446196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889660, "uuid": "e15a05be-0ec4-472b-9bcd-70764e84b24b", "comment": "Malware payload (Miniduke)", "value": "714d55da6725bae2d22c7d70b749c21f54a26b2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889660, "uuid": "64b9ddd7-0685-4444-994a-0bc965e84859", "comment": "Malware payload (Miniduke)", "value": "cc2b14b9639290351dca45c8fcf488fc3a3e19116bc6ebba30bd46423cccdf8a4a3e84d2a799ce1de3a3d36e35231e87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889660, "uuid": "1703235d-8b36-4e9d-8e70-f0cca7d533ce", "value": "T1C2249F2132E0C075E15305B4BD759B268A7F7C1886F589CBEFE41E6E6E34A91D23930B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889660, "uuid": "9e0bed77-4c95-48c4-872a-b1d1a50bc742", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889660, "uuid": "7a379db6-e62f-4e40-a717-00fa854b3e41", "value": "3072:FRMw8nUego/+/wZ4kyMMa/1WohdIWJlw5Se:FRMw8nUeNm/W4ky0gqIW7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889660, "uuid": "aaf00e82-2d0e-4a17-98a5-1b4cde50df5b", "value": 228062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889660, "uuid": "896c97b2-d60d-4582-90ef-c0f424bfb20c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889660, "uuid": "63f83235-ccb7-43fc-8eb2-ade22d0c1bdf", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba28dc9f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889660, "uuid": "15ca3770-2ed8-47b7-8afe-0ee4fdf6f9fe", "comment": "Malware payload (Worm.Mofksys)", "value": "b1e7352bc32e7a7725daaa52a472c8d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889660, "uuid": "40f1f10a-b5af-43bb-abf9-de08334050fa", "comment": "Malware payload (Worm.Mofksys)", "value": "42a636d67fd0635b8bbd81c8ae9e34bf6c256c6cabda839847f6ff65b60a5d61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889660, "uuid": "de8d4dd7-c21f-4693-bf06-9b3a049c6556", "comment": "Malware payload (Worm.Mofksys)", "value": "c53c094a1bce8e935cb6f69ba9a1dc5c7db4ca89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889660, "uuid": "1fa32208-9b6f-4b6b-ab71-ddf6a3b8259a", "comment": "Malware payload (Worm.Mofksys)", "value": "80972de5f07602bbe1ded10fa0b99ac992802d7f6eac0b7440233bc488e2121d0fb043b2dbf71cc0b75f9f6e07cb13bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889660, "uuid": "4b282a11-62a0-4fef-bb12-cebf21c20ad5", "value": "T1B1241B2BBE00606BE893C6F0186571AAB6252D361B92DC4F63C1AF1A34B5553F2F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889660, "uuid": "d9b93b28-9261-4f4d-b45b-b753c380270b", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889660, "uuid": "b17136da-cb98-4711-be0b-867985c50ee2", "value": "3072:XmMvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4PmuK:XdvEN2U+T6i5LirrllHy4HUcMQY6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889660, "uuid": "4fc08b1a-300b-4787-920d-1c926b04d825", "value": 224780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889660, "uuid": "ef09a569-dab8-4f21-a486-2715609349de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889660, "uuid": "09c15d48-2ca6-4f23-a7ab-b76f5e98149d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad39fd8-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889662, "uuid": "cdc7c53b-45be-488a-922a-e632c0cfe0b9", "comment": "Malware payload", "value": "825a79d901e220901ce64c585cbf1485", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889662, "uuid": "151ab2f6-3b53-495f-8207-03e4a033e4c8", "comment": "Malware payload", "value": "42a8694374cefb7d3b5b5bb8654dc7ca8fde6813f890fdab3864f136ba18f2d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889662, "uuid": "22d9cc5a-9b80-4958-b324-9a2e1b438bdd", "comment": "Malware payload", "value": "c6cabafae33bfa9c5c96c17980679c56db8875bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889662, "uuid": "8778f099-2ba8-4f58-86d3-016a7ccbd731", "comment": "Malware payload", "value": "2d10c384caede65f97a53821eef926e26a93521fcf5b477bbee278a2bf649be3c2cc7acae85f12fee085437d77b1fb2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889662, "uuid": "c6a073b3-443f-49c8-a7f6-0d602400235b", "value": "T1DC75332573C288E2DD17173101865E784EFBD73C19BA281BE7E866036CF5461FA6A7C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889662, "uuid": "5cc791cb-4de2-4a0a-867e-13fff717a4aa", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889662, "uuid": "341f2290-b7d7-4df8-a777-38fc0f6ca7f8", "value": "49152:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxTspAepKLU:82kQCN/JT/kgFWLa6viU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889662, "uuid": "da0848ec-5a2e-4781-acce-564ed058f5f1", "value": 1595662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889662, "uuid": "28971538-0a68-4c5e-81ee-3c86ad6e1086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889662, "uuid": "28eecfe9-c2d2-441b-901b-ffb70633fa69", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb720819-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889663, "uuid": "9c56e87a-3c6f-434c-beb0-5aeb7fdec5b5", "comment": "Malware payload (Simda)", "value": "8b6d52f057944a4b8130a17bcca828bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889663, "uuid": "63a308d8-d571-4f8c-9ae0-78cf0e67e0c9", "comment": "Malware payload (Simda)", "value": "42e4b4f9e119dff9be5cf64f1243b37d0e38832c7fbbeec01aed8f15a61d95a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889663, "uuid": "b15c8e78-2f49-4f3d-a6c0-9776c597f6e8", "comment": "Malware payload (Simda)", "value": "938fe21148c2fbf0ff67abd1d09dd6b06c91dcdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889663, "uuid": "57f3ac52-f833-4be1-9d84-a54134054b8f", "comment": "Malware payload (Simda)", "value": "8ea6c66e749f9c9ea67bd133cf51e44aec2927afdd61b4630356b7cf8664cc4b371728332b161a11d4c9330a6e78bae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889663, "uuid": "adacebba-ff50-4829-8ec4-a31a66e01441", "value": "T118C40141B3D950C8E5379A7398BA972098B6BDAC4B30CE5F03A476191EB33E07839F55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889663, "uuid": "3f83bdaf-5e56-4df9-ab07-d38b76753aae", "value": "616d060f84174fbe550615d295f4ce51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889663, "uuid": "a932ca8b-a6de-45bd-beaa-a2b3a6a46f1e", "value": "12288:Ef58GxUh5kHyKFhW6cb21Dvv/TNjYGgpK/vnRsmH5Ckt73qfKrrzD8D:0800kHPa2DfTNjx+mZCkt76fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889663, "uuid": "57348b80-9a72-452f-a55b-42dc33837186", "value": 589785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889663, "uuid": "96e0153c-0d4a-44ba-8a9f-4cab55aad256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889663, "uuid": "c6c4cab2-1736-459b-9fdc-3881f0358af1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc14f5bc-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889664, "uuid": "d41e6e1d-0522-4ef7-a35f-cd165c5f529e", "comment": "Malware payload", "value": "8e7555e441117e91f1e249b3f76a99fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889664, "uuid": "5e6b01c5-b6e8-4b01-9be3-5d471e7eae81", "comment": "Malware payload", "value": "431363fb56902401eac99ecb25f31169b91fc5c27c7162611348499ab8ff604c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889664, "uuid": "3e636a02-e354-433a-81d4-736ede7e5f09", "comment": "Malware payload", "value": "b967c934c9ca9eec1755b70e05021d79fb194f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889664, "uuid": "cc08148d-7489-4160-8031-3b9fc6a5fb90", "comment": "Malware payload", "value": "f567bfb4584aef0a50f5907587772bbdc2fb2c585ede7efecfebd56916a285f88c550cd3d7655742be0448b73b3fa0ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889664, "uuid": "569f7a3e-a65a-43f5-bf10-f955715a7de3", "value": "T1F635231F32C262B1CE89133107462A986E73D77F2BB0941AB3D855072DF29447F7AB99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889664, "uuid": "7dbb7df8-5912-4af3-bbff-f5a12f231fdc", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889664, "uuid": "c3ade812-527b-4953-a628-6162a2cfb0de", "value": "24576:G6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1BPG:GE27hQs7tWVToP0Hs0/htDHiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889664, "uuid": "54a269ff-1a27-4de7-b4d3-fc7c7d10a5d5", "value": 1120643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889664, "uuid": "b23e1a6f-f900-440b-99d9-2ff66f4947ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889664, "uuid": "76bc9b4d-7bc2-44fb-a402-5f257663326f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bb3d22-c891-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763918621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918621, "uuid": "6461d5ce-f621-4c88-9919-75733e6e049b", "comment": "Malware payload (Mirai)", "value": "a981f56215e28c2b20cd07f1375010bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918621, "uuid": "218ce9d9-46e8-4ea3-92e5-09d3ee1c99fa", "comment": "Malware payload (Mirai)", "value": "437fe2ea35b2f241e8a6210fbfa41b2e550cbec12948e0d9035e5a4b11b18331", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918621, "uuid": "991ba93e-4b03-4f35-b088-49d1d1328ff1", "comment": "Malware payload (Mirai)", "value": "a203f2ef8a8d45b2b2b8067be5caecab389ca4be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918621, "uuid": "f6f6ffcb-42e5-4f51-aee7-58a6829a3e49", "comment": "Malware payload (Mirai)", "value": "d88f78a3f01c8960d7f79635d60e429ea97329b661254dc551614e4a806038ebedc740c4da3cd3719414b8e18cde3edf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918621, "uuid": "061adab5-be69-4ece-af20-3aae3c48397d", "value": "T1CE635D01B31C0987D1676DF0373F27D1D3AEE99121F4E685355EAB8A92B2E321186ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918621, "uuid": "81019618-2d02-4667-b049-4778aa5a8a9a", "value": "1536:+gTZRrMoWB/BEiCZXx7LT6nyF8M1Bzp4c76eOYB1kEBFl:DTEX/6l1fnfnzWc7nzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763918621, "uuid": "6d8f1756-feb4-4c84-813a-ed737823b653", "value": 71524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763918621, "uuid": "77fedcc9-f36c-4a91-891a-987800e1c5f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918621, "uuid": "375e9fd8-da41-4329-be55-7ccea9882663", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb3a4d5-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889665, "uuid": "a2c3f98a-9300-4581-9bc6-7b2eb67f178b", "comment": "Malware payload (Simda)", "value": "62df70834105b05203332508c2eca875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889665, "uuid": "ef023e80-3b16-4472-959c-4a3ba7b5cc51", "comment": "Malware payload (Simda)", "value": "43b63a52440ffac30793033b61403757f8680acd77219444cf76d767fe0d7d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889665, "uuid": "481b8a61-5198-4131-9a91-321aac3aa2e1", "comment": "Malware payload (Simda)", "value": "93645d5432bd59d158dcc570d63592602b6368b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889665, "uuid": "6916c999-af5e-4150-a932-446f75e19d0a", "comment": "Malware payload (Simda)", "value": "f5c87ba31083324e17d0354b71b6db308e1ce0e1eadf597a8df3e8d319d4a9c62681b38c05819002f72626a9f7452156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889665, "uuid": "13d7c21b-a64b-4cce-a027-ff328605c356", "value": "T175748D21F1C1C039E4F5157196FF395B246C69B64B2838E7E7986EC928740F27A3C28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889665, "uuid": "dde861f8-4e56-482b-8c88-e99618b05ff4", "value": "173abfa8f7d7adac2a90a2e42625b7d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889665, "uuid": "f6ea85bc-bcc0-4f73-b9cb-39638976d468", "value": "6144:W3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TS:hmWhND9yJz+b1FcMLmp2ATTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889665, "uuid": "7d9fb64b-2109-46ce-b9d9-87573ab79136", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889665, "uuid": "ef387dd1-fe85-4705-9146-a68232b773bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889665, "uuid": "9296b623-c473-4ec2-b45c-9a7b022c8313", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9299f0f-c86a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763902087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763902087, "uuid": "471f9fab-0396-4ee8-9003-638f27eb056c", "comment": "Malware payload", "value": "c31bb22bf6e06736283732e8a55c7cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763902087, "uuid": "0071187f-d6bb-4969-8ca4-04b799a0a65e", "comment": "Malware payload", "value": "43b88345c02250c0bcaea11920dd797ec58e7261671cce0329fc3e0f241822c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763902087, "uuid": "676c4260-440f-4635-b026-8488e25d9fa5", "comment": "Malware payload", "value": "3a49dcb132b943d5460b7d88befbb512248859e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763902087, "uuid": "3b027424-1170-463d-bd35-c03c7cc1cf48", "comment": "Malware payload", "value": "44ac17b1faea15089a585a668e08f5b3c96a7b399f07e7560d509600a2def88d67d451a53a11ef1ec2f519b8aca86ff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763902087, "uuid": "d8183598-4bdb-4355-9f8b-5d8a94e95653", "value": "T1A1D4198336C71CFAD9532B3895DB533A7735FE608B6A4B278908C6321C136D0AE5BB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763902087, "uuid": "b701c27d-9714-4c50-bd68-1b4771d80894", "value": "cae4eb97ebd03d71dbf5e7ba4fb4089f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763902087, "uuid": "dd052a38-cfdc-49b3-a21a-38dfe6ab502d", "value": "6144:Rf4GSMt6JCkiVUNKKTJJI4V8YX7FHdFvG+6kve/QpAe86UBHUWq+9yN86IpKIGl2:4MtPHYX7VdxG+6kve4WSHyQFQf/QRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763902087, "uuid": "8db3406c-e5e8-4582-8bad-05fc105fe921", "value": 618055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763902087, "uuid": "81207345-1e22-44d0-9f53-699079205116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763902087, "uuid": "abf21289-de1e-4898-b068-0df36b126c09", "value": "SecuriteInfo.com.Win64.Evo-gen.31452841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd516968-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889666, "uuid": "430a749a-f745-4e54-a6aa-d6e398fe2f77", "comment": "Malware payload", "value": "08a75b37b113ff570ce56efcfe04a764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889666, "uuid": "7f09d6c2-4f4e-469c-9a6b-f83e0d3f5cf4", "comment": "Malware payload", "value": "43c43d6143f8400ea87026e7cd3e4bbf63a02c4bb2ae1d8dafe5c76160ad3622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889666, "uuid": "d27a391d-02c1-4f4f-b613-92e9b169f19d", "comment": "Malware payload", "value": "25de93d5e658ecbf62c745be243c868997fca5dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889666, "uuid": "3fdf99e2-90c2-485c-bce2-e439a980bb2b", "comment": "Malware payload", "value": "a85899531b87535f3bab1a6a5c31ac6add39c71f181201ca40236f7acaae2c07454590c0d06092047a8f83c18acafa25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889666, "uuid": "0ddde5c5-690d-45d0-9842-392aab930133", "value": "T1F493E84BF61281B9CA38C537A561C1B21F253E75AA63CA3F31513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889666, "uuid": "b946526f-b441-4de9-9155-698f02c2976d", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889666, "uuid": "64ab3dc2-23a8-4840-a109-4d1270e95d94", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdR:41bC4Bk6lMTOWw4PkRAPo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889666, "uuid": "46c3ebc6-e38e-4f45-82a4-705cfaa5887b", "value": 94261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889666, "uuid": "c8997d03-b67b-4cf1-8e35-8d3a5057e681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889666, "uuid": "79874d11-cc55-49a4-bdb8-a98bf0c7583e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf87819-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889667, "uuid": "7a4ddf0a-8249-400a-aac3-675d8a237909", "comment": "Malware payload", "value": "1885523a817bd2597b4520ad7bb12dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889667, "uuid": "62f0868e-8065-4927-bde6-b57d396bd7e5", "comment": "Malware payload", "value": "43f98f94e6142d6a452c205c74ec87c5f2f4bb8ea6b64c4c8e30a2e29f3d2d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889667, "uuid": "7806f468-0174-4cc3-b527-7f0725c3881a", "comment": "Malware payload", "value": "8577b1e3cc0444c0e9a2f43cce76fd040154bf55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889667, "uuid": "cd63c89e-2648-45e4-a89e-86a708464f1f", "comment": "Malware payload", "value": "6bc82329f8ced6af30582e000e7711e95c5561ab9fd4617c3d0023431e87be4df3a573398634130042f78015078d9472", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889667, "uuid": "8769db8f-90d1-4e54-8e28-b6bd8694b945", "value": "T10245332927922F8CFFBD9F79830D5E104AA012C95F6EF8117E9DBC9253924D3B866170", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889667, "uuid": "50a6d482-1612-4d9f-84f2-31ca3d72bf7b", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889667, "uuid": "62b203de-116e-4da1-845b-3cf129307d49", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVv2WqgI:+YhQs7tW2zku73bFgVlRlbN015CoVv2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889667, "uuid": "91036d03-0a29-4e11-8171-7996d48ef7e4", "value": 1202709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889667, "uuid": "818400f7-dffb-4382-8308-04c6c35b6294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889667, "uuid": "6406cb4d-84f5-4d8d-9b4d-2a4f8dce5729", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebaf910-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (MeshAgent)", "timestamp": 1763889668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889668, "uuid": "a4fd100f-6998-4ce2-8442-9dc733afedb0", "comment": "Malware payload (MeshAgent)", "value": "b64c9c1c86d782a19739494cf8a45146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889668, "uuid": "11cab30a-7eba-40ed-8599-328d7429fcc3", "comment": "Malware payload (MeshAgent)", "value": "4410022f0ecbb686954a2b97f29ab59ba95eac554f96b4bd0aa88467dc684a46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889668, "uuid": "afc192b0-2a35-4598-bb65-8bcc5c5b4cc1", "comment": "Malware payload (MeshAgent)", "value": "1784d5c1ce109e584cc1e2f0c1d4ee464de7cbbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889668, "uuid": "16793e56-4911-4707-8583-fa7693834ca3", "comment": "Malware payload (MeshAgent)", "value": "277547a44e0853863449acccb329a7d83ab180bde22112f740e16a350802fc48b51c5ae65d3e07298efc806c7118e90e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889668, "uuid": "548c68db-2db5-4621-a932-13bcd7883206", "value": "T131168D52A7A400E9D9B7C27889968617D7F2B9111370CBCF06B48A6A0F237E12F3F755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889668, "uuid": "bc618987-a9ad-441d-8d0b-bc1391be6d18", "value": "3f5028e5768331511f29cb9dad53e80f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889668, "uuid": "b3880d81-f711-40df-b74e-3c0682f5ba60", "value": "49152:o5+jFCq+CLu9HgXrgHYNYP13Ca3aSAdifeyQVqFt+uJVHdrxtm24hFuxEogBgGza:o6q9A+T3aNMedKpdrIhxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889668, "uuid": "37272023-8970-4bf7-b9a1-95f2611ab795", "value": 4025843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889668, "uuid": "92b8bd3b-be07-4b55-aa2a-444bc76916ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889668, "uuid": "ecc42da8-525a-4a32-8999-a09d0b214d3f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fdeec7-c884-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763913011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913011, "uuid": "c7dbcec3-d89a-493c-8614-a818c3fcccbd", "comment": "Malware payload (Mirai)", "value": "78be79dcc2160ea71d895b18f264cd07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913011, "uuid": "decda4bf-f926-4a5c-9f96-7974f00799af", "comment": "Malware payload (Mirai)", "value": "4426227e0cebfcb6071c2645d0b076c4cdf9e3dde7edb9f18a1028a58eca047b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913011, "uuid": "0e0390ef-3696-4e2d-86cc-236ac2a638ca", "comment": "Malware payload (Mirai)", "value": "3dd8ff524660c793f404b5c72fdff5904c12f9e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913011, "uuid": "416b2c65-06c0-44ac-82ac-e87b9bf8ea12", "comment": "Malware payload (Mirai)", "value": "543ea6b66c1026c42d051c65d52b7d9575be6156ab7fd82da4d4b73bc49f112d86ccb9d2eee981286459a2606103f669", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913011, "uuid": "d9f8c7ca-550b-4752-b4f0-9371adc65d8d", "value": "T194A34B92BD82DA12C5C162B7FF1E424C772713E8D2EF72039E215F31668A56B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913011, "uuid": "b5a3dfaa-2cd8-409c-9838-14930064e5d3", "value": "1536:cL49im0k9rgc6bjKZcilRGwp49sadpQzbW4H/jO8jqkjoI5amp+sesem4:cL49L98cMKZzjUsav8bWkd5jJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763913011, "uuid": "462bafff-bb03-4522-8b42-a42bf5b416df", "value": 99540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763913011, "uuid": "918f96e8-9c2a-4032-9422-f4b650a9d17e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913011, "uuid": "75cb9a7c-1d70-4a75-b9de-dc9b8c552786", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5a947b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889669, "uuid": "15aa2453-715c-4fca-9f5d-387fac098fd2", "comment": "Malware payload (Worm.Mofksys)", "value": "24892665110ce2ed46586c044a9bc7b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889669, "uuid": "fe34e13c-3107-4c0c-8c1c-d81217d47c3b", "comment": "Malware payload (Worm.Mofksys)", "value": "442e876da355cb31eab403f28e7ac1e31ee9a0df662ac28e0219ea08ce81d211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889669, "uuid": "2dfc55bf-a5e3-4611-9d57-f4dd6c8962a2", "comment": "Malware payload (Worm.Mofksys)", "value": "a056c4c5b90a5e4bd1993868e89af0eba31b80f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889669, "uuid": "1b12a517-4a8d-414a-8e70-90b1e6a1809e", "comment": "Malware payload (Worm.Mofksys)", "value": "6ea754abe06eb76d5d0f42be96304d023879b8b424d06e9bcbb21fbfff27ee70682082b945a2985ee45fa7f2369cefef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889669, "uuid": "313c3fe6-3de3-4001-9d28-68b19e8bf287", "value": "T15224072BFA04311EE8A3D6F05836B4AABA252D250FD1AC0F63919F493476613B5F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889669, "uuid": "8a402f7d-a513-442f-af25-2026d9a95118", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889669, "uuid": "71aeef6f-11a1-465b-a81b-139f1b7f2b1e", "value": "3072:mvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9iY:mvEN2U+T6i5LirrllHy4HUcMQY6C9iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889669, "uuid": "31040f1e-855c-472c-911a-190c0c6dd04d", "value": 221941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889669, "uuid": "3edf5390-10af-41a1-a328-bc947842bfa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889669, "uuid": "1ca038c0-a0ee-4d42-9a28-4a91fce1e1b1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6339b6-c8b2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763932881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763932881, "uuid": "52a322bf-c890-4c13-82e1-c710c30406d0", "comment": "Malware payload", "value": "5ac68278cdd742701013f85a2f113a62", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763932881, "uuid": "6ee4cc0e-796a-4287-b371-188765e54105", "comment": "Malware payload", "value": "444dc2f5dd22a8529a3fb3da9a9a043ce2668e454893d36310be1c0c426db57c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763932881, "uuid": "0c76177e-8c3f-4c31-b059-d311c0c04171", "comment": "Malware payload", "value": "f53963693be3efa04d1b639a9045e633753575b0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763932881, "uuid": "7e252bef-2500-43a4-9cfd-341c696832f5", "comment": "Malware payload", "value": "759215955b59369e25283f2075d7de47bdb1bcb5e89642f57d02bb1665f451d0bc83e10ad8be6bd1d5e06ab72cd2c705", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763932881, "uuid": "223b28c8-17d9-4243-b5af-ee945ed6e51c", "value": "T18F672397F71CA92FC0B715718EFE6221966B0D118B02620B764C7A583A736CC4F9E7C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763932881, "uuid": "c4fcf32a-6a02-479f-bba5-89628ff1c543", "value": "786432:odllH22AX5xW/GnUt7tKmGVjKPhUojQeQy:2B2p36mqJKhVnaQxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763932881, "uuid": "fca31045-009a-46fd-a086-e4492b6298b0", "value": 32452308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763932881, "uuid": "c2899704-5cb2-470a-a2d2-edc864efe754", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763932881, "uuid": "783d845f-192d-4968-9f3a-092e817730c0", "value": "XPR_DOWNTV.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff82b95-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889670, "uuid": "15146edc-0697-434c-aa79-2e28383a28cd", "comment": "Malware payload", "value": "b5aa9eea09ae1f1ffa90c6e2d36eeec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889670, "uuid": "88f85828-818b-4df4-bf92-bb6af275bfda", "comment": "Malware payload", "value": "4469c24d12152427a0dda6e511b4ed713179f79b83a52a86f75e74f6d9f0b0f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889670, "uuid": "c536ef3d-eccd-49fa-9875-a686990c3467", "comment": "Malware payload", "value": "6d4763418e39d4271b93ba1d418b9c69d580e213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889670, "uuid": "b4bf9269-14d3-412b-b603-ba363fc928d3", "comment": "Malware payload", "value": "a4d96e77cf9fc67840ef670baca202c9a072bbde23fa6a2f0d88411de5beff0754d504b7a1525d9dcdfcf4ae80afcd10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889670, "uuid": "589f16d8-757c-4ae5-a072-88876027e9b6", "value": "T1B214E847F60281B9CA38C537A561C2B25F257E75AA63CA3F31513A2B2D79B001D1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889670, "uuid": "4cda6aa9-0fc9-4d8d-8d91-71d111b6b76c", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889670, "uuid": "224ca5ba-883b-43bf-a433-87144e954387", "value": "768:IUKxW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAar4PzpyRAJ7IwnDoSdvp:IUKHbC4Bk6lMTOWk4PkRAPoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889670, "uuid": "16f93fae-42d0-4d85-8753-90257c92ef21", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889670, "uuid": "c4841233-869c-4c31-a6b4-92f606b02228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889670, "uuid": "cfb2f0a4-0b7c-4264-9330-319791a2e8b6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c093be62-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889671, "uuid": "74d34cf8-2172-4038-b259-2c6c5ebc90bc", "comment": "Malware payload (Simda)", "value": "ff63fa3f1c1a84210df8e87b0ffd777d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889671, "uuid": "3436bef6-1b97-49e4-8816-61811f21e0d0", "comment": "Malware payload (Simda)", "value": "44784162936590c58f8e5d1591dbdb5a68bbc62e1a658d06062f538d273b816b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889671, "uuid": "6dc2bcf5-a792-4f02-8701-f85a27dcb3e6", "comment": "Malware payload (Simda)", "value": "5f4d927511bf0703d1d6845af0a49924e416478d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889671, "uuid": "782741db-3675-43ef-b2d6-733dd17d3b8a", "comment": "Malware payload (Simda)", "value": "ddd52cf6831088bf8d7a1bbd50110806bc416e0bb28a2f6ceb0d3857b24860ca282a0fba9f4dfc011fe60ebabab6f338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889671, "uuid": "c62e583f-c6bf-4bd1-8832-6a9bb2d8d428", "value": "T19CD4125AAFB81296C1500DB35CF37B2016BBE44A172DD9FACF04C7B464A53DA7C72A90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889671, "uuid": "56e40026-8312-4754-9b8b-07b2b6b0f7a2", "value": "cb466204f5c37666fe7d05c000308c29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889671, "uuid": "6e4062da-260f-41b3-bddf-c2a65cb88c91", "value": "6144:PxNCLW6opBZMU/y/JEGjg+op2BSNCCr7/jUr:pw6NBT/yEGjWwa7vUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889671, "uuid": "389ad509-b176-4323-840f-b0f0d6c9599a", "value": 627726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889671, "uuid": "48f667d0-339a-45e0-9417-55f45d7c55b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889671, "uuid": "0c60b50a-9b26-4903-9c61-7b7c4c2f67e7", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c126d6e6-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889672, "uuid": "012776ed-8a57-4a33-bf1f-5181725fae20", "comment": "Malware payload (Worm.Mofksys)", "value": "79ee40b8aae9b4bf8a8b27ed48c91186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889672, "uuid": "384d8324-0ea8-4821-a0a8-d046038a89b1", "comment": "Malware payload (Worm.Mofksys)", "value": "44b73c9f140721ccfe16d10774f1047c74055e3e8efe3f6330623ca82718ee4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889672, "uuid": "8c76def1-1dd5-455c-9c6a-dd03bd9a21c3", "comment": "Malware payload (Worm.Mofksys)", "value": "6a1d189f382ed9cc1b623c36ba96d89b49629ef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889672, "uuid": "01d4e770-45e5-4211-9569-0de4ba21f9e0", "comment": "Malware payload (Worm.Mofksys)", "value": "b88f90850569036f9fe1ffb8c11dbe05aa2b1a073484caa0920185557e626197bd47efc6b8848072802b6d19e33b60f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889672, "uuid": "a4a3594b-9b5b-4d89-a54b-fe7ccbba0a31", "value": "T18724096BEA00712EDDABA6F05422A596F6312E7A0BD19C5F2381BB4534B1603F1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889672, "uuid": "676006cd-8795-463d-ab5a-5e1d9167b6ec", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889672, "uuid": "287960b5-a1be-4984-a685-6af334ca5909", "value": "3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unc:+vEN2U+T6i5LirrllHy4HUcMQY6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889672, "uuid": "9d069f42-cbbf-400c-8e99-39e103f49871", "value": 211794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889672, "uuid": "65d22364-8b08-4df0-95d9-8021f02f39f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889672, "uuid": "014b6b47-6edd-401e-be1a-be5875efa204", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c6a3e2-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889673, "uuid": "2047ef91-d6c3-4b19-9625-20c7b48755bd", "comment": "Malware payload", "value": "a259effaf417f2d75e9e309d1a04c0c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889673, "uuid": "e544adfc-03a4-4db0-8875-61652953607e", "comment": "Malware payload", "value": "44bd72b8dcaca1bc1645383723d5e71aa01d6fa5407e4d8dce1d257cc449e908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889673, "uuid": "482a9e86-a8e8-466a-bc8d-2c9aa1cf7d23", "comment": "Malware payload", "value": "69017262723ce0927d48057357d664e272d2d306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889673, "uuid": "b0d38db2-1b40-4ff8-85c1-b54bf2f7e4e2", "comment": "Malware payload", "value": "7e654a3c65b8f720af777898105a6428688f3d2fa36a3b4ad8c1b5f29edfaf853aaba40371573f0b79920eb34641a914", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889673, "uuid": "4f80b0dd-9f71-4149-a046-7e4bdab56cf7", "value": "T1C825334E0BC22A59DFEDA3758B46189121A337EC4764B839771CE48B03F36495DF81AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889673, "uuid": "60ab79a8-a360-4bc4-8691-c0a17688187f", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889673, "uuid": "d6d3a1c1-3837-40af-9099-6f5c7c7e1604", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFyjtr:+YhQs7tWVToP0Hs0/htDH3pGaFyZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889673, "uuid": "befaae49-9fb1-4f50-be0d-8c3747b038dc", "value": 1047129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889673, "uuid": "c2ef912e-67b6-4f27-adac-060404f912e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889673, "uuid": "ad760864-0f30-47dc-8233-2bc9c761017e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7caae9-c853-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763892166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892166, "uuid": "2d4c0c6c-d673-44d6-8684-a73a7b3211ed", "comment": "Malware payload", "value": "d4bc2bb7b1d670c1a620a26eaeed65bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892166, "uuid": "3167ff6e-4df1-401c-9df5-b47ae3be82dc", "comment": "Malware payload", "value": "44d20b264eb77b5323a06ff826020aef615f3ba0d0141abe76ec64d75655fe12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892166, "uuid": "05234be1-23f6-4400-81eb-579bde1c699c", "comment": "Malware payload", "value": "380714e963ca16ab3c50cb318a76b69e067bd00b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892166, "uuid": "767f75fa-d65d-494e-8dcf-a45a1bbe1efe", "comment": "Malware payload", "value": "e88c6a541a3a6da793cf0571182a4f0679a83bcb978b5af4067611e2717ddbb7d46d26d32e83cf1d39308a172c5c8736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892166, "uuid": "060432f9-2066-4132-bcb8-f632bd4a2684", "value": "T1ED35232333C259A1DD49D172038763B95E73FA7C17B1D42AF7ECCA0B1C70950BA696A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892166, "uuid": "cca0cb46-7c9b-46d5-84bb-38a46ff2ea80", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892166, "uuid": "7486af2d-750c-48f6-b167-e54568c894fb", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuNpLE:qE27hQs7tWVToP0Hekxbl5TuLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892166, "uuid": "da1235f0-533a-431c-a900-c63fef134616", "value": 1131970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892166, "uuid": "1a34e6fe-ed9c-4d83-b51f-be0928b5b128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892166, "uuid": "617ae9fb-1eff-4831-918b-b33dabafb572", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2760099-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889674, "uuid": "8d1137b4-8628-44c2-b788-36c5f85918da", "comment": "Malware payload", "value": "de87459bc44e810e6ed06673d5fbac33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889674, "uuid": "d61152ce-91c5-46a3-9eee-68997824a51c", "comment": "Malware payload", "value": "4508a5522b6a945353331f74eb1d0f23e06ed69424e7c0a6db610be052175e22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889674, "uuid": "e060138e-3f4a-4696-a32c-db664be34fac", "comment": "Malware payload", "value": "91a3604624a98174a8e784a9ffe8b8e426908f70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889674, "uuid": "ce903303-69ed-4f29-9155-4ccc56089d7b", "comment": "Malware payload", "value": "23c1d3c8772c6b59e49aba490a0b4d3b236f46c78e164e2fb49848cb76f0c4c6eb2f29293237ef77f1acfbee3b373783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889674, "uuid": "5a08ac1b-17e6-422c-967a-41b912c3ea13", "value": "T117A54B346F51C802D15A267889B9D7BAEA146FC0A416A307B3F2BCD77D1A19BFC41DE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889674, "uuid": "d92fc8fc-2005-49af-934e-e1b4ba751fc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889674, "uuid": "7a099de2-4b7d-40dd-939f-8e7535bc94f0", "value": "24576:bpPmJhz/zDwhADM5L9Y7MWQiPJ5onzVxihFj+p:bpehPDwhVOGu5K/mcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889674, "uuid": "cf3a3328-469d-4eaf-bbaa-52bec1b0e5d8", "value": 2108160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889674, "uuid": "b02f4a2f-3bb0-4e01-848a-90452321847d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889674, "uuid": "7fff1279-139b-479e-a79f-b055c5de2033", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32c5cce-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889676, "uuid": "9810d67c-873b-4f44-acab-8fe441f9f7e1", "comment": "Malware payload", "value": "6f9e1ba62f27e1d33cf02fb4734b12db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889676, "uuid": "d1de95d9-6ba5-4667-9ef2-f809a246dd3c", "comment": "Malware payload", "value": "4525af98d067a59bb81167ed017f8896fa8c9ca3ce2af2ada2856f8a6c6bea0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889676, "uuid": "8a3c974b-8ff8-416f-befe-2d012ca10b98", "comment": "Malware payload", "value": "ee5b0d229cbd23f7d817a8efdcace029b6bc360c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889676, "uuid": "66782469-17c7-46a8-ba6e-c79efd5fb800", "comment": "Malware payload", "value": "e67ce506557aa53feb30fb0582258ff3cc824abf2f7d265af9aa90494b1a02188ff162ef257a5742ef3ee954aa917b08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889676, "uuid": "fa91926a-20a2-4f33-bc0e-390a1771f402", "value": "T142C5D061D9B213ADC2B4BFF7C0466EF139A50780721A8412D5E6708640FE79E6E5F3AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889676, "uuid": "3d5f9fa3-9ff6-4463-a969-94e21e29c0e8", "value": "b672bf4528e2ef8904397d0b17905606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889676, "uuid": "fc093f65-3ada-4275-826f-f423b14841d1", "value": "49152:lF5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/Yn:lF5G4DOT5JGIVzh/5aZX0zgd0IZGpwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889676, "uuid": "bd4a731d-75e4-4c60-835b-3afa8a270e6b", "value": 2694035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889676, "uuid": "179c691b-7f47-4d50-82c9-6b03cad8e4a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889676, "uuid": "adb42775-26a7-4f31-82cb-8fc50bfc7e17", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7edfe6-c898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921667, "uuid": "de45d6c3-05ff-4a19-b127-d027b10eb8a7", "comment": "Malware payload (Mirai)", "value": "502e8251971c7c31411b751376d22faf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921667, "uuid": "6342ca97-41c8-4475-b39c-a3545652b38f", "comment": "Malware payload (Mirai)", "value": "4551d2fb0b9f348564161dd0c3fb706c871fd0a08d1f031272378eb2d39ed6d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921667, "uuid": "17d13bd8-d4c1-4485-b0f7-6a869f175598", "comment": "Malware payload (Mirai)", "value": "f2f69535d32a0e569a50738f43272ba46f450e1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921667, "uuid": "978aff2b-5cd2-4858-93ff-846b27175107", "comment": "Malware payload (Mirai)", "value": "7b7682387bc4c181899e0c0b2d81d2788214d32e5b21fbfc09254d6a595633b7f0fa9146817e1ca13e010ca300cb35df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921667, "uuid": "ce5e0fcb-94bf-4662-831c-2360b843bd37", "value": "T17A13F2B9AD3BE3BAE037A9B5240597D9FCD12003CB53575301D861AFBC6AB5C9800B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921667, "uuid": "f47f56bb-f848-4795-8645-563179e71c3e", "value": "768:KxCamcw1GTi3P/aKbSxUS1Kc1EslIsyCpfDoBbtijm1yc3KgTXK1wK2sBx05F:KxCamcGWCP/DkUS1nWCpcBbt+u13Kgj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921667, "uuid": "43988820-c062-4c15-b23f-5f84944b26e7", "value": 41988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921667, "uuid": "80502c17-1169-4769-b0cb-1df40bf851b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921667, "uuid": "12b4df64-ecba-4cf1-9925-c0eb4d477b66", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d508680-c882-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763912295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912295, "uuid": "8769d9f0-d42d-4f2c-9283-e937dfa3c810", "comment": "Malware payload (Stealc)", "value": "fea9ba1295b220e064a85deacabcc321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912295, "uuid": "35e1e5b4-bfe8-427c-ab14-8ffb3d9093d7", "comment": "Malware payload (Stealc)", "value": "456cf0a0ac9c3e3060e46045ebcb67c9f25721b4d9fcad6ce85056f2193a9ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912295, "uuid": "d3e05bd7-f543-4a6b-9259-da63d6c817d5", "comment": "Malware payload (Stealc)", "value": "c04e55e7726bc98748ca1a93e123f1ec6ef03e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912295, "uuid": "2a84ffed-4751-4e8c-bebd-80cb84ed8b4d", "comment": "Malware payload (Stealc)", "value": "0e3347e1812bece10ad435a99728483f6ff40a0853436f0b93d6966d4c28469fc2108665439f673a02f28ebfb19fcb32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912295, "uuid": "79d1a803-1ef0-4b01-8df6-0a5b46251463", "value": "T1F015235B530168F8DE0899B10BF52F75DAB0F66510AE3DBB7324FB385D268D86E23502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912295, "uuid": "8addf6d4-b954-4195-ad2d-538e7d552551", "value": "120c3d3af2759475e99f74c0ef5e5853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912295, "uuid": "8e6b5e7f-efa4-42cb-b287-8967ae5cb755", "value": "12288:rfJJ8Zfn50Vg3jr+p8CR31cpMlfNVWN4YCC+U76PU4S1II+pBfWWl2WGPrIO7:rfbcf5wgTIx1cyq+U76PUB1FqfWceMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763912295, "uuid": "943158f0-00a8-4eb8-90a1-b74e7932756b", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763912295, "uuid": "b2558b6b-62f8-4f67-af5a-a2218d4784f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912295, "uuid": "4f8db819-f670-4494-8d47-dd3aa267f1f0", "value": "xQ4gNK9auvFo4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273327d6-c851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891132, "uuid": "ee0a2347-3797-4751-983e-f28b9e584b47", "comment": "Malware payload", "value": "e85db6363c074ad85a517f6945cb034c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891132, "uuid": "a548d8b2-80ed-4c61-a1a2-ef11e44f3069", "comment": "Malware payload", "value": "457a48381be6d9467f911871e63456248546e863143ce10c7a1594e3945c7857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891132, "uuid": "5ebdeaef-5a40-41cb-9a60-7f1e8ac2b89d", "comment": "Malware payload", "value": "f5b9a0585146f3b2d496d8625a87b47cc1b53341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891132, "uuid": "bc638963-ab8c-4b42-b125-7b5a042d4fa9", "comment": "Malware payload", "value": "1521065ae205e182a437b69b5d1db0d66b532e309b948966e22a7eef40fa06185a1b7890bfa5d5d04ac673989bb6125c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891132, "uuid": "722ecec9-6ff6-4ddd-9966-ca8c8d9b6937", "value": "T16255237632C198B4EE924E31020D5F254FB2A3761F6EE815BBD46D2728708E2FC67761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891132, "uuid": "460d0972-3a46-4fb6-8329-861a32324279", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891132, "uuid": "9ed9db96-796c-4724-b837-d73ba0962723", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iWtPWnQKPT:qE27hQs7tW2zku73bFgVlRlbN01Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891132, "uuid": "6ac1f61f-f2db-4e01-a187-eed030a41c1d", "value": 1301230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891132, "uuid": "3fe7dd99-95b6-429a-ad0a-3a93be83f704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891132, "uuid": "2491664c-9cc6-4eb1-8085-f00fff14631d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c63a1c-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889677, "uuid": "35c73e1c-e358-4537-bc17-ce7aac97c031", "comment": "Malware payload", "value": "855937f25c31ffa868496b32aa1b8042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889677, "uuid": "5ca5ea66-23c5-45c4-912a-2a4ab70789f2", "comment": "Malware payload", "value": "4584b7669374f5ac3f5d920e462e4eee9b9e52ee379b9dee974dd5808db0de2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889677, "uuid": "c97abfc8-f495-47bb-bf3b-01828b653eac", "comment": "Malware payload", "value": "7f19d905c3dff5fe79c334c54dd319e91085357a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889677, "uuid": "6248094c-a3cf-4233-8c67-066ca8e6c9bf", "comment": "Malware payload", "value": "008655b095cea5bac9637a85efbedeeaccf5735b5bfcffabbd4b5c9552b3005a1a1d84e43a19a45e2814b211fbf20576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889677, "uuid": "d17a2c13-d403-423f-8a9b-cfeb5bd7dea4", "value": "T18E83491BB3CC6857D99B2B3A25E7D2B896237D5F9B438B472054323E2C31F012D2B652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889677, "uuid": "74bc190f-f090-460f-986e-8b88caea8853", "value": "11b9aad2295138cfa59d24bbd4f7b476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889677, "uuid": "6e6406fa-6024-49d3-b484-1fa4eb1f68a3", "value": "1536:z1sMveb4lR0daHy9v7Zc86y9U4AFRfBW6EnK:ZDeb4T0daHy9DZc86yGUjnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889677, "uuid": "7de798d1-8ee2-4df8-83aa-6a3855dd85c6", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889677, "uuid": "678847c5-13e1-4c0a-a135-cdfeec5f53df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889677, "uuid": "8eacabbb-b821-43d1-8e44-19453a440845", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea33b2e7-c8b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763935268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763935268, "uuid": "3381f3ad-7dd9-4322-b238-61fddfb4dc93", "comment": "Malware payload (Mirai)", "value": "e5b351c99fc1a53815d8727b12b088ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763935268, "uuid": "94d23c91-fea7-4c11-9128-29e650caafe2", "comment": "Malware payload (Mirai)", "value": "4591c54052c787376ea64aae9e4297bedf835551d9e1c7db3c2e5e3f90bff02a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763935268, "uuid": "b658898f-bdab-4b39-bf97-abd606565da1", "comment": "Malware payload (Mirai)", "value": "f660c24f8c7f6aec661dba2c54ef7cc084571d9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763935268, "uuid": "ce379cb1-e680-4894-88c2-4d5549f77617", "comment": "Malware payload (Mirai)", "value": "af8224bffb02c60d426ed22ab743ffd64dc9b5334ab8f9324edeb200b43ba6019cb7793dcbb3304af5e03bd6e50411c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763935268, "uuid": "fa02c644-98ee-49ce-afe5-b4d4a31deb37", "value": "T1E0936C0AFAC0D4FCC899C339565FA275C932F46D1236721B87C4FB257C8DE212B2A656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763935268, "uuid": "f6b79b25-a5c1-4870-9944-c5a87025356c", "value": "1536:k5/oaj+aaAci5fTrZyhiSakK1gy5TAoEcvtuoytQOKul7vrN:kBNj+61fqiSm195TAutu9QxulTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763935268, "uuid": "464c8e8b-733c-483f-a17b-216bd257a6e9", "value": 91792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763935268, "uuid": "2b2fa0b9-96c8-4d20-ab6b-2a359c2a1305", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763935268, "uuid": "142e9984-ddec-4bef-a668-da271713d93a", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46a1332-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889678, "uuid": "98e3a63c-72ee-4216-aa94-b7d97c08a945", "comment": "Malware payload", "value": "0972eb44c051f20a11295601c9c6fd91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889678, "uuid": "24aa72f3-486b-4f48-9ddf-e42177d5bb81", "comment": "Malware payload", "value": "45ba52f40f30054247f7a76ea309592c048b9c715a6a57599adfab3b4212a447", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889678, "uuid": "41a1db63-ce20-4fd4-99a7-0fb8b8a61647", "comment": "Malware payload", "value": "08d80ea692edafa7ccbd378a9e9d0b740af7dd5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889678, "uuid": "ca046a71-04d3-4927-9562-bfc3e4187504", "comment": "Malware payload", "value": "9bb3d59517c8bb422d7a56291991f0e123dfd1718e2307282f7bfc798a984a1bbcaae9cf9ff6a08c2bd42eb13ff660e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889678, "uuid": "c4865140-a68a-4440-a7cd-bf456110ec7d", "value": "T1514533281A522F9CFFBE9FB5C2095E151DA053C54F2EF9107E997C9293A1493F8BA130", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889678, "uuid": "f3838f1d-1c78-43ca-be57-a5cf363e2163", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889678, "uuid": "1fb1fe82-04dc-4aae-9a7c-6fb442122fea", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVRHcn+:+YhQs7tW2zku73bFgVlRlbN015CoVhe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889678, "uuid": "6c345adc-929c-4af1-bce7-60d7a8fdb488", "value": 1261457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889678, "uuid": "e4f3e7d4-2bd1-499c-ab02-5f3b5dae0d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889678, "uuid": "9abe0b33-1156-46ad-afbf-897d536a3c31", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa32ebb-c856-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763893500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893500, "uuid": "243bb845-e642-4455-8e6d-6273036b9dc6", "comment": "Malware payload", "value": "9be2fffa96114549c98bb3ae7db93cd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893500, "uuid": "f16f51d7-c16f-496a-9862-9e8e094f9c8b", "comment": "Malware payload", "value": "45cdeb9fc847c561cb1bc07740efd2301a8caad7081b4a07c7c03356ebfb1a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893500, "uuid": "68f1580e-597f-4e99-b2c8-7a74be1692d4", "comment": "Malware payload", "value": "30b5790fcdf6a95ed899747e5987ae77314138b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893500, "uuid": "1ea64449-e14f-48be-8900-838f5a7acb6d", "comment": "Malware payload", "value": "54af7df192a5bd01b3026581c9fe29e782c252fde91dcf77dbf0b6126578db95747ad798c7d27d2987dcfb99717fa91c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893500, "uuid": "eb28b8d6-3366-4dad-8914-b4cac39b2f72", "value": "T1AD35231F32C112B2CE495731074716A82E73E77E2B70542AB3D855072EF2984BF79B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893500, "uuid": "32f7a8b9-0383-4b42-83e5-91fde16f9656", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893500, "uuid": "31fbb182-31f4-4300-8989-2e469daf501b", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1ZX1:qE27hQs7tWVToP0Hs0/htDHi7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763893500, "uuid": "42f1399b-4948-4a05-a1f1-7e238f583a21", "value": 1070097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763893500, "uuid": "f0df04ae-0d17-4569-aa23-d492440633e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893500, "uuid": "e9c2acbd-2444-4eef-83a8-c3805f5742d9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e1d318-c8b2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763932823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763932823, "uuid": "b02fd0ac-a31f-4db0-b278-bf5c08a68c7e", "comment": "Malware payload", "value": "6afc13715c8657dfca1a72f139f686f6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763932823, "uuid": "e58ac7be-34ea-455b-8946-63f5074cf8f5", "comment": "Malware payload", "value": "46299739a366cb48740eeb9b7ba4727d15a2d5e04401b96d941cb6659acd5e38", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763932823, "uuid": "192244e1-a41e-411b-9ba3-09909aaf86d9", "comment": "Malware payload", "value": "1b3cb01d333a1b2447a54f540e04cc71c6224649", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763932823, "uuid": "168c2d78-d202-48ea-991f-dd0c90ef648d", "comment": "Malware payload", "value": "7da455a6ab36ea8ea86b9bf268165a175047506fef9b61df6cb5d3b659ffa41ae85dd35c784f14ccb6ef5c3362e9c062", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763932823, "uuid": "d9f2efa4-d5c3-4660-9ab6-d26759dd433e", "value": "T174953358B5ADBA81CFBC1431B4DB576B57A6C5820D2F945ED44348CEE02C52FFA08B2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763932823, "uuid": "dc00803a-3fc2-4371-b7b9-e35e146936bd", "value": "49152:9B8rQkuCB125I87PI4frlXD9P9OK5fwnsWaGQtiW5i2hJLi:9BRkrBh87D5TlT8aGQtiWU2hJLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763932823, "uuid": "1cee355a-bade-436e-ab81-f223daac3513", "value": 1932429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763932823, "uuid": "09c5a800-e718-43b9-bf50-8999541e59bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763932823, "uuid": "94c8ce15-e29a-4498-b237-38c8f8949581", "value": "C3-server25.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50c9352-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889679, "uuid": "be653b96-e52b-4d43-8e97-7f02139b8a4b", "comment": "Malware payload", "value": "8fb788ba54fadf27b7597680b2d7ac6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889679, "uuid": "cb315d7e-792e-455c-815b-dd5419734780", "comment": "Malware payload", "value": "4633c634b164c6cdd256415ae8a4ffecfd9a293d3d9cbe6ac6510da15034b375", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889679, "uuid": "5f643838-3562-43a8-b797-9255cd9edfe8", "comment": "Malware payload", "value": "9c5d30ca6cf3bf05fc7361db526414da6ba30e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889679, "uuid": "f62bd805-aa2a-4b62-b1a4-db8c3ef73353", "comment": "Malware payload", "value": "09f0ada0d2c51550f51c3c7ffd7080000ab7d5698374c52e24bf0dcc6ad78debdbaea33c51100605d426c55fc93564af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889679, "uuid": "2fc3f846-3eaf-4c99-bef5-fff35ac430c6", "value": "T13A2319187698C52DD23E4B7DA4A21A104677A33F121BEBC57CCC48AD2FB372845317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889679, "uuid": "052d8952-bad1-4a51-899e-a9cfaaaf7c51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889679, "uuid": "3b4964ce-81ce-45cf-b5bc-ab3ad6e1a785", "value": "384:GxysR3YvG1Ce83ggIMM/06WUz214dHRjQxqmlTW4gCwL1gb+PiGkxiEVjn:GwYdgwWedHdi3Iv1gbJ4EJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889679, "uuid": "5805b544-6d04-4887-98d6-dcf9f997d1d3", "value": 49164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889679, "uuid": "b28b6ecf-00f7-4ee6-9367-214420b4a6e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889679, "uuid": "0d35b652-a9ee-4c85-b755-dd4dc423e38d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c99718-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889680, "uuid": "b75a35db-1be1-411b-af47-770e58fac300", "comment": "Malware payload", "value": "376b92bf4717fb2fbc52129f845908bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889680, "uuid": "bf6aba0f-093b-4a63-823a-aba902e62fb9", "comment": "Malware payload", "value": "4634e62124e69838d6c9915f2b1c5d9c128b8dd61a12fac6597576f33a3a59d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889680, "uuid": "b12de710-bee1-49fc-bbb0-df57ca4efca4", "comment": "Malware payload", "value": "e078747324690fcb58e3c0a95a5a5842a8beb254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889680, "uuid": "3d8e27b4-0987-4bf6-9338-064f0a983168", "comment": "Malware payload", "value": "371d38f5aa7cdfa431f64d123139fd8cfebf0ef0aa62bd6198b5a58605ccbb17233cbbc2b7c1aab24607455875aa64e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889680, "uuid": "de9d4c12-7885-48bb-8cf4-57f0f64220a1", "value": "T1EE45233633D199B5EE464E30030D5F255FB2D2791F3AE416BBE42E2368708A2BD26761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889680, "uuid": "8f1cdb32-57df-451f-81f1-8befad8f4d44", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889680, "uuid": "5b3d7324-86e2-48df-8cfd-04acc2e4a201", "value": "24576:G6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iWtPW/7:GE27hQs7tW2zku73bFgVlRlbN01TM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889680, "uuid": "5cef58c3-c7f9-47c2-8876-bd5b81a66bb0", "value": 1235210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889680, "uuid": "fc63e217-3d3c-405a-9bf2-b502dcd0b605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889680, "uuid": "984bfbb9-8655-46b3-a563-355c1b07c32b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66ecd6e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889681, "uuid": "bf8b5964-21ea-4b15-b9f8-bdf47403d683", "comment": "Malware payload", "value": "32ac09fd582581ed646fa5b792e484cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889681, "uuid": "2fb37983-4303-4cd0-9e38-b687f52727a0", "comment": "Malware payload", "value": "463a52c6f4e8979d721e3c2d4286d7398354dc90e17d43138d64cec60bbda639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889681, "uuid": "2e7dbebb-6cb3-4374-ad85-8d5fc93782b8", "comment": "Malware payload", "value": "f1fba2798076dab0141c95abeb399a6942febd9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889681, "uuid": "f21682f2-fd49-4b0e-9dcd-b986434cb7c6", "comment": "Malware payload", "value": "05d47c2e80d4213d90bc81bd24d4748d32f86d79e874603061fe9adc8a7f7f301604815f336911d1a48bb3eafe00fc2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889681, "uuid": "3fab1380-bf40-4642-af49-6868ff97a053", "value": "T18C45332927923E8CFFBD9FB9820D5E1059A013C95F6EF8117A9D7C5293D24D3B866130", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889681, "uuid": "bcc95e96-6d2d-4835-8552-c31e1c456bd3", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889681, "uuid": "2b11becd-1aef-43bb-ab4b-8876fa852ad6", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVv2Wy:+YhQs7tW2zku73bFgVlRlbN015CoVv25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889681, "uuid": "244aff8d-aa70-445d-9201-5631f5fa14e9", "value": 1189620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889681, "uuid": "2f33ca5e-7388-4a06-8fd1-523144382d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889681, "uuid": "1bc2562a-f635-49c0-a292-7ecebe695c5e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778027f4-c890-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763918325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918325, "uuid": "d73aa07a-3097-475a-af8a-9c41278aaf7c", "comment": "Malware payload (Mirai)", "value": "e5c767508f883181066335a239ae0e34", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918325, "uuid": "d7c9993c-b7fd-46dd-8927-e9ff8135e273", "comment": "Malware payload (Mirai)", "value": "4648fe36ec5436818619692859b48bb0b48442270eed73d6d0e4db7a9564a318", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918325, "uuid": "4f8edb99-4483-411a-969c-670af481ebfb", "comment": "Malware payload (Mirai)", "value": "3efe745c15c6d8a8b1cb6e97e60475f770ee7cb7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918325, "uuid": "827d1111-65a5-4b45-a22c-cdf0be73b215", "comment": "Malware payload (Mirai)", "value": "3e281c0bb1a84e74171349addb370f34a8941881213e0adecb8dbd8ee78f8b7a451bbb0290f7709da37e7ca4a7a4ef4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918325, "uuid": "be594b75-87e1-4b85-b1d4-20c79002d9a0", "value": "T1B541FDED02802B3A31058A25A3E755AC9C5A8FD1B14B17ACD5897C2B8C0F71C7BF9D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918325, "uuid": "b5c02819-b633-4394-8f07-6669dc15f286", "value": "48:pIydqsSaanhYapwMZBkZhVCR27AF3OHeENnuXxwhE:pTgLleaGuBWhIADUW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763918325, "uuid": "dc0497ae-1874-4e55-8a25-098d17e8f42c", "value": 2274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763918325, "uuid": "670dfadd-4783-4504-a01e-640fee518fdd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918325, "uuid": "70200c42-465a-4edf-b780-4d61fed741c3", "value": "dr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1451e472-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889812, "uuid": "4e662794-ec40-4b68-8c99-6d1fef676c0a", "comment": "Malware payload (Simda)", "value": "c567e0f20af4744c1b790268c8d4f941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889812, "uuid": "69e31441-03b7-4e8a-9728-da27556859d9", "comment": "Malware payload (Simda)", "value": "464ecff212442163b17cabaddcb4df1ac77fba48c7382663953d96f546fb2531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889812, "uuid": "1f0f2877-3c41-4a04-8343-d74da6b81d12", "comment": "Malware payload (Simda)", "value": "a32092993c499ee5d0b989c366e8bc40749135ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889812, "uuid": "3e4c91c5-a942-424f-99f2-b7c10186080f", "comment": "Malware payload (Simda)", "value": "c8962e0384f3bd9f6db0590fb4bfc48e04ea24c60fac4a1115fd139e76e2235e2816b3043bb9d1d233c940e4717d44c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889812, "uuid": "3f5a754e-d4dd-4bb3-9aff-cf673b001385", "value": "T10D55233632D198B4ED924E30020D5F254FB2A3761F6EE815BBD46D2728708E2FD6B761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889812, "uuid": "d74d4463-2d66-4b56-a625-6c07e0c2c2ee", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889812, "uuid": "fa2d9a26-ab48-4d80-9124-5b3738317d3b", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iWtPWnQKP4:qE27hQs7tW2zku73bFgVlRlbN01Th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889812, "uuid": "784af76b-e229-4519-ab7f-dc21645be619", "value": 1301472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889812, "uuid": "d637f11b-25b0-450d-8a02-132b594a59ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889812, "uuid": "a2770789-4249-4c9c-877b-98304d01163b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2f11cd-c882-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763912211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912211, "uuid": "b59b07ca-ed22-40fa-9dc7-f53ac240d969", "comment": "Malware payload", "value": "9d5a10cfb3ea2a56585fef3d9a40333c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912211, "uuid": "1d530676-e445-4620-b9e2-bc9045e34f8d", "comment": "Malware payload", "value": "46c0e96f944f4ad4b7f0b8b140ecd42eedb23f3226f72bcfbd1da7f51b909474", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912211, "uuid": "dd1dfab6-afad-4c84-af2d-f808a5aca0d8", "comment": "Malware payload", "value": "4697eed2115fc362ccadd5642a9cba6f04ecb82b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912211, "uuid": "d6c09880-459f-4163-84ed-b852a842b3fb", "comment": "Malware payload", "value": "3bd9c32f2a32c00221f70f2e265bd8e35f11113dc2ae34378e54a22f9a75dfa43120f17db8317e75693b02126169faa9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912211, "uuid": "a7d18739-9b6f-449d-9527-978e17aa4c5d", "value": "T1155633A791403DC7D9E393BA5D33C9808D19A8B6AF0F5536F05F26A0839294D8FF5B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912211, "uuid": "7c6f75f2-f02b-4316-b934-8943aa1305c5", "value": "9ecad17161342c5ed0725c6d520c5009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912211, "uuid": "2a58471f-be82-4854-99a9-6fbbe1155188", "value": "98304:sqtYYM9IFR3NeTJyibxgMEq+JQGOKIoONLrBcUyIhiva4W9xKoXoFVw8ibsQPiDD:sPoRuyilgzq+Jwh/LrBcUy+4W9PYw/IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763912211, "uuid": "ac1b10e1-2462-4493-9083-83c3638ec7a7", "value": 5933080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763912211, "uuid": "3736927b-f93d-4a4d-9b3d-7d0124d39ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912211, "uuid": "2d9df15c-e70e-4fec-8943-b4e526db474a", "value": "SecuriteInfo.com.Trojan.PWS.Banker1.37780.11318.23708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c706e5fa-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889682, "uuid": "90df591e-d0aa-41c9-9f18-6eda7fae78db", "comment": "Malware payload", "value": "4bff4bb9e28947f473ec2eea5b038bca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889682, "uuid": "c44f30bc-3c63-42de-ba7d-0770850b0a96", "comment": "Malware payload", "value": "46c83711beb5a0b8badd08a27c78f79ea46b15a9d84bf631beed48e34e1a54c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889682, "uuid": "b650de12-fe7e-4965-acce-3728063fa528", "comment": "Malware payload", "value": "84fd826e0bf9508f19157cc996f093e23951b626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889682, "uuid": "1c12e85a-0dae-4adf-a752-cc32f9c922b2", "comment": "Malware payload", "value": "b065b3b4a6d562a7b67133a09b1ac44df69cdc43f608641a335c716ed9fd65e7f1a8a47d26e198f271c2a33bb011c690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889682, "uuid": "59466c62-8779-4e18-9334-16efb7bbe63b", "value": "T14F93E84BF61281B9CA38C537A561C1B21F253E75AA63CA3F31513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889682, "uuid": "7fb83bc2-689b-4dfb-85c8-31adeb2aae0e", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889682, "uuid": "98c4b4e8-ce94-4d93-8085-c720e7e3580c", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdr:41bC4Bk6lMTOWw4PkRAPos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889682, "uuid": "bc1587b1-de44-4a22-9125-2e4b97920bce", "value": 94261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889682, "uuid": "7f6b4fa5-ef86-4822-a0dd-75e2dcb56c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889682, "uuid": "f3f1b63e-edaa-4aa3-9439-17439278e77d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7aae742-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889683, "uuid": "8550bb4e-f84b-4132-8baf-52593c5767c2", "comment": "Malware payload", "value": "da3930d42df9c9e6d4b7d2f323757edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889683, "uuid": "01a34f30-0855-4ecd-98d4-a5ab9b5ac878", "comment": "Malware payload", "value": "46e5f324a8b0d84407441d1997f2a60bc5281c800365dd03679eb89ff2e4cfed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889683, "uuid": "9e8f8ae0-df12-4d54-a76c-eb2b53857ee2", "comment": "Malware payload", "value": "5c1bfb1ab06cce58b833c6124e836f71ff3f085b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889683, "uuid": "b03ed3b6-d03c-46a2-9d66-542a863efbee", "comment": "Malware payload", "value": "7f044cbdafb26b3ef5ef99066571f0f317061ab5f9553e82e03e11b9cc2a7c785b5507f07ac8cb9f4d7adff8de75c3df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889683, "uuid": "e85b74c1-427f-444a-89cd-21f6bc26d49f", "value": "T13075332573C185F2DE1A263101566E708FFBD33C1EA52417F7E85907ACB9462EB6B382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889683, "uuid": "23c433c0-e2c5-435a-9019-61ce6be211ab", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889683, "uuid": "009354e0-ddaa-47be-9dd5-7308a19fa6ce", "value": "49152:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxTspAepbu9:82kQCN/JT/kgFWLa6vp69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889683, "uuid": "178f471d-cae5-4bc7-b280-161cb8e86fa1", "value": 1647899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889683, "uuid": "e1e1db3b-a569-42e4-996f-913ed29790f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889683, "uuid": "eac9d118-2b38-43fe-9de8-fb6b2cba8879", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85097ab-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889684, "uuid": "2ccdbdff-4b8c-4d2f-8994-19daaca4c812", "comment": "Malware payload (Simda)", "value": "16877b86895f86daf2555682fd7acf1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889684, "uuid": "0d9d428a-5ee1-494a-9c2b-5724c36c450e", "comment": "Malware payload (Simda)", "value": "4706bfd51c7f6d36e99f8edb5554f48f57d68629f88d0fae4d2cd485529d37b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889684, "uuid": "18272b94-b733-4b48-8a3f-a2d684002873", "comment": "Malware payload (Simda)", "value": "a6b66e7c9581131e63d71df158116b79617a5b60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889684, "uuid": "66549235-41c9-4720-95fd-3e139073f750", "comment": "Malware payload (Simda)", "value": "55f8fc3bf8c676031cd6cba353bf45d3c80dc1282869e2d2db80c33698a4feeb2b4ac57f175309b8ead2c95837f05457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889684, "uuid": "11e9ccfc-bda4-4207-8178-e29b68f69a25", "value": "T1C13412C7B18928D5C440067349FAA7815A2DFD551B1BC8FBEF88412DAFAC981BE3531E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889684, "uuid": "8c074dd4-66d1-43bb-ac8d-0b2089065f85", "value": "25724a12bec6f765c371201f99ac92be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889684, "uuid": "53e5fabc-2092-4dc7-9119-e26b99993663", "value": "6144:hEXlSylvFuWaS54hIAv/QhuA7HY8pPZ0FP6BzxM5Em:yAylvv5YRwh9HYd61xhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889684, "uuid": "07f6ecc1-a2ed-44f5-902a-1fe5e4507883", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889684, "uuid": "f22f3e3d-4057-49e2-96cf-62b1f99867e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889684, "uuid": "c4e2f45e-be36-4676-adea-18141579f000", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f5b0b7-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889685, "uuid": "d15b3ba1-37b0-4998-9b0e-f1daaef056be", "comment": "Malware payload", "value": "5e893f9c7ab90b4e8153290b23803a1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889685, "uuid": "ebe1fe61-6182-44ca-888f-ee1c574e90d8", "comment": "Malware payload", "value": "4713f10a602169d398ffb0f8e92f6ffe2f428097a012acecf72937b808833eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889685, "uuid": "a384dcfe-62ee-4ec3-9549-579fdfcb803e", "comment": "Malware payload", "value": "c1dce1ac2c16457755eb45ba74478d7d45ef7f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889685, "uuid": "c6fc15e4-24f4-4f92-a05a-42c347fcab63", "comment": "Malware payload", "value": "8d966c815acf0320dba26f52f5962cc0cfd275c7538e8632e6531b16b2afe95431e61bffc3d0f99ce3e392ead580ea1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889685, "uuid": "90e29b3e-7746-465b-aa8d-9531fe5e183b", "value": "T1704533692992AD58FFF6DFB9420C4E091E9023845F5EF8156B487CA651A24F3FC76330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889685, "uuid": "fe4a7fbc-fbf4-4452-b690-445dd9a65036", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889685, "uuid": "a05ae7a0-0a6e-4f43-9960-d2dafe7f6966", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iWtPWnQKPT:+YhQs7tW2zku73bFgVlRlbN01Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889685, "uuid": "14d996e8-5af0-4c3e-88a7-75acea856773", "value": 1250030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889685, "uuid": "9d82070c-a08b-4909-9960-4821b68d2fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889685, "uuid": "796273a4-85ce-4543-ada2-5093bab637ff", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc96026a-c8a5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763927514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763927514, "uuid": "02978266-f91c-464a-b437-3daa8b88216f", "comment": "Malware payload", "value": "fcb3a39140705b70ad618f210a67cbfc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763927514, "uuid": "de7e4b81-8d98-4a84-9ce5-a838c4c41d97", "comment": "Malware payload", "value": "4741f6612fedc84d6a994ffda0b413ca82999f8acdea3a9ca11b9c16933fead1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763927514, "uuid": "0615dd47-5044-4b5d-b8a9-aa9c795f3dd3", "comment": "Malware payload", "value": "a36e1666b28d295c1aeabf321f328ffe175cf830", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763927514, "uuid": "95df77e0-23ab-4842-bfda-a551149771fb", "comment": "Malware payload", "value": "4d40a44a26b85979c839441e6516f502235b12ed3e152d94b871015bf4235ec0c065f6d902b9261a22d3748b13a25653", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763927514, "uuid": "319defa7-5352-4281-8feb-1e23460d9f40", "value": "T1F2F533210E75EEFF4618832A607F2F3D0FE20B5694CA70EB9BD074E75A97B51041B929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763927514, "uuid": "a49384fe-4e12-42b4-a64f-86379c7d4e9e", "value": "24576:qu6jBPtkOzMGY6+Iy7xamRBPbUKmateJfhK21tqr2wmkyhDZA4UKhYRxo3Zae8W/:OKJGYAX4ybamNSxFR2dpZvzYDax7j9c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763927514, "uuid": "7c4abe0e-acb9-45cb-8f2c-0ad4dfaf02cd", "value": 3357452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763927514, "uuid": "2fde0fc9-44f8-47b2-a151-1eba4606e7f8", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763927514, "uuid": "ff7f1c9f-8564-4a5f-b9c4-f237abe5bef7", "value": "Ryact.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99e99f4-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889686, "uuid": "7a338474-8f3c-413c-9773-16d3868e7f84", "comment": "Malware payload", "value": "bd8f67e597ac853e4af15844cef63d9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889686, "uuid": "005e546c-0316-4f53-b559-3b3f99aa57fd", "comment": "Malware payload", "value": "479e63c78a41d8c9cde662db735f37d0176ae6da4dd80bc5849be42d221ae781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889686, "uuid": "a98299cd-122b-4825-a2d6-a4ed31bd2cd6", "comment": "Malware payload", "value": "9ef1617b89b35e48bc8a9a46c82e49faf750958e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889686, "uuid": "75c83e70-1483-479f-90f5-9f6edfc756fe", "comment": "Malware payload", "value": "af0ebfec57b9eedf0381aaae178ac681012e081d3f4d7df43f6e0d5dd4320f11529c1157b5bfcbf3a9ad3d4de4944392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889686, "uuid": "272b1448-7a87-4b4e-96a6-dbac87d94107", "value": "T1E964AF7377C08DB2C846053002976B768FB3FA3A15718467BBE4572B6C74D50BE6AB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889686, "uuid": "5f82265e-d93f-42d2-969c-7cebe62a39ad", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889686, "uuid": "41e6fbb7-1f88-4873-94fb-7edd5e95cbf5", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5TKReFA:BtKe6YiDdv3m3mgKHDjSeeRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889686, "uuid": "50494e1f-a780-4e21-aee0-3066cb5763a8", "value": 324203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889686, "uuid": "dbd63213-e0e6-440b-839d-7405a85bc2b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889686, "uuid": "b3fb2e4a-742e-4042-b691-f254b81c95f1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca49b62e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889688, "uuid": "59d4f18e-c9f6-4ae9-8756-bca1cd799b3c", "comment": "Malware payload", "value": "85c8a45830df5e9393bb528420cff322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889688, "uuid": "892618b8-a15b-432d-911b-b6e06dcd80ad", "comment": "Malware payload", "value": "47f14432ac260779dfa20ab615719d8512aea651a17212da12d13e0885b11a1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889688, "uuid": "8ce3fa3d-ecda-4d9a-bddf-d6e54e047801", "comment": "Malware payload", "value": "55ea122f4065081c6318094ed15cfa87d8b37649", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889688, "uuid": "39b414cb-2fe2-4132-95a2-bb622501095e", "comment": "Malware payload", "value": "911f31c75be6d281a276fd1a027d522e8ec0e114dec45b1ea7bb3a34595e5039180dee79446d7f4cd26721d250b0a0f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889688, "uuid": "b0ef47dd-fc73-41f9-b54b-a367f38ac641", "value": "T11925334E19C23B56EFACAB724B4614CD345327DD2B91643D370CA48B13F3988AE7866D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889688, "uuid": "a11743d0-7004-4346-a82e-2de611482dcf", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889688, "uuid": "09903328-7565-4a37-9de1-10273b17eb37", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1ZXm:+YhQs7tWVToP0Hs0/htDHi72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889688, "uuid": "cae610af-d8b9-4ce9-b54b-c9c177378738", "value": 1028314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889688, "uuid": "ca8833f7-5adf-4e28-9f1e-7493153ac6e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889688, "uuid": "135265ed-2095-4f2c-aec0-554e00a36ea1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac29d9a0-c85c-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763896079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896079, "uuid": "d875efd6-274a-48e2-9046-84cb64700452", "comment": "Malware payload (Vidar)", "value": "6e4e34a307c89613ff4bf2ae3cb7a07c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896079, "uuid": "bb7cdd91-771e-4078-8aa5-f97e843a88de", "comment": "Malware payload (Vidar)", "value": "48065f7d46be2c83797990f4ea2fa08e58f31df99e98a80f40d446be7308d60f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896079, "uuid": "edda3610-ed37-4244-a7de-6ae168b81c0b", "comment": "Malware payload (Vidar)", "value": "ecbd76643fb6619b0934f0cb724d8ccf25736769", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896079, "uuid": "0dca2e01-9372-407c-9555-be5b51be828d", "comment": "Malware payload (Vidar)", "value": "29f5474e8e4fea8fffcf56204221fe9af6722e1b925fe6dac71e821c506116f65449f51575cbac56b1593189fdf43015", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896079, "uuid": "e361032b-28fa-4a0f-ac0c-fcfc4cdc9894", "value": "T1CEF54DC62FA0C86CF099923558B653A3B2F178A8077167C31EF92B395D327D47632B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896079, "uuid": "cac7dca5-57ea-474d-87ca-07f3f612efe5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896079, "uuid": "22372779-8ace-4b57-be7d-e1fa95d8d3a5", "value": "49152:arOR2NliCEz8vPBAWIhkf5h3G43MAG4pttNdwO6x:a5oza77G4Ltox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763896079, "uuid": "668ef61b-1e7f-494f-88c9-f83462d621da", "value": 3559128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763896079, "uuid": "700cb3f5-ea73-418f-ac6d-0bc62556506f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896079, "uuid": "32ee2307-6365-4641-8c4d-266889c129a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729695af-c85e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763896842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896842, "uuid": "b9cd796e-6a43-4f85-97c0-e7f7e312c2eb", "comment": "Malware payload (Mirai)", "value": "20031b1bf2b3a3c7fc998cd169e4db01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896842, "uuid": "55a173a6-7451-479f-b5ae-4e38e815753d", "comment": "Malware payload (Mirai)", "value": "4836b3f93630da91892e93584bb3e45cc9e5bc015cb18402aade5189323ef149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896842, "uuid": "3b4a8f72-ad5b-42dd-b0b0-14d19321dca3", "comment": "Malware payload (Mirai)", "value": "d425836f3101ea0ab77366de509882e5428a0fbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896842, "uuid": "2bb6a650-096c-483a-a760-d3fb96c7068e", "comment": "Malware payload (Mirai)", "value": "db7405f5f41013e7fd037f219db11717ac1e16fce7de9a6e8c8260a52b680d4c633e03760f5b5fb0885e105f2a6a128a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896842, "uuid": "898b2655-3089-4a5d-9fe9-baf458da8e52", "value": "T11EE46D06EF441FEBC4AFCD30852E875B15EE8D8702C1A679A1BC8D9CBA5D5690FC3948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896842, "uuid": "2a09da86-d7ef-4306-aabd-1134409189a6", "value": "12288:T9Iqeg9BKb0BU/c20wQVfw4b0Ki1KWwhkWjH8iCH7dfaIW4IfKbhi+r3Ind35YND:BBrlykKOuSDaQPx4P9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763896842, "uuid": "6dcb2610-125d-4117-9b3b-37c34b4e5ecb", "value": 718488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763896842, "uuid": "5ac88e21-e634-4301-b281-00c6fac34fe7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896842, "uuid": "b05690af-df4d-4882-9c21-ba22abd5ebe0", "value": "Mddos.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14986f8e-c844-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763885517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885517, "uuid": "ac7a7a7f-2b63-41b0-8adf-05fabe0f1af9", "comment": "Malware payload", "value": "9674e81a967bd96fcef85d7851eacfbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885517, "uuid": "67334060-1e10-48b0-8c50-31f05a7b3696", "comment": "Malware payload", "value": "48bd5c447cda868707dfc0210f84567197deb7f2a81b2af3e93e90be4547589d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885517, "uuid": "e80216a3-7d53-4ed5-9e57-dc7bfa2770a0", "comment": "Malware payload", "value": "35a5b6029f7d2c25533e3ce7d0b50a3516096aa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885517, "uuid": "6d2f08cd-a884-45ec-a7eb-e4ab104b1cae", "comment": "Malware payload", "value": "b168f7fc5352dd3a62cd247dc2fe5b8ba3d0f82265e8391aadb481371b4f5aca996bf3ffb3a7a13725b53f2445293a10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885517, "uuid": "6c89f5dd-fee5-40d3-a6fc-a6060b655b1c", "value": "T1CA95D023B24E673EE47A8A3549769A50583FAA60651F8CB3D6E40E4CCE2D0601D7FF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885517, "uuid": "be6fdb56-f0a6-45b0-b48c-76881e9128e0", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885517, "uuid": "d737fc39-ac9b-4630-8770-0bf03f0033ba", "value": "49152:YDXrumxshistbE76MKVXWYUddaatLVIQLE:YDbumxXCY76MKVjatPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763885517, "uuid": "33e046a2-4ff6-4d87-99aa-3ab95a2ac833", "value": 2053472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763885517, "uuid": "b894a3f6-917f-4674-b103-90df5ba401a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885517, "uuid": "8af129bc-e9f3-4436-a3d7-eb4922b36f19", "value": "35a5b6029f7d2c25533e3ce7d0b50a3516096aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bbf9b8-c88f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763917730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917730, "uuid": "a23a914e-6f4f-420f-9d20-79ca7b13fab4", "comment": "Malware payload (Mirai)", "value": "340008a353c2c56d6acfebda50689db2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917730, "uuid": "5dac3304-8503-4cd3-be44-bc5704ad4622", "comment": "Malware payload (Mirai)", "value": "48e878a69ec02c9e6abe9766c12aa07f9872406c90b3152ead895d5c038afb52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917730, "uuid": "db6c39f1-58b2-4043-bbc6-b96e562f34b2", "comment": "Malware payload (Mirai)", "value": "5ed178d439b3b5395f51323f3b2e59a2706d2acf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917730, "uuid": "6f092295-e588-465a-88e7-31445ccd87ab", "comment": "Malware payload (Mirai)", "value": "8f760415cb43b43f3498365df8c6336b2b1f7c21f4579b3df5bd6201d263782f7bb83cabcc73fdb1db9c5cbbd5757dac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917730, "uuid": "44b99b29-2f45-4155-991f-620d394c5b5e", "value": "T18C432921B93A1F13D0E4A47D21FB4B59B1A15ADE22A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917730, "uuid": "9f0668b8-5a0a-4a1d-965b-1a99117ea1c7", "value": "768:xqowmZPu9wtnfbltWgC6BSJsBcfDDTFIqQKqgESnmCTbO++nAwg:xqtmZPuutfbltZFBSJsBcfDDTFIm/Sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763917730, "uuid": "45c791e2-6e6c-41a0-b084-3292f1629d26", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763917730, "uuid": "bded67af-ec83-42df-8380-1deb44f9a3b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917730, "uuid": "70131b87-432b-48b0-8300-860bdcfff2ee", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf05563-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889689, "uuid": "c1b6a14c-88fc-4ff3-89d0-d24c97ae3cd8", "comment": "Malware payload (Simda)", "value": "4b55903b2cfc883eddd997abfef78b49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889689, "uuid": "7f38ee70-2097-402a-8f80-cca7aa65baf4", "comment": "Malware payload (Simda)", "value": "48f84d7d505f3a2ce61baa8e56dd0838d0b81a0103db009bfd5596fb3f62af4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889689, "uuid": "d67cc372-c104-4fad-8644-d9cd9a1da3c7", "comment": "Malware payload (Simda)", "value": "beef4ade0f4e37e90d75dd4d5feb47e95a01b285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889689, "uuid": "c4535249-c054-4527-abf7-6216c1905177", "comment": "Malware payload (Simda)", "value": "de9b8857118fe9120b1b3f841f5c9f5ff6443c0503c62338f6b102053934faee278ac20dad6d1ae9a47c414c780604af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889689, "uuid": "ef6d3d67-6dfa-4da6-b5fd-6f4fb5c68aae", "value": "T19E241223EBC61E42D8650F78858EE046DEFCE48D3FA292368D54CD473E437624E59B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889689, "uuid": "e828f092-0b68-40c9-b77c-075b116b72bb", "value": "a1477f62efa130779fcb2868cf890b42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889689, "uuid": "8130704b-89ea-4a08-be52-2a0216772b2b", "value": "6144:arRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:gsTbzu1glovW4EH6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889689, "uuid": "7b75f789-4800-4903-a7c8-6348f5f251f0", "value": 223040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889689, "uuid": "15c1aa07-d7d1-4273-9c0b-dace4566cb8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889689, "uuid": "5a458535-4ccf-42ec-af2f-ba6221f47a39", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeac0468-c848-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763887494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763887494, "uuid": "d8e99b75-d56e-4602-8da9-85d34b86b455", "comment": "Malware payload (Mirai)", "value": "e032f6a35afd0db5ed07ab86e29ef8a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763887494, "uuid": "9fc10b1b-a3c3-4184-bf30-a815dba5cfa7", "comment": "Malware payload (Mirai)", "value": "4900de10166d8cc5412846c94b4b27469d1a63c95ac4656b9f064ed8e16ead98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763887494, "uuid": "26abfcb3-d012-44d2-9945-87e6c1c5af8c", "comment": "Malware payload (Mirai)", "value": "95e073fe730905a557cd9b0bb5fdab648bc82717", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763887494, "uuid": "2861bb45-5cf5-4bfb-b9a4-945c75f55b45", "comment": "Malware payload (Mirai)", "value": "9b8aedeab0c5bbf496b60999743b10092fef0b0d8230f6616f0f870c6b7b1d96bfad592c7198167aa77f100df1d89138", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763887494, "uuid": "87399d0e-0ae5-4c2c-94a6-1a709ea32e84", "value": "T130935B06BAC0D4FCC89AC738565FA176C932F82D123A711B97D0FB167DCDA302B1A5A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763887494, "uuid": "d61ad278-9066-4d3e-86d4-14e1360e23e2", "value": "1536:az1qy4ra7sw0oAlOf2G1Z/zXLdbts9NaM+p9Yuh:aZqyN7sw9AlOl1Z/7zs9wp7YO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763887494, "uuid": "938238e2-45f5-4ae5-b60e-06f05d41f92e", "value": 91792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763887494, "uuid": "0ed16e3c-053c-44f9-b2f7-c18322134fc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763887494, "uuid": "c2512f50-8e30-461b-be10-447ba977d921", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5900683b-c850-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkComet)", "timestamp": 1763890786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890786, "uuid": "0d068aa0-f42b-4390-8b23-10225ce84d06", "comment": "Malware payload (DarkComet)", "value": "a5e45231ac569973154a0098227affa0", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890786, "uuid": "b5d8a5a1-e25a-4fc2-8d1e-f5c6e4cf67e6", "comment": "Malware payload (DarkComet)", "value": "492c55622ab28f5549a53604a4525613268aa1ab5ca99cbc6a969d8e387337f0", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890786, "uuid": "4990a996-e763-451e-a4bf-80220d87f876", "comment": "Malware payload (DarkComet)", "value": "8124ac83f3188bc856486fb2c5284fadd73bc991", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890786, "uuid": "96dae5c3-4775-4d5f-91df-93a36c674cb1", "comment": "Malware payload (DarkComet)", "value": "2b7d23cdb0c74d95cdef13ab8a2a57d98c1617b2ac79f1912f2da8eb36bb2e7c48f1accd16e39a5ae7ad2d973057ccc2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890786, "uuid": "0749f16e-e544-4a60-8e3b-b12b8d40c733", "value": "T165C5E030F180A47FDC6635F48C5A88B554167E262E26250B35F73E0C9E3E283EE565AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890786, "uuid": "b34a5170-3596-4f00-a298-f6e0223527d0", "value": "9d617e643d715888a08eb0e79581244c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890786, "uuid": "3024fed2-4a55-4923-bb7e-252bc1f843e1", "value": "49152:dQDgok30Pn+9nUW6z/8StAA3qnE3cgka5mpLS+Mnoga:dQU/kn+h2KE3bmxGno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763890786, "uuid": "f9166940-5c2f-413e-bd46-e4c127bb0aa4", "value": 2590208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763890786, "uuid": "009eb656-51f9-4bce-a60d-084ee3eebd6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890786, "uuid": "58bb4537-5c3a-42db-aa70-ac82f575f6a2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcec18c-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889690, "uuid": "44f95fd6-716b-4fb0-8a1a-541df20c86a4", "comment": "Malware payload", "value": "29b2acae56af2ef40dd20c253f28bf1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889690, "uuid": "83600be4-476f-4b3e-8866-4c0d9a330d48", "comment": "Malware payload", "value": "4989ab29c1bae110f5ad555f21e9e3d396858d6fb0c5cac6e422b7488fc7fcd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889690, "uuid": "9e463fa5-8959-4f6b-9cf9-a24a83cba48d", "comment": "Malware payload", "value": "89372fb526b2155c68371f6bd567efb9c194eeeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889690, "uuid": "6702b128-71f7-4c26-a73c-49a9df654a02", "comment": "Malware payload", "value": "aa26ff9836f33761dda53865240c6db72b6c6b824f4e9026fa7ac973d18c738176f9ec97b107b54e0e079125325d220b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889690, "uuid": "f72600a1-6527-4f27-aa42-10d2aaabd7d5", "value": "T1AB86330572B509F6E9B7D079D2D38A22EAB2B8560375C3DF73A482642F237F45934B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889690, "uuid": "1267a695-c43f-43dd-83f8-b13e87b38836", "value": "7d1e2eb3b49f4770c4fb61600805c72e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889690, "uuid": "b4ec0839-82d2-46a1-8322-f5cdfcd304f6", "value": "196608:K5tA1HeT39IigFeE9TFa0Z8DOjCdylVSE/GoznzZBW0C3n:K5m1+TtIiRY9Z8D8CclsSGorM3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889690, "uuid": "7766878d-dd04-41df-8a3a-318802da8730", "value": 8229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889690, "uuid": "070ce3a5-be0a-4e18-897a-5e2f50e93d05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889690, "uuid": "6c164cf8-be3a-4c1a-87bd-998ad6c9b2f4", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca707c9-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1763889692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889692, "uuid": "788f4e4e-da71-431d-8dd5-f857db249eec", "comment": "Malware payload (SheetRAT)", "value": "d1aceb3e38028e96fef4816f4e582dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889692, "uuid": "5ce25eeb-e336-4d5e-94ff-75b68135718a", "comment": "Malware payload (SheetRAT)", "value": "49996891040e8b318c9ba591cca03d01b7c8f043fac38e31d4240e82f833a3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889692, "uuid": "58aa2f69-484a-43d9-83c2-0ed3866931ec", "comment": "Malware payload (SheetRAT)", "value": "a7fafdead0808bcebb49d3e8e0e01da1af5c7246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889692, "uuid": "aa7b45ad-54a8-40fa-b109-b07a8d04a849", "comment": "Malware payload (SheetRAT)", "value": "290f07de75b2020a1d5ca6f67af71beb5b28ddca537affc7d5c5c2e3a48c8607a708531a8eb21d72dd1cfb76b0be0ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889692, "uuid": "d2a22d31-cfc0-4e4d-ab8b-78eaa760d3e9", "value": "T1C2B6C60CFE91E80ADF1F3DB7CBE915000F7162C22E1185562259AFFE9B6537268A257C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889692, "uuid": "73b885c4-41e1-45a1-bcf7-65949269c2e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889692, "uuid": "120fc1b8-c73d-4d08-9157-ce9d5c75e3a7", "value": "6144:vUrlV9TkpmJdVM6zjYaaGce6VlWT8b9o0jQjRVY0JsZjK3vaVsadA0bbuhXad3:8rld4PVle8GF4i/vpjUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889692, "uuid": "bf3a113c-5e35-41aa-926a-79e9147dd2cf", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889692, "uuid": "227d2fde-280a-434c-ab92-7e02086862f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889692, "uuid": "dfaba6a2-f4cf-4c6f-a500-78b60bc37d34", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd41415f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889693, "uuid": "170b3606-8b9f-4389-ba14-bfea98c42a37", "comment": "Malware payload", "value": "9315fc319621583e409d975b61a2ca3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889693, "uuid": "3fb03d41-6331-4a05-b388-66739cd39e9b", "comment": "Malware payload", "value": "49b33a7e9bd9472382516c2a997ac6e9aa5a39845c75a5a2fec5a57d95871e32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889693, "uuid": "c995f201-80a4-448f-99ce-93b4744a247c", "comment": "Malware payload", "value": "2cfe95bf99742bfd87b94d29f78ba8a09e898424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889693, "uuid": "225e32c5-0a6f-4af7-8882-1f0fd36542a1", "comment": "Malware payload", "value": "433288eb89c85261f2662a13336f676c23faf7cd46578929f8e3038f329bac0b310f03bbab34cc1329080e8fb04180c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889693, "uuid": "020c2685-a9e0-47fa-8755-fa5275c5cfb6", "value": "T1BB03B1895782DF04C978313240F71B1953B1E1DE7B7A962F4F0ABDB21EC22565CDA22E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889693, "uuid": "bd4be2af-27de-4361-83a3-8f187e00d8d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889693, "uuid": "eaf5db6a-d682-48fd-a724-15c5aa9957f1", "value": "384:BDoDe6tdDFyCwZJWLv94Zdi5SCZFjFPJDD2KiXkkjRkKykDd182XgSKFlEPFUph:ctdpzL1WlCLFPNK0+RUM82OlEPFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889693, "uuid": "be386fff-684f-4fa6-a52f-25251c558a25", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889693, "uuid": "1bfe8f4f-ccba-4999-9f9f-ed3599516b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889693, "uuid": "bed578e8-52c8-4b8b-ad81-5f4b292f2cbc", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c9782e-c858-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763894269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894269, "uuid": "d891485e-2937-44cf-b4e2-6c27c9a59cd3", "comment": "Malware payload (Mirai)", "value": "48e9e1efa65ed9cc89d6af5e0d17ba52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894269, "uuid": "905d59cc-3e67-4046-ac74-881435c6bc0c", "comment": "Malware payload (Mirai)", "value": "49b78f52a03f7d2bc0e1d38eb4ab91e39e7f76418cb4064115ecff116de8c952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894269, "uuid": "cd3f1e17-1bde-4a46-aa30-6ef0c8b29c6e", "comment": "Malware payload (Mirai)", "value": "bed75b8c19c9a97046f02266a53b1566817a8b2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763894269, "uuid": "c6a0858a-ad77-4c3e-897c-f9615297467d", "comment": "Malware payload (Mirai)", "value": "fd9d109001498a3e2dd541263788f590a58e1fd10951b115fb94f07daf611b568ee818e85afd7d05d85d440b8276b668", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894269, "uuid": "9f2b2dce-acda-440d-ac0f-122b2299f939", "value": "T1BE735B46BCD19A12C5C151BBFB1F829C371613E9D2DB3203F9156B6D7B8B92A0E7B240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894269, "uuid": "c30669b1-e72e-4ec3-8dac-e8a34a1e5dad", "value": "1536:Uf/F6crAvGcPrF07FnlePhylMSwfB7GNOhJXgfMF0Rx00Nk0zH0:eFMOcGxlqh8HwfB7jgfMexRlzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763894269, "uuid": "77f0813f-6ac3-4283-868a-efb81b71168b", "value": 79296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763894269, "uuid": "1b4d5349-448f-404a-a4bb-6a3b6b5f7fc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763894269, "uuid": "2b69858a-072b-4268-8267-0492303f7d29", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde2aede-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889694, "uuid": "34e81b37-0952-496f-a3ea-92feb9f835d7", "comment": "Malware payload", "value": "34155bd2847e19b083fcf5ac8d9e4469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889694, "uuid": "39917d15-061f-45e4-bf91-9f3ceafa970c", "comment": "Malware payload", "value": "49fda873f987debebae8ab2e729f2f6c9dc653198f4fbdbe81d580c8b72f96da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889694, "uuid": "4b08483a-df37-4a39-b9ca-845695d97af1", "comment": "Malware payload", "value": "802b40449de2ac97eb018ffa07e9d08545930d18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889694, "uuid": "2b9d7b65-1283-4c3c-879e-e4cc45c01ce4", "comment": "Malware payload", "value": "4530e68f31a8a3eb9113b18cfa2327a2bd021307bf6eef99a41f368fdd494037060ac6764109cabef54748f4e54123da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889694, "uuid": "05990764-d67b-4de6-994e-2bf2e085872b", "value": "T16845233632D189B5EE574E30030E5F159FB2D2791F3AE415BBE42E2368708E2BD26761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889694, "uuid": "806891f7-437e-4094-910b-95140cab395d", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889694, "uuid": "e85418f6-88e2-407d-9096-d8732adc620d", "value": "24576:G6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iWtPW/J:GE27hQs7tW2zku73bFgVlRlbN01T6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889694, "uuid": "739211c3-47bb-4061-b682-c18980673a80", "value": 1230754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889694, "uuid": "8a674b73-d44b-466c-aa47-4aa557ff07da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889694, "uuid": "25848b93-d6a8-41fd-b0be-c8710ca8c379", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8d9c15-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889695, "uuid": "f9de0fa7-72c0-4969-9423-494cd0e1129d", "comment": "Malware payload", "value": "a4f7a23aff323553957731b1074289d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889695, "uuid": "7ba7dbae-7ca8-4ec7-83b3-5f72f18c68aa", "comment": "Malware payload", "value": "4a07587f029e570877225c4474bc615b7709cc37015f08970d9b4212392ded32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889695, "uuid": "908352f0-f492-4f95-bd09-9188d314eeb1", "comment": "Malware payload", "value": "49105a594d95564f3a821e74cb7120af8bbb4984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889695, "uuid": "9ec91351-826f-4d80-ba79-488ed2f6f3b2", "comment": "Malware payload", "value": "bb152fe5e00876d3459290a9800198009cfcde40c46e350d73b23cb08868eec8e484c2219f236f08039d109d390a6de6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889695, "uuid": "3fe49ea7-80da-4baf-b7bd-7ff7422dbb5b", "value": "T15A25334E16C32B54CFBDA3B68A862895255737EC4794A83A371CA48B03F354C5EF81BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889695, "uuid": "d3b498f5-6955-4831-965b-2789c64822a3", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889695, "uuid": "b0f83ded-1257-424a-a595-a8ed4af55be5", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mv:+YhQs7tWVToP0Hs0/htDH3pGaF5+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889695, "uuid": "9ed261ee-ceae-491d-95b4-e104dcf110ae", "value": 1053102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889695, "uuid": "70444b11-1bf1-482b-ba64-3b35f2249452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889695, "uuid": "ffdc0c3d-f585-459d-9908-f9afc837b027", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6826004e-c884-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763913145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913145, "uuid": "030365c5-3a2f-438d-a480-a09074251069", "comment": "Malware payload (Mirai)", "value": "e3f441ef9e56b4d368b6c2301ce31bda", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913145, "uuid": "87575ac2-32de-4174-ab13-631667018a70", "comment": "Malware payload (Mirai)", "value": "4a3cb19457bef557ede860ec1b92aad9e82b48764e783bfbc5fc88a2918b36dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913145, "uuid": "11a1b1c0-3451-43e7-87ca-bc485f0317a9", "comment": "Malware payload (Mirai)", "value": "eadaf6b5ebd9f1688b17e90c94bff18059f2eec8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913145, "uuid": "11d11b55-19b2-409e-a794-89a5315bc643", "comment": "Malware payload (Mirai)", "value": "e2940d87bf12d713ca390c21b1ec9d7b980483a11fa56ba9800dc4c8d5d467f08b62b66f2463983748457302bc5a58b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913145, "uuid": "16b1d111-ce28-4592-917e-234d511e7972", "value": "T1755184CD71440C3459B3EA13FAB7F12C32C9919219ED7B9699E4BAF4839ED143A40B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913145, "uuid": "7cc0999a-a37c-4269-98c9-1ee130dc6302", "value": "48:vl7k7N7hlv6GlgXzPlfKWlhoUl7h7o7Ulfq3bl09RlNcgl4pVlXSOl7+Cl6fTlCW:vl7k7N7hlv6GlgXzPlfKWlhoUl7h7o7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763913145, "uuid": "3f6eb335-9ca6-4619-abbe-40ee12b8d6c6", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763913145, "uuid": "7b7fd240-802a-4fb6-92a0-fdb15b914d09", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913145, "uuid": "6d173430-ab45-417f-8e89-444288a1d9b6", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d97ad1-c85e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763896846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896846, "uuid": "89b31c05-db93-4c7b-8965-d160e8169ecb", "comment": "Malware payload (Mirai)", "value": "2220a1fa174c21ae7e1e46ca548257a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896846, "uuid": "847ed5b5-2ce8-43d1-a9b2-59a28a7e56d7", "comment": "Malware payload (Mirai)", "value": "4a53ff11c6c910c95d32cef31d902a92aab7bac01071fa26ce161b528759fbf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896846, "uuid": "2bb6b02d-f6e9-490b-8c13-00451b0c9185", "comment": "Malware payload (Mirai)", "value": "48a7f8dbc9488cda071fd5bc4b3cbc14d94656ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763896846, "uuid": "cda6f20b-1b5a-4e8d-816a-13482822cce5", "comment": "Malware payload (Mirai)", "value": "e36069e0ce739d5aa4efd078c96b0ff5082624f3c91fe3f31bc795183932b75d9d785ab6de41294c9b7b19defb0bfca9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896846, "uuid": "ee5fb3b7-8ac6-4e0d-bcb6-19ad92d06a4a", "value": "T1CAE47C637721CF94E325D27005F38B655EA421A20AF29486A37CD3207A51A6D7C6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896846, "uuid": "f55ccc3c-77ab-4a23-aa0e-c80adab0728f", "value": "12288:pgAqW4hcSBAzhvfhaMRPhPABreX78y9ea+kgLDTQ8pa2wcRB:pgAT4hcyAzZ8MPhPAFw7f9pVgLDjwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763896846, "uuid": "a924b872-411b-4de7-9de9-7d0daba3989e", "value": 718488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763896846, "uuid": "9418edf8-9ac3-4e81-8dd2-ae0d2a9d844f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763896846, "uuid": "336642e9-2010-4027-a6f8-201fcd4c5287", "value": "Mddos.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2e5826-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889696, "uuid": "a36c7614-636d-44b3-bc1b-d3c6254366b9", "comment": "Malware payload", "value": "ec0a8c3e866ae6d14589192a00fc49f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889696, "uuid": "661f7571-822e-4298-abc7-34c804a61ba9", "comment": "Malware payload", "value": "4aac5265b903d0beaed7dd8356532f093d7735b17a76c5d479071b5ab6dadebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889696, "uuid": "ec74fb4a-1a1a-4701-93b2-1f4aa7ee1185", "comment": "Malware payload", "value": "2c613045013e5b739422afed860cb453b74f12a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889696, "uuid": "96ae23b1-64a7-41e4-891e-30405ff90826", "comment": "Malware payload", "value": "face554f2ba079d7c089fed61f8fe792c3d25fe4a00eeca6d450dfe506c420bb5cc50617259ef04d9d095431a7d581ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889696, "uuid": "1b73316c-da3f-457c-ac2d-58add1f63050", "value": "T1F225334506C73E44EFBDE6BA438637A939BD3F8813A2583E7A4DC24F41B151D79A40AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889696, "uuid": "c54bf662-b7a5-4801-ace7-38943ae690ff", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889696, "uuid": "a0ceaea4-e7d3-4bbb-823b-7e8f705d6d17", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuN2b0zAC:+YhQs7tWVToP0Hekxbl5Tuob0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889696, "uuid": "e7d82750-116b-42ec-acbe-83b62cd41f1c", "value": 1023519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889696, "uuid": "31c7b9de-a585-459f-8658-cdb6154f21ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889696, "uuid": "d0fe9cef-86e2-484a-8e89-d4975d84ae8a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbd9393-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889697, "uuid": "c8f911cd-a9fc-4c36-8c8a-0b9b6601f9dd", "comment": "Malware payload (Simda)", "value": "5078110bf170f782324893c535036b7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889697, "uuid": "25a16990-5ae1-4fb0-bc96-bb58263498e3", "comment": "Malware payload (Simda)", "value": "4ab94759adfbfabb027f2dd1262e6eecbcd38b336dea1e9dd5b4550a885946b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889697, "uuid": "1528e3a1-8a87-4264-982f-7213abdbdd65", "comment": "Malware payload (Simda)", "value": "0cb5fe24a9d566578b0a6c24871c0f8cd6edf4c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889697, "uuid": "f38e9441-b926-40d0-9e70-c76e9a5df2c4", "comment": "Malware payload (Simda)", "value": "ecb6a2fc385b7efaa280d86a34ea8590257e84b44d80800d350ccdfb916946dc0e890cf38f8345733ea103b93f60814e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889697, "uuid": "d4a08652-6157-4e27-ba27-651f332e91fa", "value": "T18893E0631B0C197AD9150F7B1ABAFB2171BBA4541333D6E30B009A6E6E233C6BD39745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889697, "uuid": "1cafa423-37c3-44d9-85ef-ed1255e5af79", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889697, "uuid": "f94acd66-a1f7-4751-ad44-945d7e42bb97", "value": "1536:L843cqTzCA2PYi+4RFjD4NeX8jIokzah2lPYEWpwPZrmDy5JFfnj9kYfsyLb5:LJTfR2L+CRDeeXrz9lwEWGs23xsyL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889697, "uuid": "f839d15e-d48b-4126-8652-651cfe4141e0", "value": 92820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889697, "uuid": "f11bb494-bc01-4809-9870-841553812cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889697, "uuid": "d987941c-045c-4549-a996-1646af3493c6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05f1dbe-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889698, "uuid": "02a5a2c2-65c7-4615-879f-0024d45e7111", "comment": "Malware payload", "value": "792e2cf1f7f25f5f2f0cec8c2ffc932e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889698, "uuid": "ab72b1bf-564a-4008-9189-91d1d3d9cf18", "comment": "Malware payload", "value": "4b2caf69ab5be871de84a018dfe605be7ab176b47e64b060abab31e495125157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889698, "uuid": "a1820a94-6e2d-4a37-bb5c-ee81fbed4467", "comment": "Malware payload", "value": "a9cb0908cbfd1a38a88122ee23ec3caea3f8851c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889698, "uuid": "8402f8b5-6d6c-4179-8b43-9b472511a805", "comment": "Malware payload", "value": "b2a8bcf5863555a20dbcfe071da9499d2c3374818d3fece482712a9a545390f0adb164065af1ff4d2532d25670de1ee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889698, "uuid": "9d9e7274-c7aa-4f76-be07-5e39bdd9b505", "value": "T12845330D16C27718DFBC63BB9782388536B22BEC5795683A7B0CA48713E750C5AF416E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889698, "uuid": "f1d9dda2-f4bb-4f83-b585-8d1122559acb", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889698, "uuid": "0bf66fba-b2bb-4592-802a-e6d214a39067", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mjC/QjxD/ua57T3:+YhQs7tWVToP0Hs0/htDH3pGaF5+EDRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889698, "uuid": "131b5b19-1138-4830-af3d-9d5e0ce32886", "value": 1228814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889698, "uuid": "b621913a-f4e5-4edf-880f-4bf5e0281ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889698, "uuid": "d030e408-b02b-4442-abde-61f6ff982a00", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b7714f-c895-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763920466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920466, "uuid": "c0c42e9a-364d-40ab-8d7c-123e1ef1fdfe", "comment": "Malware payload", "value": "418ef6deecb48ece5dd1a019a2d1d22e", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920466, "uuid": "834f9500-2069-41db-9735-f77c0b77afa1", "comment": "Malware payload", "value": "4b6570b9e8158241f7201ada7e7a7b49a9c8e41e0386a012677b4e5660c38908", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920466, "uuid": "4c3578a2-7c36-4546-9aba-a3d06816faea", "comment": "Malware payload", "value": "b40068c869ab884e6b317cbf5fcbd79e4efd620c", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920466, "uuid": "b6af8c91-e4b2-4678-af2c-a64471485e91", "comment": "Malware payload", "value": "0809c59af560b5ff163d59de97774e008e8a45a929bbadeeb27ec2b3af3c6db8d05aeae210beeae0489de7b00a0833fd", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763920466, "uuid": "632b7305-7094-4cec-bab8-25c070a8bb9f", "value": "T1C125336561988D26E62C463E10AEF3F7B218737799684BC3E5AC1B7DCCF05051728B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763920466, "uuid": "a9f3e6cd-04e1-4cc9-84ab-588207be6bfd", "value": "24576:0eLhAHddbr+yM+1vc70ihb8b/ns/8WGLk88D7GM0HLsrgL1O+OA7:0eLQzyyV1k70ix8LsE7k88DyM0rsYOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763920466, "uuid": "ef74dab3-bd49-45d7-bcee-802d621cec9a", "value": 999550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763920466, "uuid": "f124d274-2335-4545-ac10-e8d3b5fc2505", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763920466, "uuid": "2580f904-9a0b-4604-bc23-ccc44dc361dd", "value": "927_sy_coord_conf_dscsc.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11baf46-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889699, "uuid": "3ff83853-66ee-4643-ae2d-6b59c630e469", "comment": "Malware payload", "value": "74ead4c7f0237d651223b5be63466aa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889699, "uuid": "7e53fa37-cfaa-47fb-a751-2b199dbce618", "comment": "Malware payload", "value": "4b748b1242952b6f0d64e3ab0f9dc370fc99b4faa20047d09f038ccb6af837d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889699, "uuid": "e0b4fcb3-d338-40de-a24e-13d02aa7bb09", "comment": "Malware payload", "value": "9814cc889476e9d9a8a8c0a7f9e685b7a0fb9c0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889699, "uuid": "702b5a3b-a1c1-4cc4-989f-c8f848aadddf", "comment": "Malware payload", "value": "bf5f801b5c28b306c6311efaf27e23d264cd2422b9ee1e1f7b917b8d2c189b56138dd6ef5afc2a5283ba15b984c274b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889699, "uuid": "d25841c1-0dca-4e06-beed-6302baa74b1d", "value": "T1F855E0336EFF5846D5EC883B2931660E4DFF54E6E01943243CCB10995A6F8BEC914A9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889699, "uuid": "864c8750-561b-4b60-a3ed-c622ad13a55c", "value": "37c6c0cc4d20c311c793c6b743da8942", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889699, "uuid": "e2f43994-0cf7-42dd-9e8a-404ee911c69b", "value": "24576:gOgtYqfVOm8pBflsRAtyqUZdwI0TjSVkNClkJ4evk:gOGOmojsRAtb2wI0qVTi+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889699, "uuid": "05bc1528-0153-407a-ad64-e2a2ac5790a4", "value": 1353460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889699, "uuid": "1577b085-941a-46ee-a4ba-821fe33c88f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889699, "uuid": "2538e8b5-251e-4473-ab8a-23bf7e8dfd91", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b6ae1e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Backdoor.Shiz)", "timestamp": 1763889700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889700, "uuid": "a798b462-a914-406d-b987-038b15ae7b92", "comment": "Malware payload (Backdoor.Shiz)", "value": "0f2665954de36058a7f651f9c04d0de1", "object_relation": "md5", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889700, "uuid": "a3679c1e-2764-4f0a-8db8-218a1793e6e5", "comment": "Malware payload (Backdoor.Shiz)", "value": "4ba858e94443e856c856d1fd88f8c74802240f5220fa8113ba167537d1d39d98", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889700, "uuid": "6269e7f3-3829-4906-9e33-4ea7e8824d39", "comment": "Malware payload (Backdoor.Shiz)", "value": "c7781e20d8bad7ff3e0ad72051a0df08754f8073", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889700, "uuid": "682e8f17-a577-4d24-8bba-c759adab8207", "comment": "Malware payload (Backdoor.Shiz)", "value": "da31a2e2cd47e0ab37d2ee80d8b99044950c2aa1e0a65126e686965373f4134cf9cadf65d41a7c4ac5c333e83ed3c8f3", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889700, "uuid": "1b33fdf8-948b-4284-aa82-c0fdb0357cde", "value": "T1062412B33B844017CD5CEF7785ABB3050B39E11B2E51C2270414846C6EA2BF17FAAA1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889700, "uuid": "e4770f36-d4f4-43d5-86ab-0ed6da63bdee", "value": "430af33f4ce9475c62e2d9321d894f4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889700, "uuid": "ead3c5f2-e180-46fa-99f3-f7f77d6469c6", "value": "3072:8O/6nl92ILkt6i2ox7c39b1a0J86W8xXCKNWOHU/ezYMVWtG4SPUkxbgl:8gFtboVBJtNWyPnYG4fUbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889700, "uuid": "ff0e85ea-3432-4af4-929e-e8fd163fcad8", "value": 209687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889700, "uuid": "c114b6b0-2d44-4a3e-9462-f5ba8f3814aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889700, "uuid": "a129a927-728d-4535-bf25-a7b87b2cf070", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25fb54f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889701, "uuid": "0dc7e6ff-7820-4a8b-8b50-ba6b28da97af", "comment": "Malware payload", "value": "803dbabaccc3c6f3a45310f0c2e1eb51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889701, "uuid": "fe4c1d96-9179-4b0f-b246-d445c3c2a41d", "comment": "Malware payload", "value": "4bc09f3d08f800d4c028321212e476ac2f918e282893a9aa947586c63f9b95bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889701, "uuid": "c1f24a94-bf0c-4fac-bec7-3b1bf900f5d6", "comment": "Malware payload", "value": "f3b48536ba3dfa7e7ffde587b1761e671d295515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889701, "uuid": "ee3d7b95-2456-4854-b35b-53e05076abe5", "comment": "Malware payload", "value": "f287edb36f2a70d996872e5d9d0b755464aaa80e44f3fe20b0fd5de0d2474caa9f5c6c1b328c77b6cd28461a2697e6e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889701, "uuid": "f53ba713-3539-4b68-8ed8-1e33a8d51aea", "value": "T12335330E15C63759DFFDA7774A87299129A337DC1BA0EC29B70CA04A03F39185DB816E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889701, "uuid": "cdedb4d4-8454-47d8-8c39-3b285ce884b5", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889701, "uuid": "2e20cba6-ce52-412c-9fc0-0d00595d7857", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFDwsigi:+YhQs7tWVToP0Hs0/htDH3pGaF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889701, "uuid": "7829414a-b712-4d08-a0cc-e29438994e5f", "value": 1126206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889701, "uuid": "310f8c81-0946-4298-85fe-452dfc3122b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889701, "uuid": "bd38387a-fe26-41be-a0c9-3e50adb057f9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d303c0f3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889702, "uuid": "269d9b9d-79db-4b34-9cc6-0a8e7f207d40", "comment": "Malware payload", "value": "2dffc9d091d0f6817b482659bc997334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889702, "uuid": "7599a69a-ed8b-4601-afca-a31801d13512", "comment": "Malware payload", "value": "4bdc6ec2344b734d20aa2c69972a37eb5c484c628db981a2abc8d12916b9de52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889702, "uuid": "a5b4aa3d-fdcf-40a9-b52a-750c295e094c", "comment": "Malware payload", "value": "a45f340ec50a3463c23b598fe8fe150777d8d280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889702, "uuid": "96c0ee00-099e-4462-80a6-983324344ae0", "comment": "Malware payload", "value": "c4f6ec2944bb1d24649676d8f85b1589782a73a80e9d76dd7ffda7bdccce844d95dc348529230935c86157ef00f8ead3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889702, "uuid": "38444cd1-12a9-473b-b40b-464a5d6fbbdd", "value": "T1FE8533A33180DCF5CB222B7442462A726F33EF78057C651BB3D4161B3675AA6FF21692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889702, "uuid": "e81c17df-8a8b-43bb-b73b-8a8d38d7f2ed", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889702, "uuid": "3d934ff5-a7b0-4592-b569-afc52a409485", "value": "49152:vE2ivhQs7dLNuhmuVZ7iHmv5FJRIqXCzjU3ES8c77tJg:82kQCehz7iHwMA0S8A7tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889702, "uuid": "19208db6-2048-4fe7-8fcb-8b94e03d5462", "value": 1747802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889702, "uuid": "2d9e27a1-ac1c-4bdf-b53d-9dbe8c6e30ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889702, "uuid": "f481509a-b0df-4ede-a284-ff97e4359555", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39c42ae-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889703, "uuid": "f5e23384-a664-41e2-a08a-aeb3e3d4e869", "comment": "Malware payload (Simda)", "value": "888c28fd1381f8c0daf00ea5d9df2140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889703, "uuid": "e13b0ed5-b486-4d4c-b037-e9846c10ecfd", "comment": "Malware payload (Simda)", "value": "4be58f23552773c5d2eae9e54cc40ed8443c342f74c4818d36109cdfffeb15f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889703, "uuid": "be38bbfa-bc02-4ec3-b465-6b79f304106f", "comment": "Malware payload (Simda)", "value": "8df25f7d3f2cc7b017b74a8f482a2adc44c79e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889703, "uuid": "b74c157f-df1e-4164-8323-3181b5b6af3a", "comment": "Malware payload (Simda)", "value": "75b6c32e67c9309842f1f6ee929ed01d30ea85a9681251be7a4f720d7ee50b66fb5675fa6b5dc2ed8b9bc8d55372f3ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889703, "uuid": "e5f9fd3c-2411-4af6-a0ca-e68abaa1b01a", "value": "T1980523FD772A8766F57A47736A43C31FA02EF3A41984E152F69948623C707A331993C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889703, "uuid": "0521c69d-e10d-4c48-af3d-c7c57d154ab1", "value": "846a8dcbd0f5c9ffbf7cfa1fb2e5b31e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889703, "uuid": "8b6bcab3-4819-4013-850f-7a390e6a1b2b", "value": "6144:u9y9VlVACGmxRoyt1SZq1Q9A9ty5bhJcrs0MurPw/c4hd/B/coyXT3nOGX6T:hlVP1FtEZv9qyFhJy56d/eoyXjn9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889703, "uuid": "8d6f6814-8df7-425f-870a-69174a6c3854", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889703, "uuid": "17e2744a-3f27-42f7-9db7-004807f3d0a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889703, "uuid": "b09b5e5c-d60a-4233-8c03-67d0e7908561", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44075cc-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889704, "uuid": "364f8c13-09e2-4172-be77-7d260db39748", "comment": "Malware payload (Simda)", "value": "80797d32aae8cf891ecc195fa51a39ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889704, "uuid": "90b431e8-c112-452d-90b0-562a7528da88", "comment": "Malware payload (Simda)", "value": "4beda23665a9c263ea8d7125c836a162d1d739bc5c910b793df6d6b3b3d2c3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889704, "uuid": "63fbb7cc-f241-4365-a469-16f9628f1e6a", "comment": "Malware payload (Simda)", "value": "4c1c60d5f5a968c99f98e20db0bc823179a14fce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889704, "uuid": "fab223fe-f3ac-4817-999f-175d0fb22738", "comment": "Malware payload (Simda)", "value": "9c485a2bc50f553b8c4bf6105c3c0cdf687cdbe4152ee687938983ba97e9d069acd5ac651d95b29d2e600fd0a1849acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889704, "uuid": "0abee2a8-53bc-411c-ae25-07e383826bf8", "value": "T108936B119504C236F2F8063095FB7A2F266F796817CA1AD72794BECD29702E1763D2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889704, "uuid": "b756fdc1-8af6-4ae5-acad-edbff2e1e42f", "value": "a29736d96c1bb5330d99576cd94e80e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889704, "uuid": "8984b93d-c65b-4832-93c7-c7fc30e59bee", "value": "1536:omZBM/wCzly5CcIO77y2q03eVapcDwuhZI7hfXphN2LfjEc8xVn:oSBExz45CS77yQeVapDqZI7hfXphN2L4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889704, "uuid": "fe5be581-7f47-47db-b665-a57a01cd9ad9", "value": 93076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889704, "uuid": "4d732a12-c800-4fc9-98e8-7375b68d1feb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889704, "uuid": "6f04e655-54eb-4fd4-a642-0a936435b0e7", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1749161f-c80b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763861040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861040, "uuid": "7e6c961b-42c5-4904-b4cf-d1b2754a16fc", "comment": "Malware payload (Mirai)", "value": "437aaffd835b1262ad9b86ee220d7237", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861040, "uuid": "e30ae6c4-c227-4467-b09f-bb04a5ea2257", "comment": "Malware payload (Mirai)", "value": "4bf8d97cd3ddbea515024819eef0ecc7a535f28bb9ea100ecb9b857b8977ef06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861040, "uuid": "49e216e7-d2bd-406b-8a74-78970b69a9c3", "comment": "Malware payload (Mirai)", "value": "f9fcf94d1506ee03cc22f7bda61ccabe075a706a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861040, "uuid": "d736fd1a-b6d0-4100-a8e1-e15c708dd460", "comment": "Malware payload (Mirai)", "value": "d2b3b8ae673ca43fa5c36b695b5b979f2d0b86259f97e9a923342cd71f21cc374feda2ea1f345587e6f9cd86cbd53aa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861040, "uuid": "b244e584-6b3a-4945-861b-96051c1adf36", "value": "T1BE43F1B91B1629E2CA724833ED29C3873BF658B8F39DB990501C27DC764B45792B095C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861040, "uuid": "dac3a9cd-3f45-4805-9a2c-edc9c5e55209", "value": "1536:W0Y3p37F1w2JzlCZE6vP3D1Lw02fhdM2zD:W53p37vBJzluTafhb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763861040, "uuid": "e5e1cb55-717b-4669-b5a9-9140597089c7", "value": 58168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763861040, "uuid": "8c927a8c-5049-4b45-8ce8-7da4ddf3df72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861040, "uuid": "66d6d604-6a57-446e-ba7e-b47ab38f3028", "value": "ngentodluwh.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e69650-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889705, "uuid": "3020e640-3bc5-42fd-9cde-a87b287d5cc9", "comment": "Malware payload", "value": "a4cc1cbcc5f944e25b9432a17783eeb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889705, "uuid": "1b2b90ea-6c81-4000-8435-f7498fe409f7", "comment": "Malware payload", "value": "4c07ff7a25d2e4fe633cf384e895df7ae6715db576cc0427bb166a6f16fe3377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889705, "uuid": "9ac56609-f3a5-4ac1-8d66-b7cf23d42605", "comment": "Malware payload", "value": "c2ac37a5e85251fb0094d1c07d79979fab77a690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889705, "uuid": "3e7809d1-8c0f-45be-bee5-26269f00b4f9", "comment": "Malware payload", "value": "35f65e23088347c4845c663d2b2fad7cb973df648c77961a1aff9b07e8c185c47454b952decb66912b01919ae52a5907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889705, "uuid": "fadb33af-8fe8-4c15-9844-249882be772a", "value": "T148553323B5D090F8CC4929370199E675CBB26AF726F6A1759FE80C6A2C314A16F1FF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889705, "uuid": "98698202-1822-4d33-925c-3a71764ac5bf", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889705, "uuid": "19836c59-f2b3-48b5-bae9-a5f202486483", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lAN2kwSk6Ye17lH:7E2lVL3Ze+/F5ndjFWmrjyx1cmNk7YK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889705, "uuid": "c999ce38-f6ec-4de6-ae96-8dd55455b941", "value": 1407800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889705, "uuid": "9fb745fe-a80e-4de4-a58a-a9670201033b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889705, "uuid": "7fbf789e-264e-4f1b-9d89-ce346db22e93", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58ba195-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889706, "uuid": "5a2b66ec-2754-44e7-a1a0-18f8e6c7cc98", "comment": "Malware payload (Simda)", "value": "a19031852e80a27c2a83363624f5bd98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889706, "uuid": "44446d9f-80fd-42ba-a43e-f60712d5a3c1", "comment": "Malware payload (Simda)", "value": "4c2ac723fa0b5835243712cf8f1205701cf441e4a030587f9d64e96a9205a734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889706, "uuid": "90a1e0d0-3896-4060-80fe-a98adc5918e5", "comment": "Malware payload (Simda)", "value": "b1c1908b7f8fdb6d1ba30addee12df6bbb842d90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889706, "uuid": "87287311-d7b4-41ea-9ce3-44611dee4019", "comment": "Malware payload (Simda)", "value": "92aeec8616057548e4b71d983400aa79fc8f4b291fec93a767bd1fd083de5a96ef07efb48e8bb6b0928e6d5c7851600e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889706, "uuid": "93c18aa2-6c13-48fe-9be6-e9e64375a2b1", "value": "T1657423FD772A8B66F57A47736E43C31FA02EF3A41A84E151F69548623C707A33199382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889706, "uuid": "fb539663-c065-40a9-a3f7-9ee2fbc6a101", "value": "846a8dcbd0f5c9ffbf7cfa1fb2e5b31e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889706, "uuid": "d5fbaf5d-8653-45b5-90ed-52fd8fb3a580", "value": "6144:99VlVACGmxRoyt1SZq1Q9A9ty5bhJcrs0MurPw/c4hd/B/coyXT3nOGX6T:9lVP1FtEZv9qyFhJy56d/eoyXjn9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889706, "uuid": "1539bed4-a008-43e9-ba8e-2abdc1633f04", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889706, "uuid": "de26ab4b-62b4-4c2c-aee0-b2ce66416d6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889706, "uuid": "6ee2aba1-9d62-4916-878b-5b799f88a73d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6374012-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889708, "uuid": "3030d1ad-e37f-4585-92d6-4921a204d32a", "comment": "Malware payload (Simda)", "value": "e8e10d8969d6ee3654c67d1809cee88a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889708, "uuid": "b5beacfe-bcac-4288-a08c-201d12800a12", "comment": "Malware payload (Simda)", "value": "4c6ef1c52b12e2128f33f647abfa335cdf5b1baef474b840703b4958a1914f0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889708, "uuid": "c1d65bd1-32fd-42c0-9c8f-9d30e5b21e89", "comment": "Malware payload (Simda)", "value": "91a3d51376e0fb902e620538a7fc0e2a0e0801ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889708, "uuid": "ef865074-c489-49b3-b776-c62b7646cc9e", "comment": "Malware payload (Simda)", "value": "c1c9054cd4378e4b03e7b54704477f1262f7ae7adc9b82bc2290ab64e99767915f928edf6e772037a7b629a665169d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889708, "uuid": "a870c4ce-1fac-4747-bbe3-f7a490b14a2f", "value": "T1402413226D5D4E63C6A714BB1BF6FF552326E5A8432BC7676C00420F0C756C97F3AAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889708, "uuid": "9a2a6e11-cb8e-4252-8657-82f53c1a2638", "value": "088303a3216315a2ba8d66c94c7b80a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889708, "uuid": "6a3ca5b4-64fd-4e84-9ef7-f6ab8f660019", "value": "6144:tmKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3:V71YpQiU/RcO1VQInVob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889708, "uuid": "05c7a9b0-3f49-40f8-8590-cdd0f95c935a", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889708, "uuid": "b23c75b0-8ad6-406e-94e4-18d7fc218388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889708, "uuid": "ef633e60-cd16-4f0d-b00f-7e54762d7e2f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d7c421-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889709, "uuid": "12524477-b4a6-40b4-acca-4ed19452a2a0", "comment": "Malware payload (Simda)", "value": "391052186edbc65685ae2c42978cb281", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889709, "uuid": "4ba549f0-bbd8-40ce-ab6b-1c3856a8d6b1", "comment": "Malware payload (Simda)", "value": "4c7164167d236b558b6b9feffec4b8668e4cc2e2640c17572b5f9d5a227bc14b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889709, "uuid": "7c8f8793-b5dc-4e39-ac03-f888240baed1", "comment": "Malware payload (Simda)", "value": "1da16d407ffca231775f9f040d79d967d6e09ee9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889709, "uuid": "8af57b5e-d1b2-4c94-ab75-a56d2475e94a", "comment": "Malware payload (Simda)", "value": "92b7c038e921bcbec7d04288171646839d15e0244d09a861f021b82215f2e31d1be06df7c2b6147bd78815b7808be297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889709, "uuid": "a6e60ad0-48c6-4297-adac-610b30250977", "value": "T18C848E21F1C0807AE4F5157096FF7A5B246C69B6472838E7E7986EC928741F27A3C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889709, "uuid": "e2264c97-4d22-4461-a59c-57da355a8bd8", "value": "173abfa8f7d7adac2a90a2e42625b7d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889709, "uuid": "330eefbb-294c-4e52-aec0-9156ca5cfce5", "value": "6144:83EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:3mWhND9yJz+b1FcMLmp2ATTSsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889709, "uuid": "5533c7be-46ff-4f0c-8ded-939cea23007c", "value": 387484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889709, "uuid": "955ac642-3c39-49bc-bf1a-7edb7db91a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889709, "uuid": "383016b1-e6e2-405e-9830-629456f9f08a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d788e0ad-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889710, "uuid": "a29626ee-13b7-44b4-9230-81a9b9cca1a6", "comment": "Malware payload", "value": "75575cb8196a9405dd0509b5854f48a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889710, "uuid": "74a96fd2-4e1d-4559-b417-6f5cc9afa41c", "comment": "Malware payload", "value": "4c75966b34b65c3b2695868bfd6f7d597d082d03ce77f6b050ab451feaee9307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889710, "uuid": "f09116ea-e4bc-41a7-9ec1-2baf561e77f4", "comment": "Malware payload", "value": "644c31c87fbb074c4871e5969ab39758cf83258b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889710, "uuid": "e4990c17-d1c9-4eba-a91a-f2752e56ce0b", "comment": "Malware payload", "value": "b7fc7d7e7c613b05a28ae68963185d16c3838e526398c8bdb849df6274258d0e5e7650063de4b86f643c1c1b6c7c44a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889710, "uuid": "db5b24ba-6e66-469e-bea5-726ce25a6d20", "value": "T17735234E19D33755DFFCA3724B851888396327EE2BD0642A760CE40713E3A486AB967D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889710, "uuid": "45b62065-5ccb-4a34-8ef4-4e7607292497", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889710, "uuid": "c41e5acc-3d8c-43a6-bdc0-600b4c1e0b47", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1BPx:+YhQs7tWVToP0Hs0/htDHit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889710, "uuid": "4f13a184-c22d-4539-a81f-69975708dc8f", "value": 1068487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889710, "uuid": "6cbca36c-7653-4102-af5e-00c6e266b162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889710, "uuid": "721ed412-057a-42cc-ace3-28df7e67d5b7", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8237fe6-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mofksys)", "timestamp": 1763889711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889711, "uuid": "c6dfbe7b-98c1-480a-8fcc-353861b5d147", "comment": "Malware payload (Mofksys)", "value": "448819c0147a9e20732ea911f698a196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889711, "uuid": "68328d21-fe90-4e01-a3d9-f78aa9c86849", "comment": "Malware payload (Mofksys)", "value": "4c9931f7d18931032a709727652b9781a1565ef91e35e041d1dfa2e4ae15d2e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889711, "uuid": "c1ffb97c-0f40-4717-a0eb-3f1812c6ec69", "comment": "Malware payload (Mofksys)", "value": "f907addc387e58887447694731c5bc9b1730b7f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889711, "uuid": "ab9c605a-9b13-4b77-8d50-1f8d9fa7829c", "comment": "Malware payload (Mofksys)", "value": "4ac79f18b67ed9ce8f4dd67a26b2ce01bafa4fc008d4bf40bba424834d86ce9c6dd9da82be245614d0c95a268356fb8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889711, "uuid": "ef1c7ec6-3c73-447f-ad83-2665bab62973", "value": "T1A994091FBF98202ED567E2F09C17BA95B9157E628AC09D0B26917F0A3071193B4F934F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889711, "uuid": "c2d8347f-6c65-4e4d-9318-0d880fe4b65f", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889711, "uuid": "397d0091-fc56-4cfc-afa8-0bad34cb1278", "value": "3072:QvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6ux6tqtvB1TgRo:QvEN2U+T6i5LirrllHy4HUcMQY6NqHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889711, "uuid": "8d151911-e2e7-47e9-ab94-3e1eee4e15e0", "value": 423694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889711, "uuid": "7022525b-3ca5-4094-b686-471d30a370a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889711, "uuid": "b3d3084c-7dd7-4cd9-94ef-18deae1037db", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d24273-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889712, "uuid": "599d336a-0ae7-40a3-966b-2d501172d175", "comment": "Malware payload (Simda)", "value": "99236a675caaad1ba74c2e02e9cd889c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889712, "uuid": "fc6281ce-4d9b-4e08-b03f-6c688bec2020", "comment": "Malware payload (Simda)", "value": "4cc78f8cc4d98752b46457526c516354dfeef3d3094b4bac48a5a53411ffbf29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889712, "uuid": "c4ac72d5-46f3-435c-aa68-7cb415547c0f", "comment": "Malware payload (Simda)", "value": "5323945dbd8cea1f63ae99bd062f3a3e9c9a8bfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889712, "uuid": "42ada6cd-24ef-4b4f-9f6a-78ab0dd9fe15", "comment": "Malware payload (Simda)", "value": "889f453aa9cdef56fb602524fe653a62e5d763ff7229083d17f49b0b98bcd4e89c6baf537bfd7c8c5ac3420518487ced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889712, "uuid": "6617d8c1-ee04-4269-a575-2b500c5d8e8e", "value": "T1A4841252F38240D5F0695A7484F2BBE1A7ADED640150033F290C46A66CC6BE21EE97FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889712, "uuid": "5c96923c-c5bc-4cab-943d-c57404a8c63d", "value": "5e00ef92140309dbfb33f494ea55f134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889712, "uuid": "1ead7132-07a7-446d-afe1-01fc5ceceb5a", "value": "6144:LPlJAbSZuxf8+3AKH8yvjarYrTAxo7er66UVtqw2LlkL:fySZw3AKH8Gj4ukxo7eGLgJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889712, "uuid": "4e5041c6-e7f2-4728-8414-a21046648a89", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889712, "uuid": "568d1348-4ab5-435e-a500-8795c0175bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889712, "uuid": "ee9ce678-05d1-46bf-8989-88487e39ace6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c7ef3f-c88f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763917723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917723, "uuid": "7eb28b0b-327b-4f83-996c-f07ee06889a4", "comment": "Malware payload (Mirai)", "value": "ba7f0a991574c3f470e5915e09ef9804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917723, "uuid": "dd60b979-91db-48df-bfdc-e86cf422e5e9", "comment": "Malware payload (Mirai)", "value": "4cced9b97754b924fe13183a07afb0fca7ba9ee3773ea1fccc6e00a29002e48f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917723, "uuid": "2b020eee-ed90-46e4-8fc7-9f03662108af", "comment": "Malware payload (Mirai)", "value": "3153e885706f560c707b914fe9679fc963f25940", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917723, "uuid": "4c776112-29ef-4140-a171-d1a2de1af760", "comment": "Malware payload (Mirai)", "value": "a1093fbc6032c1f04402efcb45fc5517e3ff723b95d753f425bd7aaa745cd2647e17f0fa9011af39ea7dd7e5014405f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917723, "uuid": "53ec1bee-fa68-46a3-bdc1-a6c252ab658f", "value": "T14633088AF8029D7CF90FE6BD54160E0DBA2177C152830B2767BBFD936C721A46E12D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917723, "uuid": "81d687fd-64be-4e73-bfbd-b9a4459739c0", "value": "768:RO/PeNfPogiRVqOCb+1Er3wM+TS806MZnzzsPgXOG7J131G+:emYqi1Y3wMqS806MdsPgXv7Je+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763917723, "uuid": "a45e2219-17a9-40f3-bfb5-e0b296e2d5e4", "value": 55036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763917723, "uuid": "66becd5f-43bd-4393-8ae4-894181429c98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917723, "uuid": "749030e2-e3a4-4cd9-9090-786f8397d9af", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d978477c-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889713, "uuid": "18d94688-019c-4a4a-b81b-1f64f181f6ef", "comment": "Malware payload", "value": "0a5b4a93700c69f5e1b8d962c9484348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889713, "uuid": "6377153b-378f-47c6-8941-7db04fcf0f33", "comment": "Malware payload", "value": "4cf1fbe333254ff792211a7e0b93bf20134e4b5151738a7d9b974d945528a5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889713, "uuid": "666c091e-2d64-4767-bb96-d76e8d6d2b96", "comment": "Malware payload", "value": "e763349937460eb933c32563064bd8eb77b5ba71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889713, "uuid": "eb718279-f6a8-4e4b-96aa-8fdbaffd9938", "comment": "Malware payload", "value": "8a66f1cfed08c4da1df98d14d9526ed33fee348fd871534d529775fb327863650dae1e2ddf6dc24c73134a98d40dc154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889713, "uuid": "6d20bcf9-9367-44b7-84ae-d744290ce32a", "value": "T1914533652992AD58FFF6DFB9420C4E091E9023845F5EF8156B48BCA651A24F3FC76330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889713, "uuid": "d62e4c5d-ea8c-44ce-bb10-0fa53c0212a7", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889713, "uuid": "280e3cbf-caba-4df8-b716-0dd0fad604c7", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iWtPWnQKPb:+YhQs7tW2zku73bFgVlRlbN01TY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889713, "uuid": "5535fbe3-4e08-4c2d-ae44-0afd30789a21", "value": 1249615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889713, "uuid": "97fa652d-c49f-4225-981f-36c02a5cf010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889713, "uuid": "b997c51f-0530-4b1f-a8e9-ec973310828c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da362e40-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Backdoor.Shiz)", "timestamp": 1763889714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889714, "uuid": "17c9de37-177c-4d83-b23e-5af3b8021194", "comment": "Malware payload (Backdoor.Shiz)", "value": "183239e384a5c3c31f05e8a2848fc68d", "object_relation": "md5", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889714, "uuid": "a846f3b1-5679-4bcb-9a22-6512f8db6187", "comment": "Malware payload (Backdoor.Shiz)", "value": "4d54b520ac3d0830ecf9dcf4850af8fa4257b2b47c1866cce32cf8d2bce2e869", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889714, "uuid": "7a02aa8c-d865-40a8-87d1-4c9a3ea0fd8e", "comment": "Malware payload (Backdoor.Shiz)", "value": "cdacd47fc8bf01d2f743ba6c6fc431a0e0995ca9", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889714, "uuid": "f0aad3b5-08d3-45d8-b514-5105d1584024", "comment": "Malware payload (Backdoor.Shiz)", "value": "d950626643d784921e226cf2a9effa3afd4be013cb1f8c0e3849108e129619d62c1189935007c3be0f4bfe4de53f3a5f", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889714, "uuid": "fd42a09a-39fd-4154-bbb5-e57077dcf848", "value": "T13C1412B27B84411BC95CFFBB466B77040B2CD12B2E51C2270504547C6EB67E2BEA7B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889714, "uuid": "c51afa51-fd29-4787-ad01-3127287fe7fe", "value": "430af33f4ce9475c62e2d9321d894f4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889714, "uuid": "61a6ff72-dde3-428b-b41b-ad12fe5d3e04", "value": "3072:9O/6nl92ILkt6i2ox7c39b1a0J86W8xXCKNWOHU/ezYMVWtG4SPUkxbgN:9gFtboVBJtNWyPnYG4fUbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889714, "uuid": "7ce180df-d5cc-4609-bf85-22d7aa25d9fd", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889714, "uuid": "0c72153f-7508-4a5a-8403-615d00fdf8e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889714, "uuid": "b7e96119-1617-48e7-9339-56c4568b24c0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae1ba51-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889715, "uuid": "6b6844ab-d166-4129-be1b-52c7b0ddee82", "comment": "Malware payload", "value": "1a4c61fa15d187eb247a144f15ca8437", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889715, "uuid": "ff156f7e-027a-4627-8c27-e69493270e34", "comment": "Malware payload", "value": "4e8e80600b769a319ef6f7cb3cb0e15583d4fe50b5a33b1b5c9f30b225f6de38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889715, "uuid": "7efdc265-cd4f-4a2b-b87d-859004bcb54f", "comment": "Malware payload", "value": "92704ab157b351637591603c172cf66674d1e414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889715, "uuid": "b048540b-d3b9-4248-bf04-7ee5cd6f5b37", "comment": "Malware payload", "value": "0da26e98796d374e0d1bed06c6bec32db32cb0ee3e89a9afe5e3ba84d1c69d10ecb3c9af4ebdab46daa4e261612d086f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889715, "uuid": "6225ac43-e8f9-4c73-a053-82496616fcd0", "value": "T14B75331637D288E6DE05163101926DB58EFBD33C29786426F3F86507ACF2851EE6A7C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889715, "uuid": "c8e5f77c-17a1-4a77-954a-e7d637b13e6d", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889715, "uuid": "a3817e48-b01e-48d0-a18f-5afb014d7b0c", "value": "24576:v6Zv2ivhBVnFys7xP86LXtqWJ/ej0umQf8/+1gFDsHLAgDmfluSTspfP6MAtD2tQ:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxTsps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889715, "uuid": "3932b793-b948-4f04-bb66-8109d8229505", "value": 1555570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889715, "uuid": "323461a9-f28e-4090-8178-4b83dd399714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889715, "uuid": "0370c239-760d-4be0-b411-8b66c4116994", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb63d5c-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889717, "uuid": "dda775fc-c907-4090-b2ef-924a9163ac9b", "comment": "Malware payload", "value": "d06163fefaafae1cc8bc52a5a3360dc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889717, "uuid": "636dace1-8b56-4789-9604-0c38d9948e10", "comment": "Malware payload", "value": "4eb578b84ae390cf83562165b14b7d2b8f9275e6434cf70c307f37c5f82f530f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889717, "uuid": "8d3f8baf-6fd5-4243-a3ce-1b3c15c131a4", "comment": "Malware payload", "value": "d8fe87b526df6654d6d23e51687987be4046aadd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889717, "uuid": "88d954bd-b1cc-4e8c-858e-116ba55e50b6", "comment": "Malware payload", "value": "45d4c287ed93aade77b4b6d18c009dfda14049591c477f37fbd59d6c5ee451066984eb8cf83b60c5dd1fc8492033e528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889717, "uuid": "95aff75d-cfa9-4fba-9bf4-0d518204b667", "value": "T1652602623958ACE8E9560738CC5A9B3E995AFEC0142195F092EA7B3FDFBC343441D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889717, "uuid": "76ac1ed9-dda2-46c1-9e1f-1e5f3c2e81d6", "value": "68c8b6c1c34258010d37b2cef4172345", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889717, "uuid": "134f1d88-59ad-4bda-b1ce-b96e64f69a30", "value": "6144:rew4u+mDea57gv3V0hi90WSyuE17xstY9t1zq1swHbcMAH:qa9De00+hO0WSyh17xst4t1zksAbWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889717, "uuid": "4c7e51a0-ff27-480a-b87b-cfaaa294306c", "value": 4766071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889717, "uuid": "73ff0a10-3caa-434d-89a0-a8685bb2ea6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889717, "uuid": "7ec77975-f2a7-4dba-aa45-c76b39066d2f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116bd43b-c88f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763917724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917724, "uuid": "60b69f71-7d02-41b6-8284-b297e605ddbc", "comment": "Malware payload (Mirai)", "value": "0ea4dc7ddf6e771d533254a0234da49a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917724, "uuid": "c0a74276-8d6e-4c17-9029-6ffbd155816a", "comment": "Malware payload (Mirai)", "value": "4ecaa18a5b022c8a5117c58255403f0895c4dc50420fad611813b42e089349f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917724, "uuid": "090d6252-4c67-444e-af2e-05051e566e0d", "comment": "Malware payload (Mirai)", "value": "68cd2fe35a6dda9963cdabbfdcf745879b0484a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917724, "uuid": "db4855b3-38eb-45d0-8470-44a8e56b4e1d", "comment": "Malware payload (Mirai)", "value": "cbf6d0f32c0ae8bbb6fa2a72b9f9da55b9e8f6339372b313741c096dc925a89ac122bb8cfc3c94b99586a3c3072d9996", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917724, "uuid": "5df7b773-5b81-433c-b931-92e1095e62e2", "value": "T195A2E1197A3388DECEB21836FB28D98E1452F564209FA2D6BB57C34652FE34E3431674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917724, "uuid": "34b58a11-73d8-4703-b055-56db1697f6a7", "value": "384:MDbrJRQ2n3t502fWExc2S5YbXtVLa+PMZDA5YqqUTwNIZtlHEBYHrElfSyo:0/n3t5hfY2SwhxoA5wUtlg+rU1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763917724, "uuid": "ab4c3ae5-d389-4bff-9939-fc905fc159a6", "value": 21572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763917724, "uuid": "60abab13-24e1-4cd8-b8ce-69fdabd9b730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917724, "uuid": "451a0756-2902-488c-a26e-bdaabd7abf16", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc73dc61-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889718, "uuid": "e0770a8e-b45c-49ce-84bc-9081d641f4c3", "comment": "Malware payload", "value": "cbac526d39bb18b89483781366e0499f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889718, "uuid": "bdae980b-1345-4b2f-9e93-111996f92dc4", "comment": "Malware payload", "value": "4f384522e01e84f5c9735aa933576f6f5c4e6c1ece8d1b26174011cbae03f9b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889718, "uuid": "f095d735-5884-4cd9-a07d-c3c5b59b8332", "comment": "Malware payload", "value": "32fbbb68df7fa67e5f519a44bedc22ad15e1f357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889718, "uuid": "347c0817-fe22-40b5-abb0-e2a347dd9cea", "comment": "Malware payload", "value": "248187206471a5ee13f3f60b28f4e9a61c760a3a13e7923fe7620ba4e89ebf27194e336efea322cd1356ab1a4cbf92c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889718, "uuid": "d7a0bcf6-adb7-4c31-a793-c164d76fd23e", "value": "T17645232676E48AF1C5090B30016B2B665F73EA7816355A1EF7F81D0B2D70DC0F9A47AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889718, "uuid": "b5f06f25-1d91-4bec-a359-e439633591de", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889718, "uuid": "c3a84282-15bf-4b05-810f-48de24a357e5", "value": "24576:v6Zv2ivhBVnFys7xP86LkRCwPYfuukvDtiflQBU3jYYrjVrlImW:vE2ivhQs7dLkRumsUU3zj4mW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889718, "uuid": "628772ad-0260-4868-894f-75f44f28ce07", "value": 1231812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889718, "uuid": "d0488b1e-7b48-454e-a162-df967aee61c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889718, "uuid": "62432fd5-a434-4327-baf8-540fde75ed2b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd35217e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889719, "uuid": "2eb845b1-38dd-43c9-9cdf-19b68688b66a", "comment": "Malware payload", "value": "9418be747dbaadc0563064f5faebf6fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889719, "uuid": "8c8ed00d-ceff-44bd-8353-5bb0e733d08a", "comment": "Malware payload", "value": "4f3f72c3daf07539e264a693d3e1960fe68587c6358f3ffd3494f581fcacd2a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889719, "uuid": "17bf795a-9e2b-4680-bc51-34a9988ce078", "comment": "Malware payload", "value": "b41d304ca35321702e6c3e629be72736d5590a56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889719, "uuid": "fc274edc-f110-4db0-875e-daf698f24e18", "comment": "Malware payload", "value": "cf6566840ef81b58968a0670d1629a3140e8e4cb6a8425a6b85adc1247695982d27e8a78ce60cd91ed33f0ad1e571228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889719, "uuid": "b4bd07ce-1a78-4817-ae62-52c30ab7e844", "value": "T158644E5163E90664F1F77F30D97906226E377C859E3CC24E025095AE1EB2BA4EC78B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889719, "uuid": "8e7d9329-8f17-497e-bd2f-12d756795316", "value": "e14388498639688dc750895bc5ef963a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889719, "uuid": "d01eb71c-1932-4477-914b-b47e051130d0", "value": "3072:yjbF3Otaxatj0Q5QCD6DZTRBW4FQ9NAabGErvXmlQJJxoUDbgyu5Ohcl/OivN/TD:yUjl5QCuDlXW4+DiErv2yKU9pcl/fNB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889719, "uuid": "75f5eae7-c1bf-4f42-b1bd-2e1a40bc0af5", "value": 315834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889719, "uuid": "e4e2fc18-ba56-42e8-8c5e-deebf8efc0ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889719, "uuid": "82a4a4dd-6ff7-43a6-b069-48ee84807076", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de15f2dc-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889721, "uuid": "5ad1e638-d511-40a7-9ab2-2e533d8aa416", "comment": "Malware payload", "value": "3c5ee5ac101b6a0c5d732ffcb2fb4e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889721, "uuid": "7fdd2572-3387-4414-bff4-9f132414baaa", "comment": "Malware payload", "value": "4f944aaafacbea5f25be3f9002ac18d549d2dc546b9e2535a4f4202ce78f0746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889721, "uuid": "17820ac2-8d05-4261-a4d1-3f657878c84d", "comment": "Malware payload", "value": "33cc068b159340058b31004d362d8cda3b401b10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889721, "uuid": "3d45542d-8455-4495-aaf1-f0b1d7807545", "comment": "Malware payload", "value": "19d506a3907c30f3e757756f6a41592dd8fe99f505fb3b95af112f5c89a6f203559d8eae4eea70033e4946ca8f9fc491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889721, "uuid": "b8ebd2e5-a385-4a41-b1a3-90bc1aaaebfe", "value": "T12535334E06C22B15CFADE7B75AC61891265337EC4794A839371CA08B03E3A5C5EF85BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889721, "uuid": "d1a72904-e82a-4d4a-87b1-aa1e1e6467ce", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889721, "uuid": "a1261c9b-1c30-4fad-ac87-aa901b1e1ba0", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mWY:+YhQs7tWVToP0Hs0/htDH3pGaF5+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889721, "uuid": "6420f5a7-d462-4736-bdd9-53cc1ca808c1", "value": 1086487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889721, "uuid": "a14996c2-3a40-4e6b-a4e2-b27219569630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889721, "uuid": "5c983c04-2543-4e27-ad25-87ce4d01e67b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debce910-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889722, "uuid": "49f869e5-12e0-444c-b9b4-aca98cbe83e2", "comment": "Malware payload", "value": "a75bb3c20f2109a3412cef9d814f72c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889722, "uuid": "07ddc955-bb66-4339-b40a-78b5d249c84b", "comment": "Malware payload", "value": "4fa5708edb31dc6b71b1429ae295228f48f59fbed1f38039ff99816cd10d0698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889722, "uuid": "0d0cbf12-46ee-4c12-8c6f-d437c35232fa", "comment": "Malware payload", "value": "e3468b837c10a634897092fac2a4529bbbef8823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889722, "uuid": "b88d162f-cb7c-4360-a2cb-b667e85b4875", "comment": "Malware payload", "value": "89c37a6b4872143e5080a7fe3bf4a4fbece6bb21522d978b4a92a9295e1937ea90b8d9ce6fcbd6e6f748059d57bd83d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889722, "uuid": "08cbdcc1-9409-4818-8ebe-cf6cc3441e40", "value": "T156C32803BD24457BD5A48DF098B6EA6DBA649E3A0BF59E4333C4AB952C7810375F120F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889722, "uuid": "d4b86dba-d2b4-4707-8ffd-3d515a40c9c4", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889722, "uuid": "6fb37259-333b-4cdc-be77-babccb459139", "value": "1536:niyzlrXCu2lsuAoeQZZ86ukpj0nGGF9v+4Dvg:iyZCu2lhA1QZZ4kp4F9Xzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889722, "uuid": "42790e89-2e0c-49c6-b0e1-559d6afa14a2", "value": 125567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889722, "uuid": "61e00edd-c53e-4f9c-bcb8-462bf96e08bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889722, "uuid": "a4f82ecf-3b62-42af-a2d4-d81d1c42c1ac", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df64799e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889723, "uuid": "abba0219-95ab-4c9e-a475-467e629f2b12", "comment": "Malware payload (Simda)", "value": "4f443c0df0748cbbcfc9cde135aaeeeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889723, "uuid": "c19aa27f-8e18-4cc3-ae50-47af01c06c52", "comment": "Malware payload (Simda)", "value": "4fb0bfcb588b30b864da6473b915cc41c525268dd1486ef841dbb3cee98d6df8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889723, "uuid": "7cb8435d-7b50-41a0-a0d5-4412727502d6", "comment": "Malware payload (Simda)", "value": "c76589160d95cf3e59c6c1f36acb36cbeb11ba5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889723, "uuid": "ddc80fca-6790-4f79-848a-bd09cf5c8029", "comment": "Malware payload (Simda)", "value": "e7d6bdc08b1151a0852e8d4e998b69c4f36eca620e206792c310419bc42717a9bb920ef634c6965c348a05fc6f557c6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889723, "uuid": "6559c17b-fdc9-4252-8c65-dcc6426686cc", "value": "T1DAC4120BE6E04AF5FA624CBB17CBFB6291F9D50A1391D5FBC8C010A9D8C44E1B679178", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889723, "uuid": "b454fa54-c146-4f66-b5f3-d097cb0a188d", "value": "e12f72e7fe59535708698b4de0340a02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889723, "uuid": "d9052157-4c54-40cf-a8db-e17a5bf5a863", "value": "3072:jdGaTPrrIGvvyy8dHSi+OcGMrOpOVKdOyMbkrWRdg+E2uEPczTinJhV+p9GEVFU/:BGazIc6TVBMrOpzeJEsuirSGEMpgEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889723, "uuid": "117fed80-94bc-4e97-888e-f20ca950c364", "value": 578744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889723, "uuid": "daa7f0bf-1bf5-4fb6-9099-21d5bd00afe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889723, "uuid": "99f17b17-3137-4d44-b88b-a0b2942a4ba9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e012bdec-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889724, "uuid": "76f17961-7363-4e4d-b85d-cdc3a839bb47", "comment": "Malware payload (Simda)", "value": "c64f388ae7f748007e241cef61689840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889724, "uuid": "1184bee6-f84f-42a1-a498-c229b4e8b5f2", "comment": "Malware payload (Simda)", "value": "4fd57c988fd17b5a088d2eb105fa3ec0df45e718287b470edff69c2666fd278c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889724, "uuid": "4d5f4030-e4ba-47da-9c96-3f1a1ecb7012", "comment": "Malware payload (Simda)", "value": "23f27d57676eb69119973110379f848fcfaeb0e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889724, "uuid": "fdfb92bb-33cc-42c4-ba62-e26f11d1a5d9", "comment": "Malware payload (Simda)", "value": "375db8353f83928215ebea14081c03d6e0c831ca85d2951c97742520648d23abf7467d20e7e5d8a08b757a10a7eecb6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889724, "uuid": "8818d31d-323c-4948-8051-6227aef15bb0", "value": "T12034120FBB010F93D9B75E7BD8F2DF156A366087AF66C36F9B3010400E82682795B995", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889724, "uuid": "2d40b1a2-ae66-41b3-94b7-ff8eb7cdfc6c", "value": "70527f2eb8f7c61d13b2009a3286b536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889724, "uuid": "d05a9603-65fb-4c12-a58c-bce27411b297", "value": "6144:F7HI/0S6GcV6yabg0OLe//fRD/uzc+8fJpgY08gA:pH6b6GcV6wq/fJ/rDfJpgYEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889724, "uuid": "f0bef481-f56c-4399-9f78-b942efe1c117", "value": 250906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889724, "uuid": "27bb07fd-309a-4bda-af34-b209e7cedbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889724, "uuid": "ccc3b77b-756d-40a8-aba9-3e769506fa51", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f1e799-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763889726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889726, "uuid": "363342f1-9dd0-4d22-b6f1-f82ff08b07ae", "comment": "Malware payload (CoinMiner)", "value": "5eb08847148b221bf5f4d56e93b6cb26", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889726, "uuid": "e943daa4-902b-4dbe-9793-4218af30ee80", "comment": "Malware payload (CoinMiner)", "value": "501d66b202d2f77e0eb74deb7f67db9335695b81e7836d946976fe2402a9e171", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889726, "uuid": "efdcac56-8684-478e-9379-6e93638912b7", "comment": "Malware payload (CoinMiner)", "value": "d9a8ac5f04a7ad48c57b44e57f2f26894d343829", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889726, "uuid": "85223c53-b5a0-4be8-ae5d-4d84f36ef88f", "comment": "Malware payload (CoinMiner)", "value": "5f2c09b049cd626ecbddee5a16b3145fc79aacb8ff739b76e924578479e1119194684d37babe19a68b4251a56d4973cf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889726, "uuid": "b350baac-2d2f-41d9-a371-58e54a7a18fd", "value": "T169569D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889726, "uuid": "2a46aef5-3bd9-4155-b17c-361148bc18ad", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889726, "uuid": "4ea52176-72af-444a-ba60-c8b3e37ad22f", "value": "98304:IvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ6506:I/II/6aYXdFD22VatktKpEEd1Qi0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889726, "uuid": "6276cd44-eb17-43c0-8b33-83741101f4bd", "value": 6437934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889726, "uuid": "e06c40ba-a5e4-4613-b76f-2f3a4d77d898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889726, "uuid": "8bee6990-02aa-4abb-bf57-f1a011d64e8d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1968ae2-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889727, "uuid": "4dccc39f-ccad-4f07-bb25-97fdc1af0169", "comment": "Malware payload (Worm.Mofksys)", "value": "392ed21cd336955dcd43b7f2a16ba6c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889727, "uuid": "207008e4-d3d8-479d-b499-83d6a3a4166b", "comment": "Malware payload (Worm.Mofksys)", "value": "50391f90e83462c736603b6bb5ae26fa5f328c40f2e3b05e696cb7129edf6e34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889727, "uuid": "6816eb34-c1f1-41af-90aa-9d71a07c1afb", "comment": "Malware payload (Worm.Mofksys)", "value": "9c73c63ef1ccfc41431368cd5c5a23d0a80d4ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889727, "uuid": "84b58057-d2e7-4b11-9714-fec9150eb7b1", "comment": "Malware payload (Worm.Mofksys)", "value": "09551c55ac8db0bb5781ef62b2f5b327a26c0a33c280d3af64a51ed8eef07485b8d8a4591d272544678d3f879cd647b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889727, "uuid": "dc79a21a-4b5f-492e-8f6a-131c401df239", "value": "T14D24F82BEE44702ED9A3D5F05927B1A67A222E320B91EC0B66D1AF457871117F0F931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889727, "uuid": "270727c1-add8-4c6a-a60d-d4b31af2ffa6", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889727, "uuid": "15a11771-c329-482f-88a6-59686ece2658", "value": "3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unYlCCCCCCCCCCCCCCCCCCCC4:+vEN2U+T6i5LirrllHy4HUcMQY6rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889727, "uuid": "4a535193-15a2-4815-9a38-a7ee69cbe389", "value": 211884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889727, "uuid": "46ecbea9-4e84-49c2-971f-5a8d29f06ebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889727, "uuid": "07de71cb-bdfe-4619-b7dd-a11164973267", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e236f8d2-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889728, "uuid": "9c1d2b68-f7eb-462d-a709-1a76df5d4282", "comment": "Malware payload (Simda)", "value": "5c973b513727eff17b422c14c3b04da7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889728, "uuid": "a57fef97-20a2-463c-b33d-7123442c0965", "comment": "Malware payload (Simda)", "value": "504405dff18ea53ebbd7b88c2aea0984e792ba1960cab97f3b44a291195025b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889728, "uuid": "fe333d45-4bc2-40b1-ab30-bb40c9d74c9f", "comment": "Malware payload (Simda)", "value": "78d6e724491efc99d42d38efc5b5eab1059241a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889728, "uuid": "ecefa1aa-837c-41a8-bf94-e310be9dd2b4", "comment": "Malware payload (Simda)", "value": "459c50d8676762b70a2c1fb436d6253f5a8ead42494d2a316d28caec78de29ff13349a56039a50133eb31eb3338df13a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889728, "uuid": "5fba6136-1767-448c-9df1-50c5e329c54a", "value": "T1C8748D21F1C1C039E4F5157196FF395B246C69B64B2838E7E7986EC928740F27A3C28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889728, "uuid": "ac19ef4e-3a73-4e4b-99d9-3b1294f9e902", "value": "173abfa8f7d7adac2a90a2e42625b7d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889728, "uuid": "522b0a3a-8346-4b6a-88cd-d5242e6c410f", "value": "6144:c3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TS:XmWhND9yJz+b1FcMLmp2ATTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889728, "uuid": "d4b1389d-e098-4290-975e-5003c12c8148", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889728, "uuid": "d2a423cf-e907-4bad-ac38-34cfe54d8735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889728, "uuid": "38e967fa-30d7-4eb8-b264-ad988f1c2380", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dd8b79-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889729, "uuid": "031071a8-7550-46b0-8783-9b530cddcd5d", "comment": "Malware payload", "value": "ad94e1b5a3c67464a782b8db20149d30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889729, "uuid": "a251c938-d173-481c-97be-14010bd6da56", "comment": "Malware payload", "value": "506c0e4851220a126eb1ede838f974ef4f70b7c4b4cd177e55ff25d8a1108b3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889729, "uuid": "57b074a9-6f06-45fe-8c2b-658fcd619150", "comment": "Malware payload", "value": "8cc3ecabdd511d20bdfbf47436a4ea0477730174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889729, "uuid": "a9e2870c-23b7-492a-b627-190a8032aff0", "comment": "Malware payload", "value": "3b9e21ad834583b6fd0c75f0612037150b683f673f0decdafd995b74b46195cba4655e27ae332228505c0da4dc5e1c48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889729, "uuid": "148e16cf-5d39-4c95-86ca-4e495656cab3", "value": "T179653323B4D090F9CC4929370199E7718BB26AF626F69275AFE80C7A1C714A17F1BF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889729, "uuid": "8d94154a-85cc-48e0-b7d9-74df4b43ad4c", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889729, "uuid": "4e432921-1e49-4a18-8798-2d9900453481", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lAN2kwSk6Ye17l9u:7E2lVL3Ze+/F5ndjFWmrjyx1cmNk7YKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889729, "uuid": "52482c32-1771-40ec-9f7d-3ac873e89a0b", "value": 1430441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889729, "uuid": "a849087d-eb30-4556-8973-c8759118c996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889729, "uuid": "b184bb99-b65b-4bf1-8479-29d0e6fa3cc6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3820612-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889730, "uuid": "7ad7f85c-530f-4e8e-9b00-8ef3c2b19a8e", "comment": "Malware payload (Worm.Mofksys)", "value": "137d67de364e555908a28e5023def984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889730, "uuid": "ef62464b-b6b4-483c-9292-1de67f011875", "comment": "Malware payload (Worm.Mofksys)", "value": "506c4069d7ea94b6df063c86dcb3abab4b1ea682b7284f7d050c6a558d70b7e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889730, "uuid": "0ba91271-17eb-4488-b5dd-7f0cac9322da", "comment": "Malware payload (Worm.Mofksys)", "value": "f6fd1dc06dd8cd91c2cb5cdfe1bf8ad59e5c02fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889730, "uuid": "d4e7daac-3bb3-4923-96e1-dcae743cd635", "comment": "Malware payload (Worm.Mofksys)", "value": "a923b8f5b74bb472d66a6d5d1dba99ff20a3c1e7c28ae207e0e938b3987f1c0d848364b02ea860bacbfa15abed6d2e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889730, "uuid": "d18f90ef-c63f-4513-ba86-29d8effa50c4", "value": "T15B24E91FFA05702EE89386F118667566B7222E250BC0EC4B57D1AF9638B2513B5F930F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889730, "uuid": "163fe73a-1b3e-496b-98c9-04dbd9fa2b9d", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889730, "uuid": "8143e026-21e3-4254-9513-a69d62610090", "value": "3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unh:5vEN2U+T6i5LirrllHy4HUcMQY68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889730, "uuid": "38d2b6f3-ab0e-48d0-86e1-6215715010fe", "value": 211750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889730, "uuid": "b1f04b57-451f-4029-a0da-f075f18aa29f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889730, "uuid": "283c5882-e75f-44ca-8258-7cc7a8a63b65", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41d9d99-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889731, "uuid": "4d6773c4-1fc1-424c-886c-ecc4685aab3e", "comment": "Malware payload (Simda)", "value": "fee391cb7f0ee0b48d572faa938c357b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889731, "uuid": "3e8697af-b8e9-4990-846f-e8c2bada4bd6", "comment": "Malware payload (Simda)", "value": "50a321dcd76fc31a2255f87cc85ee9b16c332164aa91ef3b6527d3ddb689e7d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889731, "uuid": "334bcf0f-99fd-4c4d-bc22-a4fbdbf4d8d8", "comment": "Malware payload (Simda)", "value": "ea2604515fcb915e665df7c9b39d96c06fd27e94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889731, "uuid": "00ff1fc7-3d49-41af-b7d2-1ca695268cde", "comment": "Malware payload (Simda)", "value": "ea0d43b2f5ddaada95d6111097c6f062db59704cc6e5b26979766fd5ac91c6e97981bdf069fbb24db15e41b681fd7eb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889731, "uuid": "2c5524d9-fd38-4788-98ec-c7fdb47ed36a", "value": "T123947D61A0408177F3F8163425FA7B6F25BE6A6403DA19DB27A46ECC29741E2713D1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889731, "uuid": "426cf6a7-0a5a-41fb-a8aa-b37185ac5b3a", "value": "a29736d96c1bb5330d99576cd94e80e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889731, "uuid": "e8934982-4c06-4812-ad4c-38f0b2a08427", "value": "6144:YExz45jS77yQi8Dq+9fXphN2LfjEcYzaWqr57Q7Xwxc4SQjWvvf:SjS7XDq+pcYWWqtfxvSQj2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889731, "uuid": "6c821bd7-2594-4692-b736-105d33bcd7af", "value": 421540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889731, "uuid": "fc1d2e61-7a99-4e92-89fe-c9a955b1ff6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889731, "uuid": "14350e3e-19a5-457a-b04c-6e1f2f96e2fa", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df64e87b-c88e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763917640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917640, "uuid": "560cec11-ab06-43ef-b2f4-b848dcaf1953", "comment": "Malware payload (Mirai)", "value": "e18de255f5217520211262c91b58e4e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917640, "uuid": "0e24da8a-df2c-4df8-a568-e1240f277b90", "comment": "Malware payload (Mirai)", "value": "50c1721fa0449b5203b06d3935a56cf38e116694a3a46c3c669024f35b2d1e2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917640, "uuid": "27ebcbd4-d8b8-4d2f-832a-876b38417090", "comment": "Malware payload (Mirai)", "value": "f381ced3e1c515fc56a26c40885ac8e0fa3f4052", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917640, "uuid": "de6ab5d6-ba0f-4a98-9740-5abf60a375a8", "comment": "Malware payload (Mirai)", "value": "784dc25cad69f6afccf0151a69ac4c77ef927b39bb04f15c9b7c88843b44fcfdb6b88fb015c8ce2b97a756ed021826df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917640, "uuid": "65705bf9-17fd-41c6-9c9e-ab5759aedd31", "value": "T193334B42322C0F17C0A35A74252F5BE487FFFAD122E4F685251F87668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917640, "uuid": "c60ff8d4-2a82-4cd6-87bb-6423fbd2b3c9", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GcPS4BBs96Bk9DgIni8Twp:ivW3jdQGqt7Y+Z+3W9cmgIibp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763917640, "uuid": "60c58323-4e46-44c4-966e-ebd7cdf83f65", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763917640, "uuid": "d9dfa64f-4bc9-4d59-97f2-8079cffe9fe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917640, "uuid": "3fa353f5-27fa-4278-aeff-def81281779d", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c5f113-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889732, "uuid": "eb900fd8-a825-43ad-9fdf-273b49aee68d", "comment": "Malware payload (Simda)", "value": "37a9f964a51b2b38f6b28c683de8afd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889732, "uuid": "31a29f2e-694b-4ec7-841e-8d7f9a7353cb", "comment": "Malware payload (Simda)", "value": "50e4b88fcff7521c5d5caaca95b9437f61615e74290eb03aea7f0ace5a4d131a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889732, "uuid": "7fe225a1-42cc-4c80-9a01-5c124a812f45", "comment": "Malware payload (Simda)", "value": "bf3cba3e150ad56e7e7c398f8f21862ec1b5bd66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889732, "uuid": "c83223ff-cf3b-472f-ba88-57c7a533f4d1", "comment": "Malware payload (Simda)", "value": "d9dc20081dbe30c5824c540c76bfaeb8c1eedcca2cf6661e339b85c2bf6b6d970d7aa3013f3e2dc98f4079bfe058a6d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889732, "uuid": "a972d1c5-3bde-4e68-9149-fa1bd60963f1", "value": "T1DD24022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889732, "uuid": "b30f391f-720f-4bd3-afc3-6edb05e2f58b", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889732, "uuid": "8ffae7f0-439b-42b0-9ce1-e045f0f01bb4", "value": "6144:uZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq56:squCuygMQjd5vJIBP1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889732, "uuid": "2ea77b63-9770-4c72-9565-a0384f2ea892", "value": 213010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889732, "uuid": "f27376d7-58bc-4f27-998b-44f904cec1c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889732, "uuid": "7d0a2b3c-33e1-4358-99e7-dc76def43b29", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b188af-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889734, "uuid": "48e5f531-b8f0-46a3-80c9-bc0d0f98163e", "comment": "Malware payload", "value": "7d2120f55b14a5b118283c73725a62e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889734, "uuid": "57d20bde-c47d-4b44-a44b-d2bcd6e188d2", "comment": "Malware payload", "value": "50e4fd2d3dba93f9c5c064d6e3018e7c3e4f1de40486fcffe18f8521a79187b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889734, "uuid": "c924ef85-a791-4f19-a3fb-e2049cb89794", "comment": "Malware payload", "value": "7d61e7f21cc4ef5039f5c6697e41e85fb41fd915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889734, "uuid": "ee0fe229-b9fc-472b-aa5d-e1679df836c8", "comment": "Malware payload", "value": "96ce1f198a03d92c8b189e4ae5d7082c64fe744057afd39f41656fbff1fb3a86d98e7fb84130271f3af93d60a7aa32a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889734, "uuid": "36f4f4f4-7889-4746-aef6-182a57be51fe", "value": "T17125334E07C22A59DFEDA3758B461891216337EC47A4B839771CE08A03F365D9DF81AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889734, "uuid": "11ca2650-0636-478c-a0a9-87c90b8a5c95", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889734, "uuid": "5399abd1-d43b-4fdf-b164-fdc1b9002883", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFyjt8:+YhQs7tWVToP0Hs0/htDH3pGaFyZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889734, "uuid": "db655fe2-5c24-4c07-8cba-77af344010bf", "value": 1045579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889734, "uuid": "fb247e2e-8247-4075-b29f-0e6879d5afc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889734, "uuid": "cb200e85-3950-4835-8405-d22f005e4496", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e650dcb8-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889735, "uuid": "0fd815f6-062e-461b-8080-cc3f9ba15c8c", "comment": "Malware payload", "value": "e6339cb1617228edeb075d47acaa663b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889735, "uuid": "58d986b2-8e80-4895-bd0a-93dcd4156ce2", "comment": "Malware payload", "value": "50fdbed7c56195cdbfc8dc9777dd1c633cbda60d5d734a4575c5d4ceccb0ff4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889735, "uuid": "38b4d97d-afbd-4939-9a42-aa5a8505310b", "comment": "Malware payload", "value": "fb0e7012118347103a70bbe47a43996659250b51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889735, "uuid": "2badbac1-dd31-44f1-897c-bba48fe26fa2", "comment": "Malware payload", "value": "9879660e85ae9c39c4c7099108ad232a318f68a28603dd631ea087b37d3426828f6832f0ec298aa17908c7ee75e0c794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889735, "uuid": "44351405-3488-448f-a3c6-a0fb6b0ce90d", "value": "T11335334D16C22B59DFFEB3B64E872891297337DC57A0E839770DD08A42F351869B806E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889735, "uuid": "d12f99c9-5201-4e22-aa4f-b69f8034153f", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889735, "uuid": "d00b0bcb-066b-40a8-94de-b9ac4728df54", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFD25:+YhQs7tWVToP0Hs0/htDH3pGaFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889735, "uuid": "7f090337-ee0e-4d5f-91ce-dab2e294ad60", "value": 1101701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889735, "uuid": "b722e7ca-0ae7-4072-b786-9217db6f6ef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889735, "uuid": "4cb9c890-e5be-4a1d-8499-4ef252f78abf", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f101fb95-c8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763925830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763925830, "uuid": "e518ebb4-8764-4dd9-a5dd-f9883b706135", "comment": "Malware payload (Mirai)", "value": "e8b209355b8265c35e342c8ef79b9a43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763925830, "uuid": "cec98771-ef49-43e1-8651-69b8409bbf1a", "comment": "Malware payload (Mirai)", "value": "5153a76178d0bf875035eeb84c2963f9a5e981ec993cb6a0ce4f4ad45ec5b728", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763925830, "uuid": "55fb3d6d-144e-4633-8363-88dc80947013", "comment": "Malware payload (Mirai)", "value": "2681625c79ecbb85415691549687fe30814726e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763925830, "uuid": "a515aaa7-0afe-49ef-8228-e7d806599d99", "comment": "Malware payload (Mirai)", "value": "df944b86e75522f98a87bb2a2e2163db2a1bf63bf984eb1f4f51b08244de3dc4d140fcd2f56e53b5e59d35588bdf2a82", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763925830, "uuid": "2b7b10c7-3e0c-4ab0-903b-90e39097ec14", "value": "T16C5121CA336794B0EF629556B7F60808B1E052F3E9C69A87D9FC74B8418CE1C74B8653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763925830, "uuid": "77a50d83-f358-434e-affb-8a690625bf99", "value": "24:ItlaAsaQansafkhanejej4a2TJkaOaraQa0qaiaSaqaPaCRE:ig+1ZMk56/G1UHXPih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763925830, "uuid": "48dfec42-9f39-49a0-9cab-f83ce6a7e0b5", "value": 2798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763925830, "uuid": "829931e8-1922-4f14-9495-c2f3fe9bcc68", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763925830, "uuid": "17d61970-b9a9-45ce-8b47-1d5c0fbcbad2", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c493bf6-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889476, "uuid": "4462282b-7459-4b4b-9fd7-bf7b7c137908", "comment": "Malware payload", "value": "f837f0c2fc534afc39274ea6568f3049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889476, "uuid": "edac8422-33d3-4d3e-860d-8a875d583120", "comment": "Malware payload", "value": "516ff81b00f33d3dbf9f2329d0875a3ac6b07bc1181fc29192796b1490986cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889476, "uuid": "991aed71-c782-40d9-9d0e-96af312ba221", "comment": "Malware payload", "value": "abb060695dfb05b0b2459cdb58bed05fd27f91ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889476, "uuid": "78b39b9c-be3f-484c-be59-12390f4737eb", "comment": "Malware payload", "value": "7d741f7589e21d4f1cf63e8b84825eb7798ee75974a52ff1c0b24fef0d0deddd9406449b78dff7500d064a7fcfe8bc8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889476, "uuid": "ac61274b-ece6-4c2a-9648-6c683934d88e", "value": "T16335230B33C15572CE8A533107472AB11E73A7BD0770E83AB7E8A44719F29447FB969A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889476, "uuid": "67abed6d-127b-40a9-9bab-d6c044ae3a8c", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889476, "uuid": "f1fb45db-8c03-42da-8895-b4318525dbd4", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFyjtF:qE27hQs7tWVToP0Hs0/htDH3pGaFyZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889476, "uuid": "86615880-cc48-4a0d-a8c0-fc6bbb880482", "value": 1090473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889476, "uuid": "c437d4c1-6f09-495e-a94d-8dfbda83d8b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889476, "uuid": "f0a1b4c9-b8c9-4f87-8e0a-38cd03fcae87", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f0eff3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889736, "uuid": "4fff623b-ae27-41ae-aa7d-f8f190fb5643", "comment": "Malware payload (Simda)", "value": "64ed2b7960cff529ac02197159ab5116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889736, "uuid": "501b3ebe-4091-4e25-a3a7-94b93adec994", "comment": "Malware payload (Simda)", "value": "51790d25e561174ef71cd6f3ddee6bc272eef61cba7572c4a67a1c69aeff51f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889736, "uuid": "bfd7ad76-8fb5-4ba0-aa13-7df56683dac2", "comment": "Malware payload (Simda)", "value": "23998fdb5c0af2e3f34a23dad0acd95f4fc734a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889736, "uuid": "468e9cd4-c959-4d40-8c98-5aa55233f751", "comment": "Malware payload (Simda)", "value": "6da7d25ea9294847c32da38ffcdef6ce8ad08eaa2302587dafec82ffbef6a1fbc492e2b35b8c99850aa1da8873185dd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889736, "uuid": "f34ea39c-2818-4153-b47c-7cdf0ab4440e", "value": "T1EE24022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889736, "uuid": "6bfbb103-2b87-49a8-a8a5-50d77c151a8c", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889736, "uuid": "b241a85e-3178-4862-9378-808df6ebe862", "value": "6144:tZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:/quCuygMQjd5vJIBP1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889736, "uuid": "86092376-f257-4cc0-8edd-1b17d509cb70", "value": 213054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889736, "uuid": "db68b2a3-696d-47ba-aa00-ad795531bec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889736, "uuid": "87b49975-30a0-4966-9bd9-8c6c9f7119ba", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e794a508-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889737, "uuid": "663b6b4c-59a4-4726-a839-8e5bfd977076", "comment": "Malware payload", "value": "5cfefe5d767ea3c50d71761661e25389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889737, "uuid": "7e88a217-0505-4b05-86c1-1269da45c7ed", "comment": "Malware payload", "value": "52293f4d231707e3454fd1ed84f67b51be6db0c1346e2e5c8d709233a285e1a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889737, "uuid": "dba42f1a-2736-4c05-af9a-46a50f87514c", "comment": "Malware payload", "value": "270ac71986d7e44e533cfc4f42123d449d4cbdc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889737, "uuid": "dd95c13a-6336-4ccc-88dc-6d1fe10b6c0b", "comment": "Malware payload", "value": "858bcd8596d839059987d65a2fe4a60300df51e95c2b285da66fd294fbba6b785d96e9ab4f875cc9f12ece86b98dbf48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889737, "uuid": "aea04172-9ce8-46c7-b0a4-c73dbd9d7018", "value": "T14435233A32908CF0D8951A310B8637B54FB3F336361548666FD41B272E7229DEF6971A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889737, "uuid": "22871032-ae48-46be-992e-a282ae7025a3", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889737, "uuid": "46e3b3c8-d211-4008-909c-4a99e0965c98", "value": "24576:v6Zv2WqhsVn57hqQeKUP581L9k+4EBtXMRSkqJZB:vE2WqhGtbUPuVt4EBFCSkqJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889737, "uuid": "9eec3022-e4e9-4956-acf1-b231c11dca75", "value": 1144953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889737, "uuid": "a3c01868-0b6f-495e-af79-6840bea61238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889737, "uuid": "c92b60c3-de5c-45ab-9b86-c30047e72f5d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84244aa-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889738, "uuid": "0f5e60d6-9f5e-4812-b6c7-cd1ef6e9348c", "comment": "Malware payload (Simda)", "value": "866236c315ee844db048b1585d7f664a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889738, "uuid": "f47759b3-7b55-47d7-a104-d10e770098a6", "comment": "Malware payload (Simda)", "value": "523311da73951bd6a84b8209e8bddf2dc2054664f179b9447e4673eb37715e79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889738, "uuid": "01af11fe-e4d2-4ca6-8749-5804ba5a5429", "comment": "Malware payload (Simda)", "value": "01cd438d604f207eed22f2cc52f991aa4c3f7a37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889738, "uuid": "5af2a2fd-49f9-4e1e-a53b-80884bd20eca", "comment": "Malware payload (Simda)", "value": "b1a83b62541c6d77c6ebdae7b980ad022a9b94f4b871112c2d66f29f98f5411f66062bacf4e6a160a08376cfe18233e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889738, "uuid": "02e329f9-5edf-4c53-a233-c7887d0f01a5", "value": "T17A2413226D5D4E63C6A714BB1BF6FF552326E5A8432BC7676C00420F0C756C97F3AAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889738, "uuid": "04de7ea0-ae76-4d88-a771-3bdc92c1966e", "value": "088303a3216315a2ba8d66c94c7b80a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889738, "uuid": "12302ed8-f5b0-43a9-963d-4c9622d46952", "value": "6144:GmKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3:o71YpQiU/RcO1VQInVob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889738, "uuid": "28541d1a-4d11-410a-b7a7-152b99022a42", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889738, "uuid": "b7077845-bdc8-4e3c-829d-9f407928ea81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889738, "uuid": "d71f91c0-8650-4141-ab65-2be01bcaa6ab", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b612c59b-c850-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763890942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890942, "uuid": "b741c693-9e43-4866-90fb-de2a57c855c5", "comment": "Malware payload (SalatStealer)", "value": "7bf15fe142bf0265042a8e3a285eec14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890942, "uuid": "4f663970-284f-41ff-b3c2-aa6f611c90a6", "comment": "Malware payload (SalatStealer)", "value": "524024e06a910407486a660881c1245bdb999e7371d76f466ad0ba02dd657803", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890942, "uuid": "5c5f9b9e-b2ef-4505-8ec4-a1ab093c9fe4", "comment": "Malware payload (SalatStealer)", "value": "c919d0b06a1c68b97075809718cff00bb18d3c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890942, "uuid": "cb1833f9-a82b-47f2-be6c-befc2f3c00fa", "comment": "Malware payload (SalatStealer)", "value": "54a70699f556b4bad72294de55395e8ac6e1f0f06975825a37b5ce68a2134775b597e59d1b323ef0e71784f7a97e573f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890942, "uuid": "38a456b1-a421-44d1-b85a-1b019e4dc6e7", "value": "T18EC65B41FA8B54F6EA031832415BB23F63305D049B28CBDBEB547B6EFC77681197A609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890942, "uuid": "adaaa1ee-e19b-47da-9063-2ff4fcd2d0ac", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890942, "uuid": "01b44873-f6ae-494e-8130-54537f21e268", "value": "49152:gG6Dsyf57KbEhu6sTFWb/1ekLsMBwuPeofNiaty34N5p8xiSVlQtw5yXz0pqyZqN:vqsw5Dupx432VYiRfNdv/KFPrkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763890942, "uuid": "a16e891d-a8cf-4cc0-afba-3fb6df037188", "value": 11654144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763890942, "uuid": "d26c2c4d-81ae-4272-9b42-b28e748d991b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890942, "uuid": "b9cebec5-ecf8-4cf1-a97e-4d2f0b122fc1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e909955e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763889739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889739, "uuid": "fd1b8cef-330c-4b19-959f-085f7341ade5", "comment": "Malware payload (CoinMiner)", "value": "692fd7cb0c9d667ee19d6008513f0f21", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889739, "uuid": "442f4b1b-3af9-47f5-9e95-3aacedc15904", "comment": "Malware payload (CoinMiner)", "value": "524c0139aba14fbb22b5cc151c63a9b1c8332fa5d8cb6dc6aed6bb70feee0016", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889739, "uuid": "92e673e6-07dd-431b-91d8-95067714d39b", "comment": "Malware payload (CoinMiner)", "value": "bde3c1d26b62a038ede1b85cead01cddb1363c29", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889739, "uuid": "b48599fd-b896-4ac9-892d-330db1697916", "comment": "Malware payload (CoinMiner)", "value": "5b2de469c80a8ab6dc80418fa8277812a98bdbbd4e054c42b9d030769ae721fc0ae9805543612f0d4a57b1fe6d6fe4a3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889739, "uuid": "828a22a7-4e98-474d-89c3-f41beb077dd7", "value": "T1A1569D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889739, "uuid": "2fc3b408-d2da-40ce-8ed7-0dabfbc68a71", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889739, "uuid": "885258ab-3e75-47ea-836b-3d611efe4faa", "value": "98304:IvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650G:I/II/6aYXdFD22VatktKpEEd1Qi0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889739, "uuid": "e8ae4ec9-7238-4b9a-8502-fc483734c611", "value": 6441911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889739, "uuid": "8352afcf-e98b-455f-a450-eb5307dc07b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889739, "uuid": "2ce7f9d8-0ddd-4a9e-add7-8d54f4db5e2f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c5b151-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1763889740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889740, "uuid": "7aabeeaa-ad63-4965-9e9c-a1c983e388b6", "comment": "Malware payload (LummaStealer)", "value": "2c983e8a01b18dd7b1650e473f5daf11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889740, "uuid": "fa4aa8e5-4194-45a6-9134-685a31c75487", "comment": "Malware payload (LummaStealer)", "value": "525a2f6a266dcf0dd08ef95cbbeb062bb3d04ea07ebd0da0edf17b7be4ba95c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889740, "uuid": "2cc97d94-fd46-4f58-9c3b-c11ea9155ce3", "comment": "Malware payload (LummaStealer)", "value": "8647c770a351f7332e01ef56a6bf150300e33c34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889740, "uuid": "99deacf0-41c1-4fc2-bd02-360bd7b48c1c", "comment": "Malware payload (LummaStealer)", "value": "e0299ab7e8275344edf402031d2742097f7df39b692cb52ba49dfb30ea29cd4ec6816bc8bb50f2f7d5381948040f1c5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889740, "uuid": "8df8e582-ec54-40c7-9743-1a5027b3e266", "value": "T149D4CF0AFA5381A1E809083714EAF77B1630AE174725CEC7EBC0FB98AC77BD16579506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889740, "uuid": "bc1d0caf-1eb2-4fbd-8325-2008257c2477", "value": "77eb68348ee30e01ec09fce3582c5f76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889740, "uuid": "037799d4-b2c6-4140-afa8-8ddd4123ceeb", "value": "12288:vsjCF2QZiOU+4zX7wM45QygROD22O3ZGdZD7AyyymI:vOC39Uv7V4WnROD22cqD7YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889740, "uuid": "649e9f4f-09a4-435a-bd56-3fe9ba76264a", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889740, "uuid": "b695cdf7-d24d-4e7a-9cd1-de7b62129409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889740, "uuid": "2c7527f5-f6c2-4b33-8f0d-85d64934cc1b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f3ec3b-c84b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763888843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888843, "uuid": "f550c7eb-42ea-4ceb-932e-3b812932d934", "comment": "Malware payload", "value": "02b0920a7d7ce3edf87092bdb54336e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888843, "uuid": "416092bc-bf3e-4c79-a8d6-af0836dacc06", "comment": "Malware payload", "value": "528a1907212e1e0bd834d068e15594e855d6b4da38a0e0b599a902c2c29d9dcf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888843, "uuid": "c57003d2-9575-44e5-a681-e5220a37361b", "comment": "Malware payload", "value": "6a61ff3647dcbe1c332c7bc3a879cd47e8e4ccb8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888843, "uuid": "b39bb0d0-46cd-4ab6-bba9-37399e641068", "comment": "Malware payload", "value": "aa3e55b15545a75b29495750135a05b1010e74de9f0216eec0d92b6dd7a3085d213cc671c8f281a85cc09c6eebc80906", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888843, "uuid": "1850fe38-7d65-4665-97a9-63b5a053f672", "value": "T197C18F9E212DA7B13F0A7F29717F44185913419632F60B64F79E18BDC2EA105F322ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888843, "uuid": "eb6568be-a4e3-44a7-9489-04c847d0b324", "value": "96:DSgRkvRW/+m8wuLTk1wKgbIetxmEXmvHwnNwQr0D0FnBgVsTYItZlMGoMl9LVS8V:DSyeo2VwCY+nIiUa6QNwOuie+ciPdJbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888843, "uuid": "d6fff624-3afb-4a92-8b6c-4cb6082b0d81", "value": 5893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888843, "uuid": "0346a691-8e9f-415e-8cee-955485811f33", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888843, "uuid": "0d513f31-2ea9-41c8-8fb8-63e37e4e22ad", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5b7647-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889741, "uuid": "ec608b6d-ab44-444b-8581-d5d31de401f7", "comment": "Malware payload (Simda)", "value": "de8b1e91d63b3c67771035c068e0c584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889741, "uuid": "109390ea-1292-4c27-b4f4-c739ab1ac592", "comment": "Malware payload (Simda)", "value": "52d7c0f1ae0c82b9140ff3127f8f08027215f6ed105c279d9aee13a6be480d61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889741, "uuid": "bfb7ab89-8518-4335-a8d9-f51d25a4755c", "comment": "Malware payload (Simda)", "value": "5dcb0d19488567a24b2ecd15465c311ed07e3d97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889741, "uuid": "ca33d9cf-8318-47dc-8398-8747f11b67ab", "comment": "Malware payload (Simda)", "value": "88d5f9198003b90536d62108728821e3538b43363965de8d7561d6f65db3c489723728fe2e684045d67185c7851ecdc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889741, "uuid": "06c26897-96b8-41ba-8c50-5a9078be0668", "value": "T178241202A7EF1DACD55F093B67772323D379E2720E70EF96481C185D7CAA14C7A885A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889741, "uuid": "60d8ca1a-af18-47ae-a7b8-fbb2eab41efb", "value": "fc654781844d06a6ccaad40505274c80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889741, "uuid": "202b6169-48f3-48dd-8c4e-b300c9fb1f1d", "value": "6144:4+Gupq7CAM0TDJZJ8uMYG83Qnqi9p07Sl:4+GmwCt0PWNsJiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889741, "uuid": "7f741aa2-a7c4-4ef4-ba14-8e30facbaa9f", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889741, "uuid": "67a8c8fa-32a1-4b63-a866-c50fa716baad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889741, "uuid": "fdef5f54-1651-4ddf-ae82-c253a86002f9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafd7bb3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889742, "uuid": "d95642ad-146b-46e3-87f3-edb77cb5f4f7", "comment": "Malware payload", "value": "b507974b582c2985410c4c719c6c6e11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889742, "uuid": "7a583b6a-616f-4044-b32e-1773b937bc93", "comment": "Malware payload", "value": "52f2f14a6c8a8282907d54cac15af57fbd5c828378461f8e882cf1d0c10021a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889742, "uuid": "1b2c9c1a-98b3-4575-b19c-7ac93a729bf2", "comment": "Malware payload", "value": "738ed7ae4286ee96a8cdd8bf17117ae62593311b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889742, "uuid": "2a709584-9976-4509-af8a-15f19171274a", "comment": "Malware payload", "value": "42567706ba284d49229d99ab1941e5d1dbb061ff31b384b51303da5f06878b6a55a88eba5a190202dcc5963226a82c0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889742, "uuid": "9f67ddfa-cf0f-4983-917b-fab8be1b7427", "value": "T15D45332927923E8CFFB99FB9820D5E105DA413C95F6EF811BA996C5253D21C3B876230", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889742, "uuid": "45c56907-00a4-4091-967d-62a56f782f3f", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889742, "uuid": "e9c33127-482d-4c72-9f80-40242e455b95", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVv2U:+YhQs7tW2zku73bFgVlRlbN015CoVv2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889742, "uuid": "9d43c5e9-7533-45a7-921c-8807423ed1eb", "value": 1193936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889742, "uuid": "cefd449b-95ef-4248-a181-2a97a36b7a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889742, "uuid": "aef1b524-23ae-430a-8122-ab3b2141e520", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9ec571-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889743, "uuid": "9a7a2392-aab9-4820-871a-aea1ec412241", "comment": "Malware payload", "value": "b59ac897d726ce20b3222301c6d901d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889743, "uuid": "16184030-5e33-4382-bae3-864e30730852", "comment": "Malware payload", "value": "5315577da787089e6e03284fec9eb7c293ccba9a4fcd0ea85453e0a9e7d74ff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889743, "uuid": "693f81d9-e708-40dd-82c5-55dd6caf4669", "comment": "Malware payload", "value": "45e9509251215836fce3f36f32a26d993028c993", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889743, "uuid": "f2b59182-1358-4e43-acc7-b12ae76b49bd", "comment": "Malware payload", "value": "de1b9353ce6a507ac1b6cd8731c159df737ede5d1adf6e7c038f1c160fd89b0b2d1961d729ddbd6111635ce1a2e9c159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889743, "uuid": "f1085333-7b54-4e8d-a259-1ca7ae9ce7ca", "value": "T12F14E747F21281B9CA38C537A561C2B21F253D75AA63CA3F31513A2B2D79B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889743, "uuid": "a2e19825-b79b-4137-9e76-f05e4f3094cc", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889743, "uuid": "aaf7e45e-de15-4a38-8bd6-119b30ed6a73", "value": "768:sW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAar4PzpyRAJ7IwnDoSdx:WbC4Bk6lMTOWk4PkRAPoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889743, "uuid": "63d00b0f-9189-458d-a7f0-30ebc7c42821", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889743, "uuid": "fcc370b4-10c8-41e5-bd69-4d6cfb0310b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889743, "uuid": "48fcda51-7d54-4767-b08a-8c2aa554f05f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec46705b-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889745, "uuid": "a3d50155-fb43-4e64-b508-30336b25fc7d", "comment": "Malware payload (Simda)", "value": "e50c6ffc3c8a3c8c73d7820d555ab921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889745, "uuid": "1da3342c-886e-4df7-8a68-fe7b5a9b93b7", "comment": "Malware payload (Simda)", "value": "535b682938ea8f9ff66d4c75cf9dee36060ba4caf9713cadd4638e4adddbdde2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889745, "uuid": "a62b9f4f-286a-4f8b-938e-52b2ac1830d5", "comment": "Malware payload (Simda)", "value": "c0170717f96582c106c0bec3e9b6003616e4f14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889745, "uuid": "e69336f2-b1c3-4162-90f7-e9df0ec308fb", "comment": "Malware payload (Simda)", "value": "165f25660efc3d3830c61e508c8c45546fd710e75bbd7d9c12a493d76ab765c3156847e679764358e3b631952d41656e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889745, "uuid": "396666f2-9fb7-4007-a0b7-172c06e640fb", "value": "T108B51223B89D73B2E67F403B26C78262217CD81B336E963D59503926BC632746A53F94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889745, "uuid": "8fa6a99b-42e1-4c24-a759-c816262888f3", "value": "cd7fcdda5ab111ed483e93c44d1d1ae1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889745, "uuid": "8b137208-ba05-462c-b9ae-8597d09923f2", "value": "6144:CQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy6:RXkej+f4VDOEVdbgtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889745, "uuid": "4b2503db-b5ca-48a8-a52e-4d92491656f8", "value": 2400946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889745, "uuid": "f8aa5456-8dfe-484c-80b6-f6d102751efb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889745, "uuid": "2f612fc3-0877-4221-9a5e-3a5bf245324e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed12302c-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889746, "uuid": "ccd6f019-0848-46c5-b6ca-4459e3c401c3", "comment": "Malware payload (Simda)", "value": "994ec6e67bd979383dd949f0dbc079a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889746, "uuid": "7bdd774e-9505-48f3-b5da-4002790f7e3d", "comment": "Malware payload (Simda)", "value": "536e70798dab08ea627c1b86a7ad8a4918d768a93de68dce01896ed4cffc9c6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889746, "uuid": "418f6f4e-86f7-436e-a811-8d1f4111775e", "comment": "Malware payload (Simda)", "value": "e0a68d3732e1f21a9fb76bbb2eb03278bbceb4ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889746, "uuid": "494e939a-8868-4d62-a483-af0d3b74e4b1", "comment": "Malware payload (Simda)", "value": "fd470cc9fe36b453104f76dc566681370e02e08f924bed55311ea7ce4ad7851d46148f1da053243750047fed7e69262b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889746, "uuid": "ba49a2ee-0073-4a54-a0a9-66e01c6665f7", "value": "T1EFC4123253088DE2D9120DB704F1974225E9E63893F5C2876926098F796ABA37C7DF1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889746, "uuid": "ec9039c8-17b3-4c5f-b19c-a7f4a5e82994", "value": "98aa7065495f35513795744857924eba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889746, "uuid": "366a157f-3070-4256-95f2-4d689666c3f7", "value": "6144:ut++Jbojf5Vq5OC4qZhZcKYhc/ZfUozYE:Z+cff22qZhZcKYhc/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889746, "uuid": "78a0608e-aed8-485b-9771-c8af30bd5e6d", "value": 593468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889746, "uuid": "f364e676-4537-4367-bf05-cd1a52b2a4cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889746, "uuid": "9a8aeb4b-5dc2-47ff-b3a3-565f0da384e2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb0fa08-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889747, "uuid": "9751b601-0c62-4cb9-89b5-941c52a9352f", "comment": "Malware payload (Simda)", "value": "f3a3bc1a5a325c7838c3b209dab6e7c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889747, "uuid": "e552dfb8-4cc1-4042-8895-e2078436df79", "comment": "Malware payload (Simda)", "value": "53c1854d8132616a67e0aceaa012cb8b760e6205d433f0e01aec35ef81cd505c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889747, "uuid": "b581a3d7-2aa5-4b48-8dcf-336d1bc9cc7f", "comment": "Malware payload (Simda)", "value": "94438b0b7dd09560274dcfe680ad195eb0446e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889747, "uuid": "d6204487-f920-4841-9887-b638129067e8", "comment": "Malware payload (Simda)", "value": "ee477149c213a323abe9ef250943bb0dae93a59c834bc4cdccc7ac0d346573d0892b57c94156ec173e158935cc98bc89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889747, "uuid": "813d04be-1e06-499c-9ed3-cded4fb3d4b7", "value": "T1BF14014374594342E23446B058B7BE62C97CD54E3A79113B3C2C555A2FFA3839CA16EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889747, "uuid": "7e518d4e-7ea6-4b7f-a1df-706ed342ab66", "value": "19369dbaf9a929d28a39d7c43e1ec6f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889747, "uuid": "9c4c1cff-6aa0-4501-b0dd-0713e1769dfd", "value": "3072:M8nh2Hrp3Tlp+soN3BY2ZBHetwcyf1w5DYRZPQaQrhu8ihDNugrBVgc8gbmT2Pcs:tnw9lEs3hhyaubQTkhbrBVL8gbmT2Pcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889747, "uuid": "79adddb8-6134-4d9c-b287-6e4c63462b42", "value": 207376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889747, "uuid": "db923328-16c1-442d-afa3-d443430bc95b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889747, "uuid": "18ec5d42-4da9-4176-8be6-4c4528353ffd", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4a9495-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889748, "uuid": "e79c1152-58cb-4798-8b01-65641194cffd", "comment": "Malware payload (Simda)", "value": "4daa27770446f1e911887ba84c74eef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889748, "uuid": "1b8629c9-78a1-4178-b84e-2aa237299db0", "comment": "Malware payload (Simda)", "value": "53d38f08158d457643c9d8f4d6b7a1d4b7bda55928b63772d703831e00bd2c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889748, "uuid": "fff3d6b9-1183-40af-89c9-a819a0f03a96", "comment": "Malware payload (Simda)", "value": "f6646f11ffc173f6632c6e4a8be7fd2b743720bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889748, "uuid": "62bf7151-752a-4f76-a6aa-2cc320110387", "comment": "Malware payload (Simda)", "value": "0b0a24b371e3d073368307a9db29470d9a2bbd055960fd94474556e14570b86fcf2a6166dc54356bb23e1d423f7dd03a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889748, "uuid": "ebe91435-4dd4-4e86-9953-f1e2792f7b19", "value": "T15324123BF6A418C3E6B63A3014FEF15819A8952C3552AE3BB40613DD2F662C44FF5B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889748, "uuid": "76912d28-55d2-41b6-9502-f185d915a364", "value": "a0f41bd5de82cbb844f692b48ffd09bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889748, "uuid": "ea88e956-0266-4db3-94c6-85f4ee81ddf9", "value": "3072:MoAbvJrZ/CEp1Td3INNAILgwKRpP3fJ2pwLAt/iw1JmWTe1eyfLUH+xW6Lyk:M7vJN/CE/TZINiPPBIwcuWTegi9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889748, "uuid": "24d14aa1-4a30-4798-a9bb-78d25cb29e39", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889748, "uuid": "3f9e84d7-3265-469c-a5fe-e2bbb7869601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889748, "uuid": "23c8d78e-87a3-4143-8b52-9097c90434dd", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefcf3dd-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889749, "uuid": "2e0bf47f-8c5a-4cd0-ad93-a22792a7ab2f", "comment": "Malware payload", "value": "c8fe397c4819294a26e2e53e91f46c28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889749, "uuid": "704f5f73-7429-4032-bd3b-45f0274a4b49", "comment": "Malware payload", "value": "542926bc98f1b2e358fc655c8297e13a88dd619a17128b24c7aa090e0a777406", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889749, "uuid": "3b51a607-7e74-433a-b949-d05248ddbcda", "comment": "Malware payload", "value": "0e8943a4820b3e43018eef549204a858504ed8a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889749, "uuid": "e615626e-07f8-49ad-a1bd-84e9eec156e0", "comment": "Malware payload", "value": "753f424a6f20cb531c478d99104b242cb1ae5685cce96be59ca3602d26e5d6e7afe56d6f046643e83d6854b6f57248d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889749, "uuid": "0ba1aa19-46e6-4dc3-91c1-e2d9108bd970", "value": "T19F8533640FE2046AE823183E726C137AA8AFB7644524DFD383D4DCE8E477435DA956CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889749, "uuid": "7cbc9822-3f42-4b04-b819-e33e554f9e39", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889749, "uuid": "a9fd9b3f-72ad-4028-ac46-663025978915", "value": "24576:LuGtcjN3lRfEyB9MBhavuS5iavgJKUdeIhRHq9aR5iP3QtbMDynPll8w+VaMjPPc:fiB3ffDBvd8BRJO/2nPcTjXbnB6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889749, "uuid": "ca513e52-8368-47d6-b6a5-189d8741cc02", "value": 1740432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889749, "uuid": "3a8850b6-4388-45df-a144-1ff501b6f953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889749, "uuid": "0366b39d-47a6-4a8f-92ea-8f3668bda5c4", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef93cd6e-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Backdoor.Shiz)", "timestamp": 1763889750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889750, "uuid": "f359efa6-1f89-4421-8181-adee09559ca0", "comment": "Malware payload (Backdoor.Shiz)", "value": "d111dbf592a2e81d2f1c7f0611b00d5c", "object_relation": "md5", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889750, "uuid": "00768faa-077c-4e7c-af81-d8751a685309", "comment": "Malware payload (Backdoor.Shiz)", "value": "54742c4344adbfc0795ca1a770081981014f117bafe410ab14395a01f4454013", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889750, "uuid": "1b35fab4-ea97-4849-a34d-09120b7f18d7", "comment": "Malware payload (Backdoor.Shiz)", "value": "cc2ed361655b1565c93413a53ba71ca876ab7b6e", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889750, "uuid": "3745c50d-8eb5-4c8d-be64-1a87a7dea0d3", "comment": "Malware payload (Backdoor.Shiz)", "value": "0f6393689dbe5f4fd86faebaea208af56cc82bb7ccdfb681accefc44b18942d084ea3a5a13239387dd32b854e3b72d5b", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889750, "uuid": "6caf05ee-455a-4c8e-ac17-844b7bde7fe5", "value": "T1EFE3015213152220C0BB0DBBD8E2E3092376DB5A0F59DBA39B51C2109FA3BE63F78754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889750, "uuid": "d2af14ca-d1bd-402f-bcbc-75687821761c", "value": "1614c4536fbcd7831c572b49062368a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889750, "uuid": "610016a6-a6c2-4c2e-9f8b-42d4ba7a3ff0", "value": "3072:vru5SkB2ca09lIqb5nr5JYpQ4O8k99K//RLbyVZtde:ToSkB2R09l9b5ntD4LKS/6de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889750, "uuid": "78a28aa6-e613-4989-9c29-a10a3dfbe9c8", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889750, "uuid": "3410dde3-1008-4aee-95c7-6e156c500f5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889750, "uuid": "d4b878fa-31f0-4828-92c6-257435f9c9c0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03d3288-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889751, "uuid": "82b4cb7f-22eb-4988-99ae-4a654a2c0337", "comment": "Malware payload", "value": "d6cab8db3c14cd3625dc8c692517db8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889751, "uuid": "f28d876c-867a-4239-816b-49f304b13d96", "comment": "Malware payload", "value": "5477c108ede715ba928a9b793d2833a2b7a3204b1b1b9296e9d3e5ceacc40dcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889751, "uuid": "e6b1002f-b8af-4202-b189-a9b89198ad0e", "comment": "Malware payload", "value": "35a68904f7318473ce840a03578f8325969f89f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889751, "uuid": "0208bf08-83b2-4942-a041-99f80c65b6dc", "comment": "Malware payload", "value": "e82a673c77705f1da421b7ca75385bfdafadb8c4492a88bfbf541beeafdc2b7cbf91fc29e8cbd6816beb4eeec6c12245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889751, "uuid": "06db8428-4f5c-4838-8203-4217a7c171b1", "value": "T11265237373C1E4A3CD480B3203852FF42EB2E43927B5883677E559561CB46A2BDA9786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889751, "uuid": "c7d55c1b-5c4c-4b1c-97c3-aaa8f81c05ba", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889751, "uuid": "60de8004-1c29-453c-b834-11c7f840bdff", "value": "24576:P6Zv29EhBVnFys7wuVW2r7o4VvM7L3gTLl2PuT5UgZq/Lr6HjdMlMm:PE29EhQs7tW23RM70t0ufcLYWlMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889751, "uuid": "34c50dd7-929d-4294-93d9-f4a1dcb3cb8d", "value": 1462909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889751, "uuid": "05453332-3b5c-481a-b38c-255fccf7db97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889751, "uuid": "6a22f174-3e1e-4528-8cc2-1cf6a9d65a5f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4773bdb-c8ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763930426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930426, "uuid": "af117d2a-968d-42c3-9e08-998e84a15a7d", "comment": "Malware payload (Mirai)", "value": "ad154c865902ae592d4a454bd0bcf2c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930426, "uuid": "ce53a630-0cd3-4350-9c64-112bbfa435b3", "comment": "Malware payload (Mirai)", "value": "54b916d05ab15bb3036571fcedcac9077cb2ac97a1631437c76635a695fda388", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930426, "uuid": "4442cbfe-9bc2-4ad3-9ac4-7cd5006ba50d", "comment": "Malware payload (Mirai)", "value": "4d7215d0f6f28f0135cc1238c4c19fc1fc8986a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930426, "uuid": "08f7b1de-85aa-47cd-9c58-f940f435faf0", "comment": "Malware payload (Mirai)", "value": "adae2d345d8c2d0c9c6155aaea0e08874becab746aaa1dd5ad3e05fc9fbf1a11c4c9951ce1f8a766b57e4da9d86cd6f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763930426, "uuid": "7d6b6149-da9c-4132-a4c1-820d298f3b99", "value": "T1B10633A6634F927BE3B7E639163649908908005D44DF60F0D72CD38BDEBBD08DAE1697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763930426, "uuid": "49b51826-53b2-4099-a2d5-d4cb4a7f7fc2", "value": "98304:fTyljoCYNWYL38d6y1Ph8DBXCYgf8NfSHEkxL:fTylfKO6y1EgEFS11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763930426, "uuid": "5386ed32-4604-42cb-845e-81bd77375865", "value": 3677188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763930426, "uuid": "b5a857c4-f437-47a3-9c66-d00f2455068a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763930426, "uuid": "c133e37c-4ca7-4ed5-b88c-46e848d464de", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d534d0-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889752, "uuid": "0cbeab19-3288-4020-a965-35251bb4fd9b", "comment": "Malware payload (Simda)", "value": "d49739d90bea2697d263f24e32156d8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889752, "uuid": "61697b8b-b5ba-4dc9-84ce-bceedcec15ab", "comment": "Malware payload (Simda)", "value": "54bf8a580c305e124f3a79f52bccb3339c41bab9f9397d4030d7a4fdf6127592", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889752, "uuid": "dd27ba08-d906-4a59-930d-53291cc0e811", "comment": "Malware payload (Simda)", "value": "7c82e47810608f399f1939ad5795c3dbc762f908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889752, "uuid": "a95938d6-80c4-432c-9076-6f1d6f42a21f", "comment": "Malware payload (Simda)", "value": "7b787fbdd8842a844a1a93ec0e5e42a195c0bf0cd90265df2deb06caae1bad998c2c8dcad25af987bbe359fd4276cca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889752, "uuid": "2c6b235e-3e0a-4497-9739-6f650076263b", "value": "T1FB848E21F1C08079E4F5157096FF7A5B246CA9B6472838E7E7986EC928741F27A3C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889752, "uuid": "0c1928a5-2c01-40e8-af4b-af0b5a2deb02", "value": "173abfa8f7d7adac2a90a2e42625b7d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889752, "uuid": "5e8aeb31-17ff-4083-9b26-084bdbe1d905", "value": "6144:GfEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:xmWhND9yJz+b1FcMLmp2ATTSsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889752, "uuid": "34b10631-dfd8-4795-8532-0b3ca13f6b46", "value": 387484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889752, "uuid": "af209827-f288-46dc-8099-c8d206782e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889752, "uuid": "5fe3b31b-a54c-4035-a923-fd716ac81ac5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16d2e27-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889753, "uuid": "25acbdc1-b0cc-4984-9eb2-de3db4383a5c", "comment": "Malware payload (Simda)", "value": "dcc6637acf14a6b000e29267a173e93d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889753, "uuid": "4ebc5ebb-7cd7-4699-8bff-0885c04ee6dd", "comment": "Malware payload (Simda)", "value": "54dfe926b7a2ced2670b7a51f99f7b8aa56ea2a10c3f366c56a16d391ce616b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889753, "uuid": "28c48715-a2f3-4e43-aeca-276d7a8d78e2", "comment": "Malware payload (Simda)", "value": "3b2a8967c1967c8a330263fe75ed99bac563560c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889753, "uuid": "eb37ade1-7518-43e7-9390-72a87031dc69", "comment": "Malware payload (Simda)", "value": "7f6816514433c2f580e6eff930f513287f52c1b7f1f3caa3c7ccd61f07e6e5166207019368964dc1794492b1fc8237e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889753, "uuid": "3896552d-8aba-4395-ba9c-4cd8cdefac23", "value": "T15CC4122B1B2C9933D6550B3B8EE5EB3461BFF5516733D6D30B009A9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889753, "uuid": "2be397a2-339e-43d6-af45-c83ac5b9e045", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889753, "uuid": "72ccace6-3e51-49a3-b1e0-c7273f94ad71", "value": "6144:AZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:OquCuygMQjd5vJIBP1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889753, "uuid": "18e5689f-433a-407c-ae4e-6fc37df25c89", "value": 574490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889753, "uuid": "f287a8c8-5828-4b70-ac12-20ac8c5573d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889753, "uuid": "764e85a7-a636-4ace-b1ca-2ce49e67f602", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21de574-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889754, "uuid": "d4d59f50-7b16-4546-9618-261a878e8f2d", "comment": "Malware payload (Simda)", "value": "9c785f2d1330c16e0fd43b5eb12520a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889754, "uuid": "7210f91d-67db-4229-9ea1-7e26c633c579", "comment": "Malware payload (Simda)", "value": "552b60239027f24fbfacaf9d7497a318f4ae89898c60338f68fcac18327cea88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889754, "uuid": "034c91b8-1cc4-4f71-9e11-42b3cd1a1ef5", "comment": "Malware payload (Simda)", "value": "6e5485f565e2a0be86cabec737252726afd24af5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889754, "uuid": "533c211a-138d-48c7-94ba-144e78993a48", "comment": "Malware payload (Simda)", "value": "3fbde8033be2b9a1e6f36ea615bd025a39ea4741ff0b6ccbd32fc90435c4c6725263e05a88733900b6f7033a82b0f406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889754, "uuid": "32313314-574a-4f73-a635-934db3821f5c", "value": "T1A5241223EBC61E42D8650F78858EE046DEFCE48D3FA292368D54CD473E437624E59B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889754, "uuid": "548dd6a3-7534-4f23-a6d3-373a522ef7bc", "value": "a1477f62efa130779fcb2868cf890b42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889754, "uuid": "db4971c4-4dbe-4d23-89a4-f0e9e9bee2a4", "value": "6144:DrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:vsTbzu1glovW4EH6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889754, "uuid": "24cce421-80bb-4d3e-bc0f-b062334dc378", "value": 223040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889754, "uuid": "9247f2cb-4a8d-4fb4-98fc-f6c6e348cd75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889754, "uuid": "75726abe-6016-4fae-bb75-fab55a724745", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b2807f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889755, "uuid": "93382c55-921e-446a-8fd8-9848ffe5b438", "comment": "Malware payload", "value": "3317bedd596b80004b8a06aaf63c912e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889755, "uuid": "1ae5ea32-67d1-44b9-bca9-a35c7f6bc5e6", "comment": "Malware payload", "value": "5547cc6bbfe72cb4afdff0cdf9aff7a1e36ff77c43682e2e49fca137c86a163d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889755, "uuid": "14331631-d0e0-4418-a4d8-b83c11089f4a", "comment": "Malware payload", "value": "2d40131c482134ace92ff17e8c9da92982a7d072", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889755, "uuid": "dcf57f9d-b84c-444f-a6ea-61ff6c79945f", "comment": "Malware payload", "value": "68e818da3532b929eb2982e15f2981b3f8d71025d2bbdf04e9e5a46ba3bf49a2962502b79d4fcd504f9ab09335dd7c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889755, "uuid": "0ee5ad37-676d-4bc9-a317-29e884ac09ae", "value": "T1C5432918675CC62ED67F0E7EA4521A1066B697761203CBC63D8C24FEBEE3304872179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889755, "uuid": "2bd270d9-ecea-4b71-b5a2-636147f92ec3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889755, "uuid": "573e8531-6ef2-48bd-b6d6-88d5a2c253c2", "value": "768:omQZqx1lYcTYbFiAnSaPWdgwWIjUq1fzu4AOXbYC1XkUt:o0lY4exPWdR/Rh7buUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889755, "uuid": "de5954d7-e627-48d2-a9bd-ff1b934e916b", "value": 57356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889755, "uuid": "914548d9-455a-492e-aeb8-dcd699c9ffc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889755, "uuid": "c54b080f-acf2-4336-9079-8099239dc98c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fbaba7-c8b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763935423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763935423, "uuid": "53eb456f-16a2-4d33-8386-07a570a41e83", "comment": "Malware payload (Mirai)", "value": "e97b8101e5c8794d3abe703a0009219e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763935423, "uuid": "0a120c23-eca7-49cd-bc14-79316d665980", "comment": "Malware payload (Mirai)", "value": "5563a5a7ddfa4ed29b594e9b1f0c7c528c1d6f398caf7bc80cfb4a883700dfe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763935423, "uuid": "b391bfe1-8c0d-4dab-88b1-2f5cd79b30f8", "comment": "Malware payload (Mirai)", "value": "30c01e7fb736bb3d39f675eea66357bb730e1e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763935423, "uuid": "258a5287-226d-455c-bcda-7fb50e015dde", "comment": "Malware payload (Mirai)", "value": "962a44980c98fe527e773047006ecc172257a222ec16798fb3c476533c70cf407ea31b6711253e96f3bb15ba19a01381", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763935423, "uuid": "14d50f92-a7e3-42e7-ab36-1bd97941addc", "value": "T14FC34A16B9919F01D4C735BAFB9E414933136FF8D3FA71128D20AF61238A99B0F7A512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763935423, "uuid": "d3ea7890-710f-4521-bbb0-487374c735b7", "value": "3072:np7mQvAzKFvC3sQUSToxyaOZwtFl57+fm6Zvcz+KXm0H:np7x4z2+sXSUxyaOZwtFlkfm1zzXm0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763935423, "uuid": "6c533159-768d-44af-aaff-01e860adc90e", "value": 128088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763935423, "uuid": "79df1ff7-ca35-45cb-9745-ea615cc799ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763935423, "uuid": "957b73f1-c790-4f8b-85de-72ca8112a4bb", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d2050f-c865-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763899777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899777, "uuid": "e2e563cc-7cd3-421b-aef2-b02073c042f9", "comment": "Malware payload", "value": "70cf78bd049ff09da9a2f9007ad4a65e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899777, "uuid": "51eff224-d8de-4769-af13-155372542905", "comment": "Malware payload", "value": "556966f9be186d5b28d100142437602131d919593a687e6d56b567052957ebc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899777, "uuid": "15bd004c-2023-49bc-8c31-d03f607e0e4a", "comment": "Malware payload", "value": "ce64242fa0c72305ce1fd8cb3073cc6dc86fbea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899777, "uuid": "a0b08bbf-33b2-445c-be90-801b1775462c", "comment": "Malware payload", "value": "eeb8b7834f34eec97372fda7baba26ba92bf2b87fc0b6ca8e66ea0c81cab8ca50c02ba549a0989885c9c5e5938cece35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899777, "uuid": "050722ca-e603-48ae-ab63-3716b79649b0", "value": "T1CCA633C7E7A104ACF927433FB4C4581BC87A78264B54D34B1EF53A168E673AA6C7B241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899777, "uuid": "fe701791-f3fc-4a59-b13d-fba8e9af348b", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899777, "uuid": "b418a9ab-1fc7-4e5c-8765-0797982afb70", "value": "196608:912mvCsXDjDyfc9/r6Mb48RmU/3ZlsPvzwxg2TvN8CMsJx:+mvCEDdvtN3ZWzeVTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763899777, "uuid": "3f49fde2-b9b7-4a3a-ae64-36c1a63339ff", "value": 9528637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763899777, "uuid": "cc331446-538d-4662-b4e9-9b3fa8bebd54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899777, "uuid": "29c6a3e5-eb6b-4175-ae28-cf49be8cfa1b", "value": "exoV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f349c76f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889756, "uuid": "53636557-d0f4-47a1-a095-5bc3a9e48deb", "comment": "Malware payload (Simda)", "value": "4d4da0ca69d94516bf83f9f8288abbc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889756, "uuid": "d7f10e02-cdf2-4712-b44c-67298a0b51c9", "comment": "Malware payload (Simda)", "value": "55a0bf1edf21be68ad6de8c265884ee20f59aef9ce6a083d33476113e545afad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889756, "uuid": "99acdfd5-8831-4aaf-9d9c-eb7b3a4b2069", "comment": "Malware payload (Simda)", "value": "87fb294a2ac7fd36711e835b89c3684ac3ad2030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889756, "uuid": "dea81f7e-97f6-4854-8c21-13e63cd50c9d", "comment": "Malware payload (Simda)", "value": "2875918f952566b08f5648d2183898825164af76b5194061eb81f22c43c785a94df45d06f829675c6654f5087967a21b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889756, "uuid": "07f6e6c9-ee61-4502-87d7-160ee5787a1c", "value": "T1CF24022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889756, "uuid": "a054ea9a-c853-4239-9c11-28ad60a22e75", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889756, "uuid": "64f5e1b6-a635-4daa-b9a1-8ac293c92e22", "value": "6144:JZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:bquCuygMQjd5vJIBP1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889756, "uuid": "6520f399-efc2-4a98-bfe5-7ef103c857d5", "value": 213054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889756, "uuid": "49b64e95-c412-435b-ae81-e02adc4622e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889756, "uuid": "8e98eb6d-aa89-42c2-ad88-4c7325c3a306", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e8e255-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889757, "uuid": "6941dfa0-1646-4224-8d34-49d26a788196", "comment": "Malware payload", "value": "d8a3ad1812be4bfb40cd397afa5d1766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889757, "uuid": "19477584-115d-4ae3-b9d0-5d55ca9fcc23", "comment": "Malware payload", "value": "55c0b73ae9261025fcc0a69c910789ddf42f54040432959cd86f18da0d993ff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889757, "uuid": "58722ac5-986d-47eb-b9cc-3d7e5b4898b8", "comment": "Malware payload", "value": "20a5ada058e26bf97aae12f5c16b858b4cab35d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889757, "uuid": "d127a152-962f-462c-90ba-368cf61e5669", "comment": "Malware payload", "value": "a5e0d73361148544c723ec14b819d6a0901190d5c356cd818b657b52e72adc4551e2b8c27e4208b081e1af080badfac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889757, "uuid": "e2cbd167-4947-4414-8927-e57aa6a5b807", "value": "T1C475331A37C29896DE065A3001957E74CEF6DB3C09792009F3ED06077CB59A2BF5AF92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889757, "uuid": "6bf591c6-cb33-479f-8ea1-6611aa5c5329", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889757, "uuid": "6be4a891-9c9a-4282-bbfa-ed7563157ada", "value": "24576:v6Zv2ivhBVnFys7xP86LXtqWJ/ej0umQf8/+1gFDsHLAgDmfluSsttObPIDXCRB:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxsTOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889757, "uuid": "7692ef3a-6463-4858-b3f9-2c803b22dec7", "value": 1563079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889757, "uuid": "1b81488d-8dd6-4744-8457-a0a2f65f8f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889757, "uuid": "2b557ebe-391e-45ec-a47b-d02a7b346ecc", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f485f5c4-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889758, "uuid": "7203c335-4035-45d3-89bd-deb8f6ce6ce1", "comment": "Malware payload", "value": "274017647fc0398c6029298b4cdc3292", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889758, "uuid": "edb25cd6-d31b-4f3e-9e28-c2dedb239e53", "comment": "Malware payload", "value": "5602551d459db46d9d5544ba762622c1879acd55ea6e56ba724c5305b6a39605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889758, "uuid": "89b78d7d-9f0a-46ff-8c5b-4983f54e8aa2", "comment": "Malware payload", "value": "9436a044baaff50806bec1f75ecb387de6723a37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889758, "uuid": "87b91516-b8da-486c-9f76-0cfef9586d7c", "comment": "Malware payload", "value": "b4da5b756ceffc84efc820fc3db9a1ee9ba2d8c0dc3a9ad536345f0c30344c1cc02b9ad6608e10794ed7d3416e93894b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889758, "uuid": "a830a8cf-57d6-4f4d-9962-f6808de41648", "value": "T179234B18ABACC61FE1EF0E7D64631A21127293911303DBC64EDC64FEADAB78406257D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889758, "uuid": "797a03b9-fc78-401b-900f-742c9cb69805", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889758, "uuid": "6f91ee6f-baa7-4ae8-a0c7-1028a6f46c19", "value": "384:xxiHABz9q3FxmHu+JjOdb4iLaFRCOHu419awgncpMQiW4zmkZXOfq1aK2rkLp9ij:xCIFqb4waTCOOuKXbOfq1ck+nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889758, "uuid": "09aaef2c-0aee-4b12-afb9-ae3c957dc47c", "value": 49164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889758, "uuid": "0e94d2ef-de83-4e31-a543-6d905aa59cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889758, "uuid": "4f5b07af-0a52-4ffe-be14-250659b54137", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4f413d-c891-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763918625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918625, "uuid": "ebac3041-bcfd-4e15-b1bd-5d321ba60819", "comment": "Malware payload (Mirai)", "value": "884166bfa66069650d569a878f1f3047", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918625, "uuid": "3fc8f082-f2b4-4c5e-9d13-5d916fae456a", "comment": "Malware payload (Mirai)", "value": "560a3e1264aa447a680ac2deb7b8e71e2ec8c45a1e710e4ad3838396d82942a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918625, "uuid": "501c0001-c7f9-4a4f-879a-ba32c357fde9", "comment": "Malware payload (Mirai)", "value": "6d550227d6463cad3d3936fd280e84d784841d29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918625, "uuid": "a8f6ad70-af1b-4a5d-8345-1b19f22facf9", "comment": "Malware payload (Mirai)", "value": "7357fddfc47cf6b1576b6478df2101d89d24d667d46e62bd7385735fbee9c973db5253c3f7008cb4429e1ea47c788e68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918625, "uuid": "4ab61e19-bb15-4053-8cf6-3ffded733e9d", "value": "T157F34A46FB408A17C0D62779B69F42463323DB6493EB73069928ABB43F8376E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918625, "uuid": "9ed555ca-af21-4ef9-81c5-3161cc475ce9", "value": "3072:qLWyCGIfja9T0hXqEJBEKDqpXrNP32MiL/KEYRz:q/Ofja9T0hXqEBRqZrNP3xiL/KEYRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763918625, "uuid": "1ed3dc12-a4ff-4753-990a-6b0a2e9ca4fe", "value": 170097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763918625, "uuid": "a1362476-d006-4236-814d-e18d9d049560", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918625, "uuid": "f3f8b77c-5b2f-4588-8136-8b8b51988d2e", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8e1129-c865-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763899810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899810, "uuid": "ecdbd4d7-9ee0-40f7-b45d-cb05bb280375", "comment": "Malware payload", "value": "9c01a15fc082e2e4a9fc3ab975d6f0ac", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899810, "uuid": "7f179db5-c18c-4cdc-af19-7d5c84b6e04b", "comment": "Malware payload", "value": "5616c49fc976c1b04c13abd1405119ea224691c257783a5df3436ffe4a4e9290", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899810, "uuid": "b3b7ce9a-8e29-4da8-b07c-43d74b24adfb", "comment": "Malware payload", "value": "a2a7fb0795d4c83143de730723145cb214c91493", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899810, "uuid": "e0ca2ad3-04fb-4286-85f8-630607032410", "comment": "Malware payload", "value": "3082500f02fe78c2ce13b690d800468fb74bffc3259c282fea7b7d9fc8b8b58de636d7a7200f3089948d2f396f338e97", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899810, "uuid": "22be45a6-a031-408a-804d-1a93cb313c15", "value": "T1BFC533ACE873EF20E10B8951775645272EEB8FD1B74ECE4B3376B4B11A25A50099930F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899810, "uuid": "afb6c3a8-aa55-46a2-98ec-09a752521936", "value": "49152:GMNVP1EOP4pbmBTNCRQwjHK8FBg3VOhG7NyES3VTFzA98Hag02ky1bRr8onz:GIVtElz3ekh6P8xzAq2lyHJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763899810, "uuid": "89052f51-fcd4-4445-93f8-a9c6036ecd1a", "value": 2715571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763899810, "uuid": "9293a04d-338d-47ad-822d-e64b52668501", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899810, "uuid": "c9b19db2-c4a6-4916-8ed2-27e8422e0237", "value": "warn0900.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddb5f82-c887-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763914416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763914416, "uuid": "6c88ed74-75d3-4679-932d-3016b551b967", "comment": "Malware payload (Vidar)", "value": "e43265542c2f7dea0a1f72a1c3352dfd", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763914416, "uuid": "62229d1e-4c10-4907-87df-269cae44afc4", "comment": "Malware payload (Vidar)", "value": "562582ffed521b0144b0120cc7dfd5fb50c38e94d6c10a86f9ef800ff0cf7bd1", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763914416, "uuid": "ba3a1cc5-1c9f-4975-941f-e77ffa4951f8", "comment": "Malware payload (Vidar)", "value": "a510397acfd27a343cec3dee9771a4a2e08c313c", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763914416, "uuid": "2b50a668-844a-47e0-9161-82bead026236", "comment": "Malware payload (Vidar)", "value": "f2a55ce5b324b22132ece3aaadfab81342506e81b683520d038755efcfdeaf53d4fb616919adb516a11e2935161dc24c", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763914416, "uuid": "a51e4e6c-32e4-4a65-bcf6-a2fe854b409c", "value": "T1FCD57C237D90C4A9D0A9B33499A65297BB20BC289B36F7C31FA13E347D36BC05536B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763914416, "uuid": "111112b4-2f2c-4f04-a0df-ebf87583642e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763914416, "uuid": "e7aebf1a-9f26-4e2c-8913-1929bff43226", "value": "49152:fyo7g4z8I9QgWpNjyctBHbywnfk2EqIho+Ol:fROHGw5Eqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763914416, "uuid": "27a3d24c-a665-4140-a24f-a3fb79ab8a89", "value": 2774528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763914416, "uuid": "a7899867-e7ca-40e5-9713-55262edf3c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763914416, "uuid": "c475b379-58e8-41c5-81d1-64afeace5172", "value": "download autodesk fusion 360 full crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53507b0-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889760, "uuid": "31314d8f-ae23-4aae-9255-46188c017a5c", "comment": "Malware payload", "value": "14f22fcac2dc6adad0b2d8442c5cf34d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889760, "uuid": "81d1e831-acf8-4657-8fda-154075852e57", "comment": "Malware payload", "value": "5643b3d56917b069ad5765a7345033bf24eb09886a082fe0290596056014f54a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889760, "uuid": "35514c70-b54d-46a1-a199-93d828a5e8db", "comment": "Malware payload", "value": "d2ed9d6530841d23b8baeb2e839aef5985fd9674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889760, "uuid": "1f06381b-11f9-4bd3-8fd5-243f81fd8608", "comment": "Malware payload", "value": "0ab66157467b80667bfb331feb7ce9b33dfda944d2030c4bac4f3e3652dfdbb511c773ae321e8248c89baa82e59e7d52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889760, "uuid": "23f1a2e8-8e62-4dc6-81c5-5e69acec1260", "value": "T1C8C448257BEA0C10D994187D893E271ABB34E1F24B06A3C77352B2A65D46DDDCE2C2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889760, "uuid": "5614f1cc-26de-469e-8eef-f114d92bf35c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889760, "uuid": "8d915342-5e58-4417-a7b3-56e317580a3a", "value": "12288:KRWSlpyGcuWo4NreU6f5N0Q0DFPgA8z2P9ckHEvK15UFo8Sk:ApVXW9eUOMQUkqWWGFIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889760, "uuid": "7fa582ad-ac37-40fe-9492-bf412411be73", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889760, "uuid": "b4b3fac3-1002-4658-872b-897b92e22971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889760, "uuid": "1a26bbc4-a180-43f7-af75-b15c3aaa8776", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d7c475-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889761, "uuid": "b593b9bf-237e-4257-b4d7-76dde5ab0e23", "comment": "Malware payload (Simda)", "value": "c0611a7e064fe1db3ca99e900a408083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889761, "uuid": "a013d242-b2a0-4ffb-9b0e-7ab85215715e", "comment": "Malware payload (Simda)", "value": "5670aefd76923c0fe34aebd14a78951e997fd50ba6e3637a0ef6697d26fa9967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889761, "uuid": "a76e8c53-cc91-4405-b00f-cc0bf8cbbd17", "comment": "Malware payload (Simda)", "value": "d45cb7eaaaea8cf09592ae95b995cdd3da074d81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889761, "uuid": "f2b00936-9722-4d78-9a20-cc6f7fa6365a", "comment": "Malware payload (Simda)", "value": "bdeb9d014aad832c784c750f1e25695a412e95f85c2d8e360767b08dc398ad0590a92b61b39d2015f5f3431579757686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889761, "uuid": "88aebe4b-9a41-486e-a082-2d6a551fb6d6", "value": "T145D423226D5D4E63C6A714BB1BF6FF552326E598132BC7675C00420F0C756C97F3AAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889761, "uuid": "37ea1dbf-de40-4bd9-9406-79c90cf28a16", "value": "088303a3216315a2ba8d66c94c7b80a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889761, "uuid": "a19b7818-5f81-4a0e-a3f3-0b4105e746ad", "value": "6144:smKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3s:271YpQiU/RcO1VQInVobc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889761, "uuid": "5624a545-11d9-4f99-974a-fcc357cd3dec", "value": 631738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889761, "uuid": "ca9af4f3-f176-471c-a3fd-7d04f20d7a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889761, "uuid": "ef295fb8-0f5a-4d29-b020-ab6c05dc1e5f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66b6ae7-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Backdoor.Shiz)", "timestamp": 1763889762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889762, "uuid": "f29db8c7-6fe5-4e9c-a927-8f1114a5f765", "comment": "Malware payload (Backdoor.Shiz)", "value": "e975ac3109c435c3ded672f56dbb8968", "object_relation": "md5", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889762, "uuid": "7a75c494-6119-46d2-9254-0efe01be7020", "comment": "Malware payload (Backdoor.Shiz)", "value": "56fb00243ed0a77e653aa885116c3a7006cbce4f3aab99fd38ff3a2e04e1e3e1", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889762, "uuid": "7c2f8d13-f1cb-46bf-a437-905850137d2e", "comment": "Malware payload (Backdoor.Shiz)", "value": "8d9f0733b2c497aeac16949ba46e4b6c29e60276", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889762, "uuid": "42d9d1dd-a296-411e-a54c-8f7f4cb66898", "comment": "Malware payload (Backdoor.Shiz)", "value": "065f10408e64ca8f3663c0979936b1179f4f9d92ceb5c9c46e7b0725c8b96842e21d5beec38d8eedbc2d3fd2c3b8af07", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.Shiz", "colour": "#00FB35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889762, "uuid": "6696b740-6015-49c2-82c2-d5be125b818f", "value": "T1671412B27B84411BC95CFFBB466B77040B2CD12B2E51C2270504547C6EB67E27EA7B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889762, "uuid": "29f1c42c-ae8c-4e69-abbf-d592a0b14528", "value": "430af33f4ce9475c62e2d9321d894f4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889762, "uuid": "f58fcfd8-7180-4ed7-b637-d43c394da920", "value": "3072:2O/6nl92ILkt6i2ox7c39b1a0J86W8xXCKNWOHU/ezYMVWtG4SPUkxbgN:2gFtboVBJtNWyPnYG4fUbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889762, "uuid": "51f4379c-6c80-4684-866f-6004ca01dab9", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889762, "uuid": "3dd89899-9ae8-4eaf-bfdf-73afd1193b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889762, "uuid": "b2052122-9f9d-4c08-8ed8-cc698006bdd4", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70e533f-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889763, "uuid": "162f4230-4e7c-454b-abba-dcb20931cc9a", "comment": "Malware payload", "value": "95f7bb1890bdcb8bf02262e2e1d3e18e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889763, "uuid": "139d08f3-c868-449f-a308-c3d60370173b", "comment": "Malware payload", "value": "57259b9a6438edfbf26f4a93adabef5e48b149b37c6b90223aa040c1d4edf0bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889763, "uuid": "9cdaed4f-072e-45b4-a095-8f02b264e176", "comment": "Malware payload", "value": "049ca67cb7cdd17d4d69e27024f91e8e25cd39bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889763, "uuid": "eb5915c5-148b-4c36-8397-daa4822352f5", "comment": "Malware payload", "value": "4762c93870e5b7bd42287aba8d35ef7e10a1b71f0b6754fa82164188e6909bf52a3bf23c3f7822a881689c9f07e7e224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889763, "uuid": "14911738-b1be-447c-9ede-cfcc2805ac16", "value": "T1A035334D06C22B28CFBDA7B75A871891155737EC4794A839371CA08B03F3A589EF85BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889763, "uuid": "940f641a-4d9f-42f7-bc8b-9691c8d95a17", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889763, "uuid": "14db4722-d181-4f77-adcf-acbc7ae4d7f9", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mW0Wr:+YhQs7tWVToP0Hs0/htDH3pGaF5+9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889763, "uuid": "0632f023-c1f4-4ef8-84fa-b6dac7009c16", "value": 1109810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889763, "uuid": "ef3cac36-7ae6-4b7a-98b7-bb5705548eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889763, "uuid": "c733dad8-5bcb-406a-8276-a576c25afc74", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b90025-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889764, "uuid": "07802d26-c3cd-42a1-ae5e-bf1a2d362709", "comment": "Malware payload", "value": "c3e37f31d36d98ca4a0595201410c1d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889764, "uuid": "cd65a284-f32a-4905-9480-b217e2c4ab92", "comment": "Malware payload", "value": "5760108c797f6b2fb5745f43aff3d2d9e1fa8c4a96c2c60d2f028aecc48ae89f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889764, "uuid": "a5c01684-b01b-4c51-8c6f-ec78a6cb9bfd", "comment": "Malware payload", "value": "56cf0d077e3768dbc1eda6efbe291387130fce9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889764, "uuid": "06a1002f-06a9-4168-b075-32f969fe1832", "comment": "Malware payload", "value": "fc9bd0d611acb42eec50eeb76c664cc9ce0cb8efddb76de794b20eaa2cb051ca4742817b5dc1322869fe15d27076a8f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889764, "uuid": "40587eee-730d-4e54-a969-20a00aba1708", "value": "T1A1653323B5D090F8CC4928370199E675CBB26AF726F6A6759FE80C6A1C314926F1FF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889764, "uuid": "b3082b84-bb0f-459d-b67a-d39395e481fa", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889764, "uuid": "bae93975-5470-4e66-ab3b-7b7da624eb59", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lAN2kwSk6Ye17lo:7E2lVL3Ze+/F5ndjFWmrjyx1cmNk7YKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889764, "uuid": "94b91138-af1d-4210-81a4-ed85e09777f3", "value": 1412196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889764, "uuid": "461af690-bac3-4c9c-83e8-2a51744a375e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889764, "uuid": "8366ad54-f7b8-4818-939c-a8345d457413", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84bbf43-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889765, "uuid": "1bb911cb-df79-414f-8c8b-834094d2441e", "comment": "Malware payload (Miniduke)", "value": "694f2dd6e152f53f2752e8303d97fc9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889765, "uuid": "e1460955-d48c-44e9-b165-d50b9a9971c8", "comment": "Malware payload (Miniduke)", "value": "5763c24bd008f8945e816388727efb4f4e282da42a1a4314e1cabf8c47cd7dce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889765, "uuid": "1272545c-7b75-4bcd-9efb-eb26d90c0a22", "comment": "Malware payload (Miniduke)", "value": "a8e4102f31ea9bd905177daa46f5688fba077445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889765, "uuid": "d165fb5a-69d1-4ffc-9ca4-8a465b9755df", "comment": "Malware payload (Miniduke)", "value": "d54fb47825c8c57e23ac0561c8239ad679e14a7aafe4a1794d815c491d93c0ec5d36b414209a16c55a9ee2d107139cd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889765, "uuid": "0e0db313-2c14-4d15-ba04-7148e2ba15d8", "value": "T181049E3533E580B1E53316B46DF1AB72967EBC384A71858B9BA41F5F2E34A918339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889765, "uuid": "73a4291b-6ce0-47db-b9fb-8d1b6b267aa8", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889765, "uuid": "8285667e-204b-49d9-914e-acf3f8a1cd08", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZUYIWJkqR5Se:+/LhS0rKE/FLITo9mNIWWqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889765, "uuid": "48a8a65b-f686-4875-94b2-27a8768f5a52", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889765, "uuid": "bf298afb-0d9b-4d6d-8d6b-3d265cfecc60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889765, "uuid": "8748f4fc-7cf1-4bfe-b3ea-8d0712fd6109", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9dfb296-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889767, "uuid": "39decdd7-fa07-4fda-a315-47af8fcd742a", "comment": "Malware payload", "value": "298be74ee513b06d7d19db4925a1507e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889767, "uuid": "a7b08b66-2fb3-4dad-9cc8-4f89fe6512b0", "comment": "Malware payload", "value": "57d50c482b4db5d47fc51e0746fec5e8222b0e0cce7b97d33bb475caa312830a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889767, "uuid": "a39840d1-093e-47a1-b60a-8cf9b3993256", "comment": "Malware payload", "value": "77544269afee6cdc220d7f222933032412974e07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889767, "uuid": "d5dddb2d-3b94-4a23-9357-423c5086b92c", "comment": "Malware payload", "value": "e58445178931f5795277b3152230d08d8c0001d3ad75f08f0408f1209c67ced772b30fd5ae4485d73df81b655cb6d601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889767, "uuid": "402d9f89-c99c-4211-858f-be4a32bce650", "value": "T14E873319E25A12E8D86F60344053AF4BE177741A0752A7CB73E266443FEFBD0793A34A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889767, "uuid": "fb3f3cd5-09cd-499e-bb8b-390a93cad45a", "value": "786432:r8vXYpPtrg+MUdYjStLFBmh07FVNOtFvCQDdE:r8vIphzyGtRkh0dOqQBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889767, "uuid": "21abd786-9486-434f-9c94-89e16ec673eb", "value": 38350848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889767, "uuid": "1457eeba-9cc8-42ab-8a9d-18375a22aa6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889767, "uuid": "0e3638e7-bc70-40c6-b87b-b511b795b62f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8627607e-c851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891291, "uuid": "c8887d7e-8498-4e44-aafc-907e1f03b2ac", "comment": "Malware payload", "value": "58a65540fbf78088434ec65969f301e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891291, "uuid": "9e0cbdfe-7441-49b0-b4c4-4b17278aed53", "comment": "Malware payload", "value": "57f85cc0f7872f9649a7d0ca5fcd1b567725da1f9501fbfa799b4b8fe5df201e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891291, "uuid": "38ac296b-0307-4401-a503-82cd761298f8", "comment": "Malware payload", "value": "99839a310421db89f6d221e78e6c67b8a83e119b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891291, "uuid": "4599a0e1-453a-416d-b669-e36d3bdd5bea", "comment": "Malware payload", "value": "164890cb220d3fdc1f0f342a3c068adeec26798af0e49d858ec1c84d6b2ddc7db2bf4613f300b26c95e9b6f5362699e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891291, "uuid": "526c4039-a35a-4acd-85e0-7275bf1232b7", "value": "T1D835230B33C15771CE49533206871AA11FB3A7BD0770983A77E8614B1DF2944AFB9AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891291, "uuid": "c4486be5-2ee2-4ec0-b409-8643a15d6959", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891291, "uuid": "aa14e182-77ff-48ed-aa7b-e795f4d62472", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mWY:qE27hQs7tWVToP0Hs0/htDH3pGaF5+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891291, "uuid": "7ae25d32-b1dc-429c-92ad-6ae260e8d8f4", "value": 1137687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891291, "uuid": "1119f350-6cf4-4859-b92f-3eb6de9266fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891291, "uuid": "f0dd6dcf-9be0-4059-ab52-6a80374aa56d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7ddee5-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889768, "uuid": "5c8aca76-cc8e-494b-b626-e86ba0d027fe", "comment": "Malware payload", "value": "ca7d39a61a835d33bed1cf6888f85d9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889768, "uuid": "edbc863e-1fde-480a-a0f5-79602f977101", "comment": "Malware payload", "value": "586b2f3c962289f5637ee8316ca57144a62d50b0055ca4d921eabdd9e6fafc2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889768, "uuid": "781adc92-5ef8-425a-98f7-e72c53a1b0f7", "comment": "Malware payload", "value": "be49840ee580e31179c88c96ec18f7158a55caf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889768, "uuid": "dbc922ba-c2ac-4c57-8aa1-2ec7ed956652", "comment": "Malware payload", "value": "43ff5d5dfde504ee9ce6b26709f031859c0c07c79d8fd9f8d4cb5d92f12c76fd929f004f2979cb52dd197ec023fdfb0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889768, "uuid": "1a8bb2e7-aae2-4159-9899-d452c9197344", "value": "T166C33B13BE4540AFD55AC9F06CBA81697B206E254BB2AD0723C0BF5578B17037AF621F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889768, "uuid": "68e65719-ba37-4aae-b30f-a00167494f8d", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889768, "uuid": "eece152e-a71f-4c88-ba18-422112187e9e", "value": "3072:iyZCu2lhA1QZZ4kp4F9XzruuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuN:i+2AmZ2F9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889768, "uuid": "41e7b7c5-c3d0-45a7-83ce-4649f6b23f7f", "value": 125669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889768, "uuid": "c2332d14-8207-40f0-aad4-6756d140b157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889768, "uuid": "6b14baca-a0eb-423e-9053-75ea5db10ec8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb23e8e5-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889769, "uuid": "9cdadfd9-88ed-45cf-9f96-807ddaa4a687", "comment": "Malware payload", "value": "e3b210f573b9159dd9da06f7043f03dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889769, "uuid": "aa814714-7bda-439a-8efb-2943ada44ab2", "comment": "Malware payload", "value": "58c34ec52159ebd8e8477ff187facd878112114dbaadef0f2de6d7989d5752ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889769, "uuid": "fc8f387f-6e02-4430-9740-cacd6670302d", "comment": "Malware payload", "value": "d93f3f1cd445219c68874a506fd279183b6ba278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889769, "uuid": "f88fd74e-ff0f-45ee-8026-9b95321f921d", "comment": "Malware payload", "value": "ec6840b2aaf558a546d0fa761a5a5c12915b5d6ee4a46a1ad7b2d5f8064419d22f0aa87861fa14133dae11c4ca9897c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889769, "uuid": "b1539369-f1d7-408c-8b00-699c9a2a61ef", "value": "T10D9533650AE604A9E4232C3D32AD137BD49F633A4824DA9743D4CDF4E4B7970AED4AC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889769, "uuid": "05246080-2a47-4974-bdbb-6326d07f0c5b", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889769, "uuid": "2ba28424-eb6f-4310-b955-80bfdd37d576", "value": "24576:LuGtcjN3lRfEyB9MBhavuS5iavgJKUdeIhRHq9aR5iP3QtbMDynPll8w+VaMjPPl:fiB3ffDBvd8BRJO/2nPcTjXkAtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889769, "uuid": "e1d5d35f-a819-47fc-8aff-b110e96a284e", "value": 1955712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889769, "uuid": "a6f1f2ce-8df9-4b92-b0be-75027cedf432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889769, "uuid": "e33de758-7892-46fb-9831-20bb88f469f8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb9775d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889770, "uuid": "6c82b006-9d8f-40dc-a739-e51993c62a1d", "comment": "Malware payload (Miniduke)", "value": "4e970c589795c98cac0ffbbd6b1c6c80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889770, "uuid": "788241c1-65c4-4434-b022-dfbab78017bd", "comment": "Malware payload (Miniduke)", "value": "591c50d9bac4173f74c43ad5af4f9844b8920f1ae0a27f117841682a213757f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889770, "uuid": "4d3b490f-23f4-4a29-8589-c8ef9a66f4a9", "comment": "Malware payload (Miniduke)", "value": "20ce29a75dc6c9b285f7058d2f1989ca70e98fe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889770, "uuid": "2bcbd03f-df5e-401c-aa51-337310d610ec", "comment": "Malware payload (Miniduke)", "value": "fd534c242ac35c64ddfbd2a33ca0fa0aed68adaa7a97f475b785f19dc8cf22d0fb9d7c10c06b36716410d4e45336998c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889770, "uuid": "754aad12-3963-48d6-a7d8-554f82a31d0e", "value": "T1E7049E3533E480B1E53316B46DF1AB72967EBC384A71898B9BA41B5F2E746918339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889770, "uuid": "8c1a0a62-2348-4ce3-b594-88e5585f90bd", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889770, "uuid": "a239da90-9b78-4797-8d40-fdcfc2453b30", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZm9YIWJkb25Se:+/LhS0rKE/FLITo9mEWIWWbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889770, "uuid": "d42161f2-9a7a-4777-a217-dcaacd14ff1e", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889770, "uuid": "27d3259f-99bd-4b12-be11-7933799aa1d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889770, "uuid": "91e8d6ec-dc44-4b3e-a9cc-d3d2bd2e779c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421992c9-c898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921671, "uuid": "91e59baa-40d3-415e-a906-53298dbed05a", "comment": "Malware payload (Mirai)", "value": "5fa97456317e7cf86bc31d028d18b030", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921671, "uuid": "c457b5c4-fb84-49fa-a9e2-ce41631d9d48", "comment": "Malware payload (Mirai)", "value": "592a0212029d3b77c6fa2dd9da73eaf8c3656bc2f89b23edea61ae1ab22817a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921671, "uuid": "3abfe0d9-75df-4805-a1cd-4649ff3b7260", "comment": "Malware payload (Mirai)", "value": "6d4c76826eb83e9c265f8de305aec0beb59550c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921671, "uuid": "beefa268-7ada-4d2f-ad76-3e8c00ad3dbf", "comment": "Malware payload (Mirai)", "value": "4e989b1d21b325f2fd5de7da46d91c04e52394f8d059ff6e29a3065c4878ab68f665371ebdc994505fb485cd7d8be05f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921671, "uuid": "1e7043f7-83de-406d-a7a6-6f78bbf4f86c", "value": "T1E103F16EC91996C9E68FFDB5B942E3E663784BC8FEC9CD0210C2CF71434A11286256D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921671, "uuid": "9e623f8a-cf25-48f9-87cf-24197b7e0647", "value": "768:QcLSYkI4x1H4XK53Ou11aMFY8Pbch/F2k8WUOd9zO1SKnUD4uVcqgw099:4YI53yIb8/cMLYO4u+qgw099", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921671, "uuid": "bc7e0e37-80fd-40b6-9a6c-c0416e835d88", "value": 40164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921671, "uuid": "3924c358-8bff-4aab-8e5f-760daab0f8cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921671, "uuid": "14d24e7b-19d7-438f-9397-a88233f6ee6a", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc90ba5d-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889772, "uuid": "c91ee18e-8962-4969-bad9-eb77515d6b1d", "comment": "Malware payload (Simda)", "value": "264bf6f8e62e28731a98853097bdb883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889772, "uuid": "3b44de54-4cbe-44eb-876b-470ac1f23abc", "comment": "Malware payload (Simda)", "value": "59391a3197cef9e7792f17ceb5a4d435b3cadcf47999a70071d463e636607d85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889772, "uuid": "fe4cdadf-ffd0-4e38-b4b0-2e64521ad11a", "comment": "Malware payload (Simda)", "value": "7028056656732e8fd96bc86f972f0ec8e91d63e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889772, "uuid": "1c403b4b-afbd-4ba7-a92c-7a4ec8264d15", "comment": "Malware payload (Simda)", "value": "2385ace04220b9af3471c8fdf56791edc8d61a818825d7869afdab5997c67123aa563c8c7fae74435e9efa9c0ccf574c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889772, "uuid": "7dc4d90b-5651-4127-867b-f3328c47aadc", "value": "T118D412E7A7548BAAE9571A33A94FC31E516853612F84E453EF016C2D3CF06E13D7B2A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889772, "uuid": "34ca11e9-d5f3-4983-93ef-5deffa62eb12", "value": "e7f2d5507b09bfb1c824fe29a99d8a60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889772, "uuid": "b5da0653-5000-4019-9e85-a30749f59237", "value": "6144:I+EqFQ9A9ty5bhJcrs0MurPw/c4hd/B/coyXT3nOGX6TK:I+U9qyFhJy56d/eoyXjn9WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889772, "uuid": "1f03667b-c836-40f4-99d1-08fbac6e1728", "value": 607402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889772, "uuid": "a6c8b80d-2ad2-41ce-a1f6-4f98bdaf584c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889772, "uuid": "f1a20e96-5bd7-46e7-9645-2faa1cf9d509", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3522a6-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889773, "uuid": "d87eccbf-3849-42f2-8782-540471cbb58a", "comment": "Malware payload (Simda)", "value": "190f46ce04ea7ca688fde0c76a1cd60e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889773, "uuid": "ffdc6779-90b6-4b8d-824f-008e3f285fed", "comment": "Malware payload (Simda)", "value": "5967b60ce21f1b4a010eee0780a2806a11278c6ed32b544f4293119da5dc5444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889773, "uuid": "02673cbc-287f-4d80-8381-f97426dbfdb0", "comment": "Malware payload (Simda)", "value": "98b2d3bae6d98d17ba0c2a338391e90f443805b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889773, "uuid": "e4863188-a2dc-4b47-8d31-2e22d130c846", "comment": "Malware payload (Simda)", "value": "b1dda066765a97513ac8f739782ff01204728fe9e4588c0442a601b50d7f590ea0d154a7c20c4ac41403b47670607fc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889773, "uuid": "5231c312-b9a1-4828-8b43-e7c516d64c8c", "value": "T13E848E21F1C08079E4F5157096FF7A5B246CA9B6472838E7E7986EC928741F27A3C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889773, "uuid": "71d4276c-9405-4788-9d5c-69181cbdbde6", "value": "173abfa8f7d7adac2a90a2e42625b7d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889773, "uuid": "4765a740-6656-47bf-8175-60dc72a37ad3", "value": "6144:fX3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:smWhND9yJz+b1FcMLmp2ATTSsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889773, "uuid": "f96011d1-f1c3-4f0a-b6c4-6a68335350ab", "value": 387484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889773, "uuid": "274326f0-6a92-4e95-9a3d-b95e0540ba46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889773, "uuid": "a678c5c0-2e86-471b-9b50-22a058a044e6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde5adfc-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889774, "uuid": "45dbe6bd-b0a0-434c-b2f3-f5bb0590c814", "comment": "Malware payload (Simda)", "value": "cd90b03d624e14509e34225e5458cb05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889774, "uuid": "aa837af1-1de3-4f4a-95e5-c46be1b99a73", "comment": "Malware payload (Simda)", "value": "596d2c81d2c59e581560d575f8f6b91d654667d09cd86376267577f7fda9b420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889774, "uuid": "e41d5b0e-adfb-4b14-a43b-5c57b078f068", "comment": "Malware payload (Simda)", "value": "274c85d73a710e4d8c9deba1ae76942333316ee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889774, "uuid": "d09adb04-3991-42fd-a833-5bcd422cfb70", "comment": "Malware payload (Simda)", "value": "c2fc111923fe9e5329c9044c45c19f29bc475e890d040001f84070f6684048e23794b5356b358aac3644b858012cad35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889774, "uuid": "664d0a7f-e77d-400b-9147-3f119e21d0c5", "value": "T1C3C40293F39A28E7C2200D3F12F7230711B74A615375C59BA641A66D3AD65C8BCE2637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889774, "uuid": "2163aaf7-5319-4131-a57d-a3b2b9dc0a9d", "value": "1c6c3b0bd56b7f130f1f283a88a358b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889774, "uuid": "a4a60ea2-e95b-40ef-b8f1-91c5f1e9bacf", "value": "6144:zpMoUX6dxajoPXA1nriwrw1cfCOSJcAb5:1UsxVY1nZ+b5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889774, "uuid": "32553054-00e0-488c-a50a-d9c5d7eb2bc2", "value": 594860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889774, "uuid": "6ef16e73-6dd9-4fc1-9600-514da994a8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889774, "uuid": "76c53826-491a-4af6-b092-83f9691d57a7", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe80aa78-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889775, "uuid": "247573f4-8e6c-43fb-aaf1-ae45c3154e08", "comment": "Malware payload", "value": "349225e96f9fc6c08ad39ea706401ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889775, "uuid": "851ce30e-3ef3-40ac-ab74-705a285dd3ae", "comment": "Malware payload", "value": "59787ff3c7d552def2553cdeb38877e92c4fbe06b2b809cf7d4e294d16409665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889775, "uuid": "44ff909e-5929-4ed4-bfa2-265e1a6c977b", "comment": "Malware payload", "value": "19f50537b0c57084e7f9dfe60d27d3cf5489241e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889775, "uuid": "ccac8f88-6969-4c9f-88aa-6e210d90cabc", "comment": "Malware payload", "value": "2a1849d426808f0a4f54af002f124ae12e5abb86402c00eb9e25fc04a2dd7e070be681c255bc14293055a9ea13455eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889775, "uuid": "66235edb-aab9-4756-9012-4681563c0400", "value": "T1F005122376C4C9B2C4021530034BBBB58E77E8B91B26D417F7D8076B6CB9858EB77A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889775, "uuid": "691e93f5-9cf0-4869-8e39-37e8d0132fd6", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889775, "uuid": "aa613a47-11b7-4656-8f27-d7ad4ebd3c27", "value": "12288:otKe6Zv23YnTjp0Wn91PsXeYmJMkaLqGDtlTwSD1u7r:K6Zv2KOWnLhGDjwS5u7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889775, "uuid": "ca911a92-3bca-41b6-974d-c577674945ef", "value": 819342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889775, "uuid": "1c229362-9b68-4143-962a-de5d03ab53fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889775, "uuid": "d449c154-0304-4de1-a852-edf52e3922f2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3081b7-c84a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763888245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888245, "uuid": "a61619d8-a517-41a7-9cbf-5821504189b4", "comment": "Malware payload (Mirai)", "value": "befb84c0c7c517a77c06f6d057a78322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888245, "uuid": "6d18f31b-645e-4657-ad95-97627c27d259", "comment": "Malware payload (Mirai)", "value": "59908c0577a586ddd9b6f053e93b8b3aea41286878903111966501e49fad2612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888245, "uuid": "67ebf760-153c-478d-9b02-2f998f453044", "comment": "Malware payload (Mirai)", "value": "0d896b58e475a854fb2b08ff7b32129d89892f73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888245, "uuid": "2a978524-97af-4bb0-b20a-207faf565f90", "comment": "Malware payload (Mirai)", "value": "f357f150aa63c9c95c113dc76e83aff93b6d051179e255ec44c31d213f86db263a09225e06f71476ce40fa866b662f48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888245, "uuid": "12f67d2e-556f-47ef-867d-7b6ac5f83eca", "value": "T102242A45FC529F13C6C626F7FBAF018D3B196BB9D1EA3102DD256FA033864DA0D2A245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888245, "uuid": "31c92865-635d-49d7-93f4-aec87cb7a405", "value": "3072:vGQ8qlnBlQsYMX3fWFwHwt10KRV42AzGSxqlXywAMLW8Esi:vGQ8ql9PYh1tD428GScxAMK8Esi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888245, "uuid": "9c2c6936-2c8c-4ff0-9daa-296e2e31fa96", "value": 212944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888245, "uuid": "c993d8af-b061-44da-aeae-86937a735aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888245, "uuid": "f6349c41-61ba-4b1a-ae2a-c41c78398ca2", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5304b895-c85f-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763897218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763897218, "uuid": "9c4e896c-54e8-46a4-878e-ba9eabb80254", "comment": "Malware payload (RemcosRAT)", "value": "2587661327724f173f161cc068f86b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763897218, "uuid": "023a4ed9-bafe-4075-a583-8afe8fa684db", "comment": "Malware payload (RemcosRAT)", "value": "59cb6e7cfb70b9dc153d05e27447f8029302a33db20f53b236017995f58ff7a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763897218, "uuid": "a1040afc-ae0b-4502-a968-8ec2bdf9e5ba", "comment": "Malware payload (RemcosRAT)", "value": "119cb0283efa16685efc979a1e593c51f7712b35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763897218, "uuid": "d299348e-22bd-420e-af08-78e0a1f104f4", "comment": "Malware payload (RemcosRAT)", "value": "650ebb656675b9d08b3a82fde904d2ca4aac137ffed6327fd88e3d6c16e166f43d99e92a0a62ef78b4131a815af8b116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763897218, "uuid": "043c0319-d96e-4a14-bc64-e315e17ee751", "value": "T104151294372ADD02D4526BF01C30D3B556759F99E912C343CEFABDEFF82824669183A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763897218, "uuid": "30a6d2d8-4624-41e5-ba15-d087d1430771", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763897218, "uuid": "a0777371-7cd3-4a68-afb7-5d27875c770b", "value": "12288:TKTXcEN2RTcuh3RYJKbrD83HV0gPE6tuQFmlFlsKotbQ4JYSOwrI:mNNRu9RCK76HOgPE68km/lsBhYSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763897218, "uuid": "f21f1f51-8a25-41c2-ab47-c3a2a4105857", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763897218, "uuid": "2eb48a81-d0f6-4ec8-adec-59743959a59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763897218, "uuid": "997f2d01-1b96-4d84-ba01-e652a713eef9", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4813d3-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889776, "uuid": "14f0bbc5-bb64-4248-aec2-1b2cfb5b8d79", "comment": "Malware payload (Simda)", "value": "8deaac657b7791b0025cd085e14a2357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889776, "uuid": "69fa0712-4808-4c66-b076-6e67c29f9855", "comment": "Malware payload (Simda)", "value": "59d16811cc0a1c0caf3a05f043818b61e3e99c6df7476e91f8bb8fa30e188043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889776, "uuid": "53b6cbde-2dd7-4bda-9c7a-bb39ed3fa11a", "comment": "Malware payload (Simda)", "value": "f1f616042432429df45e4f789c46bf6009eb9982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889776, "uuid": "2f1e6c75-bbbf-491d-9236-521609be250d", "comment": "Malware payload (Simda)", "value": "ec3ade5b3f87063b8151ba89d95b9c2ae09aa495cc044dbf93d558b4319b99ffd9872eef054ef50c54df38a6bc1d4129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889776, "uuid": "e4e979dc-3463-4237-8deb-d09834804973", "value": "T19F14014374594342E23446B098B7BE62C97CD54E3A79113B3C2C555A2FFA3839CA16EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889776, "uuid": "b07f581f-7162-4fb6-9d42-dc706651e153", "value": "19369dbaf9a929d28a39d7c43e1ec6f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889776, "uuid": "b00b5bec-2a1d-4590-917b-eea1c80323b7", "value": "3072:J8nh2Hrp3Tlp+soN3BY2ZBHetwcyf1w5DYRZPQaQrhu8ihDNugrBVgc8gbmT2Pcs:unw9lEs3hhyaubQTkhbrBVL8gbmT2Pcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889776, "uuid": "9f7a51f5-c2c0-41cd-98f9-d6baed3ec3c3", "value": 207376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889776, "uuid": "fdb0d8d4-3639-4319-83a4-70a296d9bbed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889776, "uuid": "5e2c690b-4e5d-4657-9d13-bb3afb0ad543", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285ddd4b-c891-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763918622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918622, "uuid": "b83f2252-8bce-4d7a-949d-134c0555eba5", "comment": "Malware payload (Mirai)", "value": "2639571ac099c1be700f0d94889820dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918622, "uuid": "24057162-df78-4d82-9e4f-cff14e53287c", "comment": "Malware payload (Mirai)", "value": "59df147cf8b3ba79833010be75d42b5deec66c09fcb2b4540ec5eaa620566cb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918622, "uuid": "78d31855-0a0d-4c00-ad6a-6c1235b45de7", "comment": "Malware payload (Mirai)", "value": "cca3200d6f65ba9d5afbad816432fb1bd0d02089", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918622, "uuid": "b325a2f9-1b0c-42ec-a4d3-3aa27a961f01", "comment": "Malware payload (Mirai)", "value": "e1fa92088522f92cfa517d59cc0c8b632b83e9fb1f3737a4a8f49ea9587ad264a82da7736f89344e54e6e6a07640e133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918622, "uuid": "3435bd91-07cd-48e4-8312-75aa1da513fd", "value": "T15E537CC6EA83D5B6E85700B5643BE7378777E636403CEA07C798E936EC12601A62635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918622, "uuid": "31751c81-8c9f-4b52-8660-7935c3fdf528", "value": "1536:rpN+PV46xWvxVrDQsG/YQHq/OU/sSpXGL:TUBGxBD2YIQv6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763918622, "uuid": "b6574b4f-6f14-482e-9af8-651849045bbb", "value": 63028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763918622, "uuid": "303e9879-236a-4c52-9476-a8a2835e47fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918622, "uuid": "06413c96-3570-49c8-b01c-648cb74b9bea", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd466a6-c84d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889777, "uuid": "4f33e714-ae0c-4373-8828-0bfedd4127fa", "comment": "Malware payload", "value": "543167f6fe057b6fd30d7ca40f12476b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889777, "uuid": "c34ef181-2c65-4af8-bcf4-e36dffcabebf", "comment": "Malware payload", "value": "5a3a16354fc866c4047bc6a91ae249f79efcb15ebb7103af90cb042a595c515e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889777, "uuid": "50d4819a-d1c4-4728-8046-91d5855ceba4", "comment": "Malware payload", "value": "282beef4ff0a2e9b36ae4e7627df100c5e9240ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889777, "uuid": "6e22005a-7f25-48f4-802a-026d59872552", "comment": "Malware payload", "value": "91780ef4349b01c0205b9edee830efe20a66d5155cd0b8478f42a01fb793afc19a3115a8f97e427d5771746a10f4fa08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889777, "uuid": "6c6fbbfd-1651-418b-8d56-1024efcbc072", "value": "T180B1CE02F7F3296CE5B79A3446B75A36B039BC205D759E3B5690E2382834D106E70F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889777, "uuid": "3a8c560c-26b6-4611-a3eb-64e626f98029", "value": "48:6aAHS9ObhBtyclUiYbkTAGaUDSlRdQyNwaRHkREt8oZWygFpjEuP5Wag:FASK/ytiYbHGRwIaRHlSkW9fEuRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889777, "uuid": "71673eb5-1539-4771-96af-e3e0dec1cbb1", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889777, "uuid": "91e083b3-74c7-4f17-acbb-cea1c3e83816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889777, "uuid": "6aee0986-ba9b-4783-815b-de88fdda6633", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32d91f7-c82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763875100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763875100, "uuid": "c25be5a8-8249-4202-909d-21293445de69", "comment": "Malware payload (Mirai)", "value": "5eb38b01fecbf41d5709670844635709", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763875100, "uuid": "b30db939-14a8-4303-b1d8-71843abba20f", "comment": "Malware payload (Mirai)", "value": "5afee3e75282f8a0845b3900d7ef59d0e2583d8cc46116b9fb1782fa3abb8cd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763875100, "uuid": "c5ac9404-1998-4439-8740-4964f9e92310", "comment": "Malware payload (Mirai)", "value": "f41f2b4475754ce6846839377f36e4baafb8a917", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763875100, "uuid": "16785b83-6a02-4e5d-9d83-2e595a5df50e", "comment": "Malware payload (Mirai)", "value": "fbadf8110ae7f256dbe5beb45f28549a64e62f55be6344087a4196c4a200f7e1c1f6cda7c2d6e06426695fd42b47709c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763875100, "uuid": "901e9677-e6cf-4734-b894-e0d655834bc8", "value": "T163C3F609EB610EFBE86FDC370AFD070525CC651722A87B7A7574D928F64A24B09F3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763875100, "uuid": "c034207b-02c7-47b7-888c-8d99f90dfc70", "value": "1536:QWeUSZ25Dy5uMePxR0hFX52YuwHW2qDOUu3up+5iQ1vZZO2WNEMvlOKvj8tjlBq0:QWeUSZoDTR0VAk5iQ1Zdgju5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763875100, "uuid": "4b8ad8c5-f02f-4eef-b457-b319597a9396", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763875100, "uuid": "02443282-1f7e-4a17-89ab-73228da5ff2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763875100, "uuid": "bbfc073a-7767-4821-bc45-4523f27a1ee0", "value": "Labelloperc80.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00749a2e-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889778, "uuid": "ccfba379-30c4-41fe-9b8f-50e928e4d7fd", "comment": "Malware payload", "value": "8005a3bc639ffea818702ef6f8a4a308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889778, "uuid": "e47f8fe4-1767-42e2-a7db-24415d97c62b", "comment": "Malware payload", "value": "5b0a2872ebfa4cf6fc5ee885896a292b43146cd26606ba4b3b8220728085dc09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889778, "uuid": "6ab2a21c-9bd6-40e9-a6b5-057877367e73", "comment": "Malware payload", "value": "64d39723d11b9531301c2e178d65919792b1a45c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889778, "uuid": "6c3bfc18-aa32-416b-ada5-3abd879a9f68", "comment": "Malware payload", "value": "3c7982b73cfa66b3b0edf47418739174d066f19a628b456601d0312b26253024bade9cb4b2dc21528ab827a946221c01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889778, "uuid": "b8749e1a-a571-4294-a6d3-d88d94504342", "value": "T1D625234E07C22A59DFEDA3B68B46189125A337DC4764B83A771CE08A03F355D5EF80AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889778, "uuid": "a496bf98-361d-4f51-8ab5-585e4e548d2c", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889778, "uuid": "609f9cff-6b31-4618-aa22-fe670aa30898", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFyjV:+YhQs7tWVToP0Hs0/htDH3pGaFyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889778, "uuid": "e41042f9-7963-42cc-b3ee-68bd38dde7c9", "value": 1028407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889778, "uuid": "c179fe27-815c-4641-bde7-0c4bc9f635c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889778, "uuid": "fe83dfca-ea46-4132-875a-0fd64d3d2c3f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012ad3a6-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mydoom)", "timestamp": 1763889780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889780, "uuid": "7a71ed34-3677-454f-bcf5-4efe6534d08d", "comment": "Malware payload (Mydoom)", "value": "6152738753683753fff5e45ff6c6f53c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889780, "uuid": "0b5f5644-abe4-496e-9e3d-0afe468c8e4d", "comment": "Malware payload (Mydoom)", "value": "5b25f40581f5b9d2ce722d35731a75cc4d6ca0b41579670336386df557d5e192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889780, "uuid": "f1e94d2d-6034-4ce8-9dee-a24a8abde69f", "comment": "Malware payload (Mydoom)", "value": "157b1f663dde902201b2ebde668f0d96d7cb827e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889780, "uuid": "a66a2727-5d23-46c9-b764-1ae972ba2646", "comment": "Malware payload (Mydoom)", "value": "d7f4861a20f13de4e054dc6e9a563a6346e2c2aa516485b3ae4621b1104cee0b22965ae9e45067744f7e51c91b63b6c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889780, "uuid": "adb0c0a1-9442-43f8-bfa0-d63ded5d7ba8", "value": "T13854CF2171D1C2B3C4B6043544E6CB395A3A7032077996D7BBDD1BBAAE213E1A7362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889780, "uuid": "8d2e194c-d04f-4ed2-b31e-0c1bf0ee40d7", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889780, "uuid": "ed60711e-909b-498d-b1cc-b4acd4d01155", "value": "6144:rDKW1Lgbdl0TBBvjc/Udmz6GdlfU+Dz2WglChGKWxhU:fh1Lk70TnvjcAmWGztSP2TW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889780, "uuid": "927dca73-e9b5-4d65-8269-e30231e8392a", "value": 291912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889780, "uuid": "db060975-e7f5-46af-98f9-3d033790064d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889780, "uuid": "3b267460-d076-45d7-8f38-291d8beac024", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38dbe13-c854-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763892629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892629, "uuid": "cadd23eb-5a05-4b54-afcd-2541d0b44439", "comment": "Malware payload (Mirai)", "value": "f6eadf5b3abf558056c1093669983b2a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892629, "uuid": "e6583adb-d066-4df6-bc16-0dc4dd8ef1f3", "comment": "Malware payload (Mirai)", "value": "5bfd06796042180974d845a4f02101dedbb2649af20493895f6d48c010d6291c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892629, "uuid": "b6e7b181-8497-48b4-8021-58f72111b886", "comment": "Malware payload (Mirai)", "value": "8f185439ff0a9d4fb13ffd4e01d25f7f76268378", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892629, "uuid": "d6efb2e4-8f93-4bee-ad23-44b0ae6a209c", "comment": "Malware payload (Mirai)", "value": "f291e45c6776a52bedb69e1149ef6f9da74da5116af8ebea58e72059c3daa6d88d8567179e16280ede4ddbc1f9a10f7c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892629, "uuid": "b5e8df58-42b6-493e-970e-bbfd14f89abf", "value": "T1740133DEF27162A206848DA5B0694864A534F3D833704B1ADCD604FAC4E574831B7E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892629, "uuid": "1725ed76-f19c-4a6e-93e0-56b8f962a085", "value": "12:yhGYrNIl5Z0LKB+OF+jMuTtjiSOZsteA7Vn:bYrNI7wKB+I+jzT5il6teA5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892629, "uuid": "867c9b82-d8c2-4f83-83b3-8cffb8a6fee4", "value": 822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892629, "uuid": "4f0fe2e0-f88c-422d-b93b-6eebc5d545b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892629, "uuid": "9100d3f6-8499-43d2-87e4-3db186583890", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01df0f47-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889781, "uuid": "e393d0e6-68ea-478f-b2c9-a15dc54a75dd", "comment": "Malware payload", "value": "b693e9f912a37122268d875647fa0a1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889781, "uuid": "7db32624-b93d-4b98-9028-c4ac12f697d8", "comment": "Malware payload", "value": "5c33db59e86d2f5208654705fcb4c2e7e36e8ce5e36d37be9dea1e721cc13d1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889781, "uuid": "9bc12e7a-1f85-4fbe-8f9c-e658c121e6ce", "comment": "Malware payload", "value": "e286c68f27be1c94bdb5f0700466054a012fbdad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889781, "uuid": "1f9d6b0b-81de-42c6-bf50-09103f8e417c", "comment": "Malware payload", "value": "7b192a41dbf28981645f13cf460b9e5383e2fb7e7409425071a9338eab8db2627dc5c6d9dc922fc0409efff2f368d24c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889781, "uuid": "09db469f-0059-419c-9d6a-dce4dd8cf0f6", "value": "T1D005122376C4C9B2C4020530035BBB75CE7BE8791B269417F7DD07676CBA868EB27A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889781, "uuid": "af4b6aa1-f265-4b11-9d55-5f5cca2f64ed", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889781, "uuid": "16331bd2-9622-4831-905c-a6af7785ec14", "value": "12288:otKe6Zv23YnTjp0Wn91PsXeYmJMkaLqGDtlTwSD1+kX9:K6Zv2KOWnLhGDjwSU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889781, "uuid": "8f0e063f-e694-4d6f-ba52-11fe838c5596", "value": 832056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889781, "uuid": "1567eab7-f907-4b6f-a82b-8ff592e8a4aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889781, "uuid": "eac5b760-2613-4a94-bc73-79b65e9c60bf", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02757f33-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889782, "uuid": "57217ad3-5240-4683-a658-9026c2aad8e2", "comment": "Malware payload", "value": "280e011af9bdc410824debf5811522cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889782, "uuid": "8f40193d-d5a7-4b56-8775-c8c7f9a5b7c8", "comment": "Malware payload", "value": "5c3aa0ccf2554c1cf8d4072820c9423fa2e5d8d6d66a830a4db0828a4c97ebdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889782, "uuid": "285b1ea7-ede7-40d6-a2ab-66bbb2032c9b", "comment": "Malware payload", "value": "49fa4e7a2c7c957ca38e0ca187fec2b51dd0a1dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889782, "uuid": "57bd9f0f-6fe7-4df1-89fe-a9c312a2fb4f", "comment": "Malware payload", "value": "bb9555a4f4f057cbf81018d0292369139833e0628e66682b779728ff99af0de9739fb46607e0a640f0fdbb532eae5f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889782, "uuid": "b07d1508-c04e-4bc2-a94a-87ae7888ebe8", "value": "T17E249E7773C085B3C84605300257AB769FB3EA3A26719457FBE45B272C70950BF6AB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889782, "uuid": "4585523b-d383-423b-9546-99dd20016064", "value": "3072:MtKe6LMiDdv3mn37rnOgybD00Lb/hN9na3Tb:MtKe6YiDdv3m3mgKH/9aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889782, "uuid": "9efcefcc-5ba0-4d78-8840-96ba9efe9ecf", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889782, "uuid": "abf0b897-1243-46e7-b918-c753b9657914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889782, "uuid": "5513ad32-d556-4a9f-b5b5-8810736c4422", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771dc29b-c898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921760, "uuid": "82bd8b7e-9ab4-40ff-9918-8d8c9de206d6", "comment": "Malware payload (Mirai)", "value": "231f93d3bbbbc4248621a94dfe9bb303", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921760, "uuid": "97292e63-6e2e-4121-b6f7-e296641a9575", "comment": "Malware payload (Mirai)", "value": "5c5e5f346e7f95bd7bf0f7ea6de28cf7c31be27a8ba634b6aaa2ec929d3f675d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921760, "uuid": "2c94fce0-cc57-4841-b10a-5f3830d28ec0", "comment": "Malware payload (Mirai)", "value": "b078fc2c22504ff3e65afff42319fed47404ee07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921760, "uuid": "7875077f-5915-4220-ab04-377d6edbe788", "comment": "Malware payload (Mirai)", "value": "2aa18589bed0824ac1fa7aea76ecb1968d8df5959ca9f4d66e83dca33794c42b842df491f7a7059a55ffa26a05131f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921760, "uuid": "7a2cd91d-75ee-4c93-b086-153a7723f15c", "value": "T139834B0273580D43D1671EF02A3F37E5C3EBD59121E4FA89660E9B4681B6EF2158AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921760, "uuid": "ac1c4264-6fba-4ba5-9225-c561f8316e21", "value": "1536:VcV1nMuBeb3NxEdoKOFu+wmC2oyntcT55:VcHZy30GFMm/o55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921760, "uuid": "4327c03b-d29b-4363-91b5-21c4cda3a9d9", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921760, "uuid": "7ccb6456-1163-41b7-b81e-8c250641df23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921760, "uuid": "2d5285be-5bd1-4413-b532-dd1af6f20515", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034f1d9c-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889783, "uuid": "b393aa23-6c3c-4f5d-a084-1f64fd5842fd", "comment": "Malware payload", "value": "9a95c38c95604dfc96df61a950335473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889783, "uuid": "8cd9e332-d8ac-40f3-a127-be41bf6f817c", "comment": "Malware payload", "value": "5c8340fc45704932f766a7f89cbabbfec5ad35f688db609a590267e150bdc639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889783, "uuid": "3727cdbb-acd8-4e8b-8fc0-1068bc99cfb4", "comment": "Malware payload", "value": "87360a44d3bc7d7c1aac7f8c8a0adbf34b2e13f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889783, "uuid": "45e7bd0f-17c4-4371-a182-bf7664f4f452", "comment": "Malware payload", "value": "60b8ac4ddfff51aff2e17b26ffb2bb564170bce60913a083cf7208f0c54faac9852836ebac671604d33ceaa68f6529f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889783, "uuid": "b4d642e5-8ef7-4361-8f75-d388b69cab1a", "value": "T1F045336929A2AD58FFB69FB9430C0E095D9023841F5EF8156B48BCA651E24F3FC76331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889783, "uuid": "fdfc85fa-c49a-4927-ade8-b2b29953f039", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889783, "uuid": "0e25c987-b62b-4936-b83f-4f22a7a1f413", "value": "24576:+YhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iWtPWnQKPl:+YhQs7tW2zku73bFgVlRlbN01TQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889783, "uuid": "596e20d8-45d4-4cdd-bcc2-81a8d3cca2af", "value": 1260942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889783, "uuid": "43b42b0d-28b4-46bf-b104-176ab17b8fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889783, "uuid": "c56c2db5-2ae1-4f4f-a6af-a18e2eae4027", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e403aa27-c8ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763936546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763936546, "uuid": "dc86bdd8-568b-4735-b0be-0ac49e15cf1b", "comment": "Malware payload (Gafgyt)", "value": "5ad0ef8d1dd4be9ecd64536af0c566ff", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763936546, "uuid": "fe09284a-419f-4faf-b4ce-ba1b75f27c4f", "comment": "Malware payload (Gafgyt)", "value": "5c85852fc85ab8ec1d54ea6e60a8b50ad79c364d823559f264cddd372457064d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763936546, "uuid": "7c90f39c-bcbf-43c8-abab-bcea51e600c7", "comment": "Malware payload (Gafgyt)", "value": "f667e228df18d514cc6db3baae79bdfe19fa9cc8", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763936546, "uuid": "6eccc653-9a1c-472b-be56-56a1068ae790", "comment": "Malware payload (Gafgyt)", "value": "9998bb394b83d4667178af7b10c0169edcd3d3d93537a2328d232782dbb8820fdcc6ba925a534ac445afe2712dcd5579", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763936546, "uuid": "8775fc10-30f2-499c-8c79-ad7cc2bb4261", "value": "T1900171CA50D20A347CE0E82732AB851876C4659A58CA2FCCBDDC74FA90DDE4EF144783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763936546, "uuid": "f83fc5bd-adcc-421f-b645-81f6c9284bed", "value": "12:fKU/KYfm/hEKSKU/KYfm9H0KU/KYfm+90tKU/KYfmliw0XYKKU/KYfmpf:fXtm/hIXtm9H0XtmbtXtmliw0oKXtmpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763936546, "uuid": "6af4a2ac-b8ec-4012-83d1-a9fb5eaf7874", "value": 807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763936546, "uuid": "53bfe2cb-58a8-4d1c-8ae2-666aeec437b9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763936546, "uuid": "bc4f89a4-9685-48c4-843e-a2c4f69e0163", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7349c396-c898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921754, "uuid": "4c9e56eb-8ea6-44f7-9bfe-ade65930b92d", "comment": "Malware payload (Mirai)", "value": "695e98b771e82e9e193ff8156e33d66e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921754, "uuid": "3fad85eb-5bc8-4e80-b33b-92559d47e4b8", "comment": "Malware payload (Mirai)", "value": "5c88463550be10ea06d7174161768f19c6fb538571b562cc8e2154d3be5e95c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921754, "uuid": "64e1b6d4-2508-4046-ac23-76152fe4adca", "comment": "Malware payload (Mirai)", "value": "660963d8368b86fee8dc4ba60d14e07fc5260bd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921754, "uuid": "166b7a4e-4d44-4caf-a53e-b5f12b31e31c", "comment": "Malware payload (Mirai)", "value": "8d2cb3dd71c8d1319fe5efbbd8f2492ce60ab79fcd9ab264584774cafd3c2cd62653e5331f89c585a2e3bd279d05de31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921754, "uuid": "049c51cd-39a4-4264-9a64-4d3e3d3b7b89", "value": "T112933B45FC819612C5C513BBFB2E228E376663A4D2DE3203DE25AF22338659B0D7B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921754, "uuid": "98536897-6354-432d-bf95-01f3687ef84a", "value": "1536:UgkggYyJ63GKi+3BzJJRS8nP9stFRuuXffdij6GvNRC:Ugkgg969/B9lnP9s7VPENRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921754, "uuid": "d11e08e3-0621-4e26-a5f8-1cdb3d7cbc66", "value": 92260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921754, "uuid": "a1f4f5dd-246b-4764-9a19-515b9a8a2969", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921754, "uuid": "71eabd4e-4ff3-4d90-9db6-b68d0450145f", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451dab77-c882-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763912227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912227, "uuid": "b4a1df52-1818-4d4b-a688-1ab3e841f384", "comment": "Malware payload", "value": "fe259a38354a8e826d76ad23977a3ad7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912227, "uuid": "94bcfd49-0b19-4e7e-a42f-a9a0eb866a13", "comment": "Malware payload", "value": "5cc413a30c3cfb0ffe4b5d36a4e81278cade930501ace6734abb6948aa120f83", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912227, "uuid": "0be97b8a-8c8d-4842-9d05-6964101e3cc7", "comment": "Malware payload", "value": "357839734292a07d495c06d511ece814d27cc96c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912227, "uuid": "2e381ce1-873b-4c28-8b09-cc663d4f0918", "comment": "Malware payload", "value": "ccba021ff47ef0d677f3063066e5a9b4af1df0ff371e638ad68b92dc64e03807a4d9b5599ca7e6e08bdbcc7552222fb2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912227, "uuid": "e2895fb4-20e2-45a0-b649-cf42a0a71593", "value": "T1C45633A716801E03C1A6A3B92837C4429D2DADB3BB19052AF05F67E183E695DCFF5F50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912227, "uuid": "9c7a7dd4-c6e9-4aa1-b91c-60bc5ee52c53", "value": "9ecad17161342c5ed0725c6d520c5009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912227, "uuid": "7d78f884-d264-4d6c-91aa-0720aee56778", "value": "98304:d+/5Fp/LwjoG7wZY8T6qYupl7Y7qzU+aiIWqi0BuN2HtaZN:C1UjF7wZB6EBzU+2Wqi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763912227, "uuid": "8eecc16c-059d-4f7e-a7e1-92a9324656c1", "value": 5997144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763912227, "uuid": "f4e5b4ca-f36b-4cc4-9bbb-a1b1ba92670a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912227, "uuid": "3245a8ff-9ec0-426e-9c01-4cc40d56e3a9", "value": "SecuriteInfo.com.Trojan.PWS.Banker1.37780.15375.16150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e697ea-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889784, "uuid": "68fff1a1-efae-460f-b203-ccc7534b5db0", "comment": "Malware payload (Simda)", "value": "adb2c6369ba9b4be38cbe8f3245af348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889784, "uuid": "e38beeec-6900-4301-ba26-ee2f95de772c", "comment": "Malware payload (Simda)", "value": "5d63bea911b8c02e8bd99eb5c1e8120d4516d43ab25d754204d9313ee85d0e38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889784, "uuid": "4f4cb58b-2d58-4d7f-b0af-8da1bc265251", "comment": "Malware payload (Simda)", "value": "38bbe174f252d6904961897e8d5122b19fac800f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889784, "uuid": "c5d49ce2-65f2-44be-b4d5-d2b008034da6", "comment": "Malware payload (Simda)", "value": "21f31525bf35a2e7bfed8d8c1d085ee8ab5d83fb10cdf76c58277e0f1bd9517976d9e121ef4a1484d4f11364073cf7ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889784, "uuid": "9bf5cdce-c129-4a52-8f66-90852afc4b42", "value": "T12A848E21F1C0807AE4F5157096FF7A5B246C69B6472838E7E7986EC928741F27A3C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889784, "uuid": "b7f95b47-daa2-4771-b511-3408e53749fc", "value": "173abfa8f7d7adac2a90a2e42625b7d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889784, "uuid": "e2e002ad-df6c-40d1-824c-f7a5a90344df", "value": "6144:jB3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:qmWhND9yJz+b1FcMLmp2ATTSsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889784, "uuid": "8e9b386b-b030-4a4b-8a0f-459309510bd7", "value": 387484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889784, "uuid": "53338d5e-ad24-42b8-9916-faedf453a29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889784, "uuid": "669e2af7-50aa-432a-8974-ba86e33ab3d8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048cd2ae-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889785, "uuid": "d0073d62-0fc5-4a2c-a41b-b3d36f2b817b", "comment": "Malware payload", "value": "abf41794d600760266af81cad1c0d3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889785, "uuid": "91a629fa-4228-49ff-a69e-f42173eb7239", "comment": "Malware payload", "value": "5d7d50d92a8a78b2edeb5a88c193e124cc3a781138be5857e00bb489d110db88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889785, "uuid": "62801e97-47f8-41f0-872a-0c478c64f1c2", "comment": "Malware payload", "value": "e5b8484b8e7f28f7552c9dfb77212cdeb24e618f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889785, "uuid": "89dda321-4710-4f07-afc4-9aeeb7dbe635", "comment": "Malware payload", "value": "917e959aa9797d953a54d07825a5e1439f74d86250a460e0e4200c69ccb91ab8d831d4c3fa184952715d26afe8dab2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889785, "uuid": "3de6e9c6-ec6d-4e88-9550-d4191338f258", "value": "T1E78533600EE2046AD8233C3E31AD0737D8AFB7354914DA979344CDE9E427D74DA94ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889785, "uuid": "a0eb27ec-77b3-402e-8cb9-22b4c90a1ec6", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889785, "uuid": "53b7f358-cf8d-4e8d-a137-d98853c69be1", "value": "24576:LuGtcjN3lRfEyB9MBhavuS5iavgJKUdeIhRHq9aR5iP3QtbMDynPll8w+VaMjPPg:fiB3ffDBvd8BRJO/2nPcTjXkAKWHs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889785, "uuid": "6d447d5d-f37e-4dda-ab7e-d069b7bd47ad", "value": 1840944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889785, "uuid": "58cde713-22fe-48d8-9153-a678b1672396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889785, "uuid": "f23d5628-4266-47d9-9723-1e39778620a3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cfec46-c898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921672, "uuid": "b49e5984-c5c6-4926-ae35-edf34647ba31", "comment": "Malware payload (Mirai)", "value": "ccb0ef256dfc765fadd4e1ae996126b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921672, "uuid": "903d7de0-26a8-4e36-8dfe-7c19fd6e0d5f", "comment": "Malware payload (Mirai)", "value": "5db94cabb4b0b15b59009ad712ddf60e4cb7b88e687ce72ce109a23ca1e836a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921672, "uuid": "b40872da-1ae9-459c-955c-1ccae82d2107", "comment": "Malware payload (Mirai)", "value": "47476d684350d2176adf69f285a524c5c21f7cba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921672, "uuid": "70690a08-8fc4-4073-9785-9f6e34620458", "comment": "Malware payload (Mirai)", "value": "8acb3c13c7a901eede638973b81bfbcf0a9845aac97e373b16683d8679909c22dea0f996fa505efad395d26d492b655d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921672, "uuid": "b8e13187-4d3a-4ea4-8e78-e06c07779c54", "value": "T1FE03E113D1695F18CADF61780DDDEB6B2698CA28CD04DBE73A413023E9B079A275DAC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921672, "uuid": "9c89025e-344d-4b6f-a097-61b7bdb912f4", "value": "768:1ytMkD57uIgMtSRXuXBS9DtE6/FkPWYnmHFWuCXGJ4KIYtrnUxGXnbcuyD7UHQRo:QtlSMtSRXuXBSlQ+amrCXGJ4KIYxnUGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921672, "uuid": "4c17f401-ab10-4b5d-b461-ee1ba480816a", "value": 39700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921672, "uuid": "1336184a-3171-4710-8345-f0bc3d2e353c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921672, "uuid": "c28ee33b-516f-4e92-adb7-9650a4972267", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055f63e5-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889787, "uuid": "608d7476-a85d-488e-8f74-68ef97990dbb", "comment": "Malware payload (Simda)", "value": "711779f77cc8e7bf9faf513166fa8596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889787, "uuid": "91904c37-78e7-44a4-a598-9fb2a98edbb9", "comment": "Malware payload (Simda)", "value": "5ddd0a6baacebde213217a0331b0deeec1fcbfab4103491252ca83b8b5bfce0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889787, "uuid": "b6e4d73c-9639-43f2-b27f-4a9bb148514c", "comment": "Malware payload (Simda)", "value": "2591901001db266acadce3c06d70007067835328", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889787, "uuid": "c555142f-1cb6-4146-9dc9-80010b128a85", "comment": "Malware payload (Simda)", "value": "b3042319d0b481824dcb1ed0dc6ce6ab1669a8e24f10860d7f362789b452a94542ac224bcfde0ac2e65e3042347f8e51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889787, "uuid": "5aba4e47-4351-48ff-8421-fdcfa1be9547", "value": "T1DE241252F38240D5F0695E7484F2BBE1A7ADED640150033F290C42A66CD6BE21EE97FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889787, "uuid": "8bd39517-1248-4104-9376-d98137683d66", "value": "5e00ef92140309dbfb33f494ea55f134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889787, "uuid": "6094d512-208b-4889-b5c9-bb364c2b0914", "value": "6144:0PlJAbSZuxf8+3AKH8yvjarYrTAxo7er66UVtqw2LlkL:+ySZw3AKH8Gj4ukxo7eGLgJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889787, "uuid": "a519faa7-8920-4159-a3dd-8496c798f1e5", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889787, "uuid": "2bee918f-510c-4b64-903e-9b70d983dfd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889787, "uuid": "3607da5b-eadb-4903-a16d-1d7e34ee6309", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0636f201-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889788, "uuid": "a0993f35-6801-41a6-b6cb-ecb1ac4852b3", "comment": "Malware payload", "value": "2e30bf1cb66cb7cf5c57d0b28e43dfe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889788, "uuid": "9cfa48df-d25b-4456-a4d2-4d33a4a0bb62", "comment": "Malware payload", "value": "5e0db768aa6abea005a483cce1189b8f9ffe2c96569008ead0b296fea15cf7bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889788, "uuid": "d171e3ef-fa0b-4e23-9078-f13990852144", "comment": "Malware payload", "value": "a4023682070e8483b20274357affcc2d1a5fe626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889788, "uuid": "e3339a2a-8aac-4f93-b4ae-780082ca4700", "comment": "Malware payload", "value": "d16698eace6d76d9901c7844dc0c21901684f9b23b6d5557db06dbcdf3032accde8a63f3966e4eaf8392f3d55e69a164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889788, "uuid": "5a955123-436a-491c-9fd2-2cd81406ffaf", "value": "T19FD3192563B419A2E1BF96B066E2021343F4A04B6B39EB4B3DCC53DD1F82F918953797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889788, "uuid": "74c0e93e-05b2-4e4d-9e22-3efef9e9f44c", "value": "3072:z0HnfXKngJWWKR7zx+rH68ZvDlOYbGKEC8Qz:oHfXkdWKNN+r3ZvxGDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889788, "uuid": "42328c8b-d685-47b1-83c3-6bd53e9d50d0", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889788, "uuid": "b80681fe-0885-4702-b49d-b1d101dc4b25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889788, "uuid": "c40c1682-c80f-4e0f-82dd-682ec988a53c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3523051-c885-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763913674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913674, "uuid": "eaa3e940-7aab-4780-98e6-009117e7d4a0", "comment": "Malware payload (Vidar)", "value": "afaf47ef22b89d14090c30a0df5c8ab4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7747", "colour": "#4D7C2C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913674, "uuid": "04fa9b77-7481-4b08-8a86-b8d305a38484", "comment": "Malware payload (Vidar)", "value": "5e22792fb30f86c5b1ca67f90039dc4d77ab0079227e5b28b3ba6eb0721f8e8f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7747", "colour": "#4D7C2C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913674, "uuid": "105992b2-bc98-4f08-9394-dba4299335fe", "comment": "Malware payload (Vidar)", "value": "1b10b42100ce632d64f290d39a81bf4afef604f9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7747", "colour": "#4D7C2C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913674, "uuid": "54699f2f-5982-458e-9baa-758916595848", "comment": "Malware payload (Vidar)", "value": "9ce7f08832cea98b0f644a43abe2a51f529aff9fce8b200d1d63740e8c642c5821072349c6c8478569dcb89ebe333f3c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7747", "colour": "#4D7C2C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913674, "uuid": "2af13094-7293-4973-8912-313f857f498c", "value": "T18CE633429A23BBA0397472C951583627BC1DB89FB2F316C35F72A6C11D75878D4AEC83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913674, "uuid": "8da7f6bc-ba10-46e1-8973-529bea64dd72", "value": "393216:1VEvUTWeITvw6kqWgzopHyJdbIpTMZo1aGwu:wlBcwopHyJdbI9rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763913674, "uuid": "661655b0-b667-4345-ab6a-bb1b348bb581", "value": 14774947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763913674, "uuid": "9978a331-1156-484b-ba8b-f1c996109f76", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913674, "uuid": "0f057c92-13a0-4341-a099-178c9ef5abfd", "value": "download autodesk fusion 360 full crack.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070394de-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889789, "uuid": "f5bb41f1-adf3-45bf-8d05-295547563862", "comment": "Malware payload", "value": "be8dc66e2c32a8d9a6c31ce14e155b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889789, "uuid": "945dc65f-da45-446b-8385-99772a08f554", "comment": "Malware payload", "value": "5e448fd1749712e32886e878c297d6daa2cd58dc088ec6a0d217989e3571f3e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889789, "uuid": "4bf398d7-c23c-4e95-9f9f-7553ff2fb80f", "comment": "Malware payload", "value": "bfaa63e71eaeea58ae07e9d64d02487e8eed6f82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889789, "uuid": "c2e86304-d35b-47cb-8532-1cc72b837282", "comment": "Malware payload", "value": "5d8a40a50b64389229296647a54eab9fb61b5332813ea08fa225ccf2e1a5bada81ef93ce9f5fa84ac5252021725c4f0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889789, "uuid": "1b03debc-0f6f-462d-bad8-aa9908514904", "value": "T187C30913FE61446BE5A6C9F19C3EC1A93661AF7E1BA15D47A2C0BB46297030379F120F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889789, "uuid": "daa72bc4-fd11-40f9-864e-9cef6e647b65", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889789, "uuid": "d85572a1-a70e-4011-b1c6-3147218cdee0", "value": "3072:iyZCu2lhA1QZZ4kp4F9XzKFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFM:i+2AmZ2F9WFFFFFFFFFFFFFFFFFFFFFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889789, "uuid": "45704f4d-8f90-4fae-a9fd-7285ed75d7f6", "value": 125501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889789, "uuid": "5f7d9a41-2f40-4462-ac35-ab8a00aa200d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889789, "uuid": "88bd7278-bab5-4ba5-bdc6-63dd90520c44", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fd6521-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889791, "uuid": "bcf46851-ae41-443f-bacb-23ac9c16ee1a", "comment": "Malware payload", "value": "22c9aed8e5f165c1df0368725bdbcab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889791, "uuid": "d98a1c39-0761-4f84-98c0-ff77f93f8e6a", "comment": "Malware payload", "value": "5e528db3998555338ffbf2f6118743fc1ad775d0a7c6a93b65327cae92b04f2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889791, "uuid": "0830a530-12f5-4816-ae4f-1ce0ae94453f", "comment": "Malware payload", "value": "210bbd30097c546f070ab2ee2f9c14488266f28e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889791, "uuid": "e6e649cc-394b-45a4-b340-aeb8c416101e", "comment": "Malware payload", "value": "d9cf48647bc4260759a26124380f6cbd89598a083fc788b25b15069b1b80ebdb6ab02b7af97bb3ee28681f04f7fd58f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889791, "uuid": "d98a503e-d214-4325-a1d5-0a25f6dae14c", "value": "T1AC75331673D288E6DE05163101D26DB58EFBD33C29786426F3F86507ACF2851AE6A7C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889791, "uuid": "f66ab249-c0e5-49ae-af52-894a13dacc95", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889791, "uuid": "c86a33cd-0fb9-4ec3-9539-8c0a08d72c32", "value": "24576:v6Zv2ivhBVnFys7xP86LXtqWJ/ej0umQf8/+1gFDsHLAgDmfluSTspfP6MAtD2tb:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxTsp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889791, "uuid": "8f139adb-0acb-4a23-97c7-e4c96e5f1295", "value": 1560981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889791, "uuid": "f565723d-4574-4efb-8e40-710bb34bb382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889791, "uuid": "75cc5e09-2adb-4f56-ba67-d018dfc4d9ba", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08db7f03-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889793, "uuid": "0dbaef5c-13a6-443c-9550-9844e929b9c1", "comment": "Malware payload", "value": "1ec7125188cbea89ad1eaa3e4fdc965e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889793, "uuid": "b7d4c10f-3b0a-4410-8cde-188dd4584f2f", "comment": "Malware payload", "value": "5e723131266884ce2de5b707e7bda2a90644cce2f6881b70dc8797cf52853e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889793, "uuid": "73ba93e3-6fbe-4f74-a3d8-6fe7b4ace5b6", "comment": "Malware payload", "value": "9147a37f8faf4625b6f796f0b35b41213ea7cc6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889793, "uuid": "8c3f5613-5a24-4f0c-aed1-53e756cb7b9a", "comment": "Malware payload", "value": "b40eb35d87f7bd2c000ad89f82b778593a7edad3c96ee134586175b7330b04f8cfff511c05413b9d657b0823ca5f8aef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889793, "uuid": "24cd2953-7ded-4fdc-a2a3-9503af724360", "value": "T17935234E16C62755CFACA3FA8A8618D1265327ED0794A839371CA48B03F364C9EF857D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889793, "uuid": "eef212d0-31e9-4c14-a6f1-8c7ac10d7393", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889793, "uuid": "55bc22e4-6833-4caa-90cf-29f97d303511", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mMW:+YhQs7tWVToP0Hs0/htDH3pGaF5+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889793, "uuid": "a3d51a69-1606-40ac-a3e4-8cf08d5faa5b", "value": 1084859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889793, "uuid": "a104c8d6-a7ea-4aa3-a3e5-1096717ac1c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889793, "uuid": "f81a2992-f12f-488a-ae6f-d59f3264a8c5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c0235e-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889794, "uuid": "5f2087f0-6949-422e-a26f-20554673fa0b", "comment": "Malware payload", "value": "66093482e726d1bdef546614e3fee6b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889794, "uuid": "96501038-1b5d-4f60-a201-c88b759715a5", "comment": "Malware payload", "value": "5e76d2469eae5d7c0a041712e3ee3b6c6dc0928b111a4e34cf2bfac53f9af670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889794, "uuid": "638d1821-798d-4a87-9d82-cff03f955d78", "comment": "Malware payload", "value": "dd755d505dc2151a04b3f6ae3d4260ddd80b4355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889794, "uuid": "9861e0ab-fb61-4b8f-9070-7de7dbb7fe05", "comment": "Malware payload", "value": "72612753f69cf2bc5431c84a0c201091e7e34169b0fd5f86a64fc0c8afc89227786918335aca251057eb087b3349a150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889794, "uuid": "088ca2b1-ed2a-4455-b539-76727312d6a0", "value": "T18285335DB6C148A9CE0D253401423B548EB7EE7C6EBE2012F7EE1A126CF1A51FE1DB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889794, "uuid": "df2560a0-4ca4-425b-b871-9fb84e2c8a31", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889794, "uuid": "8bc5da08-0000-4ecd-a57f-bc11ce120569", "value": "49152:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxsOeKG4pEQPoKtv:82kQCN/JT/kgFWLayOeyyDKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889794, "uuid": "35d06669-de2b-457f-8768-9310053e76d6", "value": 1855005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889794, "uuid": "e3a4f63f-904d-4cd6-a058-1c55d4c13931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889794, "uuid": "7816bb28-5103-4f49-80fc-06d36738ab7a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab076df-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889796, "uuid": "b7db4d9e-93b4-4d21-aaf1-d1dad3ff482b", "comment": "Malware payload (Simda)", "value": "ae7382c49086c8044806a3e34746f99c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889796, "uuid": "3fd79ad7-9ac9-4393-b444-2411a7ad4960", "comment": "Malware payload (Simda)", "value": "5e87ad5361fff76a10d1800b26b97a0b67180e5e169ae95e8a88adf6ded6ad0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889796, "uuid": "50c8f301-720d-4072-8e35-97ae82ef8cc3", "comment": "Malware payload (Simda)", "value": "845073c6308045e1173d11371d2124642aa37deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889796, "uuid": "79326e40-1f93-4c7c-acdd-50296338cd3d", "comment": "Malware payload (Simda)", "value": "c6230f7e58ecb88625b288d949a5a0b181f9934d935e99d8057c5de2a38d087d0e70a9e5b3d3326e56887625cbbd5a9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889796, "uuid": "82f7bee7-b9a6-4bcb-8f75-35a818ed07d4", "value": "T1D0D412E7A7548BAAE9571A33A94FC31E516853612F84E453EF016C2D3CF06E13D7B2A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889796, "uuid": "0d517756-e50b-40a0-9f65-c33170200b9d", "value": "e7f2d5507b09bfb1c824fe29a99d8a60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889796, "uuid": "1e78219b-c18e-44de-8441-acf97e843323", "value": "6144:q+EqFQ9A9ty5bhJcrs0MurPw/c4hd/B/coyXT3nOGX6TK:q+U9qyFhJy56d/eoyXjn9WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889796, "uuid": "0636b913-e14b-45dd-983d-988894185160", "value": 607402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889796, "uuid": "7c1a2153-6e02-48e1-bd1e-be426a097a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889796, "uuid": "63c18bce-9a8f-4eb0-99e5-931d88885865", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176a99e9-c856-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763893253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893253, "uuid": "06883001-6a0e-4ea6-b4f7-bc71387ba1d5", "comment": "Malware payload", "value": "0862c645f8690e1fcd8a139085f896c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893253, "uuid": "467fefb7-1ac6-43f1-8552-363cb316e270", "comment": "Malware payload", "value": "5ea325dcadbac16d5322bdda9006894e6bb196ce75daacd163eba205c01d633f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893253, "uuid": "bb8187b1-bee8-4acc-ad62-6d62e55e2078", "comment": "Malware payload", "value": "6b592a9694d55f0ed8a0c366898eb12576f51491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893253, "uuid": "d2197624-73b0-42c1-95fc-d97582bacf97", "comment": "Malware payload", "value": "9feb31205269fc26ae4e805d849d22fe7fdd13ef9bb4c9bcb73ef31f7b53279428b4cee16db252fdee56685cf91797c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893253, "uuid": "cf8577a5-8587-42cf-9eaf-1bde93f6ba02", "value": "T19545230B33C156B2CE8A537106432A611E73B7BD1770E83AB7D8A4071DF29447F79A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893253, "uuid": "edfacdeb-6cab-4846-a6d4-9645520811cc", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893253, "uuid": "6277a04c-76df-4616-83e0-50a8322453d7", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFDrtoI:qE27hQs7tWVToP0Hs0/htDH3pGaFdoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763893253, "uuid": "5920242b-0e84-45e4-88d5-dc9fa209f285", "value": 1168805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763893253, "uuid": "3a7c10e6-832e-4908-994c-dca36dfb8b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893253, "uuid": "6eeb65fe-f006-4f0d-8421-b957d09174db", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409319da-c865-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763899764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899764, "uuid": "5c36af0e-8cdb-420d-bbfc-94b6a7bc6acd", "comment": "Malware payload", "value": "15d9ca5d41eb51aae97610b86dbeb5fa", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899764, "uuid": "428809ff-d619-403a-a6e6-ebaa7d0ad994", "comment": "Malware payload", "value": "5ebd725d3b158d56d9629a6226b8d7cd3dae030cfbb7c4b506308f6d4c6b6eca", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899764, "uuid": "3ba1eb22-9af1-4469-a839-03ed9a164054", "comment": "Malware payload", "value": "50e0a36c7dff6d2af3fb9f16b780c1cec07e791e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899764, "uuid": "85cea30c-c464-45f2-b187-809469898dd8", "comment": "Malware payload", "value": "d6712629355f9e4cb733b64d8f1458c6a82685377b54931fa87e1a143ad475e6e8f79875b25c737f210bfaa0d6167ef6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899764, "uuid": "da6b0794-ce1a-4749-8553-dec61f929e07", "value": "T10C961203F74F492ECDE2B97C4A6313716615ACEC182092CB4A12F218BEB76E95F15BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899764, "uuid": "1e01d1e8-109b-49f7-af75-3212018d2136", "value": "196608:8r7tnA+E/4j1XZWnm/5qeBAOZWgvg7LZRoGlYK:8r7c/4janm/uO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763899764, "uuid": "1b45748d-7ebb-4e4c-b7dd-38f1e69f3b69", "value": 8864964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763899764, "uuid": "32d68562-ba7b-473b-9143-81c92b5506c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899764, "uuid": "115c5afa-bbb6-401f-a0ae-697cedff227a", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d3c9b8-c898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921669, "uuid": "25fe90e7-4e19-4bf9-8aed-ff9fb8ed74bb", "comment": "Malware payload (Mirai)", "value": "67e752e3c60f14161b70603bd0c5071f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921669, "uuid": "fe0f35c6-a01b-4afb-b33d-f07c12355d06", "comment": "Malware payload (Mirai)", "value": "5ec5e1e7a90dd14c7f212e3e032fe6a3cf12d584f790493de038f33c3d5fb34c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921669, "uuid": "b5228fc3-d6ea-4aab-b3ff-657919ba9af8", "comment": "Malware payload (Mirai)", "value": "fa83ad05f58377dcd41bf467229d3f8be8efe766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921669, "uuid": "0a22c8a9-c8b4-444a-b0b8-0ebcf2acf2b0", "comment": "Malware payload (Mirai)", "value": "226089f9ea5964706bedf9760c2464eb25dbd878bbbf7664c0139255b0b4dd025687ae5c031727c98dee15ad36ad916f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921669, "uuid": "97620805-e4d4-4830-8154-e58aa2e76438", "value": "T11B935C22B4391A3BC4E4943712F35326F1F6439A24A89B1E7E710E8EBF156D0364B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921669, "uuid": "07c513d9-bfea-4911-8e36-ac4f7da03fda", "value": "1536:yl5GrqkdLGkr/gzYeR9Xio3StnpYm5mwAtQIt295:1nY5VVCRpYO3195", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921669, "uuid": "85fd4eae-6d59-4224-ad20-e438d8804245", "value": 91968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921669, "uuid": "b12b329b-479c-4b8c-96c9-e9fca7fc0bfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921669, "uuid": "01284fd6-0dab-41db-b437-50cd34769a5a", "value": "windy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba66399-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889797, "uuid": "74fd6e40-86aa-4d75-aa33-3682ccbe3bc4", "comment": "Malware payload (Simda)", "value": "b527e31239c5de1e42a5cbc2b3db3e52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889797, "uuid": "e18a8ea8-9262-4502-9479-0c87e7689171", "comment": "Malware payload (Simda)", "value": "5f6b52e9ace72e85b26efc1947e4faf7d626e332d566549408ce3a7c08120339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889797, "uuid": "25a59c05-4472-4328-8fb2-2b82737dc438", "comment": "Malware payload (Simda)", "value": "76966efbe431a7872e6aa730d66e14525c8ac3ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889797, "uuid": "fc80d14a-6ff8-45d0-a314-2111049dcf08", "comment": "Malware payload (Simda)", "value": "3ea912858adea9750c7eeeaeaae355052fbc097801c76860993aaf11efc29dabfbff5e1a423ff603c49c2046a67f0893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889797, "uuid": "dafb0119-6775-4f1b-b8b1-53888516e7e4", "value": "T1B8C41211CB7009E3D1E65F3B89EB9B064967E471CB26C69B7604639DCCEB681BC30365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889797, "uuid": "aab234be-3116-42ad-a85c-d065bb254ae2", "value": "fc5c1aac18a83503e3cae0c72797cbed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889797, "uuid": "aa524724-7b2d-45da-9879-987ab2130467", "value": "6144:Wc6BtUaNMtLLowRg4uLhuMXUk4m5xnt0Ve:WjuaWLJgzLMkvoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889797, "uuid": "9d1b023d-5ddc-4229-abff-45f3e5ca8428", "value": 562170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889797, "uuid": "8758641e-d75b-4cc3-8373-b3958eb8fe72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889797, "uuid": "b64a7f86-3d03-48a9-bde9-1949eaa2a66e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c79b1d5-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889799, "uuid": "38075ae7-36af-40a7-b08a-9302796389b7", "comment": "Malware payload (Simda)", "value": "a3b0e820e76b4b3bdddfad47d3fa47db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889799, "uuid": "3e495212-5b25-451a-9e98-a696460a67b4", "comment": "Malware payload (Simda)", "value": "5f81ce0e62e23e0a04546fa445e484f44c711a75fc59c6cd314c2f64cc458007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889799, "uuid": "3e1a3e8a-2407-46c1-a968-a0c98c3fe98b", "comment": "Malware payload (Simda)", "value": "d684f33954b3449d8bc5803e7bc3d83fd3d2dc9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889799, "uuid": "36f9ff9d-db05-4d07-b99a-ad3710ec1134", "comment": "Malware payload (Simda)", "value": "d6ae4c8000720999edd59d4f70647c9f8948772815ac0fd6c4affdf051c4a7de7d76aab83360732a08307822ff85554a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889799, "uuid": "93a60a3a-8f5c-494b-9b0b-24e11fab0812", "value": "T128936D23391859B3CD964B740AB5E421F0B9E67C0713E6A72B409B7B3C772CA8E37152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889799, "uuid": "daadfbe3-af70-48b6-93df-9a9201872ac6", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889799, "uuid": "41c79e13-44ae-40f1-8994-1afb4d79cd10", "value": "384:X4UFGCl47E+Oiazp04qCBBOmo0/EIxL+SpxDk3QR:IUFG443ypbqTmoaEaFDkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889799, "uuid": "5c545e80-3ce5-4931-9f46-1baf1f110a57", "value": 92820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889799, "uuid": "f4a53ddf-4b36-4ac6-a729-78cc993b738a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889799, "uuid": "e52b5d89-a9bd-4f1a-81ad-ff638e9657b6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4a726d-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889800, "uuid": "35360ffd-08f1-486f-a64d-88556ab2c8e4", "comment": "Malware payload (Simda)", "value": "36767628e4fe23ce9160349d0bb4b4e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889800, "uuid": "c8c7a7fb-3345-40a5-b2af-3be5cada2902", "comment": "Malware payload (Simda)", "value": "5fbfbb3b756e899d2a5cbd53bb4dc4bb73758bd2b6ddaca123f667de1a9c0420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889800, "uuid": "e58b56dd-cc1f-4cf9-b323-be6049528190", "comment": "Malware payload (Simda)", "value": "6ec1cf1ee09c89cd4fbd522971a06b799c146c1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889800, "uuid": "3231cd05-c461-4da7-b01b-912e6f9a6fd1", "comment": "Malware payload (Simda)", "value": "c2dbf1f5c5dc3939e45dea043f28c0eace57b4e5965d538d37fc835628a1aedacd734f37f3d36444d3a6a017e15899d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889800, "uuid": "b58b754a-d929-40a1-8d28-4edebdfd79df", "value": "T159241232330459D2DD120EB348FDD73629E5AA2893E0C18E1535C99F3E56BE2396DE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889800, "uuid": "f3fd7cbd-5c0b-4bcc-bcee-426b252b4b7d", "value": "98aa7065495f35513795744857924eba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889800, "uuid": "735699a7-23aa-458c-8d60-51c7c5247d76", "value": "6144:T7++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:e+cff22qZhZcKYhc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889800, "uuid": "c750e4b7-896d-4eb0-aa8e-8ad49f7c3d44", "value": 218936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889800, "uuid": "e3300c87-2820-4939-b1b0-463b6969be74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889800, "uuid": "5756e095-f840-4f17-8378-879983abc4ce", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0b0441-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889801, "uuid": "4aa0753d-820b-4251-92a0-a7870e6e1f6c", "comment": "Malware payload", "value": "84e346a913b8ea121610cb0b2a77c760", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889801, "uuid": "1b2796cd-3a60-4978-b372-76718b78f48b", "comment": "Malware payload", "value": "5fcf31941cb127fe11ae9bb33ac096d16b39b5d34afad42284010e9a46112df8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889801, "uuid": "1ed7d0fc-a12f-45ed-893c-345c06ccf63e", "comment": "Malware payload", "value": "4fc73e6e4da007f3bf44c7b80bb242d61ddbc3db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889801, "uuid": "c5c73eef-09d4-4612-86e4-4d9c20f40609", "comment": "Malware payload", "value": "ad638c0f2b82161a8a898313a9c4c15f800d029da87b0149980eabbbb6fd75d31765eb4ba075b431261da66260a08681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889801, "uuid": "80767c09-93b8-4ca4-80bd-da437e64517b", "value": "T18CB42282DCD46C76D86755702059B3B7EE73C688124087E7E360DEB3BD3B1A9AE46183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889801, "uuid": "e6254066-054c-42f3-9bef-36c98aa9031f", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889801, "uuid": "93436b81-f74b-4227-8487-a73e76e5ac40", "value": "6144:Di/l2G1/nPTD0n0WBwmH6UY/nG3BCxw+rnTRIMu7qLESnJmlfYmfLnne2aGD3s+a:+rDIHH76jx4v7q5JmlHfLnnrdsjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889801, "uuid": "de0d4fe4-623f-4bbd-8676-caa358af636e", "value": 541248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889801, "uuid": "3ff28041-ef1d-4d6a-8aba-7560bf1eae8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889801, "uuid": "6f58d3a2-d14a-4819-9131-542f4684e54c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb8a6d1-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889802, "uuid": "6c0e709b-a7d4-44a3-a03d-bc5c0f153f17", "comment": "Malware payload", "value": "213638dba58a7ded51a9205d0edd8bbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889802, "uuid": "cc52c805-c8b5-4921-8b63-992263ea4d8d", "comment": "Malware payload", "value": "60fd4fd68015730f25280436843e79c5a143206f067b59f8f7120b8d7d7bca38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889802, "uuid": "39b5a57b-771f-4374-aaf5-ba5ae2c0d1ab", "comment": "Malware payload", "value": "852cbf9839517af3264b8d70de664e385c0f9cde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889802, "uuid": "78579853-25f2-410c-ab72-1c47e81f3f4e", "comment": "Malware payload", "value": "9662abbde3ec4bba02718390cb0d763cc7bddb8f3ba815b21156acca20e8f82b2058b506a1ce32ed482b21068a668ac3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889802, "uuid": "f031543f-3b9e-4dc5-8c04-dd5e24d51d40", "value": "T1D7653333799090FCC88B5E36006DDBF59BB2ABB332B47135AFE908661D714925A1FB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889802, "uuid": "bf38444d-a6d4-48d1-8d50-69a0c43ad87a", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889802, "uuid": "a20ac846-0b7a-469c-bc0f-9516b86092d5", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lANCPrHQ0VfgHZhIv:7E2lVL3Ze+/F5ndjFWmrjyx1cmbbxgAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889802, "uuid": "21a8ff8a-f097-461d-9158-1583d01a08b3", "value": 1449284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889802, "uuid": "6763cbbb-890d-411c-8ebd-e21845c351eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889802, "uuid": "1276b51a-923d-4b71-abdf-7274fe516af4", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e209780-c898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921772, "uuid": "b497bd44-3d59-42a9-94fe-accd65ef2cba", "comment": "Malware payload (Mirai)", "value": "d6d5c6d5b0fb6a8b4785be7fa575cda8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921772, "uuid": "9005c031-5aab-4269-806f-a49a14073deb", "comment": "Malware payload (Mirai)", "value": "612fc2876c148fd91ee4d2342b89b7c95b95da6d71e9c135130edb784dedd8dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921772, "uuid": "6fc143f4-3e30-411d-b068-3f9c58383221", "comment": "Malware payload (Mirai)", "value": "b41a2984f26dbb75e8ad2369d4fc24559b239cbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921772, "uuid": "6111d15c-5b06-4301-9dea-2fe1e69edd13", "comment": "Malware payload (Mirai)", "value": "3e57de08b1eca639f0d928c563454cac9ad70af9dd663a444ced005ced7e688ec9c24917fa680b7e1e584fe25962cc61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921772, "uuid": "9372c8c2-f078-4f0c-a212-d52265f14f9c", "value": "T15BA32946FC814A21C5D512BEFA1E318E331357B8E2DE73229E149F3173866AB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921772, "uuid": "40353170-4d2e-441e-8db5-24805a77823c", "value": "1536:wAnky0uGMdiA/5JHa9yiqpp0GBEE3eSI3k7iaRr1OXDDdRiNpqx/FYv7Xh5GYWPq:Qxz+pp0DS2k7iaRxpqx/FYThULPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921772, "uuid": "abbc1cca-5460-461f-b2b8-726f51f6808a", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921772, "uuid": "bd3197c1-afbc-4f3f-af82-ee495ce442ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921772, "uuid": "26bf3214-093e-45b3-ba03-110461458bd9", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7c4136-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763889804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889804, "uuid": "a0119697-3bc0-45c1-aa89-d8ced9256f1d", "comment": "Malware payload (CoinMiner)", "value": "064e7d2a7f499bba6e54c8a6a05068b9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889804, "uuid": "17875724-42c1-47b8-a2ba-5f4c9e1ac904", "comment": "Malware payload (CoinMiner)", "value": "61ba59c0981b4a6d53500e7ea50abbb0253e7e67c674d70a7a2dac93b3598612", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889804, "uuid": "a151cccc-0d80-490b-b92f-79c242047b2f", "comment": "Malware payload (CoinMiner)", "value": "2ac3223946c9e5d1873e3ea620f45b96ce1c9518", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889804, "uuid": "244b0780-157b-4da6-9209-d570d3d5ac71", "comment": "Malware payload (CoinMiner)", "value": "3034f1c1fe806b4c60a6648f45fabb1ff50b1b539a01bb7365e845f2f304836e22cc1774ff6bde307753b83b36b491f6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889804, "uuid": "a1f45885-f690-4f41-8054-9bdf03a02ac1", "value": "T1E2569D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889804, "uuid": "ad76d6f7-ccaa-49e8-adc0-407bfab5ae29", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889804, "uuid": "b71d9b6d-fdfd-49e6-a0b1-a4db628f31ae", "value": "98304:IvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650L:I/II/6aYXdFD22VatktKpEEd1Qi0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889804, "uuid": "be5aec12-d0e0-450a-9bcd-cae57d3e6795", "value": 6443933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889804, "uuid": "dddb4d3b-6998-45fe-905a-501ae0fa2128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889804, "uuid": "ea709e2b-24ff-4d4d-bfd1-31a2a28973dd", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101fd226-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889805, "uuid": "f22ddf72-4185-4d52-9175-9acba8a80158", "comment": "Malware payload (Simda)", "value": "1bb434d5be3a102e434b7dd59734b72d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889805, "uuid": "c3ead6c9-fea9-4b7e-9344-05010138368d", "comment": "Malware payload (Simda)", "value": "61d8fb1f75b5f2a16cd31e459ca8d6a98fbdaaa73fa12598b359615adc938bf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889805, "uuid": "953b0cab-cc35-4795-a018-fc4c7ef288ca", "comment": "Malware payload (Simda)", "value": "5abf44fd66112e5aae59a801d1947eb36bc6ed6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889805, "uuid": "d9aeff2e-dd48-4f33-a02a-0ac896e2a257", "comment": "Malware payload (Simda)", "value": "c09703d19e6848db1097f2ae971ce829e99a40a629d71109c765ac79b351f8177488d4ed7b36d86a2d9ebf9b44167256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889805, "uuid": "1bc24361-85f1-4ab1-9812-6677dd73e45b", "value": "T14714014374594342E23446B098B7BE62C97CD54E3A7A113B3C2C555A2FFA3839CA16EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889805, "uuid": "dafa2c46-0928-49dc-bd17-e6631d421025", "value": "19369dbaf9a929d28a39d7c43e1ec6f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889805, "uuid": "b7d3673d-db44-41e9-87aa-81ee559df55c", "value": "3072:H8nh2Hrp3Tlp+soN3BY2ZBHetwcyf1w5DYRZPQaQrhu8ihDNugrBVgc8gbmT2Pcs:cnw9lEs3hhyaubQTkhbrBVL8gbmT2Pcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889805, "uuid": "b7c036b0-2a70-43d4-8d8f-988f5ed11715", "value": 207376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889805, "uuid": "43fa28be-6072-4e3e-bdb2-316dbcebc42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889805, "uuid": "1d3e5ed2-1149-43ce-a489-e0a4dc5e4089", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c335f9-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889806, "uuid": "1cb06da9-ec56-4a4c-ae29-8fe91d4bc412", "comment": "Malware payload", "value": "0a1966408e4fed0792fdccdb3c942884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889806, "uuid": "7683690a-f465-4425-8dcb-368e33236813", "comment": "Malware payload", "value": "6248d473ee3cd85f38bfa7389fc5d047102566f7cf7f53346f83835bcc39a4b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889806, "uuid": "30735c87-ae5f-44c3-8aff-f5a83d487ad8", "comment": "Malware payload", "value": "9cb25728a9ceb3d762685797ebae762a4c74f080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889806, "uuid": "282d2185-82dc-4298-84cb-9009d9f2b6fb", "comment": "Malware payload", "value": "9332e933970dd3add5082ab79be5e1bf1371f4e981ac4d8079b728a152da9aa55874d2ab101ed81b4f3cd2e735fd0f38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889806, "uuid": "a1512c93-aecb-4bf1-8ad7-f7812ec62e30", "value": "T14855331B32C169B7D9CB1730034E2F654DB3D97A1AB5D42AB7DC65472EF0600BE6A382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889806, "uuid": "8ba04528-f233-4100-baa8-1bb7087bac2d", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889806, "uuid": "02cc1bdf-0004-4594-b350-0b414cee6d39", "value": "24576:a6Zv2ivhBVnFys7wuVWVT0PAW0duYHM0/JTk6/Duy3tt+hq/6XYyMkZJ9+:aE2ivhQs7tWVToP0Hs0/htDuw+txBrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889806, "uuid": "40068f2e-0922-4258-b10e-7404fff6092c", "value": 1349348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889806, "uuid": "05375d71-76e8-43c8-8c46-d89c745e1de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889806, "uuid": "28315b40-b5bb-4680-a0e4-e88bd1771de0", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1165f6c7-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889807, "uuid": "b4e303b8-5b35-4bf2-8989-db31c4a0bc77", "comment": "Malware payload", "value": "fe6d6980c8b04037456078d1eb1c1965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889807, "uuid": "265245f7-62cc-4498-abb6-514101cc447e", "comment": "Malware payload", "value": "624d6976e8d37626274f7e614eeccef1147d683eaf230890034f5b45ba28a0ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889807, "uuid": "b44f0878-ed05-4359-a29e-358b5ce2efab", "comment": "Malware payload", "value": "d6343bd9b65fb5b8959069494564241c3689542b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889807, "uuid": "a3aeb60d-7242-4ba7-bc2a-5a267e900bcd", "comment": "Malware payload", "value": "d40f242475d5680269c152eefcdeed2fefd54196734c2e4dae059c8229443f57501bdbacbacd4944cb1af16856833bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889807, "uuid": "afe58e51-31fa-4ace-980b-bc7ca663366a", "value": "T19274D13777D0C9F3C806153002A76B768EB3FA3A25714817FBE85B1B6C35A517A2A781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889807, "uuid": "41330adf-1628-4030-b769-4b7f013aba98", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889807, "uuid": "28140a2c-13fd-4579-9660-285c4d4ed53c", "value": "6144:BtKe6YiDdv3m3mgKHDjSeL46zMIwzH7SfTD:BtKe6Zv23YnkICH0TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889807, "uuid": "6b252152-6719-4e2f-b1d3-e8a3ea3d5803", "value": 364242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889807, "uuid": "b75d0408-e47c-4762-8176-68ad4ed0a673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889807, "uuid": "7dbc5230-7c9c-460b-aa54-afecfd5894c6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12064693-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889808, "uuid": "9e02c06a-55aa-417d-8d8b-e98ee74c3b47", "comment": "Malware payload (Miniduke)", "value": "241bf2f78a41465ce3ce3000b780dccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889808, "uuid": "359ea615-1941-4666-9417-507816406f4a", "comment": "Malware payload (Miniduke)", "value": "6260c0c1af8f3cbe75e8cde9c21553a37a236ac23059edb3e6cef9238c873b1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889808, "uuid": "b51e7cec-7be4-416d-80c3-566526e17626", "comment": "Malware payload (Miniduke)", "value": "a9968aef8f5c6c39fb87fc1ec59f061791140654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889808, "uuid": "07dfd3f1-ddc7-48aa-a309-cb5fb1d8f415", "comment": "Malware payload (Miniduke)", "value": "fd9a092ffff13e99635c026e2f97168a058efa2163b5496d2794fc181e182bfeeeea375547d40616d5201317a8b8b522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889808, "uuid": "8f8b2f17-ce9b-48ca-873e-a8d7d8e88f4e", "value": "T199049E3533E480B1E57316B46DF1AB72967EBC384A71858BABA41F5F2E346918339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889808, "uuid": "b8a6cba0-e1a4-4703-8b05-31777f3182c3", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889808, "uuid": "a18846b7-86a9-43ec-ae4b-276ffbd0879b", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZN5YIWJk+T5Se:+/LhS0rKE/FLITo9mDyIWW+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889808, "uuid": "4117810f-e108-40b5-9c13-4acfa5ba1af2", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889808, "uuid": "2a4e9679-a788-40fb-966d-6619f7858365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889808, "uuid": "f8976942-cd8f-4b00-a895-6bb4a5629781", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a7a9b1-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889809, "uuid": "0c747484-27bb-4872-85d4-f5e75daf7968", "comment": "Malware payload", "value": "b0d037d3a2552e2064b3e1fef28e8a77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889809, "uuid": "6c4bc90b-fe86-4fd6-879a-712ce638c1c9", "comment": "Malware payload", "value": "62b227e13bc39bcc3b3d2bc613ae0b38482b647e1830d1043961dd74b7122ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889809, "uuid": "e9e26e93-5f28-44ef-a666-0825faf3b173", "comment": "Malware payload", "value": "4ca919efa0906eb1568aeadb421c4b3685fc9b9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889809, "uuid": "b68dbccd-26aa-42e4-ab19-316c0aee135e", "comment": "Malware payload", "value": "943bd5ccfa5aab32385eacef8a7fb136ff6cea5a134fc0ca8a2277a8266d68f494da941381c45af4d2f75ff33f34a102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889809, "uuid": "795fe258-34c1-419b-bafe-aea022787337", "value": "T1B774D07377C08CB3C80506300297AB768EB3EA3A25718467F7D46B276C74D51BB6AB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889809, "uuid": "31dcb084-9019-49fd-9552-6d6ce77829a9", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889809, "uuid": "156e6f49-0dde-43ce-aa48-ef722c9e1e6e", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5TtI6gpbbWPm4rJ5S7k:BtKe6YiDdv3m3mgKHDjSehFgZym4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889809, "uuid": "7591e3a6-5525-4c37-bca6-5a94b2167df1", "value": 362730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889809, "uuid": "fd4a9da2-985d-49b1-8960-00d6ae4d6517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889809, "uuid": "8b2e63d0-5c06-4359-b73b-cc889d8b261a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1361ab18-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889810, "uuid": "8a9837a7-b013-4dea-ab63-f86b5b2e6fe5", "comment": "Malware payload", "value": "411c2df430cedee86a08232635e14a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889810, "uuid": "e4f8be8f-a3b1-4078-90b4-fad4b18fe47b", "comment": "Malware payload", "value": "62d490278f8e3c0e1ff6631a9b804c8f8e03a939ba8d6b17e195d13635806ebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889810, "uuid": "411ca046-1dc9-4831-bde6-1c39cf9daa4d", "comment": "Malware payload", "value": "45eb2b291689fce063294447ccc8f6878a538a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889810, "uuid": "c43a8411-3975-4386-b585-c83f28a7dcf5", "comment": "Malware payload", "value": "0623b17d5c89e5806c2897b2e7f156b68842bb658f99b9ff6fa4b6c19f7b541fbed89392eb26d06a2d98ff5514607b6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889810, "uuid": "e20cb822-cd0b-43a2-97b9-9da5ac6c819a", "value": "T1B255230B33C11B75CE89133106872AA15F73AB7D1770E82AB3DCA5471DF2548AFB86A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889810, "uuid": "d50071e1-0b52-42af-a947-f16b6d473b00", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889810, "uuid": "38ae1239-aeef-43f5-a352-6258f13af7b5", "value": "24576:a6Zv2ivhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mD9Na:aE2ivhQs7tWVToP0Hs0/htDH3pGaF5+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889810, "uuid": "19e8750e-490a-47d4-bfba-c8e8a588e239", "value": 1303062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889810, "uuid": "bd01d726-ab60-4a28-9278-e964ca46b0bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889810, "uuid": "6999135d-913d-4215-8d92-b16ed5ffdeaf", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14087031-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889811, "uuid": "900ed105-41a0-490e-a7bf-bd35a0d3d3d8", "comment": "Malware payload", "value": "9e884b8caa175d1dd593b987ee1190c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889811, "uuid": "ef465027-d50c-45bf-9e0a-176fd9528d8f", "comment": "Malware payload", "value": "62d630c71e629942181046983fc202dda58d0182c45e69b0098275160e885ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889811, "uuid": "a0532f11-a9ba-464c-94e7-baa304a01772", "comment": "Malware payload", "value": "ef1ea08a03412e2b5eec0ebb7fa35584b99299cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889811, "uuid": "e74ca013-a98b-4e0e-aaab-c0803a9bcc34", "comment": "Malware payload", "value": "579d5c55e8ddc1f9247f9dc3aea1989e4ffd40e3f42b2f403d3da7241b84df6f16cc93f665417eb821e1f43333347f61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889811, "uuid": "588c7a74-b2b5-4d46-b2f5-cf4b45689d48", "value": "T1AF35334D06C22718CFADA7B75B861891155737EC4794A839371CA08B03F365C9EF85BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889811, "uuid": "5028f4ee-0386-4f02-9198-79717a228f94", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889811, "uuid": "bfce016d-0cb7-4bb4-9511-889071be3178", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mW0o:+YhQs7tWVToP0Hs0/htDH3pGaF5+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889811, "uuid": "f67aca05-1ee7-4037-8b6d-9eb0ba1918af", "value": 1098148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889811, "uuid": "30f9de85-ced2-4297-a045-8dcd3ef9a273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889811, "uuid": "c74d7384-e95c-42f3-8b16-69ded66ed6aa", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee61abe-c85f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763897292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763897292, "uuid": "4f7a279a-bfec-433f-9c59-85bed92b5b18", "comment": "Malware payload (Mirai)", "value": "06dca7965cb29c9d77bce1a572ecefe4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763897292, "uuid": "89a113ff-86f2-4865-9e56-d47673af34c2", "comment": "Malware payload (Mirai)", "value": "62d6758131062cec041ceae5871f72e20c276cbe50dbb784119f79493244d0ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763897292, "uuid": "4ac734c4-09a3-4a07-9de0-816a20bf8833", "comment": "Malware payload (Mirai)", "value": "842c627a0a6a609716af48da71792e943859c545", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763897292, "uuid": "c2d1d9a5-9daa-4b00-9a52-07475bf0b6a2", "comment": "Malware payload (Mirai)", "value": "010fb47b8161301de8ddc7590a5b2d9eb9a9c56a93f4915cc248c61c0b87db1a162c46aeb3f01bcb126792bf13245e61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763897292, "uuid": "ba7d37b9-605c-4be9-ac2d-166cea0f7926", "value": "T1B1A35D01B30C0E43D1A76EB03E3F27C5D3A9AD9112F4F689251FB649D1B6E325586E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763897292, "uuid": "49afe28e-e559-4548-b8df-3005d298fcac", "value": "1536:1cWSKdx9m37GWo2J0U5PHjFNaSemRwHBes7cYLAcOjxR1S6G7noemcr:1BdOCoJdvjFNaSejhWY0cG9SBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763897292, "uuid": "60f4667c-beee-4f06-b765-5246543b1496", "value": 99636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763897292, "uuid": "48cf8e41-151c-4a9f-bc33-a85fc7ebe8a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763897292, "uuid": "47043747-e28c-4d4b-885b-1aee46466f4d", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a89840-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889812, "uuid": "72fdb740-2f27-4e0f-bb02-985bb38ef49f", "comment": "Malware payload (Simda)", "value": "1cb3b9696838b730d3afb13bee1e4864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889812, "uuid": "1ba78a8b-0872-4386-979f-3007714b049c", "comment": "Malware payload (Simda)", "value": "632a95a51b95ba00d06df6881c06a766e6e8496ed2fa070b810adc4b96012bb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889812, "uuid": "eb9eb396-615d-4a48-b2de-410f48a8d03e", "comment": "Malware payload (Simda)", "value": "481e6065e5eafac633c95543d6b95b89be21cbf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889812, "uuid": "32b119c6-1b94-433c-a82e-7133a3176488", "comment": "Malware payload (Simda)", "value": "ca216a1401231eba472ce2b0290828175fe2298a4fc53e32c0f7cd118f923ac72fd90552b12cb5e9f5a050569201f0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889812, "uuid": "3bf65e9e-0cd6-4cbe-a700-be912256e8e1", "value": "T113240241B1950902F8FA403514BEB37AA94DDCDF22A0923B70CB6289BFD42C35DDA7D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889812, "uuid": "f298ca70-e508-4ab2-9d9c-c3ad597545a5", "value": "e391eee2fda3671a828f8ce7165ca399", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889812, "uuid": "b2a414bd-165f-42c8-9412-acaec838a1f0", "value": "6144:3a1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:3bapK0JCmRcU9vVokf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889812, "uuid": "ecded315-a988-437f-b511-478e0a691552", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889812, "uuid": "f78d3c52-8563-4736-8238-12d3f9116f07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889812, "uuid": "e8e5d70a-7921-4ffa-a702-06eeb84d16ee", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153f8c78-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889813, "uuid": "06c71162-73ea-433d-8809-6bd79f6c8d18", "comment": "Malware payload", "value": "5d616f9cf4ec013457b9f024ddcdc30d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889813, "uuid": "7c4fa543-adcc-4632-b40d-9e697697409f", "comment": "Malware payload", "value": "6367c77cdc9ad4bdd30304964083d9c308c5e7205d223f18cb2c4446b59ab54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889813, "uuid": "34c1cd62-71cb-48e4-bd60-a6a3c58d3e25", "comment": "Malware payload", "value": "5da4c59d3318fd805efa3a9e45ba25b8a351e4ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889813, "uuid": "4db0ebbb-cb0a-4622-bfb5-2731c622b5fa", "comment": "Malware payload", "value": "73c184837548500c4670661030c8ed35aff542bf0e999d684dbf90f07c0fd3d90bd89e0f71c10d147c4e526c74df33cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889813, "uuid": "8645601b-7930-4062-b6d5-5e500f53a66f", "value": "T1FA93F1A3B2950CD7C464183B44BF6701A67ADA203B2AD9E79E44510EEE39DC1BFB134D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889813, "uuid": "5f397f37-d4af-416c-81f6-b4a29a6ac707", "value": "25724a12bec6f765c371201f99ac92be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889813, "uuid": "8faa0325-d9fe-46db-831a-5c043b54e2a8", "value": "1536:RzszkYaShssotpyGgyPSzndOmdmTxMLBUJ+XAllxtm65F3TJglkfjjM6:GdaS04GOEmeWMSylxttTqlunN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889813, "uuid": "3ecc8618-8dd2-4d21-9314-6e2a03824329", "value": 92820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889813, "uuid": "c482330b-5122-47d0-9b90-ad1b063feee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889813, "uuid": "64429d95-a024-4ecb-b788-aa51a3d71c4c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde16656-c83f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763883761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763883761, "uuid": "db78cefa-3cea-4560-8f6e-bb74193fc3c2", "comment": "Malware payload (Mirai)", "value": "2677b3d3b7a61d361035edf95636b13f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763883761, "uuid": "8008ed47-7f04-4d64-9a59-d07d694f293b", "comment": "Malware payload (Mirai)", "value": "638f52a0cae3f495dc5f9c74531197abf1f8fea9ae78e03028a1ac68e54c153b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763883761, "uuid": "f0c6a20d-8d36-492d-8fca-a67d46bc48dd", "comment": "Malware payload (Mirai)", "value": "6844725bc6ae40048d4aa879f287101950b16c95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763883761, "uuid": "dbc6b44f-8c07-43bd-9aca-8aa32aef95cd", "comment": "Malware payload (Mirai)", "value": "50c001b209b96e2262618792ebb74f58ca30d486a4bc62f84be96332f0a7d89dc7bd5209bd75c3a35ce689d4f660390f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763883761, "uuid": "0f9d281d-ebf8-473e-a369-5f9b34321550", "value": "T191A35D01B30C0E03D1B75EB07F3F37C5D3AAAAD112F4F649251BA64991B6E365186E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763883761, "uuid": "7ae16592-8dec-4775-86ea-31b9b8dd2739", "value": "1536:lFkxJk6aWklzUTPkPIP//EXm9MIBBlJ3YpAcUjn6Ieo+oqVemlk:lFi2HucPIP//EXTcFYCckHe5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763883761, "uuid": "cece5574-1f22-4004-9f54-d124b743c526", "value": 99636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763883761, "uuid": "887a8b4d-c035-4099-b49f-f9e573d89564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763883761, "uuid": "43b74a88-4969-4b29-b8a5-bed50bda334a", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d76abf-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889814, "uuid": "bc0191a8-7c63-4fd3-8d07-7efa11bf03b0", "comment": "Malware payload (Worm.Mofksys)", "value": "5f17f3870138485e7394e148c28ba4b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889814, "uuid": "2896510e-1ebc-4cd7-8132-382e7d5c4913", "comment": "Malware payload (Worm.Mofksys)", "value": "63db2355a7bac3041f68665849fb61987d4f8084d1b7b25a0850bf458ce41f95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889814, "uuid": "397db1b8-ad0c-43a8-813a-2d93cd2f1514", "comment": "Malware payload (Worm.Mofksys)", "value": "e962a26991a32a52963bb183c645dda8a4861b2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889814, "uuid": "91523c4b-7869-495e-a80f-1f69e12154cb", "comment": "Malware payload (Worm.Mofksys)", "value": "9b5bb9667795cfe55b78c68d1d83f7334cfb3805fdb386fe5975939cd4711b72209e547a76d2183accb7ea12f6d1d47f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889814, "uuid": "982807eb-527c-4dea-b399-9cd0ae0c6be0", "value": "T108242C1BFB40302AE05786F02866A9F7B5212D311B41FC0BA7A1AF4A75B5623B5F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889814, "uuid": "0af9b085-a5b4-4a9b-9173-ede264a9d4e6", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889814, "uuid": "6fbf0446-314a-4ebe-b160-8bb4ab71bce1", "value": "3072:3vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4Pmuv:3vEN2U+T6i5LirrllHy4HUcMQY6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889814, "uuid": "94f2ff20-561f-445e-b14b-dba8896bfaa0", "value": 221877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889814, "uuid": "a7135d8f-c014-4b59-a91b-3ff93060037d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889814, "uuid": "dcef21e6-6c3d-462a-b288-333e00fe08d3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167317bd-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889815, "uuid": "e2e7977f-e506-471c-a30d-c866b1186fa1", "comment": "Malware payload", "value": "eccf951b235d806f71760e0da4688921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889815, "uuid": "20c1aa54-1919-414e-94f5-c727fdd32b34", "comment": "Malware payload", "value": "64044ccf55674ef0f1db4c215b9c6910c09e7e4299c67dead67ea290a7b137ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889815, "uuid": "49d37344-fb57-4c11-bbf8-8efd56792e56", "comment": "Malware payload", "value": "ec867b6092b135f065ae64e10af8f6ccf5f3d28f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889815, "uuid": "fac1d834-3195-4d7f-a96b-bd266a5a9aac", "comment": "Malware payload", "value": "7651f450426a96eab580333aa161fdbcdd67329e1dd7cf046c97799b34f5783f0da5d4a9e50660c4e4a05e3345352162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889815, "uuid": "dbaed2d2-4414-482f-ae4c-7f20a5cf2cc3", "value": "T12593E84BF61281B9CA38C537A561C1B21F253E75AA63CA3F35513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889815, "uuid": "0ae466c8-f2d4-4be5-94af-338fb5c76747", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889815, "uuid": "6455903f-593b-483d-bc02-101d4603fad7", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSd9:41bC4Bk6lMTOWw4PkRAPo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889815, "uuid": "be494306-fc1b-4572-900c-1e98a7fce778", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889815, "uuid": "ab375ad4-c2d0-462d-85fb-e2bb5e19447b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889815, "uuid": "4bcf91f4-03d6-46be-b060-7b5efa877f36", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50873549-c865-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763899791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899791, "uuid": "81a197db-8d16-4be4-ba43-739462f98a2e", "comment": "Malware payload", "value": "5b1926101fbf99e63d350c044e74d0da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899791, "uuid": "59e0ff6c-eb11-4542-b7f6-3832c599a7d0", "comment": "Malware payload", "value": "641c88e82e110a4e4604dee811198efc83a80a2ce60225c6c3da72f8d6139ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899791, "uuid": "e04d5955-8a55-47cd-a649-a291b24feee5", "comment": "Malware payload", "value": "043e4b73405712ae92a1f6b53f46febc0b5ec549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763899791, "uuid": "e83b1713-3f6e-466a-bd4e-445ee956d29b", "comment": "Malware payload", "value": "bbe8b90e4dc6c62f597232fa203c7b2dd16f2e262e0376198076377e7bc0dffcf8b0a570923741db1611a79ab891a94b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899791, "uuid": "3dfb427f-6cb1-4df5-98c9-93f751327c78", "value": "T1CB16230AEBE504FCD063A1F4DE924902D3BFBC5D5761E68F17E45A962F132A08D3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899791, "uuid": "b0d81c91-1617-47c9-900e-caf9fc93f303", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899791, "uuid": "142a524c-1f1c-429b-9ca9-bd924905281d", "value": "98304:JzD5kIuoOPS3Yyp5d/lHCJW3ATN1MnFMFa41jCZ0n/rYo:JzDRvW2Yyp5dNZ67IFCjCE/Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763899791, "uuid": "55a24442-85b3-4c37-b74e-99cbfdf0572e", "value": 4264324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763899791, "uuid": "edff88dc-a07e-4d77-a840-8a178678135f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763899791, "uuid": "192357ff-7a35-4d7c-ace7-ff046799535c", "value": "winrar-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ff4470-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889816, "uuid": "ad36a82c-fc07-4d6b-b1b3-396ea53ae24d", "comment": "Malware payload (Simda)", "value": "94f1d2eed3ac6a3a1ffd7bac6eb6f660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889816, "uuid": "6cf3ea8a-0fef-4624-b983-b7faf7a131eb", "comment": "Malware payload (Simda)", "value": "641d9919bc70cf50bde3826b7058007b237aa291049871dee1a913de2a3de3af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889816, "uuid": "0bb5c4ae-6be8-4ac5-92e0-297dec0b7978", "comment": "Malware payload (Simda)", "value": "a1b9bc56040fcd26e1d691de9a502d8249ffacad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889816, "uuid": "a12b6afb-b648-4e29-afaa-0f89e968bc1d", "comment": "Malware payload (Simda)", "value": "89501602934597975200661f7fa1ab07c5512d4553c010c52946271df94f7b43436d6acd89cc07fe607be3bc7c63d3b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889816, "uuid": "9015f504-6b66-4414-b07e-c47f320e3eb4", "value": "T10524022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889816, "uuid": "a8709406-f915-4a6b-9570-bf80f6c42a4b", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889816, "uuid": "40bac3d2-70f1-471f-991d-ae54958729a0", "value": "6144:UZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5K:CquCuygMQjd5vJIBP1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889816, "uuid": "b47ea7c1-0d3f-4243-a748-eb385aca67c5", "value": 213048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889816, "uuid": "4926f7c2-df12-45b6-9526-a2f33fe6e4aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889816, "uuid": "78c4673b-a4d8-4702-9864-269a8ef21386", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e496b6-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763890195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890195, "uuid": "48c01368-2d4c-43c4-b4e4-6cbd660ecd35", "comment": "Malware payload", "value": "652a5dcb24615ac797f899904800c384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890195, "uuid": "9d352193-bc97-4b68-a0ac-8e3d8d8944ef", "comment": "Malware payload", "value": "647eeb37fe407966c1d09df8f7921b6b74448790346c0816ece9b9bf24261043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890195, "uuid": "f8c85c78-5c71-4ff7-b7d7-037be99c11c7", "comment": "Malware payload", "value": "96b276df20dd71be6724269f2c4efaa68522269a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890195, "uuid": "feed0572-4299-466e-b785-1b4e94d3d032", "comment": "Malware payload", "value": "198737a10bc2eeb69617cba53b1e900564a0529829c56f62d67f416fcb95c31351781a2a5dc8e6236aa025727222267a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890195, "uuid": "bf731e0a-d32a-4928-83b7-60344c97ee47", "value": "T1A535230B33C15672CE8A533107472AB05E73E7BD0770E83AB7E8A44719F29447EB9696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890195, "uuid": "32f18e7f-ee77-4bec-906a-635a51b7cefe", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890195, "uuid": "f3ff295d-8a44-4ca2-b74b-7cb8d31c614d", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFyjtx:qE27hQs7tWVToP0Hs0/htDH3pGaFyZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763890195, "uuid": "981d01fb-db5a-4931-9c01-05f3977686d5", "value": 1095686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763890195, "uuid": "ccce2e5a-87e8-4b35-9520-3b460d5a2665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890195, "uuid": "855bbe17-3c51-4d9b-a280-a811cc2849a2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee53dda-c837-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763880005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763880005, "uuid": "8e1d2ab1-cd4a-40a2-a14a-b83715f803e9", "comment": "Malware payload (AsyncRAT)", "value": "05276ab2fd0e62c4637f8d91e829473e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763880005, "uuid": "f3cde02e-ee95-4b08-8861-a5412efe3063", "comment": "Malware payload (AsyncRAT)", "value": "64a189213a5ba29b7d55ab22fb3995c4c60755746764b97a9d6124a86c2e9b44", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763880005, "uuid": "649b8aa2-6e81-499d-88f4-f630e99fc5da", "comment": "Malware payload (AsyncRAT)", "value": "f29bb9bf26184a8b4fdd12bbba46079972cc3ebb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763880005, "uuid": "11fa94f8-cf59-44c3-a048-0252d3bf82f0", "comment": "Malware payload (AsyncRAT)", "value": "3848bc42d3276b190520b6940b1c294f40d8ed6a0c8f9ed69a97433e77495514ed3fc621583699ba8e721c0264b6dc8e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763880005, "uuid": "c02c112a-3c78-4eec-a998-b3244be0b412", "value": "T1ACA4F158334ADC06D1936FB41870E3B816B49E89E901D703DEFABDEFF9356493905292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763880005, "uuid": "8828f7d5-f73b-4ac9-8547-4c3cd2b65133", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763880005, "uuid": "8661c59f-5d1f-42b5-9f67-d83b755353de", "value": "6144:SoR9pxgl0lQSJOP+63OE2aO7a+fIJwwRlx7zCgBaxxTya8SIhKNWNwpEVFXYzB:BKTPzrdbFRlxBaxFYOPcYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763880005, "uuid": "4ea3065b-6d5a-430e-a398-78ad59b07e80", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763880005, "uuid": "f7ced652-8b74-4b5a-8df4-a044464e9bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763880005, "uuid": "17e2d2f7-512d-45e4-9386-26e5e68871b8", "value": "Q1JLJloc3pILnAk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179d45ed-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889817, "uuid": "6b217d92-85dd-4744-9066-1422fcc2a20f", "comment": "Malware payload", "value": "a16b7df93f432fe7d630816a0a3abbef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889817, "uuid": "d76c60df-7aa0-4f58-a150-d09919ca069d", "comment": "Malware payload", "value": "65433eebb3e381fe0d3859c0b597c9ad730105dadf70f05258f611d872104c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889817, "uuid": "7d201fe0-9099-4fc5-b0be-358012ebb237", "comment": "Malware payload", "value": "a7b2bcf41b016e0034cc68cee39f0cdfb9f49d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889817, "uuid": "efff8a56-0fd5-4719-930b-9cdee2b62d79", "comment": "Malware payload", "value": "4106e10d5f5927a2c6ddca0c98ddcae90bca41cef151a14dae4f1323966fcb9691ab6301b1c1f328c39cc793fbfefebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889817, "uuid": "64c4d3a0-9d5f-406b-b979-0bf88a16fddd", "value": "T1FE05127372C489F2C8421530024BBBB58E7BE8792B22E417B7DC17676C79854EB37A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889817, "uuid": "d5d3ce19-49ca-4632-bc54-98cf54dd06a2", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889817, "uuid": "64119c56-4b7d-43ed-8cab-4fd198c4165f", "value": "12288:otKe6Zv23YnTjp0Wn91PsXeYmJMkaLqGDtlTwSDcnF:K6Zv2KOWnLhGDjwSgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889817, "uuid": "920d2285-4463-4008-b026-ee5b4fb5f59e", "value": 812770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889817, "uuid": "86f09ce8-67b2-4a67-af7e-29108d0b1fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889817, "uuid": "6d57e9fd-085b-4ceb-8507-8f07d9ce4ae2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183394ae-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889818, "uuid": "cae9beec-baea-4e45-9939-ff328fffda2a", "comment": "Malware payload", "value": "38aa6337c914d6b134f954857cd5bd2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889818, "uuid": "7369ca6a-bcec-43ed-9f1f-785e4c6ee0ba", "comment": "Malware payload", "value": "65489f3a9ae797aa444d54a0ab55f0204632db0b4fbe0ded096b207c1a112937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889818, "uuid": "8797e7ce-37df-4056-827d-eb5040cd8f18", "comment": "Malware payload", "value": "6b6f21f43d36c17babe28436a6f4d592815b84b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889818, "uuid": "a36cee60-4adf-446a-8344-bcf94f19db13", "comment": "Malware payload", "value": "86f4294332486f2b7bd8039d9a4a7057c5745b819a7ce155904ce827375fa2d2ed11b446d52e7bac37d01dda6c3fddec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889818, "uuid": "2ec9aa55-a24f-4709-89b9-b36f894dea9e", "value": "T1F945232737C18AF0ED960F3002095F255EB2D7BE1F7AE412BFD46A1269305D2BD3A661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889818, "uuid": "fcfa69a7-f338-4039-ae31-6924c4182124", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889818, "uuid": "ae5daba5-8661-4894-bcaa-0b58379135a9", "value": "24576:G6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBl6OWYqWCcbLoQ:GE27hQs7tW2zku73bFgVlRlbKHWCcvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889818, "uuid": "158eaf31-83ca-478a-b806-2b8d74287aec", "value": 1235339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889818, "uuid": "fe960a6e-6fa9-43e2-bcce-b48570c411dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889818, "uuid": "088da03d-6e99-4134-8590-9de1d72aa495", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d2b145-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889819, "uuid": "ad87f562-c207-43ca-a2f8-bb7cdb74cc4e", "comment": "Malware payload", "value": "25372b54106f60e1942c15c9f60d9193", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889819, "uuid": "91d35bef-8215-4451-b8bc-489fb6778194", "comment": "Malware payload", "value": "656d9852cb2aed26f438887da5213c5af5ccc03f4ef79b28e3488b39b9b4937c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889819, "uuid": "6cfdfce1-115e-4759-9613-11aaf1d42f97", "comment": "Malware payload", "value": "191b260987fadff72d7ad76063c419e1c44cc8a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889819, "uuid": "5c6f66a0-70c0-4161-a6de-26f19057fb07", "comment": "Malware payload", "value": "0e913a4849a11613ee982e18937f3dcbb8673cc32547da6c6c787250c93ee636bc9027bf9465a57b12a157f95b75a7b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889819, "uuid": "11718aea-aff9-40fb-8500-567ec50689e8", "value": "T1B555230B33C11B71CE89133206872AA15F73A77D1770E42AB7DCA5471DF2948AFB86A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889819, "uuid": "a6911bfd-c526-490f-845d-6e26c2313128", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889819, "uuid": "209df7d1-c3da-4b67-a273-e74c0e517d32", "value": "24576:a6Zv2ivhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mD9A:aE2ivhQs7tWVToP0Hs0/htDH3pGaF5+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889819, "uuid": "d0467edd-e59d-4c37-ba68-571727c9ceec", "value": 1288155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889819, "uuid": "7296cd61-02c4-4934-ae7a-199bb14022c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889819, "uuid": "e2999e7f-5c83-4de8-be2d-00a19c26269a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196b875d-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889820, "uuid": "18df15c2-d953-4068-b716-5ceb27123c83", "comment": "Malware payload (Miniduke)", "value": "7a87e87b977a6419f8876407ca99683a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889820, "uuid": "9b357b6b-9db0-48c9-989a-667bf073d43c", "comment": "Malware payload (Miniduke)", "value": "6571dfa1d45b344d3e7ac1b2e4a086a2038391427f58e2f02a02c4c07de3befd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889820, "uuid": "b63f3d3c-d5b9-4788-a4ed-b3ce90d9f6d0", "comment": "Malware payload (Miniduke)", "value": "ef85facd191aad986b52d8442d72dbceeb061339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889820, "uuid": "09de51cd-d772-4b48-9193-dcc44cdba1ea", "comment": "Malware payload (Miniduke)", "value": "6bde171801743d016f302bf3b2e71230abf29fbca4a04c7281f1c40903499c6cab5d7cd6ebab4e24fbbf22b43af142c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889820, "uuid": "58ded453-9613-4914-9deb-758df18540a3", "value": "T194249F3533F5C0B1E53316B06DF1AB72567EBC384A71898BABA41B5F6E346918239307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889820, "uuid": "12c2a577-f935-4646-89e2-bef201773ce4", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889820, "uuid": "60896c45-e170-4a3b-bcba-309ab1734332", "value": "3072:NZ/LhS0rKgHq+rFLIwgoovufDUbZlYIWJkrmw5Se://LhS0rKE/FLITo9moIWWr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889820, "uuid": "9a27c397-721f-43a6-8f2d-441c7820ad8e", "value": 228062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889820, "uuid": "9f8e5c93-baea-4d52-8ea9-62633e40f6bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889820, "uuid": "3ebeca9c-fa01-41d8-a617-1fd74faabf6e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0dc1cc-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889821, "uuid": "517eb046-fbf2-47dc-a6f8-b28c16120611", "comment": "Malware payload", "value": "73bdbebf5f92c5293c25bcff55385571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889821, "uuid": "6c568292-2c67-4428-b674-3cfe03ad6916", "comment": "Malware payload", "value": "65819cb1f010404a653c954aca5a6ece798bab8824c8d91ecdd92d73ffb57a00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889821, "uuid": "e4b71403-0170-4edf-a394-379341ee8e64", "comment": "Malware payload", "value": "f7fd9755106ab1de6c591afadf1231cda7aed02f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889821, "uuid": "980f984b-c1e2-4300-87ad-a43308238726", "comment": "Malware payload", "value": "1796b32a73ba2fc0e0138a4fda200f9f0c72fd7a527441e8330e41f6797acf1f381f105877c29d084a76491a2388e4fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889821, "uuid": "70f05b15-9512-4858-bddc-5365fbe234fe", "value": "T1358533240AE2046AD4232C3E316D137BE4DF77654820DA8743D4CDE8E47B974EA90BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889821, "uuid": "d6c4cc82-709e-4f73-8f0e-fbf8d6ea326a", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889821, "uuid": "462f261d-3257-4fe1-83af-3cee05455bb3", "value": "24576:LuGtcjN3lRfEyB9MBhavuS5iavgJKUdeIhRHq9aR5iP3QtbMDynPll8w+VaMjPPk:fiB3ffDBvd8BRJO/2nPcTjXkAtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889821, "uuid": "bb123034-4694-4e0f-a49d-afcc0b7d01d0", "value": 1815696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889821, "uuid": "21e5a510-dc59-4ebe-9063-ef1737c9600b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889821, "uuid": "7cbfc10f-5352-4b79-8412-416836a5fd17", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51aff2e9-c851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891203, "uuid": "2acb9e5f-39e4-483f-a3fa-31b80ceae233", "comment": "Malware payload", "value": "998a13a6eb138a837a9d568aa2b685ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891203, "uuid": "61a46a50-b3c8-4ed4-ae3c-b2df33cbed8a", "comment": "Malware payload", "value": "65bc7f7d0675703859085449da077549b9fce14b30723854e219338edbe82148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891203, "uuid": "31d5b3ee-fdad-4306-8fb1-f060c7363542", "comment": "Malware payload", "value": "3a4ac6fdd6746737b1edbbbb028607e59637bf7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891203, "uuid": "6b1a50b7-5514-4d43-917b-afac9e39e854", "comment": "Malware payload", "value": "beefd0b7d98df771ea14208a89fdaad7094823b0ba7b9c38b7dfc0af40b187feaa0281a9c6e07c56db65dfcad8f6477f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891203, "uuid": "760de844-a31a-4819-8305-974a11becba4", "value": "T1D645330B33C1A371CE4D127202473AA16FB3ABBD1770983AB7D8650725B5908AFF5796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891203, "uuid": "c66f69aa-aaff-4912-986d-dcdd0834b012", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891203, "uuid": "46f64883-e1b0-4a04-8c68-797cdd018863", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mjC/QjxD/ua57T3:qE27hQs7tWVToP0Hs0/htDH3pGaF5+EX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891203, "uuid": "cff6b341-101e-44d7-853a-d8d362af95d1", "value": 1280014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891203, "uuid": "d5e5addc-902d-426a-a852-d3e791387347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891203, "uuid": "b3186bd7-f034-408e-a006-d66f04a6c97d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a99f536-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1763889822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889822, "uuid": "b50a3166-a22c-4abb-b75b-1ef9aafb1e13", "comment": "Malware payload (Meterpreter)", "value": "dc5b4142211486672e74f8a57ad2e6e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889822, "uuid": "356fe766-9f33-43ab-9284-f5a9a40b8d25", "comment": "Malware payload (Meterpreter)", "value": "65c5894216b1228c0a47e4d3f743dfb9d13b17aecb843f0b307886b9fd16d3ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889822, "uuid": "0d0c1d0e-b271-4751-a565-875414739e80", "comment": "Malware payload (Meterpreter)", "value": "565c1fde2a73e210eb8c282d1fa0930a0cbf6166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889822, "uuid": "592c02bd-0130-48a8-906a-78f65e64f41e", "comment": "Malware payload (Meterpreter)", "value": "747ba78a77ea72247f9c64b949d4d2876c52f9e2874936f0efccae94ee0ad962267afa06b2f78a8addceb7163c7d7085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889822, "uuid": "67d06e71-9bb4-4c98-b079-5a65a7a7032a", "value": "T16E7258232B244D6AE87C097D4AE1FCABB3544D393F7F52729D18031B25322246CB4D41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889822, "uuid": "6d70e8de-4996-4a1b-ab32-d580fd9a29ad", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889822, "uuid": "f608c205-ea2e-4c8b-b622-1ccf0e5d21fa", "value": "24:eFGStrJ9u0/69SIBQAV2GY+4YKLq4ieNDMSCvOXpmB9:is04VBQR+4YYiSD9C2kB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889822, "uuid": "c633e3fa-f495-44b6-97a6-c09e99e9e3bb", "value": 17016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889822, "uuid": "7e0d2de7-23be-4897-885c-b1430e3615a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889822, "uuid": "caf16d70-1521-467e-afa9-e57c0ad1c306", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3a6ffc-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Blackmoon)", "timestamp": 1763889823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889823, "uuid": "45cca761-b177-46f8-8cea-d3c1ac5cf1e6", "comment": "Malware payload (Blackmoon)", "value": "ff3770e533799bb08dad14dd5935f1b3", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889823, "uuid": "6c07ecb1-6038-4232-9815-7541d054d67d", "comment": "Malware payload (Blackmoon)", "value": "65d636c794af0bd78ffe9bd32ec67ee8b3a0c7f0eefb1ba29a3456a437719a96", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889823, "uuid": "ad9ee0c4-6ef1-4e7c-a726-0909804fb856", "comment": "Malware payload (Blackmoon)", "value": "50e1cb7c3a87ea61ff78dd2f65b3c43efd95c805", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889823, "uuid": "013e75fe-9e78-4c18-9ed2-11f8bfb4f24a", "comment": "Malware payload (Blackmoon)", "value": "e982458afd3371ad914a102ff51b3cb9654524639b44e332803c68c4ce9823af2f76d6afb05009d7cfaef5e59f2b0b83", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889823, "uuid": "a95eb45e-e0c2-4a8d-92d7-23d65600d28a", "value": "T16B6591323CEA502AF173EFB55FD474E79A1FB6233B0B585E10A003464793982DEA157A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889823, "uuid": "b3f159fa-a367-46ff-9f54-7c7a71a0f1ec", "value": "2a102a8e2c21863b7d797317c20f83cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889823, "uuid": "fae4534b-e6a0-4325-93b4-31b5a363db02", "value": "12288:I/S/LOD1vm9njUTKXwYk3Ie5TFlQRJrfj5qgJzZjtCiFLbewUA0lK4/KDoFFIYiS:WDFic2p4CuFJkUwVM2dWR377yyCiVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889823, "uuid": "d2d891ff-5493-41b7-b5d0-e35aaebf49ed", "value": 1541120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889823, "uuid": "beaad59f-69e8-49d3-9a28-214702cc54b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889823, "uuid": "eb19e8b9-f51d-4309-81b6-72e45e3e940a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1a6502-c856-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763893638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893638, "uuid": "e016bee9-257c-46f7-a24b-3408b41f11c2", "comment": "Malware payload", "value": "948540e9ad77a298a843d832d9528914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893638, "uuid": "74823480-6891-4317-bfe0-15ebe0edfaa4", "comment": "Malware payload", "value": "66839e43d332c54e7fde61b85982da852777c597c0427e2a6e36e46e22b8a13b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893638, "uuid": "a1c53aca-db07-472f-83ec-6623fb16d181", "comment": "Malware payload", "value": "21399fd655295f76c16bddc86f14732196046093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893638, "uuid": "6de9e74e-6828-4dc3-b017-0aff444ea609", "comment": "Malware payload", "value": "b6c0258c6d59f3eeeea3f32a57b7fdb56806d21a72a1d7b9ba1cf116c6ca8a22f78cd9157c76290eba672749daaf1ccc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893638, "uuid": "97f0e239-576c-42df-9667-a5cf822e9a5a", "value": "T10235236333C259E1DC49D172028763A9AE73BA7C17B1D42BF7ECCA0F1C70910B6695A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893638, "uuid": "7a7461fa-c270-4761-920f-9479984bbe4e", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893638, "uuid": "49849c0c-2ab0-4a43-89ea-1f808fb601a6", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuNpLO:qE27hQs7tWVToP0Hekxbl5TuLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763893638, "uuid": "57413a0d-4809-4e2d-9a70-23cecf66c853", "value": 1132954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763893638, "uuid": "afad824f-1a89-47f6-9db2-f2c87da9c024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893638, "uuid": "2727d43c-4d94-41ee-b99e-c8cac70bdf5d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd668e9-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889824, "uuid": "762bd24b-abaa-49dd-9f1d-9c64a4ea5303", "comment": "Malware payload", "value": "70f5caee8100b8cb6d68c7c260ca7537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889824, "uuid": "e1a3715d-ada9-4c0d-83b6-9afe5063f10f", "comment": "Malware payload", "value": "66b36eec49454af7e382a47fd7e0a4a1beb0cf73f0ddf4cc8075601155d92ccb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889824, "uuid": "552dec1b-1290-4242-a794-43c1b1caaab0", "comment": "Malware payload", "value": "1394e9f02e272d536a78d77049becb6b769d6b3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889824, "uuid": "ab5abade-b814-4cc9-912b-cdb5afa93ede", "comment": "Malware payload", "value": "6378611d313d89325af173c3b1f9c4b7df6ea4467876eabe9dd26c41aa35b3c401385bb776f439c6a1c0f6bdd412f2ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889824, "uuid": "098b2438-c7f4-4b4d-b01e-45b1693885ec", "value": "T1A793E84BF65281B9CA38C537A561C1B21F253E75AA63CA3F31513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889824, "uuid": "066b9a96-b68d-4bd3-881a-4249829093cf", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889824, "uuid": "7a20b0df-c3dd-41f3-a554-91973825d418", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdR:41bC4Bk6lMTOWw4PkRAPoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889824, "uuid": "5d137783-250a-43c5-bc5d-e82bf2bad1b6", "value": 94261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889824, "uuid": "497664e6-a05c-441f-8b88-b29f1619ea28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889824, "uuid": "ae3ad2a5-c7f7-41ae-8d9d-d1123c7375d7", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6d1517-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889825, "uuid": "93a789f7-b916-4cca-8519-dd41dd5b8587", "comment": "Malware payload (Worm.Mofksys)", "value": "c6d4dfd5a78ea94032ea7a925a970522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889825, "uuid": "6043c3e3-be5b-4a36-b8e9-2009544cf3de", "comment": "Malware payload (Worm.Mofksys)", "value": "66be0846dcb4800ca0b6dfa1f58165d4f4834f12f827e2a96efd77f0f844a74a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889825, "uuid": "e0477d78-b169-4c1c-b04c-b41fb9e8c404", "comment": "Malware payload (Worm.Mofksys)", "value": "bafb262bb0d4e2b8617ff02b9ba4db194792a677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889825, "uuid": "9517b641-a51d-4114-904e-0c85dc99a14f", "comment": "Malware payload (Worm.Mofksys)", "value": "b4f9cc3434c630e4faa8dd07ad895793f991567abf5a3c1f0e520e66124c267fb54ed689576b3e850e7c8d9c77997b99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889825, "uuid": "f8ffd66a-bfcb-4a26-a4fe-cef3f0971b82", "value": "T11724F92BBA44701FE96389F0946273AAB6312E351BD1AD8F2BC19F453476603B5B131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889825, "uuid": "9a6eff90-d1ec-46fc-94ab-dbe6e3977fcf", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889825, "uuid": "d93ef91b-95cc-4aa4-bffb-02ce26a902d0", "value": "3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6und:+vEN2U+T6i5LirrllHy4HUcMQY6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889825, "uuid": "3eef21c1-dc4b-48b2-937b-c8d2570c0262", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889825, "uuid": "9857d837-b37a-4859-8102-17f8f9160575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889825, "uuid": "ca4f6f64-1fca-4edf-a047-0469cf8a365e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cd0b57-c84b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763888492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888492, "uuid": "d4498792-f80e-41c1-ab38-3043eb74516b", "comment": "Malware payload (Mirai)", "value": "099b5a55b0eea9cd935824505556e383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888492, "uuid": "03212eb3-d027-4b30-967c-e1b60d86663b", "comment": "Malware payload (Mirai)", "value": "66c738da31a7aca7befdc0934d8f51e42c37cfee92ee19cb425c5103dcea0bb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888492, "uuid": "f097ed85-ceee-45bd-98dd-cf0ac6c30763", "comment": "Malware payload (Mirai)", "value": "0480a97b8c2f316a7dba92e0ec7d8e585e75b9c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888492, "uuid": "a5b619d3-a667-42ed-9962-cf7975d02479", "comment": "Malware payload (Mirai)", "value": "dc5405cdc950d747518eff1c2fc14c8c79ba6937771e9f3a9bcc0fd7357954452af2a80d9e193e3911ad01a4c6b63d2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888492, "uuid": "271a6ee4-2d3d-4a55-93ef-2b5e876e1114", "value": "T1A1F38D44E683E1F5EC010579107B5B328A72E63A613EDD85E3FDDB35EC12602C527AAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888492, "uuid": "a887ff8b-2a5e-4cd6-a079-4d345b9b671d", "value": "3072:/FNS8Wb+LYrE07ExAKHGNzfdSgkv1PsEncRiBn:/FN9wE5GNstsKSiBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888492, "uuid": "06f7fc18-e7e2-4d3a-a9f0-e5c1f129569c", "value": 170536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888492, "uuid": "969ef95a-6583-4f32-8532-8aa7b14244f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888492, "uuid": "54bd87ed-727f-44f0-b041-2e76a65d1ee4", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf9f91d-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889826, "uuid": "018806b1-0353-4dda-a9f6-6453d7e9dde2", "comment": "Malware payload (Simda)", "value": "37d4305702caf76cbbc56fa0726899eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889826, "uuid": "c4215bbf-9404-4a3c-b7dc-111084b484d7", "comment": "Malware payload (Simda)", "value": "67189d3c1db44ccb2d91f7f9854875084bf3085f63081832eae6bce112a8d2bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889826, "uuid": "e4e731c9-9524-475a-9b10-a92f6c619e97", "comment": "Malware payload (Simda)", "value": "f9ec046d71bd70f0a20d894bc4dd0b6dbf8a5009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889826, "uuid": "7b091a26-e318-4850-82b9-35d7775b4981", "comment": "Malware payload (Simda)", "value": "3842e791e45d108009fb6a7f50a518508bff2afda2829b3127c0caae2e500dcb5135f665d648231c05c95c5820dea987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889826, "uuid": "97e22ac7-5458-476d-b166-29c99f0f4de2", "value": "T14D933A26C44640B9E8E0217C55BD2B8280BF7D786B192CD773546EC929F82F37A7831B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889826, "uuid": "d14a5311-65f8-472f-ab97-fa05a091cb07", "value": "cb59e9f2348b37e98c5e9c617c66b271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889826, "uuid": "25163926-6571-4e4f-9617-6afc22c62e20", "value": "1536:HM+VGBu5StG62/YxaAJZO/JcR3RWZPjvgJ6pADFTFDq:s+ku5Ss6yYsAq/C3RCzgJHvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889826, "uuid": "5c07066c-2d19-4f4c-bcbf-b6f748c391a4", "value": 92820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889826, "uuid": "7b231239-413f-4f80-a77a-a424d19dd769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889826, "uuid": "abfad760-80a8-4592-a9e9-5ce777e0f628", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8e8211-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889827, "uuid": "1ceeb0c1-52c1-463a-b16a-56b6cc6ba8b2", "comment": "Malware payload (Simda)", "value": "42680500b6a672f4f10fe26a60ca033e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889827, "uuid": "dbeb0b55-3945-4ec5-bad3-e6c44eb23115", "comment": "Malware payload (Simda)", "value": "67c3d6b36234a869d6d7c7fdd34b77bd139b9a0fdd3d7f536423ae4e10c38bd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889827, "uuid": "d203948b-1054-4b37-b3bf-e8d9f85a4315", "comment": "Malware payload (Simda)", "value": "c70178c29d76499cbbf75ea700a5900ca5624207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889827, "uuid": "d9aaf18d-f7e4-4a61-8d97-40491c0162f3", "comment": "Malware payload (Simda)", "value": "55c937c88dd2d92bae8ddcec789a23a780c76e0d93a0af56011b461d6515e2a1fe5de75a669b228e1412b182ef3e52fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889827, "uuid": "b5b75518-cb5c-4fe3-b2c1-e33ed43ed237", "value": "T117D3128CAB6174B3E65203399BBF7DD539389DA6480D1C420ABF24773B655B38208DB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889827, "uuid": "9b0cfa01-24b1-4e1c-81a5-7e3b37267ffc", "value": "7ec179fea3ba0cfb69d21d330597a106", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889827, "uuid": "b013a797-aa56-4785-8f21-91be435cc5fe", "value": "3072:4TJXLESylV534DNujdXwtrUHioF92L59QvPJvzxsx8ME:4tXLESuV5I5ujNHioajQHxzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889827, "uuid": "b4c61c73-44fa-4649-949e-ceef0884d513", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889827, "uuid": "40ffc42e-c892-40f9-a483-c436bed35a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889827, "uuid": "b897a53e-99b0-437d-86da-aa66b79d124d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83980ae-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763890140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890140, "uuid": "2604d7c2-9084-4ee8-8e28-638ac5c2e450", "comment": "Malware payload", "value": "3f2751ddf90becb1925efe583967cc54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890140, "uuid": "b7b079d4-31a2-4279-ba4f-e638fcc9c6ab", "comment": "Malware payload", "value": "67d8ebfa952f683172c40ed05d0c809953813019aacdd81a5ef6462ace021e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890140, "uuid": "e8400003-fbfa-48bf-934b-82a02acd5fc0", "comment": "Malware payload", "value": "b1339cb3e88090874718260ec37d1de0acff416a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890140, "uuid": "f1280e65-31ec-46ec-a1c9-22b1918a70d3", "comment": "Malware payload", "value": "f81e5b95c3270cef76eb437d9d837f45ac69bb6a0988858f90aaad7f2933731e61662b86d824c0cac26d8d930f0b668c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890140, "uuid": "e807fed7-0db9-4567-a7d7-2f4f739d13ec", "value": "T1E545233633C15DE8EE4A4E31020A5F218EB1D26A1F7EE411FBE86D1369705C2FD6A761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890140, "uuid": "51b54baf-4a2e-422c-b002-23480de95398", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890140, "uuid": "a0c25e13-2f04-49a5-a706-4f270a605fdd", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVv2JW:qE27hQs7tW2zku73bFgVlRlbN015CoV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763890140, "uuid": "aa33c6cb-6da5-4397-92b3-48ea4359cd0e", "value": 1248659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763890140, "uuid": "32c6b405-c66d-467b-a03f-110668a88219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890140, "uuid": "1271635d-e2f6-4ee6-9c86-e0439fccccb9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2902c5-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889828, "uuid": "c482bac3-22f7-43c3-87ec-d3a554af0645", "comment": "Malware payload (Worm.Mofksys)", "value": "378551b2c29f5eef8f927319bccc8211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889828, "uuid": "60702643-e5d8-4867-8c20-21fc00abb7b5", "comment": "Malware payload (Worm.Mofksys)", "value": "67dfe2bf939a6a8adc7f52f41b1d7c76f72f0d0b0f0e5612c91b8d7e82859c8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889828, "uuid": "71a5e75f-49ea-4eb4-9bfa-513de779b39b", "comment": "Malware payload (Worm.Mofksys)", "value": "29d87fb2ab5043af1bd32c0cf8d4cf968bf114dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889828, "uuid": "eddc6127-9578-4a17-979a-4b8f2b6d6965", "comment": "Malware payload (Worm.Mofksys)", "value": "11f97aed2c78a38d5edc8149a9ef723529e17c98aeb7e7c4df4479b604b65e65801f26ceac9f08045d145cfc0847376d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889828, "uuid": "b42ec2a9-0e8e-4d5b-8b83-8b2b3c2fed95", "value": "T15C24093BBE01201AD8A7C9F05866A5BABA266D620BC5DD0F27D1AF453870613F5F530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889828, "uuid": "55c15e2a-c3f0-4621-a9d0-4d6a0311a07d", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889828, "uuid": "2b9961ad-4354-4e7f-848f-c590a9c93ab8", "value": "3072:zjvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4Pmuj:/vEN2U+T6i5LirrllHy4HUcMQY6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889828, "uuid": "fdabf8f6-6b45-4677-980d-2961f026b4da", "value": 221866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889828, "uuid": "376fc75a-90e5-43c8-8cf3-2719527f434c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889828, "uuid": "ee0b25e0-9714-4b04-b7d2-95ae914bc87c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9dc390-c851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891089, "uuid": "925aa5b4-43d1-4877-9052-46f418a6ea91", "comment": "Malware payload", "value": "4a2b88dbb8304cbde2446be3a0d1888a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891089, "uuid": "5f2760df-b134-4fb9-bd9f-9db7504d63d0", "comment": "Malware payload", "value": "68d21d2eb214d92eb8fdf0ef7407ea01e11c6412c99b9eb8d1175dc246240aa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891089, "uuid": "06aabc5b-6423-4db8-9ba9-53c475f02a5b", "comment": "Malware payload", "value": "b9fb3911fdfe0b3914098fad377659d63e2c072d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891089, "uuid": "e9942f2e-76a6-4a22-a214-92752d15ee77", "comment": "Malware payload", "value": "fc08b6e54f2ff7f8889f23a32f3772ee76c1ba74a397f04bd097c7ad41422fd8c04ae18354f961d73059ebb0cafab99b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891089, "uuid": "71e39271-76ee-46df-a866-c6e6652e7fc8", "value": "T15555333533C19AB8EE4A4E30420A5F354EB1D37A0F3EE411BBE52D536970892FD6A761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891089, "uuid": "3783f0a7-7efe-4202-b686-d39a508cd23d", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891089, "uuid": "319f5a5f-7d09-486b-9cf3-1e7902303672", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVRHcn+:qE27hQs7tW2zku73bFgVlRlbN015CoVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891089, "uuid": "8a2fdf33-ed13-4496-a9ad-5cf50173d68f", "value": 1312657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891089, "uuid": "9644845f-b43c-4f6b-8a9e-5c40c7ffb080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891089, "uuid": "43c52417-36e4-46b8-a577-021a15ecd4ba", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec2c73b-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889829, "uuid": "7a529e94-141e-40c2-a8b2-9f873c96f3d7", "comment": "Malware payload (Simda)", "value": "ce612fa63d35dd75f4efcfa0772b21a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889829, "uuid": "a0c50588-dd55-4c24-9209-ff3f97733964", "comment": "Malware payload (Simda)", "value": "6914eea9c8f61d16b3bc35d0142488783568775f4e087744f870d5e27c430c4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889829, "uuid": "89171c06-5862-4046-a0e5-58baf294990a", "comment": "Malware payload (Simda)", "value": "88d7c18465a6f0889faabf452d57dfd88c0c3872", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889829, "uuid": "782aca77-f3f5-4b52-8abc-9815be607ff6", "comment": "Malware payload (Simda)", "value": "a76044e1024fa1699b4f7f85650b6a80997c311635ce752d39d846ceeec02a8f30e29aa5b0833b00254ca3477eca597a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889829, "uuid": "c4403202-4414-4f70-9a14-423fe0149798", "value": "T1EF24022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889829, "uuid": "076d6911-2c4e-494b-a6c1-10dcf067ec04", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889829, "uuid": "cb83b609-fe25-4ccf-a38c-af82d9126171", "value": "6144:4ZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:GquCuygMQjd5vJIBP1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889829, "uuid": "f9e56cfc-9cc5-4187-819e-7e14fd7f9705", "value": 213054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889829, "uuid": "3622fb90-adb2-485a-ad26-ca3d7cade8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889829, "uuid": "36dbd105-ab21-4b19-b0a4-7b902024fa65", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839a3814-c867-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763900736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900736, "uuid": "5424c9c9-28a2-4f31-bfa9-b5af194a6597", "comment": "Malware payload (Mirai)", "value": "ca6dec1206e4f75954fa2bd6cb7e3b15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900736, "uuid": "4912091d-48ae-4c4b-9c3a-7a10624beec7", "comment": "Malware payload (Mirai)", "value": "699ac04e9d733bc3b808b1e9042c9cf5a009ce449a8d3c2f189acad3d1f320e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900736, "uuid": "abe8c76a-877f-4f40-acad-f0d6e0be29c5", "comment": "Malware payload (Mirai)", "value": "a575d2420bda36d62e6dec4d11fad547f0709f9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763900736, "uuid": "64a96507-ebab-4200-85c3-a50e43cc50a5", "comment": "Malware payload (Mirai)", "value": "e4a482401f119dbe003c8b3fdf8fd7e5d8be9a038b1ba1bc74d20a61df26d8d66bd05362a0260b850eb8e9d56af42067", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763900736, "uuid": "1a678b33-552a-4d1d-bbc8-e5ef6c7986a7", "value": "T1D7836BC6A747C4F8FC6602B4653BE7374672E6390139CB4ACF64B9369C26602E61736C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763900736, "uuid": "b1473fa6-9a8c-45a4-9352-ab649f0b285e", "value": "1536:0yQZHs2l+KThIo6qRXhdJ7Gih2/mElabwt9kcSim+UmtbKv:2lsARhIo6gxdJ7GihElasjgl+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763900736, "uuid": "d97a5d59-ddfa-483b-8a23-22249a48dcc0", "value": 87028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763900736, "uuid": "29a1ddaa-b607-4262-a042-4f94949d287d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763900736, "uuid": "e4ddd386-5dd3-45ae-abdf-afd043c63b59", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f557103-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889830, "uuid": "f7d8101d-d4dd-417b-9298-8416c5090c13", "comment": "Malware payload", "value": "2125dd1678e28f982ae7a877db124e5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889830, "uuid": "f36862f2-ea93-4cd4-a174-d9db529f76fe", "comment": "Malware payload", "value": "69d520ddb1c83346fde4e3386ffa6aaffb84ae5541c8fb579d6a6215b39573f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889830, "uuid": "4602208d-d8dc-48fe-b1f3-0e0ede2197ac", "comment": "Malware payload", "value": "cd99182f9ed89c18f34adcb5d91f063b7d40e0c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889830, "uuid": "7b10d471-a082-4bb7-9243-0091cc309ba0", "comment": "Malware payload", "value": "dba823da1e3a1452c17c458054534b6d4dc59825f929b4b8dce5cede4496fcff883378b897286b13744689cdb6af2752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889830, "uuid": "5affe73c-58f7-4778-9baf-b79f18ebfc02", "value": "T1F3A41293DCD46875D8664231309AF337EE7BD65802448BE7D360CDB3BC2B1A5FA92182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889830, "uuid": "19ab72c2-4224-4ab9-8947-a7a7d0f62bde", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889830, "uuid": "28dcbcae-ca28-49bb-a89f-c4c65bb92ea0", "value": "6144:Di/l2G1/nPTD0n0WBwmH6UY/nG3BCxw+rnTRIMu7qLESnJmlfYm5:+rDIHH76jx4v7q5JmlH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889830, "uuid": "3ed052a5-585c-4c18-9bf0-704f3f4b8264", "value": 471184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889830, "uuid": "8159275b-260c-491a-8e92-cb13ad7d89fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889830, "uuid": "8bee18bc-db3e-4ae3-9133-b8387a33af9e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735b145c-c8ae-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763931203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763931203, "uuid": "03c8ae21-8e2f-4225-8d4b-1d4f210c839a", "comment": "Malware payload", "value": "e9a9eaee0b6e4e64ad85ba9cdb874432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763931203, "uuid": "66c4a82b-f2db-4570-96b2-09e3e7c60f67", "comment": "Malware payload", "value": "6a1f3f2805f56b4e7fcf6e8c15542754442b33af9451ff300d446a24b5289e4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763931203, "uuid": "baeaa103-5304-4578-9242-864da295429a", "comment": "Malware payload", "value": "296bb5b68389ac33fbfa2e572cbc4abc16a2a1ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763931203, "uuid": "3fa65abf-bdad-400e-a38d-41703c4838b8", "comment": "Malware payload", "value": "26b30a46eeaac8a2c6711cd33bb6922d8e68f5b8006185aa6f9dc1fed88bf3b29d6f0335811be1a10e4daf72ad403809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763931203, "uuid": "3fe21307-d355-4a96-b048-466ecbeb86ce", "value": "T12BB3D85F7E618FADF668C2314BB78E35A39923D623E1C685D25CE1001E6034F585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763931203, "uuid": "bb1810d3-86e3-47bc-86f6-5b25fb65ac36", "value": "1536:sjepKc1iIh0dxj2ONDS+PwIdeO0jXcHusabpmzt66OfVZTM0wvzZCxdOtsDfWBqh:AdDf4IdeO0jXc2yt66+oLs3OWfUPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763931203, "uuid": "cc63a10c-353d-4f54-bf92-5e40e4d0f1da", "value": 117400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763931203, "uuid": "c2f0d7bf-8d0a-4eb8-a06a-cb340a2dce20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763931203, "uuid": "32e532c2-5485-4f1c-aaf5-229c262b2530", "value": "bips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff05106-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889831, "uuid": "26d2e033-4406-4b2c-95fc-fa37d606f8df", "comment": "Malware payload (Simda)", "value": "fab3c6f68fe896defaacba2699038d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889831, "uuid": "3cd64c66-b48e-4ab5-b006-d24ec14150a0", "comment": "Malware payload (Simda)", "value": "6a568c60b8cf510978f1fa0028562fcb4208d62888dc6f2769d0f6e6a0729953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889831, "uuid": "d305b3b6-319a-462f-a37f-b452669f3743", "comment": "Malware payload (Simda)", "value": "879c9c3093c9ea6bda506b40c23794371d040597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889831, "uuid": "00497d28-0168-41bd-8304-73f869d450bd", "comment": "Malware payload (Simda)", "value": "930539edcdac3b6be9598d374e806474b9a54a483114ce51194008cd35b3020b5efa3838622aeb5726a85f3018eaff2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889831, "uuid": "cd75585b-0d8d-4c73-823d-52460e2d788b", "value": "T11424022B1B2C9932D6550B3B8EE5EB3461BFF5516733D6D30B00DA9DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889831, "uuid": "021f3202-2f0c-4c45-b90a-68cca855b663", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889831, "uuid": "a43c72f0-f452-4a8e-aa3c-a758f15f9d91", "value": "6144:WZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5K:0quCuygMQjd5vJIBP1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889831, "uuid": "fbb1816f-94f6-4a32-897e-8c194b3c6281", "value": 213048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889831, "uuid": "b57508a4-6653-47bf-88b7-329c00670aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889831, "uuid": "4c52546e-220a-49d7-9875-580390da3b9f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c64353-c885-11f0-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1763913470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913470, "uuid": "3cdec6e5-faf5-4f8b-be06-346bd8076271", "comment": "Malware payload (Efimer)", "value": "a45b1625a819ffc8128e13cc3143205e", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913470, "uuid": "f35ae9e1-9737-4001-a567-378a3044330a", "comment": "Malware payload (Efimer)", "value": "6a9918bc9f5715564a819a2cf77b0e800528ef40dce33dec9bf9fb97d0dfd3f2", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913470, "uuid": "909e9f9b-7d00-48e3-9ce8-cccbdabdff46", "comment": "Malware payload (Efimer)", "value": "bb44fa3f8fffb545fbd58ce3c87f0c1a8bc354e3", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763913470, "uuid": "bdf34d58-cace-499b-a879-fae7023db0e4", "comment": "Malware payload (Efimer)", "value": "8a6cb0c514fbf967cdaba18ddfa0bd21642f7f2de4be61e9e90e54e2dffc77ea4e8e87a429b7e4046b6673360a6e106d", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913470, "uuid": "99a6b584-febf-4a66-bafb-5ade1d41cbbf", "value": "T190D6334C26F111EED963C078DEE29285EA78783323B2C9DB83B492655E572F0493F617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913470, "uuid": "74d7ee8e-96e1-423e-bece-b78bca3ab8e3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913470, "uuid": "4cdc18c8-91d8-4e64-b8a1-51ffd6a5ca62", "value": "393216:b/L6a3+r/9jSADS6I1gLkVxXMCHWUjMcuI3/PjuUw0:7LWj9SA2gcXMb8ZH/rA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763913470, "uuid": "4cbb6b51-cfe5-46d4-9882-06aab8396fe4", "value": 12613952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763913470, "uuid": "a972360c-82b5-4409-b790-1fde3944fa56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763913470, "uuid": "05aa4d06-f844-4588-9b8e-226923844495", "value": "a\ud835\udc1ft\ud835\udc52r_\ud835\udc52ffe\ud835\udc1c\ud835\udc61\ud835\udc2c_\ud835\udc2f23\ud835\udfdc\ud835\udfe1_\ud835\udc20a\ud835\udc24_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a1ec89-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889832, "uuid": "cf91a095-241c-40a7-a32d-41764ca6d4f3", "comment": "Malware payload (Worm.Mofksys)", "value": "ed7b1e142cc4e59f37523c9d77038413", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889832, "uuid": "44aca425-17c7-468f-a4cd-9e5d4985d588", "comment": "Malware payload (Worm.Mofksys)", "value": "6ad0d2fb325610cf4cd3db6903ce4e548a23f945d8d8387be582313706ed8424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889832, "uuid": "29274dba-ca28-4cdc-b6a4-ce82c5b9c907", "comment": "Malware payload (Worm.Mofksys)", "value": "541aa8f737d1703e9b05df3bf469c85823a6977b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889832, "uuid": "63ffd547-a946-47de-9f53-f7cebb501e13", "comment": "Malware payload (Worm.Mofksys)", "value": "3c52453926d30573779c54038055186b4d5354e7d8328d5a05b739c18f686be86e8e5ab401f33855929d699b7f564030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889832, "uuid": "56cf4324-2286-49f4-8be9-8957a9df01d9", "value": "T10824D77BFE40A12EF8A399F01462B6A7B6223D310B916C4B66C16B493475603F6F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889832, "uuid": "cae1b058-08a9-49c8-8a56-c9a6993030f6", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889832, "uuid": "c43f8cb1-6ec8-4c15-bf15-40de64c0c651", "value": "3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unM:zvEN2U+T6i5LirrllHy4HUcMQY6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889832, "uuid": "8520bb81-57d8-47a8-986b-eee2a1951579", "value": 211909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889832, "uuid": "fe10ff6a-44c4-4cc7-9e74-543e4b3a160e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889832, "uuid": "ae53a357-4f53-408f-bfac-5e307acc811d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2138e411-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763889833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889833, "uuid": "064eba4e-2f1f-4dba-ae6e-b63b6a1ee655", "comment": "Malware payload (RedLineStealer)", "value": "550c68f6c7f2012208308ed1f589b5b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889833, "uuid": "9f21ccaa-6e58-45e1-a0d1-2bf470b149ae", "comment": "Malware payload (RedLineStealer)", "value": "6b03fddacd44cf7e1ba8ed899119a3b1e024f70670281589807cdd92c3314221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889833, "uuid": "8fe94e48-a973-440b-a2cd-065831819408", "comment": "Malware payload (RedLineStealer)", "value": "0dba94d3e638a7fc27158da78311fae7f8231a3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889833, "uuid": "421d492f-8ea3-423c-9afc-3d2a93284cb0", "comment": "Malware payload (RedLineStealer)", "value": "c97fb3b3a031b6bbfb99ea6a4149efe0aadc7e770486dfa168cdfdae64c1af1d5c0130b14061e4551814a9f0bf424765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889833, "uuid": "624072f7-8f28-4141-8cc6-440f3e0bbf23", "value": "T18A54D02131D0C1B3C4BB553484EACA399A7A74310B7A95D777DC27BA6E213E1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889833, "uuid": "51fc9876-c912-43bf-9be3-b34de3f2c43d", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889833, "uuid": "d3415aaa-b31e-4175-b555-e36fdf7fa18a", "value": "6144:nDKW1Lgbdl0TBBvjc/3CzPQY9BAQ/WHqISu4lHS38:Dh1Lk70TnvjcvCzYY9BAQ/OD94g38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889833, "uuid": "b7bb0a62-3e41-469f-bf53-c3d25f1549dc", "value": 291492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889833, "uuid": "89f144e3-0062-44e9-9fed-0b0a5f221462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889833, "uuid": "898ffa42-4213-4d43-970e-4b47dd338b04", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2c881e-c824-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763872105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763872105, "uuid": "9fd95978-e698-4954-b564-310e8091aa39", "comment": "Malware payload (Mirai)", "value": "ec04d734a53ad0daff79bab9d0adf6b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763872105, "uuid": "9850dcb9-852d-4f47-a135-2cdf687cd8dd", "comment": "Malware payload (Mirai)", "value": "6b6299d1004bff5762d6d60160154368d0ae0a364370cc684f57a2a65fa13f30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763872105, "uuid": "a8793197-3df5-46e3-9002-a44c4519e8e9", "comment": "Malware payload (Mirai)", "value": "043f44955dc2afc5769f6b1d0f8276c2900cf525", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763872105, "uuid": "7ed9f7bd-7217-4f7c-b975-fe5ef8e085b3", "comment": "Malware payload (Mirai)", "value": "e1e3a144ab94b1ad4e83401a22af3495321fbebcfb6ff23e32de0368ed02629d2977e6ca69c7ea7dd20e93c582172a9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763872105, "uuid": "419bec14-d8ab-4453-9203-91fa8928a200", "value": "T1735302981E894BF7F56A487D5E360BB805A18BC26601DC1C1CDBEEEE6B5A8E07044BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763872105, "uuid": "e03c5769-4176-4d9c-8ebd-3d1e1b7dc05e", "value": "1536:p3g24pSk9kX1vy9ULA3IPv2izxh2jCq/m1ynkbIVJun:624pSqks9xYX2wxhyC0/nLVQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763872105, "uuid": "646a802e-c2c3-4cf2-9b1b-7f5ae319a356", "value": 65632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763872105, "uuid": "381240f8-6487-489c-a7d9-96098044febc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763872105, "uuid": "a750fb87-66e1-4dcc-8315-80f40c75a78a", "value": "SecuriteInfo.com.ELF.Agent-BQZ.67132221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cb1602-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889834, "uuid": "83039bb0-dc97-4c6f-9f2a-2caeb8b247e6", "comment": "Malware payload (Worm.Mofksys)", "value": "eb55dddfb27313c64c5a1ddc7424ebf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889834, "uuid": "266fe5e2-0d92-4c6b-bbb2-1d948cb61cca", "comment": "Malware payload (Worm.Mofksys)", "value": "6b985b0df973f5b78bc62d7de3a83342b331b227b11404084c3373ba09901cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889834, "uuid": "067ad453-946e-467c-ad71-8a6740a3b370", "comment": "Malware payload (Worm.Mofksys)", "value": "0acb4df78b7422314d8a4aa9802cd3a36d66b1c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889834, "uuid": "91ab95d5-cf83-4122-bb00-58e28a7b8443", "comment": "Malware payload (Worm.Mofksys)", "value": "88dca358cce81f636668d7e4cb92c6b75e3f7a4b54ec35ce6b64d6dddbae5e65f4aabfc250a96836a2dcc67392f2e84e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889834, "uuid": "771e558b-cb5f-4ca0-ba85-089e35919d4d", "value": "T14F24182BBA50712ED853D6F01466B6A2B5322E321F91AC1FA781AF443871613F5F931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889834, "uuid": "b5711461-c103-4686-91ca-43cc63c977e6", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889834, "uuid": "7c3ed3f8-c133-40dc-b2a4-b9c0f13ddebc", "value": "3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4Pmuz:7vEN2U+T6i5LirrllHy4HUcMQY69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889834, "uuid": "175972a2-86a3-4249-a773-2cb63b8984f5", "value": 226340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889834, "uuid": "706f9416-4392-4ede-8d0f-25bed78fb736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889834, "uuid": "1d782e31-6de7-47aa-91bf-c8401e44a5f2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6640185-c879-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763908525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908525, "uuid": "5a744ef5-4eb9-4e4f-845d-8e7b9b2283d4", "comment": "Malware payload (Vidar)", "value": "41e171c3a92286786e62a99d05ccf209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908525, "uuid": "23c84044-9fbb-45dc-b5de-10e8ff4eb094", "comment": "Malware payload (Vidar)", "value": "6b9f67826c5fe1437b93c7ca9a8f5ec9d103e0e109706797a5f1465c7c1542c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908525, "uuid": "014bb3d3-dd57-4e83-a7cf-3f3a60742606", "comment": "Malware payload (Vidar)", "value": "c35ac3594b127a5ea8db21e931dc2918f49d5cb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763908525, "uuid": "b973d3d1-c2aa-4aab-82d2-3d4988415fec", "comment": "Malware payload (Vidar)", "value": "644d9a38f85ac147a446ed3a9d0da9882ac117bd1265ead1a8513874f2aee50e0e443b680bd620bacbafe4a6052ef2ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908525, "uuid": "8353808a-acdf-46e9-a034-a4dfb53f95ef", "value": "T13DE55B07AF9088A9D499D2359DF7A25A7232FC0857316BE32E633A355EF33D05876B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908525, "uuid": "c5e662a9-f07e-4c92-ae41-5769929d995e", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908525, "uuid": "a63d8f15-1488-4362-9aae-f31e36cf640f", "value": "49152:Yl5BmBLq4/4hmK/+N6rPi1OEJkgnr2q7mR:YUglEqg6cmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763908525, "uuid": "0dbb4099-c84b-4b2c-92b9-0eb727eb94a1", "value": 3236359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763908525, "uuid": "6ce908ba-59aa-432b-91a8-dfd43d392150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763908525, "uuid": "c6df9064-1cec-456d-a3c9-a0fb808a7136", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdb2ee2-c88f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763917770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917770, "uuid": "dfd97486-d2d3-4f79-b10b-7dce7ee07026", "comment": "Malware payload (Mirai)", "value": "a71e232443fb23e9a3b9090060b0ad6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917770, "uuid": "ad81623f-7203-49e6-900b-6780e610b864", "comment": "Malware payload (Mirai)", "value": "6ba3dab62f543dbc1dba97b1e35b31efccc7499aaa4f23622c953dc896829b08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917770, "uuid": "05db14c3-a463-4052-8d59-e578139a9958", "comment": "Malware payload (Mirai)", "value": "fa1a5e60e3cd40f5457d338c384b69b6dffc08da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763917770, "uuid": "6deb0921-5bc7-4fac-ba81-380634758967", "comment": "Malware payload (Mirai)", "value": "f6227f650f6381c426ba3083ad05c27361b19ab926a958689feb412b6160680017e85ca3d5dc6fd42cca3aff5352e05e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917770, "uuid": "ca040b1b-86e8-4706-be67-5217f8a1058d", "value": "T11A2309C8E443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917770, "uuid": "018f188b-b931-48ba-9915-d64282c62615", "value": "1536:6nJRT4QPfZfW5XTOeY3DveHAGX56JJ4Qwobn2iEe:Gv4QPfZfW5XTOeoszJWWQw+2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763917770, "uuid": "891d0c9d-de55-4530-ac1a-f33c2be8e662", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763917770, "uuid": "496fbf31-1274-401f-8a9c-4d7f2e799bc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763917770, "uuid": "e89a8437-012f-4fac-9395-790ddc1e4ede", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22629afa-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889835, "uuid": "19c866c4-04fa-4caf-812e-a1e818522c67", "comment": "Malware payload (Miniduke)", "value": "5bdb7197257ad6ee7eec8bb7f5e52490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889835, "uuid": "86f0f594-4a8b-4926-b6c8-ec40d76ef298", "comment": "Malware payload (Miniduke)", "value": "6bf34cb42645563102c15dbc5289b62119bfbec11b1231812f103fd36e8c733d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889835, "uuid": "7ac96a0d-2f5b-4892-8f73-cb016e0736fa", "comment": "Malware payload (Miniduke)", "value": "c9ad69dee6308ee684f9b4bcd22e42b626467044", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889835, "uuid": "8f1f0d59-14fc-411f-869c-ce86c6b7b51d", "comment": "Malware payload (Miniduke)", "value": "9f56017eb050974c8eda5b130fcb7d59a65ed68005154dd25311f96a42c2dc6f9e736a9afe0dacedee5f6f95d27d9d98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889835, "uuid": "83d54f60-3ccf-4424-8f02-ecfacd5c15bd", "value": "T1D4048E3533E580B1E53316B46DF1AB72967EBC384A71858B9BA41F5F2A346D18339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889835, "uuid": "c9d65ed3-ad62-471e-a055-b17adf554b5a", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889835, "uuid": "dda1787b-ed9b-4b3b-80d9-121850410eb3", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZJYIWJkgL5Se:+/LhS0rKE/FLITo9mUIWWgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889835, "uuid": "bfe74301-8575-42a1-83c4-5372dba4930b", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889835, "uuid": "86462dd4-cf4e-47a9-b2cd-43f82bb9ba67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889835, "uuid": "9e230945-7b85-4ee3-a049-573a27db0c6b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab323d4-c852-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891889, "uuid": "7a7bca33-1acc-4b2d-ad43-9e54eff8e248", "comment": "Malware payload", "value": "9e9ee0126e9a2bebcd36012e2c9afe76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891889, "uuid": "414c0e1c-ab70-436c-b2e3-f90ddb7f277d", "comment": "Malware payload", "value": "6c8662d493fe6a35c9337170f9af2be77630dfbed2f71d594abbb30c4cd605d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891889, "uuid": "5fd8f099-0353-416f-8f2f-78cd712fd05b", "comment": "Malware payload", "value": "efa2dac082188cfcaea3c3750f536da449d6ed82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891889, "uuid": "dc161060-f402-422a-862d-198c7f5cea3a", "comment": "Malware payload", "value": "dca08f1114cb9b6315d3dc7923c3281d26b142789eff9935d40eef155bd6d8096b144375c094af47cf93bbf203432ac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891889, "uuid": "e9dc1981-2a21-4863-acd9-31b18922dd71", "value": "T14735232333C259E1DD49917203876379AE73FA3C17B1D42BF7ED8A0B1C70950BA695A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891889, "uuid": "489b0fe5-d08f-4a11-9f13-40feb3db60da", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891889, "uuid": "df84fd08-654f-4fa9-a458-ef77ec84d657", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuNpLF:qE27hQs7tWVToP0Hekxbl5TuLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891889, "uuid": "675b7156-2098-497c-93fd-d41e91abb969", "value": 1131929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891889, "uuid": "f515949a-fafb-496f-955e-51533cbe4e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891889, "uuid": "538c1740-a473-4ae4-b70a-46ccf2dceb8d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d0ddea-c8ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763930474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930474, "uuid": "9ba0e286-0980-405b-b7cb-c8cd05fd0304", "comment": "Malware payload", "value": "29fa51a4ed1b9b276e02334163ffef52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930474, "uuid": "e7b6de68-9714-4081-902d-a8757e36ad58", "comment": "Malware payload", "value": "6ca855c1129470ae340e54a33fe2bfbe2a68bbaec189f6f6e7256a50212bcdf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930474, "uuid": "02cd01c0-7151-4fa4-9d77-54fff2554da8", "comment": "Malware payload", "value": "8fed3bcac7187b60e830315e51e55be7d1b70cae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763930474, "uuid": "09fba1f4-1604-41a6-bf35-9588c5b2518d", "comment": "Malware payload", "value": "c2a74606fa41f2e0fe4d10e0bd6996bd58bfcb0e15bc7c1ca9abf5c498150833c69ab82ac7dcf39b49d2fb94122ccdd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763930474, "uuid": "3d1a9433-35e6-495d-8bb5-4833d491f304", "value": "T1ACF46DBDE7A882A5E4B3D678DE028413D6F27C0442B1954F07C25A9D1F27791EA7EF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763930474, "uuid": "3d751a32-9536-435c-a258-6fc3d5963caa", "value": "28921ba37567a8c5a8749ff9d237c8ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763930474, "uuid": "9572a1fe-19f4-4259-bfeb-f42cc10c678f", "value": "12288:hKXew3XOzhorrdsUrJsPd47ljXPiJ1A/jW00D5Q0MX6sKeKaff90:2ew3XOzIxJsPdWbOA/2D5QHKR+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763930474, "uuid": "69a86319-a957-4394-841b-e50f5fe7e2ac", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763930474, "uuid": "3daf005d-4ceb-4414-a528-50579f7bb493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763930474, "uuid": "2dd62248-709c-4243-9483-585e9fcea157", "value": "SecuriteInfo.com.FileRepMalware.65492118", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798edcc6-c82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763874949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874949, "uuid": "e7bd0dc8-9356-416d-8867-9e73093920c1", "comment": "Malware payload (Mirai)", "value": "a08ee13075d4b8c89c43df2b51166c1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874949, "uuid": "7eaf4c61-e2be-4414-a0ad-2ba4c78a8ec6", "comment": "Malware payload (Mirai)", "value": "6cf2151f2040da257acf79348c996e76788214f2483fd3ed7a9b3be08b24d724", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874949, "uuid": "9f306e5f-3265-4040-876c-b405f119fc5d", "comment": "Malware payload (Mirai)", "value": "d4ae1ba8f16c0b0c51f9bb09ab38f4e253563a5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874949, "uuid": "10f08412-bb55-4427-b079-6ee403203f3c", "comment": "Malware payload (Mirai)", "value": "347962b6ee804af84b86ae2ade07f40cb7a16800d0bebb60039bab02368f48652c95ad9946ef989018a09ee291a1a7f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763874949, "uuid": "f49008aa-64d8-4e72-a6bc-919469da5be3", "value": "T19303F186D0C96FA7DFBEADBAED13C2982FE24D4E3EB59A9FB4CC59021563510C9C4050", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763874949, "uuid": "0de27b1c-90ff-430a-9fb1-132756c96aa3", "value": "768:7tYhJn4jvND7iIId7/GQMghzKuiFhh6hI44mPoYBag+TtIBogIlW4uVcqgw0If:7t2S+daizKVL4lPhwTe/4u+qgw0If", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763874949, "uuid": "cf99f3db-93d7-47b5-a732-c96bddcc2a50", "value": 39984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763874949, "uuid": "1ce52c2a-a6d0-4555-9f93-d9a0354f27c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763874949, "uuid": "24e61f84-000d-4e18-b122-eecb8b5f7ea0", "value": "Labelloperc80.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fdd482-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889836, "uuid": "4d7e4a66-2d1e-4b12-816b-3a1ea4e61706", "comment": "Malware payload", "value": "dbc7faf664d33a7e6a02720be7865fd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889836, "uuid": "1959de64-1728-46e1-ad51-56d88a8c317d", "comment": "Malware payload", "value": "6d0247a5f3c0b03827100873a64a1c8bf06c91e2c859ff2aec81ef7679fbf377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889836, "uuid": "17229dc2-5af4-4809-813b-984761116727", "comment": "Malware payload", "value": "bb54ba93b515679161a6aaa2563df8751daee79e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889836, "uuid": "1358788b-c136-4e83-91b0-ab4b2d1f1171", "comment": "Malware payload", "value": "e152b238302978bc493bce302c272057194c5d5b4e1a3a050b0c99b9c2d6625068edfe6b9c89a47e77ec7604e47e17a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889836, "uuid": "0ddc3bbd-8cda-47fd-8669-18e357122fd4", "value": "T1028533640FE204ABE823183E72AC137AA49FB7744624DFD38394DCE5F427425DA956CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889836, "uuid": "61b3ebe6-1e8b-4894-b6fe-d59d1f7526e8", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889836, "uuid": "9b62d2d9-a5d1-4f88-8ce1-b55d8ca0eaf3", "value": "24576:LuGtcjN3lRfEyB9MBhavuS5iavgJKUdeIhRHq9aR5iP3QtbMDynPll8w+VaMjPPR:fiB3ffDBvd8BRJO/2nPcTjXbnBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889836, "uuid": "9baf3400-6b49-4f25-b84c-2fa48013fbcc", "value": 1708016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889836, "uuid": "d54fac83-642a-4972-a408-3648d15a0062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889836, "uuid": "0ee5c6ee-1131-4487-a320-c99d5f2b3d18", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2394b3aa-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889837, "uuid": "51477a94-4ee9-4931-adb6-a4324c76ebf4", "comment": "Malware payload (Simda)", "value": "538788a5ccd756e8891c0f460a1bef36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889837, "uuid": "b3717067-4066-476a-8764-4d720b2d275a", "comment": "Malware payload (Simda)", "value": "6d1afc710c0c76a1710688f2710295019f2ea1c50841db89b9f04394a6b4f6c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889837, "uuid": "27f220c7-d40d-417f-b80e-ac39639cfb65", "comment": "Malware payload (Simda)", "value": "38dbcb2be64cbc1b13c6649cfa84af41bdee3e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889837, "uuid": "04727d08-2e1b-4669-b510-04bfcac48319", "comment": "Malware payload (Simda)", "value": "005ec47dbf9167bc9c4c38716d6b20ab3ce67348879b2cb942f6ae1ff6aea3cd1397ed8e617bad52151bad3bdec896cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889837, "uuid": "52262310-e757-4cca-9fe0-f30aae2cda1b", "value": "T1A1F33926E04544B9E5E0127C65BD3B9240BF6D74972C2CE37391AAC91DF82E37A7831B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889837, "uuid": "89ebcd9e-ddcc-4de5-b96b-36091b57ca69", "value": "cb59e9f2348b37e98c5e9c617c66b271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889837, "uuid": "a8729232-d62a-476f-a4b6-381a7305a5a6", "value": "3072:aejjyYsAq/C3RCzgJHvNA1PpYfFL6zU+BEfi:pjjjqahUSPe1SZ+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889837, "uuid": "05c90328-b5dc-4ec7-a2b9-13e707c5db6b", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889837, "uuid": "8bed38ee-4a32-4fc9-8eb5-04b57827dd42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889837, "uuid": "796fe593-35ce-4c91-834a-902fb3260852", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244b868f-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889839, "uuid": "4389ada1-a23f-4807-b170-040ff6217226", "comment": "Malware payload (Worm.Mofksys)", "value": "e29edf52e403ddb80cc670c406f883b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889839, "uuid": "95359eb1-100e-47cd-a6d4-6d09631a8939", "comment": "Malware payload (Worm.Mofksys)", "value": "6d372c11da48d3567fee1cf8929a89fbbb3b7ed4886fe7ee6a80e3f63f5980b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889839, "uuid": "70bdd986-a959-429d-91b8-3716d64e1c4a", "comment": "Malware payload (Worm.Mofksys)", "value": "17f2236ef44b22b42b5cb0052e0727b89d427e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889839, "uuid": "04d93fef-8785-4c26-9732-59bada985186", "comment": "Malware payload (Worm.Mofksys)", "value": "649c6ed2f8c308cfbc09cdfe38bd4a635fb5d8272bba14ded40e29933a76c584910d7da78edb106315cade54f11d3e95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889839, "uuid": "91cdccb5-33d1-4aa1-bf92-c05be81ec682", "value": "T13124E72BEE44B01EE46381F01927B2A6B6262D396BA2AC4F23E16F553474553F5F430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889839, "uuid": "d90f58f8-174d-4186-9088-3552c2514de2", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889839, "uuid": "5ac11960-6e87-42d7-aa63-e6cd540dc162", "value": "3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLb:zvEN2U+T6i5LirrllHy4HUcMQY6Kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889839, "uuid": "ab5460ee-fb5f-4221-9d53-1108cbdca522", "value": 211974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889839, "uuid": "32181f43-64c2-4700-a91d-bda841f0a95a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889839, "uuid": "2b59751c-e251-4026-9a10-5fc7353bbdf2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f570a6-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889840, "uuid": "d6818a04-570d-4879-ac09-ae1161eb4acd", "comment": "Malware payload", "value": "dd5c3474f0d0f37cad1183f566fd8721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889840, "uuid": "d47f98f8-c09a-4432-8d9d-637b9af60358", "comment": "Malware payload", "value": "6d6edb5b9b8249f6c631e86d2e131a890cb0184d21236fd8d50de52f576193fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889840, "uuid": "4822d43d-c091-42a9-a90a-081f3183d28b", "comment": "Malware payload", "value": "dd249787385dce8c50b774efa842f8e0411395a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889840, "uuid": "9c7f0c06-fef6-4c50-b896-d779df5d662f", "comment": "Malware payload", "value": "dc4eead4df3a49efdacb5af3f888e3544f4f4b5e5bf71f5ec8c22b31cdae2f5b1c5044e3501648b178532a224ef3392c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889840, "uuid": "d0bf58ce-375c-4982-9bc3-065253ac95bf", "value": "T1D8853359B6C248AECE0D253001467B648EB7ED3C1EAE2012F7ED1A126CF1E51FE1DB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889840, "uuid": "06cb86a1-28bf-4a8c-89d5-8a49e2d30a0c", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889840, "uuid": "2943780f-316d-4a07-a7e3-c680399ddfbd", "value": "49152:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxsOeKG4pEQPoKtU:82kQCN/JT/kgFWLayOeyyDKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889840, "uuid": "77694208-cbee-4cce-b9e6-4460d22020aa", "value": 1854591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889840, "uuid": "e4558841-5011-4b15-8d5b-2ca41b9a898e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889840, "uuid": "ee9541ff-379d-4bcd-89f0-ad3783230cb3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258a2c81-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889841, "uuid": "bee7a18e-b612-4f3c-a978-f50f4401fce3", "comment": "Malware payload (Miniduke)", "value": "e12d4a2ca5fe2922868a713a12cdb4be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889841, "uuid": "5a1f113d-b3c4-4c36-b0de-a10d3305ca0b", "comment": "Malware payload (Miniduke)", "value": "6d94f19732092b1db1ab5296b436cfc67773e55410330c9eae4e6be5cf1ce100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889841, "uuid": "b4e07dcc-321b-4ac1-b274-1a04cc13dccc", "comment": "Malware payload (Miniduke)", "value": "541c54d03b309b85f8a440ce9c281ec22eb6c0dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889841, "uuid": "303ad6b9-c76b-4ba7-a18b-cdb035546e40", "comment": "Malware payload (Miniduke)", "value": "dfa6f60e1cd92ad0f163a77332e42e26b24e07bd8d7af0e403f3fba979ab88d6570a79ee0224ac8de3f0e99782521424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889841, "uuid": "f6fbfe8b-37b9-40ab-938c-4cb490f3b89d", "value": "T16724AE2233D1C071E56315B46EB1AB12897EBD18C67189CBAFF40A6E7E74B81823D747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889841, "uuid": "9b9b0029-6f8c-4d12-b45e-45c386baf65e", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889841, "uuid": "062b424d-0298-45c8-b33e-850d4abdd84c", "value": "6144:M3vVaAHfyCk+XlKy3PfbUh4ajc5emhRzIWqS:MH/bk+XkGPfbUh4ygemfzx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889841, "uuid": "0c02589a-1b47-472c-bd08-a75991e18ba0", "value": 228062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889841, "uuid": "8dd94593-afe5-479a-9b11-06939f05e572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889841, "uuid": "69240a08-da3b-4f93-bbee-e11bce09ca28", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c964cb7-c82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763874981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874981, "uuid": "f6790f4c-ab2b-4a95-b51c-81b5db58fd74", "comment": "Malware payload (Mirai)", "value": "340fa3e3c828b07592c927e07ffea7ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874981, "uuid": "e5b3e7eb-8da9-4520-8d3c-2b9c6cdb9c46", "comment": "Malware payload (Mirai)", "value": "6e258a1a6d793414cecbbd0c99b4f4f7e8fc4649d76d433e0ccd5f0a5a75032d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874981, "uuid": "a10330a8-5bf8-47bd-be7e-4ef2d3b7e437", "comment": "Malware payload (Mirai)", "value": "453ca7a13e729786f2b6fc579a3e892a4e79e986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763874981, "uuid": "4cfd74f8-15c4-4a5b-b072-73ab3d616dd0", "comment": "Malware payload (Mirai)", "value": "14ab92a4b732130df70143d6282512a5bfd29f4ebcf63ee1b1571601d16b60f5a0c6ca2f352d992d8d92835af0b8f1be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763874981, "uuid": "a412c4b6-a283-4f91-9544-a3db42dadee5", "value": "T177934C02B31C0A47E4575DF02A3F27D1D3EEAAA020F4F6C4691EBB8591B5E361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763874981, "uuid": "4b8bb982-ffe7-404d-8c9e-9c9ccf39c7b8", "value": "1536:l8NJzXik7T7urnd2O2SivEfq2sOacN+sdDJZnZKa86FgmYeZrvOmC:qNJGMTyRdNXbZE6893", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763874981, "uuid": "630b7653-e56b-4777-9b99-ecbc38d1f740", "value": 89440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763874981, "uuid": "8baafefb-e740-4799-846d-83eedf05cb4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763874981, "uuid": "23f62aad-ec18-47ed-9050-07050f98913d", "value": "Labelloperc80.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262f79a4-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889842, "uuid": "e8cda5a2-7f73-49f3-8471-2274edf4241b", "comment": "Malware payload", "value": "b98c82943a3d2fae412dc7f83ca7db95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889842, "uuid": "2f3db376-c670-41b0-9f49-c10ab779b8dd", "comment": "Malware payload", "value": "6eb154ee21f2daca90e2ed774cdd2c845caa8e41873f54a77a6b9ba2816ab3dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889842, "uuid": "a595853f-74cc-45c2-880d-c74e2e6d3f8a", "comment": "Malware payload", "value": "21b1fd35691e24687add2797f4120b070b79fad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889842, "uuid": "d41bc337-50d4-4e35-8136-f6a5d1856ea1", "comment": "Malware payload", "value": "9483705d55d1e6f9c43ab2c1cdc89a51a835f0f9eaf616a86bfdbac0873ff5e0bf63b52844fcf0f86eb725c7a05ba54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889842, "uuid": "0b41c088-e226-4351-a494-75434a5510c0", "value": "T1C575231637C29896DA065A3001966E74CDB7DA3C09792409F3ED0B077CB4DA2FF5AF92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889842, "uuid": "88429660-98ba-4f89-bca1-ff4244b49434", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889842, "uuid": "848b6d3b-e2cb-4f7f-8341-8003986497a7", "value": "24576:v6Zv2ivhBVnFys7xP86LXtqWJ/ej0umQf8/+1gFDsHLAgDmfluSsttObPIDXCRU:vE2ivhQs7dLX/JkZ8/+1gFsHLAVxsTOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889842, "uuid": "38d53f09-fe71-44c9-aa2b-eb5caf6164bd", "value": 1562945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889842, "uuid": "a606d8cf-9de9-4b76-9f38-c7a01caf301a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889842, "uuid": "10f94474-30a0-407b-807f-5ed8de7a5cf5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e99ee6-c851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891403, "uuid": "04eb1177-d6b1-4d1c-bdf4-2275c7e585ae", "comment": "Malware payload", "value": "0915654b0a4296b25468852c0ea5528f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891403, "uuid": "d5ef7961-bd39-43a4-9e20-8545a90ec062", "comment": "Malware payload", "value": "6f30fe9beab36826ba058b7b65263a4c6d5545b05351821f75df5a9d4f68b995", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891403, "uuid": "db802bae-1654-41a0-8d59-203bdec4e600", "comment": "Malware payload", "value": "c2f32684a00ace6dc863ffd3f7d1cec0836ef1d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891403, "uuid": "0861edf3-8088-4495-805c-d55b4a0ed721", "comment": "Malware payload", "value": "af44aac15e802732a0ac3c8687f80df5c10277e850e4b46a7ff4ebd852bf8f1ece73604cd36b5204276b62c767fcb7a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891403, "uuid": "66d9ed0d-6405-4862-9a15-606f2c50c054", "value": "T1C335330B33C15671CE4A533206871AA15E73A7BD0770983A77E8614B0DF2D54BFB8AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891403, "uuid": "c1e920b8-4b6f-46c2-b9ee-fea0d7346e01", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891403, "uuid": "d535899c-4fe2-4e87-a485-0c298df07e30", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mW0Wr:qE27hQs7tWVToP0Hs0/htDH3pGaF5+9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891403, "uuid": "a4ee700a-813f-4894-baea-aca4d74d1c80", "value": 1161010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891403, "uuid": "8db164de-5bfb-4ca8-b0b2-f6349a7b7345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891403, "uuid": "47236cd6-9073-4e4d-9046-e1ae5ae54d93", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c68c66-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889843, "uuid": "e637b9e3-5fc2-4bba-a25e-bbd0503a7abc", "comment": "Malware payload", "value": "8842397bb9dfa47487b7fc477e1b4181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889843, "uuid": "20885ab1-2ce5-4d62-b9f9-d0631a51a567", "comment": "Malware payload", "value": "6fe22cd396db69c9ccc9e281171c5f79ab74f2c411b6b3797f3c000a7f4036e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889843, "uuid": "179bf2b0-daba-4a08-b48c-fa501824d0e9", "comment": "Malware payload", "value": "c166fd5d647c9bd398806e446fd0126a634f2c4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889843, "uuid": "59219cad-47cd-4d4a-a4e9-8468df02d860", "comment": "Malware payload", "value": "52095d238fa9dd414b3e1f6c9c4a4b85694ed8ae42485baa9a6b9c400965e0622fc0a0db39e71e5aa68458553bf8c9fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889843, "uuid": "d76d26b7-939d-435f-b063-56cf770d3596", "value": "T13925234E19C23756EFBCAB724B4614C8355327DD2B91642D370CA48B23F3988AE7867D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889843, "uuid": "0b5e2852-d389-44bc-89a1-3001d722508d", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889843, "uuid": "c95073da-cce5-4a37-89c8-30c461fb5122", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1ZXF:+YhQs7tWVToP0Hs0/htDHi7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889843, "uuid": "efd41a2e-57d3-44f9-935d-caf8d9881bc8", "value": 1023605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889843, "uuid": "d99b154a-595f-4aab-8a9f-a8a01e16654c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889843, "uuid": "b5fab247-77a8-4609-8114-4050e7b45024", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2765fdf1-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889844, "uuid": "367c8b5a-7817-4cb6-9a9c-065bf59c53a8", "comment": "Malware payload", "value": "fa495f2ea751a29b719e94956f404abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889844, "uuid": "92292d5e-e9a8-4776-8b3e-478531e0f348", "comment": "Malware payload", "value": "705a38a5d9e0e2c37b7fdc7c206285f342a491970cfd4a3660f9d752aaccba17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889844, "uuid": "db136620-0fd6-437a-9b41-6b521254747b", "comment": "Malware payload", "value": "3a756d4d1d9f0d57b94cffc4fe57318991aa2191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889844, "uuid": "bc0c60f1-9fd3-4c56-8d41-2bbf44c8e389", "comment": "Malware payload", "value": "d9f96f08bbc3b80911b40e7774a78b31a687439e5eff8cf1a2704576c55d8ef3c3666264447ac30f0c0bac004e5e68cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889844, "uuid": "261ffdc7-a007-491e-9485-d738e2473852", "value": "T1F015237336C4EDB6C5062630019A77718E77C9322EB15526B7E8172BAD3A990BF47E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889844, "uuid": "94bbe2ea-611b-4216-880e-1886e5047876", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889844, "uuid": "3c67622c-53d3-432c-baf8-a391de609a43", "value": "12288:otKe6Zv23YnTjp0Wn91decvPRciwwJFvu0jlt5SKCoZdxI8vREDU:K6Zv2KOWnowzwwJR1hdZdxI8v6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889844, "uuid": "f655ac9e-59fb-4c89-a0ff-8d05560ba8ae", "value": 881583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889844, "uuid": "aa87861a-ba97-4a0d-8bdd-e90a9ed10aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889844, "uuid": "cebad83a-d5e1-4dae-8ea4-ec16f4c71b9c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281313f0-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889845, "uuid": "e0f06421-83a2-438b-9222-208acc024a11", "comment": "Malware payload", "value": "1384860a8da98601a51b2a638399d885", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889845, "uuid": "859808a1-9a65-453e-9975-066f96d4dae8", "comment": "Malware payload", "value": "70c81bba5e3008d10ab81995892c229a6fe53a9349b3a3da301b01536d0d61b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889845, "uuid": "e3ab10a8-2282-480a-a39a-48db43d92814", "comment": "Malware payload", "value": "8731729c412ea4a090825c7636c5a1cddae08beb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889845, "uuid": "666ad597-e1de-4110-8c51-1ccedb4f5e6a", "comment": "Malware payload", "value": "bf90ebea88f01c1165a247c45cf01c046c5641ba939df869eb5fd0afd04f3f88b345aadf66f24d1a5ae7ac541c386944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889845, "uuid": "84134a95-4f6a-46d1-82c4-49f1c5818d4e", "value": "T10D35334E06C23755DFF9A3B24A8224E5256337EC57A0A839771CE0C903E36599EF816E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889845, "uuid": "cc19a847-7e5d-4e40-ad04-1fbbc76d2cb0", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889845, "uuid": "58c6a87a-0222-4ba9-b2c0-12a99ad61eb7", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFtiE6ALmOL:+YhQs7tWVToP0Hs0/htDH3pGaFPii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889845, "uuid": "cfb0841c-b66d-469d-80b3-08261bcd68e5", "value": 1141154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889845, "uuid": "5ab99e1c-ef1f-4634-95c5-fba8173dd300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889845, "uuid": "a0833043-d022-40c3-854e-559b23fa2140", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bc180b-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889846, "uuid": "fe616bc5-82ed-4231-b1fe-ddfa5094e3cb", "comment": "Malware payload (Simda)", "value": "0f3b9e3b8f23ed8cc4b08d8cc76dd766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889846, "uuid": "75660e51-2e09-4c57-832c-c27d48bbf9e1", "comment": "Malware payload (Simda)", "value": "70dd0e2b0cade900551fd86f289d98416738c0fff4070b0f33dc700434e4b666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889846, "uuid": "92c2c87e-9149-48f7-b10d-be092197b06f", "comment": "Malware payload (Simda)", "value": "7da84cfa1695b29dbd23c49823a406c5cbf35b10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889846, "uuid": "83ebb11e-eade-45b1-9448-7a3ba2243c27", "comment": "Malware payload (Simda)", "value": "97bc4bb330c6051cebe2c448ea283fdd7c36c01ad244c7bbafa42c49badc3a94d48cb4bebf22a70f5a121120156c7c9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889846, "uuid": "55302f2c-18bc-4c27-bcf4-5bb9691d4b97", "value": "T168D4123173099DD3CD120DB70CFD973525D99D3883A0C24E5936C99F3A2AAD2386DE2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889846, "uuid": "16e11daf-910e-430e-bd88-0a94006a2040", "value": "98aa7065495f35513795744857924eba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889846, "uuid": "e516bae8-d029-40ed-a7df-f9d07701ed35", "value": "6144:I7++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:Z+cff22qZhZcKYhc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889846, "uuid": "a71ed145-bf0b-4bd9-97e3-7b376f432958", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889846, "uuid": "3d74cb63-d598-4bc8-ba4f-4ed97e4b6158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889846, "uuid": "95cfab27-3b4d-4366-911a-95606f7b23b7", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdcfbb0-c851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891329, "uuid": "043b84b3-9ca0-4198-9371-2ef02c5f989b", "comment": "Malware payload", "value": "13c97625c7f0bb763d7bebabc0d01e8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891329, "uuid": "36f3aaff-794f-4135-8c2e-573822b448ec", "comment": "Malware payload", "value": "710f080623a9506e5895d790c10f4cdfec1111b08fc65505c45e4a93593d3257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891329, "uuid": "95240650-ab2f-4fff-93d7-0a192666de38", "comment": "Malware payload", "value": "2fde1e6f93b659453fa299eb3b09a6ab6a76633a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891329, "uuid": "3ab55013-a861-4bf6-ad35-f738b5bee23c", "comment": "Malware payload", "value": "a6e72eba50d62c2d06f4fdb1338cefea2ebb3787af908776e766f2c56f940e63442747eb1896937550b22e6aec010cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891329, "uuid": "6363f068-0d88-4213-9a82-41907d34c561", "value": "T16235230B33C155B2CE8A533107472AA15E73E7BD0770E83AB7E8A04719F29447EB96D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891329, "uuid": "485b8065-b13e-4504-a761-604e30b0b20c", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891329, "uuid": "b9e8dec9-3d4b-4548-ab47-fcef9572c63f", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFyjt8:qE27hQs7tWVToP0Hs0/htDH3pGaFyZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891329, "uuid": "03e915e1-da17-4f4f-8b69-8c7265a3df6f", "value": 1096779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891329, "uuid": "dadf095b-20bc-467c-8bf7-1318b35545f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891329, "uuid": "7262e588-213b-4eff-8346-b26b13589773", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2956a6fb-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889847, "uuid": "c35832c5-f5c7-4f4a-9424-1bec4a548d40", "comment": "Malware payload", "value": "9b1ba3f0292c2099be0fc24b911db7e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889847, "uuid": "a6c00c7e-1405-4e89-b9fa-3d3e92544d04", "comment": "Malware payload", "value": "7124ad607d8d0745d391aa177c1370550f47f575e85e7003aea903901cb1af19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889847, "uuid": "9b1c24b5-d68e-4807-b724-e37298840476", "comment": "Malware payload", "value": "fed244980a40c0808e7735027f556295492bc242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889847, "uuid": "9d7109d8-c69e-48d8-ba94-894fc5618520", "comment": "Malware payload", "value": "0aa81b12d2ed5aabea473c29dedf615f00d065b826a010b4110050b73288a6beb88222aa1159c82028df32e2a3abb20c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889847, "uuid": "e98b9c56-f665-45bb-b1aa-6ea8b3ab2fe1", "value": "T1A0653333799090FCC88B5E36006DDBF59BB3AAB332B47135AFE909661C714925A1FB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889847, "uuid": "d7209e4e-7f5c-49fb-8e29-2222a9d21a06", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889847, "uuid": "27be52ca-1df5-488d-8710-610b3223575b", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lANCPrHQ0VfgHZhIpC:7E2lVL3Ze+/F5ndjFWmrjyx1cmbbxgAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889847, "uuid": "c1bfe84f-4117-48fa-b2da-0b408fe4508e", "value": 1456715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889847, "uuid": "80fcecc8-d9f0-486e-93a0-1ac5c234fb20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889847, "uuid": "1161a3e8-f6ad-44fe-b89d-a47508e2d53e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f0d8db-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889848, "uuid": "4a8bd2a3-3561-48a2-a2d3-95307d0ab9b6", "comment": "Malware payload (Worm.Mofksys)", "value": "6e958e2f67e78dba8542b01e5ca46373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889848, "uuid": "0fb3246e-8eb9-4487-9323-4934acc3dfe6", "comment": "Malware payload (Worm.Mofksys)", "value": "714405eebd85f28d9b8592ba8482f88bc18f78902d8eceda9471935d55d420b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889848, "uuid": "6f44a1f2-4264-4bf3-9a47-7b034c91b525", "comment": "Malware payload (Worm.Mofksys)", "value": "dc41c695ab2cc7e16c25b22aee90cbf42d2c6337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889848, "uuid": "17755bf1-42cf-412e-863e-76278298c82b", "comment": "Malware payload (Worm.Mofksys)", "value": "610e5d261c0f90f1929d24bfdbbc33d12dbf3833c967b45ffa23b31e5e26e442c691efa295a444827c843effc54746f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889848, "uuid": "81d40be0-5a99-490e-8646-7e2e53bd550b", "value": "T15263D099B1AF1A52F9566EFB9F2B903C5DC0DF928E27D3F012A810AD44FA21005DE617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889848, "uuid": "14b64c12-e102-431b-93ac-6e72cf1d65d0", "value": "e029f98a2da83608852f59fa44f95f0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889848, "uuid": "c18ce4a1-b897-410f-aa95-8c8c8d2fb4e3", "value": "1536:EHNYD2S7Q69jCMBXCrYa99YFPUBHENqYDP:YYKSkijCM6Ya9qJUpENqYDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889848, "uuid": "d3521c51-022f-42c3-b2f6-12ecfe7fd7d8", "value": 70966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889848, "uuid": "78ed117b-221f-4dd0-8406-eaf1374cb518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889848, "uuid": "f1a6ea3d-c542-44e5-b3d3-22a80d5c0226", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58b2846-c883-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763912899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912899, "uuid": "5ecbd813-f705-4d88-9655-538b96dbffc6", "comment": "Malware payload", "value": "e40368c033843b5e7eb975e37f4fadb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912899, "uuid": "51990b3a-7c98-4ad5-a1dd-92d901e746de", "comment": "Malware payload", "value": "7159d592be59b3e2ff3456a3979b7624e7061dbb27dad829e48eb1ae41bc7a64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912899, "uuid": "87800f25-8bf0-4ce2-b558-44076b2bda9d", "comment": "Malware payload", "value": "22cc3700af2bc5865b8121c2f5cc05492d732e18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912899, "uuid": "dc37ba7e-9d38-462a-84b0-4b74868f43e9", "comment": "Malware payload", "value": "8fa2204c5565ba5b30f9f8ea75bcbb670e3d456c44918e4de174fdce1b6f37f77313b533fbcc995bb2487d16bb8d3e47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912899, "uuid": "687a2664-41c2-442d-bbd7-6961270da586", "value": "T1D484C847D59664E8E11C90F42E53D72EBB99B04003396DBF194880393AA3BE5353FB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912899, "uuid": "d72fac2e-9a27-4ec0-aaab-97e337e83875", "value": "652a89f85e4d768d8c05161469e85cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912899, "uuid": "d63cb0aa-fbb3-4833-85c8-9ff4eabe3b09", "value": "96:MijLn2ayRCEGqyJTaaN8Ol2lLlbzmZVO:hjLbqWaaN58B2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763912899, "uuid": "ad51dc72-92d7-4354-af2c-9f645e777b80", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763912899, "uuid": "2a67673e-af15-4a1e-909d-480244c317a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912899, "uuid": "279248a1-b90f-4101-ba53-44a322c60910", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8b451f-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889849, "uuid": "bb68bbf1-764a-4db7-bbdc-54f891d94cd9", "comment": "Malware payload (Worm.Mofksys)", "value": "2ae1989b58da6924de6e64d3ffcc9b53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889849, "uuid": "9714a2c6-ed84-4242-9708-de6f75383801", "comment": "Malware payload (Worm.Mofksys)", "value": "717543a503ecf9079ce4e3bcdf563c2347ceac307f1d438c6b21885b8df3c589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889849, "uuid": "586e9189-ea07-4554-b74d-796dd27d9a8e", "comment": "Malware payload (Worm.Mofksys)", "value": "f54760bfd1d68be9b82e79aa32e3e45e0a73c616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889849, "uuid": "a39bb2f0-72a3-41ab-b3be-53fad4af6eb9", "comment": "Malware payload (Worm.Mofksys)", "value": "bb7fa5d64ba60c827053dbf2bae54e6f5defe0c40c2342ef95278c67d3ee747f6191db04dedb51c219192a922a590682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889849, "uuid": "9bc3fb1f-e14b-4ffc-a734-68cd0360a0f7", "value": "T1B0240A2BFA40707AD8A286F12862A5B6B5376D321F82AC4B27D16F453570A07F1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889849, "uuid": "45b17fa3-94ff-42fe-a858-8693a2f50225", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889849, "uuid": "ba4b74d4-8534-4ac4-8115-bb24d54c4490", "value": "3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6ung:zvEN2U+T6i5LirrllHy4HUcMQY6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889849, "uuid": "ac234f7c-6ea5-4c25-9cd9-2b475553cef9", "value": 211754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889849, "uuid": "063d5567-312f-4e26-8ad6-168be44409ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889849, "uuid": "e5572d0a-2997-4c53-b98e-5d954c45b0f9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11de92b9-c80b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763861031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861031, "uuid": "a1e47f9b-90f7-41c2-92cb-fe4354a8dd94", "comment": "Malware payload (Mirai)", "value": "69180961b0ae871034fa1cf24f196750", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861031, "uuid": "43225e69-ee06-4784-9c5c-d0e1bf69384f", "comment": "Malware payload (Mirai)", "value": "71992486c643a6c3d941740a20446008fc9f6b03583704fe0a44e33fc08614d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861031, "uuid": "953ef286-732f-426b-8e1e-c22fb02f0039", "comment": "Malware payload (Mirai)", "value": "82fe5006dde51c6f06d96e8f4778b60e2ad72438", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763861031, "uuid": "0c9be863-969d-44b1-9726-98fc163979f8", "comment": "Malware payload (Mirai)", "value": "229621969e037e72bed5cfe1894e998c77a4e987224acb2857d53b4101e258aaa09c6ec99b9faf698be3d1d27efed9b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861031, "uuid": "8bb7c860-12c9-4623-925e-ba622cfb3d04", "value": "T18A5302FDA21035F7D47A88F425F14B83BE025D3780435F8566DCDD53A391CA8A4A78EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861031, "uuid": "0ae0a845-6030-4327-aa3b-b7b4b152d155", "value": "1536:RC3dDoGOMdSlZIs/stBxGEyJ0iIxvR2+lovZ1CBBbVJuTX:RCpnSTIJBx44xvY+qxOBbVQTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763861031, "uuid": "4031c98e-280d-4b8c-830d-250e430a91b2", "value": 61928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763861031, "uuid": "08f26faf-edc1-4b53-b850-17f71e1dcebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763861031, "uuid": "76a13c3d-937c-4ea3-ab5e-dbfa3a1499c2", "value": "ngentodluwh.mips2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b23cfd1-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889850, "uuid": "ab1909ce-bb0e-4003-b020-3c5311d57f32", "comment": "Malware payload (Miniduke)", "value": "bda3de17f9e6f01ab6fe8aa5e9594319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889850, "uuid": "69b05f4e-172f-44ea-886d-9cac0de3c17b", "comment": "Malware payload (Miniduke)", "value": "71c6df92c3d63f9b52c15f3d594eefda62aa17b88ae91e7a685ad198d851ac55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889850, "uuid": "a5572656-c047-4464-b13a-6141d471f2a9", "comment": "Malware payload (Miniduke)", "value": "a90dd23a70b4e16b3e5a3551efb0797e89d942cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889850, "uuid": "14dc2d26-94ef-4bf6-8489-fc5f5f175af8", "comment": "Malware payload (Miniduke)", "value": "4fbc5a8f5e32a4dc4f39403e403ff1bc8c10d6be7b2e563cd37a9a2c78501ac2d79fccd11c4440611cc1790eeaee1a55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889850, "uuid": "be89761f-b9f5-4c73-9ae9-57bbfde7d546", "value": "T152049E3533E5C0B1E53316B46DF1AB62967EBC384A71858B9BA41F6F2E346918339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889850, "uuid": "cd136682-b072-4bed-9ac6-d62d05e05997", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889850, "uuid": "0c207c57-9ec1-4e34-9dcf-7abade4fac4b", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZSYIWJkBu5Se:+/LhS0rKE/FLITo9mbIWWBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889850, "uuid": "bad3ba5d-5edd-4cb8-be0b-cdbc2b6b4203", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889850, "uuid": "ec78eb2e-2a88-4d91-a8e7-10ded9c16194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889850, "uuid": "667ab4b4-927e-43cd-a62d-fd546cd1d7ba", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbd71b7-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889851, "uuid": "1d933a43-2547-4c2a-ac28-a997929b86fc", "comment": "Malware payload (Simda)", "value": "9e760cd0a21b83fa631066264ef7c16e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889851, "uuid": "4dc53b2b-cd7e-4ca9-9e1d-54341fa44b08", "comment": "Malware payload (Simda)", "value": "724720f5a593481e1c8b5f0c169013cc379ccc4938adabf1435ddfdcbfc97793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889851, "uuid": "e617ad74-af2a-4a4d-8312-4b92991fbf9e", "comment": "Malware payload (Simda)", "value": "688784521622bcd14d527df3733c96609943b8f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889851, "uuid": "f7b8ddab-97cc-4b71-8166-b434cb7a24e7", "comment": "Malware payload (Simda)", "value": "cda39eea1e1a165562ca2490efcdf17dfe171e0d0d7eaa85ba677581458129ef49276e9f5d65b02594e841a57f61ff07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889851, "uuid": "50b60533-f5f3-4d5e-aa05-2e57cc84fb62", "value": "T117C4122B1B2C9933D6550B3B8EE5EB3461BFF5516733D6D30B00999DAD232803E26752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889851, "uuid": "03ecd1af-ac55-4db6-a078-e5e4e1a5f276", "value": "520c130e82cbe6120da2d52c754c2522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889851, "uuid": "23418797-2957-4db1-a68c-27ce2b02b661", "value": "6144:iZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:gquCuygMQjd5vJIBP1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889851, "uuid": "4e94781e-e09e-42a7-842f-5b19e7d67d59", "value": 574490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889851, "uuid": "1cd42eee-93c8-45cf-9fe1-a85588698dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889851, "uuid": "b0074094-1c14-4e94-8e40-a398875e99b9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c578323-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889852, "uuid": "4dad8432-57db-4407-94d6-1c6d9bb3d498", "comment": "Malware payload", "value": "d0693cbf0e2632596ae62f26c0a425a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889852, "uuid": "26eccf28-c94f-4c25-be6a-b4e57531df65", "comment": "Malware payload", "value": "725eda84f577e481bb04663c2ee2f516467fabc8826f54ecdc363eb44bc2b9fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889852, "uuid": "d52d70e1-ed02-481e-b572-41fd9b618456", "comment": "Malware payload", "value": "3c721e0d059c26a3ac0dd37328d5991f3473a0e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889852, "uuid": "70ecba6d-69a7-484e-9acb-ab365fa22b7e", "comment": "Malware payload", "value": "ec6a4db93c9038ccb407f99a036d2c0256291f5b98f4ac1d09538109157c396c3a295ba269f99524e747694839599633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889852, "uuid": "4b030ac8-e986-4cec-95c9-02ad8e9bdf00", "value": "T1D6939F67D9D066B3C26A14F404FFF849A5F6D66C43126AFBAE446738AC3B1C0083E611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889852, "uuid": "090eb04f-57d1-4fc1-8f30-beeacdb32225", "value": "cb466204f5c37666fe7d05c000308c29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889852, "uuid": "d88b37c1-8810-4802-9191-c0e453b80978", "value": "384:gzZYsFWolFtjJkDH6nvTDw5IfWHc8jFrV6U6nhTt56n:gz6sFp7jzoqf6cKVji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889852, "uuid": "6ed8a0dd-3fb9-4832-9d99-6194bcf0b271", "value": 93076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889852, "uuid": "a282de06-443e-454c-8b8e-ee083d08e880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889852, "uuid": "dd2ae114-b636-4aac-92f9-62a858f3a8f2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf7b4c3-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889853, "uuid": "9fb3c4d8-ecf7-4c01-98d7-371739c67013", "comment": "Malware payload (Simda)", "value": "2c352c98a32737b7ba1fcfd76821e648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889853, "uuid": "d89b8fb1-d5be-4eb8-aafb-51cf928085e5", "comment": "Malware payload (Simda)", "value": "7264095b75d31b7ed0b80ecaa36f80ffcbdcedeac4d49c2a70ec684ee070140e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889853, "uuid": "d5f05c44-aa56-4288-ac5a-4ab3da975e6e", "comment": "Malware payload (Simda)", "value": "2b55ee8c256ff56e653772bfd1844d82b00a05b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889853, "uuid": "c40c01d9-a83e-45a4-a5da-002a847177a2", "comment": "Malware payload (Simda)", "value": "21ba14dab3179abfab4465b28204a06111a4342542e3fd33a057f3e844eee098aee766c66109d2f6ec224ee4e46526c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889853, "uuid": "07515d8d-e023-4a13-8035-c8039e8e5ff9", "value": "T15A841213ED55915DC0710132BCB6DBB66D7FD2B9166202FF290C160A2EEC6436CE9ACE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889853, "uuid": "99be020c-5a89-4126-8818-70c85a1d710b", "value": "562bef84679104f4bb60284c80d2d238", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889853, "uuid": "01e87161-a663-48a8-b2b8-1b08d6a42aef", "value": "3072:QOJM8BUIyMh/fuGk4SGkjyu3wMD32onjlWnrBJke78ilZHMOke7QezadcarPCYpx:KIU9MheRXngMDmgV2Mk0JcRYenA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889853, "uuid": "5baccf7b-4478-4684-b9e6-0beedd6d5176", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889853, "uuid": "62332c0d-84dc-4ac8-8268-e1b40a6c90e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889853, "uuid": "7459edef-7667-42d3-a132-1c0711ab739d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd940f4-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1763889855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889855, "uuid": "6880d5e8-70c1-44d2-9536-47c4489b2c1e", "comment": "Malware payload (Sliver)", "value": "9eba16bac05062ccfd10b5df9af1b3d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889855, "uuid": "43abd55f-9d14-4361-9ce1-a52d884e2456", "comment": "Malware payload (Sliver)", "value": "729214e56d3c54956ce9c2d93b238563bcedc8b80a5ca0b8e7636602d9c712d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889855, "uuid": "1a54c367-70fa-4780-be4e-e5145f379535", "comment": "Malware payload (Sliver)", "value": "3fb1c5e2f7ab27c31c52267c41c7508a04213f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889855, "uuid": "664164ad-aebd-4cf1-941a-1b96c5c6e8bd", "comment": "Malware payload (Sliver)", "value": "2d25fb214cb17e08559daf2f0533e607f5d8afada9efd9c94e6c68ca6ed8a38c6858ec99f9b85902394b5d7ea0f8ca64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889855, "uuid": "67dbf31e-4993-40d7-88ee-59d82fecd06c", "value": "T172A62903F89141A8C1EDD270CA769256BB713C885B3533D72B20F7B92B72BD46A7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889855, "uuid": "f7113c27-9900-4c65-9586-a030e51629fb", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889855, "uuid": "771b3ac9-e531-4a14-a17a-b549247e0960", "value": "49152:L+6yF3aYVnrb/T/vO90d7HjmAFd4A64nsfJvd2UmMFg5YuBc8+AZ0FSV1CeQBTye:aV82urYXChLJEJnEpF+0gxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889855, "uuid": "56883d12-8662-4169-af84-3dfe7276521a", "value": 9997824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889855, "uuid": "195f04b1-90c7-4721-b156-3e717429a340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889855, "uuid": "01de89ad-b1a4-40e7-8538-7dc51876deda", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf57d6ae-c855-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763893132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893132, "uuid": "a5aa55b8-0f8f-4863-9942-2ed2b3121be9", "comment": "Malware payload", "value": "df89ef6600c76f32046bc2835754dcb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893132, "uuid": "40bcc4db-d417-4eb4-a924-0a74112a3eb7", "comment": "Malware payload", "value": "72be3242a795a9fc7330d2b1155238f93ff5fd80ad10c724cffad0e58d12383b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893132, "uuid": "56e04cf2-ed67-422b-82cf-2fe609ad8255", "comment": "Malware payload", "value": "3d33f77e575c4778fb19e9feddd821931c875264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893132, "uuid": "724bc9df-4dc0-4bf5-a199-26f3e6ebc4b0", "comment": "Malware payload", "value": "b6d62c3e19b4931cd0e4e50d9c25de55bbc879f983f940280834b0b11f9f6a08884c647d8d57e8a88e2e9f102af59700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893132, "uuid": "ba61f2df-f4fc-44a9-92a4-e6430bb4b4b5", "value": "T15A35231F32C261B2CE89133107471A982E73A67F2BB0941BB7D895072DF29447F79B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893132, "uuid": "d7a8e9fc-9c46-469a-85c5-cba24bc0a28e", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893132, "uuid": "f3da93e4-6579-4e7b-8f2e-a8f9d1a721ba", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1BPm:qE27hQs7tWVToP0Hs0/htDHiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763893132, "uuid": "be1f8013-1563-4271-a131-853e4de32e10", "value": 1137777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763893132, "uuid": "93c8b905-fb62-4c70-8ccb-eb4c7e303ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893132, "uuid": "d63e57ae-4283-44a7-a1db-36c57277cfd2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e76db64-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889856, "uuid": "82787217-aeb4-4340-ad1d-9725fe3f97d6", "comment": "Malware payload", "value": "acf1a157e199a67354f253bf23ff0c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889856, "uuid": "13f260a2-22e3-4a83-b43b-8456c42208aa", "comment": "Malware payload", "value": "7305c33e396b6a09c486d06c9a8a42dc46166336d286b219fe9897bb26f62260", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889856, "uuid": "f30bd939-1598-468b-8123-5ac065250e57", "comment": "Malware payload", "value": "6c4f556c7063599cf1661156441d6873933b48f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889856, "uuid": "7689b48a-362f-4bdd-bacd-0b40fc73eda3", "comment": "Malware payload", "value": "a79a3dceb59e1b1ac12c83ed75f96710120a56fbf1b6421e19a23e3a5d9c441e4b3264b862658be714da082ddf70b56d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889856, "uuid": "437f6c96-c80c-467c-b1ad-e0d613ba4f43", "value": "T17293E84BF61281B9CA38C537A561C1B21F253E75AA63CA3F31513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889856, "uuid": "00657a5f-0e13-4c00-8f7c-c5dd5d391885", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889856, "uuid": "c6fe67bf-0ce8-4444-ad5f-297a02e57dea", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdj:41bC4Bk6lMTOWw4PkRAPou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889856, "uuid": "375be03a-7f5d-421c-9e13-16930845aac0", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889856, "uuid": "ebf61b8c-08ec-438f-ba47-280e1662873c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889856, "uuid": "3579c701-1bdb-4087-b619-7047eb5959df", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d1278a-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763889844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889844, "uuid": "9885fe84-1136-4f9d-a913-97f77d68ef56", "comment": "Malware payload (Mirai)", "value": "608447ee20c77039ca55fd175f8c2fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889844, "uuid": "26598ae8-adb6-46a9-98f8-f8b75593cc9b", "comment": "Malware payload (Mirai)", "value": "736a4307513fad76489c0c86d49eb731f5bc484073efabf20a858fcccf51062b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889844, "uuid": "4c5b1d62-fcd8-4937-bc0e-0e80e66625f2", "comment": "Malware payload (Mirai)", "value": "b8f833275d665cbe752269b5fe72ad1f680f3ad8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889844, "uuid": "38e910ca-f33c-445d-b376-4b419292a0b1", "comment": "Malware payload (Mirai)", "value": "9c8d14075c0d0f786c7fd2ae76d2692c4bbff74c76dbb13959c10033075ad72ccc446d2787bf39f9ff65d9f83a082a58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889844, "uuid": "3086bda8-c6d5-4d22-abab-123dd3167519", "value": "T1B57301DE6ADF80CAD2F187B80A9B5B0316DB0CF6E44AB47471307A859E8547471EBCC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889844, "uuid": "7e97fd6c-6d7e-47ee-9acf-433eb3c37418", "value": "1536:2Y4gTTb+L2zNv7MgW/Em1pooXijsVhutRtPYqs0FTZZXp3VJuL:94WRNjMxcmAoXotRtAq5ZZJVQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889844, "uuid": "97a1f8ca-3413-43e6-97d0-295b92d95d1e", "value": 77556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889844, "uuid": "682e0f09-6d67-4d13-99cd-ea298be92fee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889844, "uuid": "117aaf59-c16e-447f-897b-11ba7f9a3df1", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffe8dd1-c89e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763924379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763924379, "uuid": "322d1497-1bfe-41bc-8178-6787691f2bd6", "comment": "Malware payload", "value": "2d2c3ee750a2a47ee86d7fb8d2d5d8ab", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pteranodon", "colour": "#8B0774", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763924379, "uuid": "ff79bc23-64d6-447e-a2d5-7b515a616a24", "comment": "Malware payload", "value": "7370668e7d715e19d36a7580ca04f349c7365d568ffbb5735eb6c79d80d63b63", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pteranodon", "colour": "#8B0774", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763924379, "uuid": "3d92c3cb-3d3f-498d-a968-584eca1748c4", "comment": "Malware payload", "value": "e948cc39edf6f3149d55d7d215b8d63d9da36471", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pteranodon", "colour": "#8B0774", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763924379, "uuid": "12391403-6e54-472d-b4fe-f197d1e174c8", "comment": "Malware payload", "value": "96e6f3873147f4a0191c4f2dbe2d4bdfa19788e7583f783a719d77c64c3d718a80a549263d23612eb81734659f1b5dd4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pteranodon", "colour": "#8B0774", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763924379, "uuid": "0b500c4a-a775-4626-8e79-4c94c5ad853d", "value": "T117A44AE54C5C55A8A7EDE81FBB740E0E0689934ADEB531DFB34E03C6209EB89FB46111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763924379, "uuid": "8290d2b2-a6be-4842-b257-caedd7560a60", "value": "6144:F/MrM7MrMeMoMzMhMQM9McM4MMMFM0M2MmMJMRMCNHNiGR/5NlN5NBnHRD9RLBFr:cnxHLIrGyLoN7FYgoq0hacyQ9Kf/CoGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763924379, "uuid": "e63bfa3e-33a9-4818-a351-a6269cb7abe6", "value": 491486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763924379, "uuid": "395092d0-93bb-48aa-ace6-a858981d0007", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763924379, "uuid": "53515a53-49e2-4608-ba1f-be00f77513e3", "value": "payload2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2582d0-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889857, "uuid": "b8df218d-b869-4a69-89be-d9fe035d1042", "comment": "Malware payload", "value": "fd689eb12ba208d4ec62498808af1ae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889857, "uuid": "d8933e37-6355-4e55-9975-d65a84498136", "comment": "Malware payload", "value": "740f66c85f56f56f52654b3d1539c20ec5f46d9d0d6b1c38675d50a762da303e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889857, "uuid": "a0f30d92-ff6a-49da-9e89-2cbfb53acb70", "comment": "Malware payload", "value": "a5d2addc137c5aac7d08278b06a4939a1517c607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889857, "uuid": "5ac039f0-dd7e-46c3-a51e-5ea9ddc2a295", "comment": "Malware payload", "value": "a536538552f48c16283c316e8c6143e68b0b4543a80aa9687e1038c7b5e7fe224270f74e79de7f943613bbf8be6093bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889857, "uuid": "1324b0f4-90f7-47a7-86b9-3b4de070cdc0", "value": "T1C00522677288C9B2C4420530034FB7758E7BE47D2B22E81BB7DC17576CB9858E72BA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889857, "uuid": "8b2720d9-8b05-406c-90ec-20e50241f5e9", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889857, "uuid": "f4ca9d1a-1011-4f24-8032-d917760d0d47", "value": "12288:otKe6Zv23YnTjp0Wn91PsXeYmJMkaLqGDtlTwSDTzh4:K6Zv2KOWnLhGDjwSzh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889857, "uuid": "f5a80897-3b43-43e2-b50a-b49e23e1239d", "value": 842149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889857, "uuid": "1fed13ef-c34c-4682-adb8-f727bd4489a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889857, "uuid": "79e25f97-754d-4f5f-8170-52a0b10fe92b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb88986-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889858, "uuid": "3f8b047a-7fc0-4b53-b728-359b2c270a75", "comment": "Malware payload", "value": "96edee747c7e4bbe7868fa5d1e6f94da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889858, "uuid": "4ec463ae-478e-4f4a-b865-1858444cc7f0", "comment": "Malware payload", "value": "743a0b2917a5ad793d289975dd481504e3d73e9349aebe2dfa491e28ba6caf18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889858, "uuid": "bde4e2df-2124-4591-a479-a55ddcedcb0a", "comment": "Malware payload", "value": "5d05faf1d3bd6bd04d4b30c26f78ac378204347e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889858, "uuid": "ca368d55-d389-41bc-a1bc-7b6e9b534b46", "comment": "Malware payload", "value": "80e2b325566b3e34d8564661a421a7d771e6fad38877dbaa85e6ea40a9cd89367fa540bb11804ee4716826d8e8e2e13e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889858, "uuid": "3e617317-4fda-494d-acc0-c182781ecc3b", "value": "T1E8C30913BF11442FD126C9F09CB99AB9B5219F251FA29F4B23C0BB52697060B78F521F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889858, "uuid": "26592a66-fe7e-4648-9601-546e0f707b5c", "value": "2c0c8ec0bdd07ad3a70b86c3d1ab5031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889858, "uuid": "f27d4c57-212b-4589-a7ff-085d890e9d51", "value": "1536:niyzlrXCu2lsuAoeQZZ86ukpj0nGGF9v+4DvMjjjjjjjjjjjjjjjjjjjjjjjjjjT:iyZCu2lhA1QZZ4kp4F9Xzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889858, "uuid": "bc8f66b1-950b-445a-8259-f777867ad3dd", "value": 125494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889858, "uuid": "a64aedc4-c94c-49c3-98c4-8afe20b2f321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889858, "uuid": "9c155eaf-8dd1-4617-87e1-645df3b663f3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3065bdad-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889859, "uuid": "508095e1-0af4-4ae3-8660-cb9b0681890a", "comment": "Malware payload", "value": "3327aaf457bcd2443a5c3488d6ed496f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889859, "uuid": "df7f4e8a-ac47-482c-8c4e-78700b896e2e", "comment": "Malware payload", "value": "74672ea1a697f41d2d62e22d75f099ea6520749f7325e1c3f76cdaefec1f5936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889859, "uuid": "0ae2be54-b067-45b8-a96f-fd785dc5957b", "comment": "Malware payload", "value": "53ca2b947299b9d8912736448ada27eb558edbb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889859, "uuid": "19c5e562-31da-41e1-86cd-57c2d015fbbb", "comment": "Malware payload", "value": "f26c177bc93b1bdafb819204db83eeb34b124ee9ee24a1e72fa8439307a58626e55d3fc07acd03f16dfcd25db695c4ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889859, "uuid": "00840b3c-6a5a-4088-9c1c-0348402d286e", "value": "T17335330D16C32728DFEDA3B64F861891255337EC97946839372CA08A03F265D9EF85BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889859, "uuid": "5371314d-14a8-4434-9e93-695ac32d908a", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889859, "uuid": "17bac3e1-4876-42d7-99c0-359188c87d48", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mA:+YhQs7tWVToP0Hs0/htDH3pGaF5+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889859, "uuid": "f2297491-e4ca-4316-a487-9f58feb83fb6", "value": 1099827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889859, "uuid": "53ca03ac-cbea-421b-b9af-c84e249df38c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889859, "uuid": "c6ab6a5a-ea7a-444f-947f-014965e8eb51", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2c220b-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763890013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890013, "uuid": "ddc405d5-55e6-4f30-9ce9-09e433f26f32", "comment": "Malware payload", "value": "4f328167cfaadf4c45129235b7bb8f94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890013, "uuid": "77b9671e-cf0e-4ffa-a07f-7b1bf4b7759e", "comment": "Malware payload", "value": "747b18805b466d2d59a49e4da83829104ece0723f0001de011dfcbcf83d60d62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890013, "uuid": "a96ada9b-7254-43d7-b11a-b7aa45472449", "comment": "Malware payload", "value": "81b30b01213caf682efc6c5377ec1778dd4e6582", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890013, "uuid": "a5134098-6ba8-423b-80c2-3f52e0d5f6cf", "comment": "Malware payload", "value": "667af6ef750bc72cd4bfea1f0e610f74adb0a272e66d1df6d4157efa12577b6bda79dc065e786f5c6dc721179ff944e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890013, "uuid": "693d07c2-afd8-480c-8765-b970cd6a2d32", "value": "T19235230B33C156B1CF4A533106872AA11E73F7BD1770E82AB7D8554B1CF19447EB8A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890013, "uuid": "326ca447-a1d3-4436-b7c9-51d1d82c13ed", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890013, "uuid": "3e9cbd4b-b03a-45b7-b216-9ae22ff49791", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFD2h:qE27hQs7tWVToP0Hs0/htDH3pGaFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763890013, "uuid": "aa783c7f-1b9c-4731-a115-4b2dd7c0c0f3", "value": 1138915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763890013, "uuid": "c2c7bbdd-9c66-44c9-9573-130e2d22fb1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890013, "uuid": "231c9fee-70e0-4cfe-800a-958c869cdc0c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31030688-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889860, "uuid": "162e1314-54d5-446a-8f10-0f407b0f3825", "comment": "Malware payload (Worm.Mofksys)", "value": "a36d299f417635ac7afff13ed37b48fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889860, "uuid": "faad439b-930e-4914-a87e-1e477de2db88", "comment": "Malware payload (Worm.Mofksys)", "value": "749206ac12f2fdebf5370e7f442fabae15bd086d136ccbab7698f3c37ff8625b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889860, "uuid": "4ea85a99-67ea-422e-8bfc-50b015e12f51", "comment": "Malware payload (Worm.Mofksys)", "value": "34d57716d9e5aa9c243e875625331ad29e6a34e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889860, "uuid": "c669643c-d1e9-4cae-a2b8-bfb7f1b92257", "comment": "Malware payload (Worm.Mofksys)", "value": "70f0f1f5cb36a7e4c035fb796e81284c7d5842340bddcaf5a296c8ebb55e532b9fb6e9c2a692d36c0ee68532341a0620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889860, "uuid": "a4fdc127-0591-47bc-85e7-10abb879d1cf", "value": "T1C3240A17FE00612FE46285F0685BA5A9BA336E211BC27C0B63D1AF4539B5903B6F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889860, "uuid": "2a4aa345-ddcf-4b1a-bbf0-882d0e4f809c", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889860, "uuid": "d5eb8df1-729c-4858-8319-7882e4bbe638", "value": "3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un6:zvEN2U+T6i5LirrllHy4HUcMQY67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889860, "uuid": "082985fa-00d5-4300-bd39-316740d1888a", "value": 211882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889860, "uuid": "0eaa0fd5-2b64-42d7-8d3c-c2871ef6a484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889860, "uuid": "a4b04465-2cf1-4561-9d72-574f6bfeaf77", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2494d0db-c890-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763918186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918186, "uuid": "4beccb98-db52-4e12-a3ba-e47118c896bc", "comment": "Malware payload (Mirai)", "value": "9cc1a5a9f7d5f677482081c9787c3bcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918186, "uuid": "b677cf5e-38a4-4533-afb5-f5bbbdd86d8a", "comment": "Malware payload (Mirai)", "value": "7496c6976b0e8438ea6f69e103f1af1e6d501a7fe26380914cbfc4010d6cf5b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918186, "uuid": "dbc6e54c-8d41-4eb5-9897-07283d569ae4", "comment": "Malware payload (Mirai)", "value": "27bebdc84428be42294a7b6605ebc56f949f3cbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763918186, "uuid": "f0728bce-c05f-4a32-b664-889e6add98e7", "comment": "Malware payload (Mirai)", "value": "f2d7a232273069952c687316465d6126cf708957119f2cd8c86cfcc633251f91ef90fd7bc249fb4136851b0710605cb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918186, "uuid": "7fa6b7f9-43df-401f-a109-0b1698f66814", "value": "T1A4D3A40E2E314F6DF779C33587F74E21976823D626E1C685D2ACE9011E6434E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918186, "uuid": "b83baa11-1086-468b-8ce3-d52540bbec31", "value": "3072:zr0VoV0UH+aS3hTPWWighlL6eQRmo7t5ZLvM2dhsRNjtv7LhkWhQFUpc9uFvDg5w:zr0VUvpSBi3Y7gCz8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763918186, "uuid": "f3bb4720-22e4-4a9c-8f84-9c3fd5de1ef1", "value": 138620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763918186, "uuid": "aa73e56e-bd9c-4492-bedd-c62e4a94a793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763918186, "uuid": "13e1888c-3e94-43e2-a31e-e9690a620b19", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a6d351-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889861, "uuid": "c8ac4f8f-4082-4e5f-ba07-736fdc8a575d", "comment": "Malware payload", "value": "e15af68b66b7dafb714308a1ef494f49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889861, "uuid": "29f8821d-f281-47e7-9adf-000cd0df0002", "comment": "Malware payload", "value": "74aa380cfaf60abdb781ca1cc620c66545418cae147a8916b6a84ff6a812b525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889861, "uuid": "586323b7-afd9-4a6f-b28f-55d541c6df02", "comment": "Malware payload", "value": "a96fa51dc9f488d69c6bff1982d12405238f39cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889861, "uuid": "bded253a-59ed-4828-80dd-607427434c31", "comment": "Malware payload", "value": "baf979c4bbcfcef37879f82ec354309f2345d3f7cd221d151f94ba11d3f240a231dbacdc356bc5e836d11f2cbbb2a8e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889861, "uuid": "133967f3-8ad3-4940-b440-74e58c155984", "value": "T143B42282DCC5A876C5274131349AB337EE3BD5684285D7E7D360DDB7BC2A0A9F90A182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889861, "uuid": "d739df41-b0fd-45a0-bac0-67af06952296", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889861, "uuid": "27ca4371-25bf-43a3-8c47-b6ce08bd6891", "value": "6144:Di/l2G1/nPTD0n0WBwmH6UY/nG3BCxw+rnTRIMu7qLESnJmlfYtvoFE+A6t:+rDIHH76jx4v7q5Jml4voaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889861, "uuid": "4815b8ee-38ac-4c4d-94a1-0fce1dcf3ac2", "value": 497920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889861, "uuid": "36141ee7-1c91-4abe-9d64-f848a1b612d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889861, "uuid": "14a35d36-dd8f-4e85-b6de-29d87f52d514", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eedede5-c843-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763885212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885212, "uuid": "9fb49307-5495-4064-9a29-5204a0338340", "comment": "Malware payload (Gafgyt)", "value": "a38901244a2ef3e5f7f071045e58f68a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885212, "uuid": "94bc2a2f-c42f-4fbe-9516-fe59204fe088", "comment": "Malware payload (Gafgyt)", "value": "74abe84700da9863bdfd848fed77687bdd57f8ecadc014a0ed8b01ed010beaeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885212, "uuid": "5dac7ca0-8cf2-41a1-8f22-a81ad9215712", "comment": "Malware payload (Gafgyt)", "value": "528dbb3c25504226e96f27876b4503b7008942fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763885212, "uuid": "62b92d9c-ec51-482c-8fda-68354c92bfb5", "comment": "Malware payload (Gafgyt)", "value": "c989856e49001ddada1985ba5fd70f256e08177eb92bea6c2e9cacd8a9bdb71d9fe78e0b95734247a3d00b3367bbf201", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885212, "uuid": "25f87add-1ef3-47c0-8d88-0be9ef340c5d", "value": "T1F6A33943A72D0F83C4DB99B12DB72BF1876DB97112A361C0690BEE9003739B81517FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885212, "uuid": "83424828-3982-4f9b-8aab-e7303ded3741", "value": "1536:7QQfckMzQzgv9OtAC0QptczD3z+FavgFTXvEmL49VqFjtUfkjX:7xH/JFDtczD3mr7vEmU9VqFBUfkjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763885212, "uuid": "a2d56ecf-edcd-4e50-946f-4ec9dc008224", "value": 99023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763885212, "uuid": "80a74c70-531e-49b7-b734-c1232cc96dd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763885212, "uuid": "b2b1cbd4-3909-4734-9117-d695ad1363da", "value": "a-r.m-7.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45fc16f-c855-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763893194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893194, "uuid": "cb77ee4d-c0dc-41b7-82d0-d399e89edc01", "comment": "Malware payload", "value": "602d4702f3e7867ae39f9f7945928305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893194, "uuid": "a093f923-7cfc-4d62-b427-0513aad69dbc", "comment": "Malware payload", "value": "74f0c4bae0d78164912827c2dd7c8dbda9677ca300832636555615bc826de238", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893194, "uuid": "48356adf-14bf-400d-ac50-892a67b2130b", "comment": "Malware payload", "value": "04f76919566f412e68cd6e9509d33e4333e567ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893194, "uuid": "fb31bac4-389a-44b4-b9f7-c0d4ca9ea322", "comment": "Malware payload", "value": "1b59a5909e8d7aaf0bbade2e1859e0eeb95c8f31a949e2e0195370a8ef8d4905bd05e262f3243faafe39c221c36b3036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893194, "uuid": "b10f8568-3331-4be4-ab1c-e9628673c5b7", "value": "T18B45230B33C155B5CE86133106871AB15FB3EBBD07B0E82AB7E894071CB29547FB9699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893194, "uuid": "0afb0b05-f88f-4946-a81d-6673a9638e40", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893194, "uuid": "a7da734a-fa69-4ba4-8356-4963f02d034c", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFwfF:qE27hQs7tWVToP0Hs0/htDH3pGaFw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763893194, "uuid": "4cd0d654-589f-42d8-bcb5-b7ed6d188e78", "value": 1213770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763893194, "uuid": "7bcffab0-a165-4dfd-805e-2bd9ceab31be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893194, "uuid": "4305eb99-d9e8-46be-bf15-87f6cdf3ddef", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3256bc25-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889862, "uuid": "197af68a-872d-44c0-8827-fee872b5ae7a", "comment": "Malware payload (Simda)", "value": "e1bb704eb311443cebeeb32f8c6bfde3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889862, "uuid": "deabca43-1734-432d-b801-18e0392bd664", "comment": "Malware payload (Simda)", "value": "7543f6f084a4cdbdeab2b91e646be81069af43557384dbc8f42038ed0bf00dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889862, "uuid": "bcc3efb9-09ca-4e41-9eab-3a4673186e51", "comment": "Malware payload (Simda)", "value": "a4df6b7b74f7ec3271df79736b83999974fbac2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889862, "uuid": "99fa5d23-466d-412a-a922-665a34e76bb5", "comment": "Malware payload (Simda)", "value": "8f6a74287759221742d8062f9d7a60d6c5f6ff294add0a4062237e55efc595aca38cacbe2df59d45a7de9650cc10270a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889862, "uuid": "660bc9d0-fbfc-496c-980c-e842f6a4cb2f", "value": "T1E2744B22F6C1D179F4E504B15AFE3A57207D68BA1B1938E3F79869C825B40F23A3C14B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889862, "uuid": "0cc886aa-9d9a-465a-86d8-b5bef4eb32d6", "value": "173abfa8f7d7adac2a90a2e42625b7d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889862, "uuid": "9c62410e-8a79-4627-a4af-52dd08fb21e3", "value": "3072:CHR4rAH3eBmW7yebDNNDf9yRPzLqE3vAX31XIoWBaZ:Q3EmWPDNND9yRPzLq+YXFqaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889862, "uuid": "fbbee10d-aa42-4c94-9195-18bf6ce3b5ac", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889862, "uuid": "9002dead-8836-4b2b-9b50-137078fdf277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889862, "uuid": "f3367818-7ef5-4856-9c0c-71cfe3885daa", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f4f971-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889863, "uuid": "90960cca-fdfb-45b9-99ce-837973485c46", "comment": "Malware payload", "value": "5c46b31beb92e4af8d9fb54c9a5dada4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889863, "uuid": "3c587340-d98f-4a33-bc72-66636e9dc759", "comment": "Malware payload", "value": "75829573ead70cce24fb5f5c7f0083ad26b71e10ea393e74a4b4741117f393d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889863, "uuid": "c69e63b5-cf74-4ce0-b2e8-959010f1ef23", "comment": "Malware payload", "value": "e9632246654dfa1c7cb2ddef3238cf714a09de74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889863, "uuid": "fd4b838b-f198-4922-90de-f1f0e4bc7f18", "comment": "Malware payload", "value": "29fc2af16941930daeb49d63ae6308845718d1c0d1278df40c08017d122f2fe0e90284a094e02d3afe0c6ebbc7948abe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889863, "uuid": "a4607e01-767d-4107-a4af-ec041362a1f8", "value": "T18B25334E16C32B54CFADA3B68A861891265337ED4794B83A371CA48B03F354C5EF85BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889863, "uuid": "da881664-4d33-472e-bea7-da65d67e642d", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889863, "uuid": "dc42bc75-024b-4812-bc38-02d64b49b991", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mK:+YhQs7tWVToP0Hs0/htDH3pGaF5+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889863, "uuid": "4f6f2281-5ab0-4dd2-9742-8a2b93580572", "value": 1051259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889863, "uuid": "48e8138a-06db-44bc-b4c8-8341951bee13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889863, "uuid": "675f246a-5709-4794-a638-d903872e3fd5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b6f096-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889864, "uuid": "ab1869dc-2a0f-4d10-a01f-779e3b6c6117", "comment": "Malware payload", "value": "7bc7f2e94dfb8dfa33ac55f2163f69a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889864, "uuid": "225cc833-99b8-4a03-85da-76ceb96edd84", "comment": "Malware payload", "value": "75877fc94137948ff3c8c40069c0c476683eef03a5c823ebe51f00010ca81b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889864, "uuid": "4a44fb6f-f8c6-404a-9d2d-19a800b942c7", "comment": "Malware payload", "value": "5426c3661d79dd6741776cee382a658fa619ffd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889864, "uuid": "fa6e031a-c1d4-4b7f-89a7-4a17b1e34523", "comment": "Malware payload", "value": "4bb0f1e16a08c6ec3ed8d21432bd9eb8daf87265e4d0deaf7c0acc3723b61742f827dc8ee984b1cb70b5f7733cb134dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889864, "uuid": "1e06a335-3ab8-4294-9849-2a5da7683d50", "value": "T10965C06C3756E832DC713A7EDE5123AF4A700A6E0404202BAFFAD7D4CD755CAA497389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889864, "uuid": "d8951ed8-b95b-4855-824e-45d7d3bfc76d", "value": "25c0914e1e7dc7c3bb957d88e787a155", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889864, "uuid": "076026ce-426c-4ed4-8ef8-fcf071433b41", "value": "24576:T9cdOqX1uuzliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlMD:T9UX1BBx4mYo83vOSeyeaKr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889864, "uuid": "411aa9dd-3634-4337-a7af-5b4adcdd6441", "value": 1468382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889864, "uuid": "2d411f24-4e70-427b-892a-7b8a979981ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889864, "uuid": "4b5716c0-edba-4fbe-a385-bb342ebdb53e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4005fa07-c882-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763912219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912219, "uuid": "49adc5fc-125e-4357-9457-3e38de4b3ec6", "comment": "Malware payload", "value": "66fcddf185bec5e1fdd9d649496ae5be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912219, "uuid": "5c1fda09-4c97-4eb9-b61e-6ab9215e890c", "comment": "Malware payload", "value": "75f2bdfb69ce6856ed8e092c8fe47a03504d79028d08e4596d535755db2ed89b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912219, "uuid": "20bbae41-2243-4aef-8047-c69e743476c2", "comment": "Malware payload", "value": "766de929d21c0a1bf8bf62386ce1c4aca89c9b1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763912219, "uuid": "ece1f0f5-ba43-40d7-a11a-857ecd7d4166", "comment": "Malware payload", "value": "71a26cc0fb1311163d793f5e73835ea001b5caae90af34214c94fe9f82e8db7777950b266f380042c426b8424d35717d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912219, "uuid": "35bcd740-a9f1-4266-9e8d-cdfd94de3b60", "value": "T10756337B66807E47DAE05337BD67C2008919BDB28F0A2566F53F16E542D105C8BFAFA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912219, "uuid": "11ebb9c5-14e0-4357-8b4e-4a2ccb25263f", "value": "9ecad17161342c5ed0725c6d520c5009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912219, "uuid": "fb2f46b4-c97d-4a73-bb7d-3eb8d0904644", "value": "98304:QYT9U7H048R0NVtjil7iLu3an/2qofQ9uuXm6ad5GCGJlfuWmyi4TA:Q89EH048RMVxII3n/2qoJuW6aKCnyi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763912219, "uuid": "c9a17830-4922-4928-a627-0835bd6a3280", "value": 6033432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763912219, "uuid": "fb808c04-420b-41db-a511-e96cf9f13276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763912219, "uuid": "aa57c81d-dc4a-42f8-8611-13d381998625", "value": "SecuriteInfo.com.Trojan.PWS.Banker1.37780.22358.5228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b42bdd3-c855-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763892910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892910, "uuid": "d0559967-67a6-4fff-8467-d08c75bb03bb", "comment": "Malware payload", "value": "196b1aa49b5c0a0ed3622554dd806020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892910, "uuid": "c0d5c75c-b78e-4185-995e-92a72021d2ce", "comment": "Malware payload", "value": "76766b8c0195996bea514b1c80017536c8cd0c82144cbe4111da5920fc41fde8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892910, "uuid": "6e12aade-299d-45e1-a850-54ab5637439f", "comment": "Malware payload", "value": "bf39a3583bc2ef13ac1ee54da71f687e43a1183c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892910, "uuid": "2d711627-b854-4046-96d9-07f5240c115d", "comment": "Malware payload", "value": "b14928b4b8b0949b9c5269f905dada570e251b38b748a5907947c76a016af57a4ce221420ae344888cd2f4382903829c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892910, "uuid": "5e75bfbc-6ec1-43a1-beff-fd9a7430bb96", "value": "T1E035231F31C16272CE49173207472A986E73D7BE1B70802EB7D8514B2DF2584BE7AB99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892910, "uuid": "96b83a62-88c4-48d1-8811-d7e5632c4179", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892910, "uuid": "2dcad34d-7abd-42f0-9927-32afe665db3a", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1ZcAQwaE:qE27hQs7tWVToP0Hs0/htDHi7HQwaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892910, "uuid": "58036049-51e0-4814-ac8c-f16ddee30c1b", "value": 1111999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892910, "uuid": "ae4fe5be-4c5b-4ed2-bf2d-ba0d9601a946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892910, "uuid": "a1d55e23-43bf-41cb-a595-917beccaf1bf", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918000c5-c854-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763892599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892599, "uuid": "511b2cf4-3f6f-4659-abbf-335a6d463196", "comment": "Malware payload", "value": "8dda406bd55e7948f43bd8c2dec63412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892599, "uuid": "64ca058c-28a5-4ac1-9c9e-073b3a3553eb", "comment": "Malware payload", "value": "7690bca2733e1caaeba502ce15087aad02978efd548ce366cfee25decd7da7cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892599, "uuid": "2fdb8f87-bf5d-4666-baab-876f40eacf91", "comment": "Malware payload", "value": "91612c790735fc4b8b8ae87055dc1bd4d6238407", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763892599, "uuid": "b67d0b4a-39e6-4a78-8ea8-e66a21d4c6e5", "comment": "Malware payload", "value": "75acefe8e970977fcb307310b9af898e01038ed5c3bc4fb5e3ab5eabcbd75c80c3685780e83d6803c3bb551e9cac6f55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892599, "uuid": "0e7e7cab-4a11-42a7-9386-42817c47797b", "value": "T19135230B33C15576CE8A533103472AB11EB3E7BD1770E83AB3E8944719F29447EB969A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892599, "uuid": "ca43f7b6-7fe5-438f-8277-a8c0b0d8eed0", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892599, "uuid": "8c5b4e54-0622-41ed-98ad-dca8d192e0e3", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFyjtC:qE27hQs7tWVToP0Hs0/htDH3pGaFyZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763892599, "uuid": "98fc6493-6e5f-41a1-a7f2-6e9409348610", "value": 1095216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763892599, "uuid": "975ca885-07e9-49c1-b356-7e62cc293d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763892599, "uuid": "683cf0ca-99ec-4432-af20-fbb23dc84d5e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3455af0b-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889865, "uuid": "d4056211-258d-4864-8f67-1dc624db23eb", "comment": "Malware payload", "value": "b2162c9b5fa5f2c8fac23654da61de72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889865, "uuid": "59606611-4110-4c89-a6b4-3d0135e32c16", "comment": "Malware payload", "value": "7690d134d49941fa33edd61d0c3c726d7a0ed61f50e5f10c52db06e0493d04a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889865, "uuid": "975452ca-6e56-4321-92b1-5693b32a1881", "comment": "Malware payload", "value": "45635d4fdcba169ea0957daa1824b7458af8368e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889865, "uuid": "89a5e9cb-bb3c-4637-a186-aa29b7a2fd00", "comment": "Malware payload", "value": "76c53b63aa9ddfe8fef165c08120c42a2ace4ad8d2b82b2fd16eb39ae7d5ce5cf8db06022efba4f2d76208bbba200ad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889865, "uuid": "715d0977-b732-426b-87b9-1ed924408ae1", "value": "T10793E84BF61281B9CA38C537A561C1B21F253E75AA63CA3F35513A2B2D75B001E1AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889865, "uuid": "052eb6de-8572-465a-abce-ef75f76f2515", "value": "5d80cfdfe5f2b9bcbf7e42c251821f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889865, "uuid": "1d2f0199-073f-4b30-bc56-08c1d3c5206d", "value": "768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSd3:41bC4Bk6lMTOWw4PkRAPo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889865, "uuid": "2d330575-bcb0-4b70-aaaa-1d73353f130b", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889865, "uuid": "52aa1a35-e290-4352-b93a-b41fe57adf37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889865, "uuid": "d438aa09-27ef-49ac-9c64-aa809b44fb3b", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34facce1-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Miniduke)", "timestamp": 1763889867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889867, "uuid": "deb8fc6d-9bdd-416c-b114-c576805d5100", "comment": "Malware payload (Miniduke)", "value": "b657c9a5d453e406b91b87cc85345691", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889867, "uuid": "4493d905-2a84-4a76-b9e2-68d6b721339c", "comment": "Malware payload (Miniduke)", "value": "770a9e9571902adb118864974b3a175a92de88841ecafe44d23f519f9c92f22e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889867, "uuid": "76d8f91f-865a-4d70-8ca3-cbc59aa933f6", "comment": "Malware payload (Miniduke)", "value": "70999e9af8df163530889ebbecc80d203caf1402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889867, "uuid": "4188b5e7-ee51-496a-bfb0-9d25a21fc40b", "comment": "Malware payload (Miniduke)", "value": "63db4c5328fc3893467c19df8b8aa0d18d923850d1adaa5dc0b2d5939244857b99e636ebb2e4ebce204dd08ff8804ca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889867, "uuid": "c95eb639-024e-4800-8534-044cab179ac2", "value": "T144049E3533F580B1E53316B46DF1AB72967EBC384A71858B9BA41B6F2E346918339307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889867, "uuid": "a99651ab-9404-4be2-87c1-48b004c29a93", "value": "edf0659abd5188c18e493cb2537cb8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889867, "uuid": "105f9b03-2958-4290-b0ea-0c0bfef675b2", "value": "3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZiYIWJkLW5Se:+/LhS0rKE/FLITo9mjIWWLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889867, "uuid": "47c33a92-4097-4548-8df6-0c8b7d2ac547", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889867, "uuid": "51d5e367-8563-40c9-b08a-8f22af3c350e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889867, "uuid": "b68fc238-de08-4b02-8820-a4b21db6cfa2", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358c98c0-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889867, "uuid": "ee05f775-d369-45f9-9162-e0eb02658f35", "comment": "Malware payload", "value": "74b28a0bd90ac82f964425a1df3c22c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889867, "uuid": "eaa28eb1-daa1-4499-af0c-0a2cc42c3299", "comment": "Malware payload", "value": "771ddec3560a7a9dcf57fb6bbd8fff8dfda4d1fbd35422a6f0a4959472c4c3b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889867, "uuid": "30dc8aac-70ef-49f6-9dfd-2e7b47b65f4c", "comment": "Malware payload", "value": "727413b742cde2f40bcdb896cb0fc26b1a9aa82a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889867, "uuid": "ec2c56e1-c52b-44c6-b761-3bb75b5fc09c", "comment": "Malware payload", "value": "9ca2f81c674b9b28fb037e2504d85309d78b3bf499b699a87e74bd166968a927bebbf661590be0c0ab19aa42d17ae214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889867, "uuid": "a075d077-75d3-4f0b-b10f-9579bf391460", "value": "T1F4235B18AB6CC65FE1EF0E7D64631A21127293911303DBCA4ECC64FEACAB78406257D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889867, "uuid": "8fdfa812-bff0-4a1c-bd8a-2233f61ecfa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889867, "uuid": "25d94cdc-d013-408b-84e4-61bf8c67d488", "value": "384:QpxiHABz9q3FxmHu+JjOdb4CtUFRCOHu419awgncpMQiW4zmkZXOfq1aK2rkLp97:aCIFqb4+UTCOOuKXbOfq1ck+qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889867, "uuid": "6fb8a69d-2933-45c4-b6d6-e53ce9b275b3", "value": 49164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889867, "uuid": "8579a3b8-6d9d-487f-9e25-30020bcd864d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889867, "uuid": "30320d17-1cd9-41c6-98f4-ebf9323c9703", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361f68e9-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889868, "uuid": "35881f77-bbc1-425b-aa05-8c3bf27a3320", "comment": "Malware payload (Worm.Mofksys)", "value": "7e72db834429e4eb4b41954e4fb35f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889868, "uuid": "b431b58b-27c8-481c-802f-02233c1a2f37", "comment": "Malware payload (Worm.Mofksys)", "value": "772e7cf172bb25472975fc8ab2512d58a16469d9a66577243f81a2ffde73d47c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889868, "uuid": "6f6dbc16-c671-434f-adca-469be29c0df5", "comment": "Malware payload (Worm.Mofksys)", "value": "fb32e4131a3bdb92277e6a13292e0ff8aac30174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889868, "uuid": "78983b91-3a8b-4887-bc1f-2fd01e56a025", "comment": "Malware payload (Worm.Mofksys)", "value": "565d8b61648da4b634021acbcca74fcbd43343ab9202a9577b1412eea20743c0fd45d09e6ef7aeec8a5ec38493f3d0dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889868, "uuid": "da1d68a3-8478-474c-8893-7a2e023c125f", "value": "T16C24082BAE01611FE463CAF0182376AAFA256E722FA09C4F27916F563471513B1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889868, "uuid": "c675ec56-45f6-4178-af86-304d9e26cbbb", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889868, "uuid": "69be22c5-a6d7-4ff4-ae12-bb2c0a7022b1", "value": "3072:ubluj2AgK1S4lQ/qml80FqCKmgTRHGvcqRI0NU/iYyAV:ubl5RKgOGqml80FrgTRHGvJI08iYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889868, "uuid": "74a7db2f-ac00-448a-bc1f-4ea2548dacc2", "value": 211832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889868, "uuid": "3ca1d7db-e06b-41f9-8978-07946d398760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889868, "uuid": "5a880b90-594c-4f19-b63b-bc8ce1a86f12", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c63eea-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889870, "uuid": "7f38492d-f866-4438-a824-f2550aaf6810", "comment": "Malware payload", "value": "f56ef0003f7de5cae66e6fbcb8063f97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889870, "uuid": "571f20e1-e093-4f15-b444-7f2439adabac", "comment": "Malware payload", "value": "7795d36410885cd7756398fa50d96c6c7baeb1db463448bb6535a248db4efd64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889870, "uuid": "1f7b6046-4422-4bcc-980a-fc9500e59316", "comment": "Malware payload", "value": "827c849a78a27ec42a46e068960c3c44f64ddea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889870, "uuid": "90170a94-949d-4d60-821d-ecf6e5679afd", "comment": "Malware payload", "value": "0abb7d644f012a7f5b58fc8a7e3f812cf9d9bb09b96a8943a7b798602deab4f129b5b7497d614f115181671a979216d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889870, "uuid": "ba06ec04-e8ee-43e0-b12e-cc6c82d133e3", "value": "T1B874D03777D0C9F3C806053002A76B768EB3FA3A25718457BBE85B1B6C35A51BA2A741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889870, "uuid": "4ed0ba7f-b485-4ab4-8cf9-48f6132d38c0", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889870, "uuid": "90071e5c-64ad-4383-b1e8-8226dbf66a73", "value": "6144:BtKe6YiDdv3m3mgKHDjSeL46zMIwzH7Sfvd:BtKe6Zv23YnkICH01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889870, "uuid": "cc1d87cd-457e-4014-931f-aa6820f3d010", "value": 364027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889870, "uuid": "7a16d502-f94a-4b85-a81a-9f057816629f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889870, "uuid": "5d1c3a90-504d-445f-a95b-74dc667ea3fc", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37568ff1-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889870, "uuid": "07e82d54-55fe-42bb-9307-49f757526bf1", "comment": "Malware payload", "value": "576418a4ea287c03e13f55aa5f218ceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889870, "uuid": "62dc5382-b8d3-406f-92b3-989e7f5d606d", "comment": "Malware payload", "value": "77a4d48bbc57958d1b422340f99f2bbc1c8ccab7ed5b994634bbabbedcebe36d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889870, "uuid": "7031f406-6a74-491b-99c8-e78318e49263", "comment": "Malware payload", "value": "67643c500e3604391a65f56b603c67634b4a1c43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889870, "uuid": "746674ba-a24d-4924-8718-e7385342f1e1", "comment": "Malware payload", "value": "5dd59fcc7d1ded63ce1405c9b9f2f4bb2ea0ce578575837a60743228dffe81cc1ed547b3f0c77d2add499f3dc5edb757", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889870, "uuid": "c24020d6-cda8-4032-befc-d8251c86e44e", "value": "T100D3F727AE14507EE921C9F06CE4DA6EBA241E3617E0ED876761FB402972B4371F520F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889870, "uuid": "fc142f83-892b-4fcf-afb6-392fe72be8b5", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889870, "uuid": "f02b6460-1091-4a81-9e1f-f32fedbcf55a", "value": "1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVZOSZ:UVqoCl/YgjxEufVU0TbTyDDalDOSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889870, "uuid": "e0c0d41f-fd42-4cba-ab3c-f3102d9136ba", "value": 138383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889870, "uuid": "01526c48-a764-49ad-a198-ccd871d227bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889870, "uuid": "097fe964-b2f0-46f2-b3d6-674310262341", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e9b2f7-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889871, "uuid": "7d4b60f0-7c17-47f4-a20f-c13d02b1dca7", "comment": "Malware payload (Simda)", "value": "b85e8ebf0b907e1cb278fcc9b79fe29a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889871, "uuid": "70b18d41-f02a-47f8-a303-8e4525f97a66", "comment": "Malware payload (Simda)", "value": "77e5f912bb34b5c2320dcef56de4bbe7c904c0d993331ec9ca3e0b2efe887eed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889871, "uuid": "b6db7ed0-ca02-4a3b-95f9-f11753ed99dd", "comment": "Malware payload (Simda)", "value": "470b5d3d8206946f454a8039f1bff96414344e9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889871, "uuid": "99848985-9cd6-402d-b1c3-1fc99a34d34d", "comment": "Malware payload (Simda)", "value": "eb5d0cec8e625b1a45f5b470cd30c9c538353d5a0c2287d999a3268175d8ee09e66ef8a30ccea9454236543aace01f75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889871, "uuid": "153ea355-0498-43f5-830a-863e9d3aefa5", "value": "T1D224123266C05A23C4B5097B55F3B34335AE83888326C5AB18499AD63EA72D7FE35770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889871, "uuid": "c16d648b-c66f-4eaa-82f1-213606e35f10", "value": "3ce7105d1e904763c53a96a44fc006e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889871, "uuid": "c955b97a-cc58-4086-835b-e10a2bf6b5cd", "value": "3072:Vg/T01/NkSp48GzFoMVZrjB2+4M9eOpssvSX4FzU5chdhGulEV5SCmGFkInV/0ao:mErGjVqiFPGYrGZMCrCIn6aQdMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889871, "uuid": "f44d71ff-f5a6-4937-b624-438b00ee0eaf", "value": 216081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889871, "uuid": "799235d5-40ee-47fc-be8e-6fcfc61f149f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889871, "uuid": "30ad015e-2970-4040-8ba4-8730f9ebdd38", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22c52fc-c855-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763893083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893083, "uuid": "9a08365e-1bcb-4c6a-91a6-24d490a23184", "comment": "Malware payload", "value": "ac469ab669348ebeb7009d6616c03ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893083, "uuid": "25a300c3-a294-4125-86c0-150def93a941", "comment": "Malware payload", "value": "780b831e855e4fb01ae9e8f467829c1b7cf1626691116ffa07a3e8ddb605aeaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893083, "uuid": "e81359c0-8201-473e-9b63-9ed8f724037a", "comment": "Malware payload", "value": "b0e29a693b2d105c092df1bed73005c9fc43f7c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763893083, "uuid": "239b89d9-7d5a-4cf1-a672-4d93f5729288", "comment": "Malware payload", "value": "7a3c2cca8e53cb0b2cc2a611aa77f0cc4d1de931025a0df770fab1dd02c6bc6e0a3dedd70c242a98ccf62a7edb471068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893083, "uuid": "2aba2178-bb9d-4be1-990b-5e161527e2be", "value": "T15E55333633C19AB8EE464E31420A5F354EB1D37A0F3EE411BBE42D536970992FD6A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893083, "uuid": "090e1e36-aadc-4cae-b3fa-ada2b3f75ba1", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893083, "uuid": "95c5bace-0699-4108-92f9-1cb2dbdbd68f", "value": "24576:q6Zv27hBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYRYhBfYP1iKCoVRHcnw:qE27hQs7tW2zku73bFgVlRlbN015CoVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763893083, "uuid": "eb03f91e-1b8b-42d1-bb61-ad3a6fcdcc1c", "value": 1310284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763893083, "uuid": "7803e4bc-c190-42a9-9134-938f61a29b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763893083, "uuid": "369c828b-f386-4675-82ec-38d65c3c7be3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388071a4-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889872, "uuid": "11ab1b5b-2368-4b7f-8769-17e43c082603", "comment": "Malware payload (Simda)", "value": "18ca1b907414a698cc8f85fc06fd85cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889872, "uuid": "14fc32c9-718e-4aa3-afb6-e35a8e4df273", "comment": "Malware payload (Simda)", "value": "788d5be8e1aecfc13d4d18ac86055aec63b2cd108effa212bca071ad6cca16c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889872, "uuid": "19e17ddf-a4c3-4c5c-86ac-7c09684f358f", "comment": "Malware payload (Simda)", "value": "5a3c130c9303e17bcb319d520a960eea370eee12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889872, "uuid": "6c34ea65-acc7-4794-aceb-aef3e1ef3c63", "comment": "Malware payload (Simda)", "value": "922660d4b09487621224e007a116f1125292c16f461fa07a1059206fe6691d6dc11a4048add412495898509c4189bf8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889872, "uuid": "3263dbe6-6454-4cc6-bc8d-61b0c4396049", "value": "T1A724123266C05A23C4B5097B55F3B34335AE83888326C5AB18499AD63EA72D7FE35770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889872, "uuid": "7126f8b6-00ec-45ec-a8c3-1cdbfbee959d", "value": "3ce7105d1e904763c53a96a44fc006e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889872, "uuid": "e068700b-ce9b-45a1-8936-ea877195059e", "value": "3072:1g/T01/NkSp48GzFoMVZrjB2+4M9eOpssvSX4FzU5chdhGulEV5SCmGFkInV/0ao:GErGjVqiFPGYrGZMCrCIn6aQdMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889872, "uuid": "edb0ed9a-2076-4f16-8d63-135f1b1cc7ed", "value": 216081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889872, "uuid": "50fc5277-642f-4072-a215-56dd171f1c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889872, "uuid": "25e4c033-d4ca-43dc-8d57-886a1e24daef", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0300c724-c853-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891930, "uuid": "e7f1cd2d-377b-460b-9364-5c0a6b05ca2b", "comment": "Malware payload", "value": "9dc77d20894ac3b963d9d8fcfb617cc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891930, "uuid": "e83c6652-fa42-439a-a79f-ed85911953fe", "comment": "Malware payload", "value": "78bdd5bd37ee69dc3dad7cebe3913a8041771ef5a2e1f0baad5e46b96bfa0541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891930, "uuid": "88878457-6b94-487c-a614-6df6d4dbb29d", "comment": "Malware payload", "value": "b80fc3cc4c8316a414b71d5c6a2bbd286270e416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891930, "uuid": "82864a17-c089-4926-9bc8-e7d053a4636e", "comment": "Malware payload", "value": "c3d7a4b814c228ad63fee5258b9aa47b2aaa928c364ef9eb9c064a3728aced83cedd3ac1397013851a6478dfb947b5b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891930, "uuid": "ce8f53d0-b943-4462-989d-62b4bb5cea50", "value": "T1E145330B33C15276CF8A573206472BA11EB3A7BD1770E82AF7DC500B19F1D146EB969A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891930, "uuid": "c56decc6-f604-4975-ba60-f0a1b800441b", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891930, "uuid": "cb083e91-3beb-46d0-9957-50d485b953e9", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaFDwsigH:qE27hQs7tWVToP0Hs0/htDH3pGaFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891930, "uuid": "83c89fa4-58f1-40bf-8a9d-642d8e74f388", "value": 1171273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891930, "uuid": "429429d9-56a7-4b6f-909a-62a5aa0a7d16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891930, "uuid": "14a462f3-a80e-4027-94d9-cb82959b3292", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3954029b-c88a-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763915644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763915644, "uuid": "b9b85926-7d7d-4c49-ba91-423a117f3132", "comment": "Malware payload (XWorm)", "value": "4895b0e16a718f70be2bf5e9455f2c8c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763915644, "uuid": "9e2774a8-ce0b-469c-9e55-7b8d35a3d621", "comment": "Malware payload (XWorm)", "value": "78d390316afdd752af4ac8648ef90a51329291c2c13f80509c4163b9bab177bf", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763915644, "uuid": "7fcccb00-b677-4cc4-be57-58afa9db573e", "comment": "Malware payload (XWorm)", "value": "134c33b14f1e2230cb25d838ee6a14235791b922", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763915644, "uuid": "23b40c21-e182-4f78-ac10-93b76134b6ce", "comment": "Malware payload (XWorm)", "value": "77454a63df70bf07b40dbbc2aa865faea00c242e4ddd0f4e9411c96c0c36f27fda5a7ccb4117f765e51496399655b85b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763915644, "uuid": "362f239a-c09c-47b5-bf60-4f9710677cc8", "value": "T1A3334B361953FEC1677F2C94F20836A10C943A674366862CF7C409A92CBA5A4DF6DDF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763915644, "uuid": "a5658f4d-4f6f-45a9-b8ac-905f0feba603", "value": "768:RonNXJgNFl7GhGZt3I85fmg4t56J3XxbJE/aKbi6bR2UpzQ+Nt5T:RoNXJoGhGfKLbmXxbK/T26R2ic+N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763915644, "uuid": "7d5eec04-7dc0-4aef-be8a-07c8b3b1940f", "value": 51970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763915644, "uuid": "9a4e54bd-c1f7-4515-8ee0-19a906b7877d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763915644, "uuid": "0b19767d-c285-4132-b721-93d82881cbf0", "value": "dd.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458d5e4a-c84b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763888606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888606, "uuid": "668dcee5-199d-497c-b748-2bab176f2364", "comment": "Malware payload (Mirai)", "value": "396e767c949d3084ffaa2a21dbaa6018", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888606, "uuid": "70e02c6a-20d0-4475-8576-a9af31555e04", "comment": "Malware payload (Mirai)", "value": "794e555182b294e74a7d9ea364566bb85458df33b93a25a16db1eae7a8406732", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888606, "uuid": "f591f957-29db-4023-ae11-ecd1515b1219", "comment": "Malware payload (Mirai)", "value": "7a905a1fdfe8cef879c9876aa99309f1a1624052", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888606, "uuid": "3a5f6e9e-abe0-47ce-a327-1b7e8bc3f41a", "comment": "Malware payload (Mirai)", "value": "8f4e074655a45c2cdeb5f5f7dd9de06e9b76378b318cab5897fe5d6d35a4610ebf6e31de4c181ec4f1b1fdfe86d398d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888606, "uuid": "158c2658-7340-44c4-b1d4-e7d04ff99a4c", "value": "T14294E149F64B3D42D9D7E535048BC681075EE4AB33F393492B47A4BB38693B24F29389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888606, "uuid": "cbb33355-6d08-4232-9b5f-2983f4f440cb", "value": "12288:m/H/ypxZaVtJc3ohj0J9U4CnQgp+4tz+:cyxZa630j0JGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888606, "uuid": "6896540c-d536-485f-b4e8-27fbe9efc904", "value": 443872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888606, "uuid": "c06da18e-c76d-4ad1-97dc-055fac5bc66e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888606, "uuid": "2dbde942-b0c2-4512-b0b5-9c4921a46bc3", "value": "armhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391646cb-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889873, "uuid": "aea96030-2dfc-4943-89e9-3bbd14487603", "comment": "Malware payload (Simda)", "value": "2a70701fe0fba887ae482135cbcda91c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889873, "uuid": "8c853086-de3e-4ad9-81a9-5f46590f3a12", "comment": "Malware payload (Simda)", "value": "7984ffa8b08aee05676abd040a649d200ac8957dceaac0197e3821a5dc7a35b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889873, "uuid": "043f7289-0ab3-494e-b3a0-d9f04a8b423b", "comment": "Malware payload (Simda)", "value": "45b82b5170e85e306c937ca6996cbcb447e05baa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889873, "uuid": "6fb9a476-5846-4f84-ae4b-dc64915bfe35", "comment": "Malware payload (Simda)", "value": "1328c7788fb022b0b7c77369f172758372d06dd3ccaed7a6a053596feca5943cf1557fc43eb79b8405914868200b6efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889873, "uuid": "b7d48ae6-a8d8-4cc6-ad8c-510d5262ab99", "value": "T14124124B478E11A5F8131B770AFB0B4773B881A5378AED7B394AA3706C536C7B8A1354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889873, "uuid": "a54c9505-440d-4ba9-9fea-3bcd9c0129d0", "value": "2a1bb0c52b45268a32bea7c08363145b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889873, "uuid": "79b86735-ed18-431d-9cbc-7e0bde706d37", "value": "6144:CBsKFk5pfANiDyJ3xF4JYK5wf6t0FU29HUYo:C3ijD43xFAwf6t0FUmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889873, "uuid": "54316e6f-d88d-4ed4-8af3-d26d6cc8e723", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889873, "uuid": "d8c6fe04-0955-4f35-9b78-51656c03cf83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889873, "uuid": "bc0bc085-97cd-4692-9088-8e37fba4599d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39afe62f-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889874, "uuid": "bc9eb032-8a08-4034-945f-0a9d5a6aed36", "comment": "Malware payload (Simda)", "value": "4718f65e81dbb1aeb7255fe8317bc716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889874, "uuid": "372e13a4-59d1-43a5-b05d-48ca0784931b", "comment": "Malware payload (Simda)", "value": "79f1b87bfc5af79b8f06143852f79312740c1bf079b4ef0e86a97fe72b12e4c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889874, "uuid": "832f4029-728b-4da8-9aef-b614c5d5a482", "comment": "Malware payload (Simda)", "value": "b6b55fb91112e4293f1056110306457770beb392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889874, "uuid": "3f747e48-8d0a-4f6b-a9b9-e602633ab44b", "comment": "Malware payload (Simda)", "value": "70540bb7398a2c5aeea700e90e6754a1dd667203154799384f46b76f62436feeaea1e76bc6a3df1a8d232fa9fc306ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889874, "uuid": "a19bb6af-80ac-4373-baf2-e3e9cd0c71d5", "value": "T12C9412247E8B2814E671CBB028F771858B7CD26D1345137EB91A1F494ECB14ADE863EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889874, "uuid": "045c252c-432c-4bfc-888a-59d330eba881", "value": "752e1ad839fdd9d87e202c92c2bee710", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889874, "uuid": "73e75a05-df89-475f-88e1-e0125e52e80c", "value": "6144:KnyiqVQBf0EaIp8fkTJJsK1eEzEB1XjrkXb:LEdp8csKpE7XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889874, "uuid": "287791be-464c-494d-9fbc-8a5894d43b2b", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889874, "uuid": "813c7b54-001a-4069-a2d1-83fa45dc5c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889874, "uuid": "d7f0c8ca-3bfd-4aa1-add0-301949b96d1e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fd382b-c84a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763888471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888471, "uuid": "77cd6628-8c23-48be-bba8-d9cdc7a6c489", "comment": "Malware payload (Mirai)", "value": "6927292648e7068f718697611683d910", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888471, "uuid": "5c69bb2d-6514-4b58-aae8-aadf78f8b37d", "comment": "Malware payload (Mirai)", "value": "7a2aa7939edd72a42eeedb556987deb4a38246cdced8c83886f9cb893394686e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888471, "uuid": "e1bf2314-275f-4463-a95a-ea463dee4899", "comment": "Malware payload (Mirai)", "value": "e0d543b85114143fb235ff7ce1f77da1c4e8ad74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763888471, "uuid": "80966bdf-5a63-4b8c-9534-8adefee49ee0", "comment": "Malware payload (Mirai)", "value": "2a882fd72d781ddaedbd01e1de679042f2eca1148529797d2ae95e1d1863f617bc62425d28764ad8db90d6c7d7460806", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888471, "uuid": "78aa10f6-28c5-4133-895b-4b1482ea19ad", "value": "T1A95312B3255863C0D4132137ACF5BB2B9BB8DB1F3745E50E319524A76DA8A2D1318FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888471, "uuid": "87cca67e-d846-4135-be62-b6190575dc29", "value": "768:b4NRnd9C6u9Bqf/BzdXa8BMsTq320Kis8j0HBn/1ptO8IctAuHEcD2PibfFujaR1:UXCZdsQKMjyxo8IKvGGR7nouy8Gyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763888471, "uuid": "a96d6292-54f9-468d-8776-c08370d444e1", "value": 62788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763888471, "uuid": "86d9bd01-97b6-4582-b10d-6fbe305497f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763888471, "uuid": "ada9387a-edd9-4e15-b64f-a0c64c66447a", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3bd5e4-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889875, "uuid": "368f9091-14e4-4932-b82f-bb001b50a187", "comment": "Malware payload (Worm.Mofksys)", "value": "0b7c792c0b2b388b39aa4e5973587c21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889875, "uuid": "6cba8f79-f4ea-41f0-96fb-aab222322111", "comment": "Malware payload (Worm.Mofksys)", "value": "7a5bb8aea9de93a93318b7df1e85628af9b4231b09338ade7866887d4e6d9f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889875, "uuid": "14026c0f-8047-4407-8be1-8c7792d9d7de", "comment": "Malware payload (Worm.Mofksys)", "value": "1a985cd9ad7033add78b9d191ed40c02900b8d97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889875, "uuid": "d12ae951-a119-40ef-8fbb-ed1e3a979576", "comment": "Malware payload (Worm.Mofksys)", "value": "3a2cb2966eb468697727fd541291dedf594abe29d089d5dec501536d03127ac25106b9c7508dda4ad7ace25d09205019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889875, "uuid": "e0c945e0-101d-4723-852b-f164415b2535", "value": "T128240A1BAD00701FE497D5F118666AA6B6212D315BE6CC0B27C1AF5638F1923B2F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889875, "uuid": "e2334636-8368-4f2b-a147-961160effe71", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889875, "uuid": "46629e98-598d-4614-9d94-45f95e19d57b", "value": "3072:9vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4PmufI:9vEN2U+T6i5LirrllHy4HUcMQY6VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889875, "uuid": "7b503376-317d-4dd4-9f20-523b26d656ac", "value": 230129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889875, "uuid": "337f8e9f-d61b-4620-b311-ece7f3a856f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889875, "uuid": "6de01dcc-b7bb-4f34-b414-4d955d7a4cee", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aca4c1c-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889876, "uuid": "63977720-4633-431b-ae88-52713cac2c08", "comment": "Malware payload", "value": "4f8bf6af8e27e09424ea52f1d50be35d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889876, "uuid": "d16c4ebd-43e5-4511-9022-b8f0a69f6691", "comment": "Malware payload", "value": "7a635a98926594f5f8f0f0c67970232e9360c24212f35aad63fe48cd0a709eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889876, "uuid": "91563077-f523-49ee-9970-b57f6016e221", "comment": "Malware payload", "value": "7d721031c617aa51b20886f7734930a31f662265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889876, "uuid": "a4af95c0-7ec4-4b3a-bcc6-d3000a9bf862", "comment": "Malware payload", "value": "43fa47dfb04b788481659213b2e268768c347cc518bd63f5258300027edb220e1b3381a25c18771b562a4b0cf738e3b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889876, "uuid": "1939e082-228d-493f-b04c-2bfee8e4638b", "value": "T11393F1226A0C8D66C689257F22E7EB1416BBF2A81347DB9F5C50110B5D77EC43E3B7A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889876, "uuid": "282a143d-755e-448c-af8b-15a7bc2eb9d2", "value": "088303a3216315a2ba8d66c94c7b80a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889876, "uuid": "c8e811dc-409d-40a8-8102-954f001e611f", "value": "1536:A0mD88+lawwrnxo199XrTZBBlgqhcsW5HwP6U/GCuO6PFz4I:PmI8+VGe1X5iS05QiU/maI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889876, "uuid": "0dcd2bca-fdc7-43ab-b8ce-7566a8b94a8b", "value": 91494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889876, "uuid": "bc1d6fae-210a-47e1-8f19-7951d92fd825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889876, "uuid": "9cb54a01-28be-4299-a7cd-f926c5f479c3", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b69ebfa-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889877, "uuid": "447067f0-d8cb-483c-b47b-f7c4b6c89dc1", "comment": "Malware payload", "value": "226dbc3fd70b95b2e5c60eeb92322454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889877, "uuid": "009cf318-a170-4ba0-b8d3-e017421e0e4e", "comment": "Malware payload", "value": "7ad0aedc99af29282b6babbdff498f207f9cc0b2393ccde3c4c00dc9e6cc61d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889877, "uuid": "a27a72d9-b448-4d68-ab4e-78d2b7ce4521", "comment": "Malware payload", "value": "e83ee2502ded0ac3fa2b9c3d43f7f359fcd4b194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889877, "uuid": "89752a58-77b1-4dc6-a7dc-bc62fdd9e249", "comment": "Malware payload", "value": "e068e2cf0be97d912c096483bf2bc3b94cc7397943de49cf454f052e53a62d579b593a43fa64879fde6cbaba2b369bc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889877, "uuid": "63947cfb-b821-4268-9b48-8edb0c5271a3", "value": "T1DD45233736D09EF5CD950F7003091F255F72D23A19BDE416BBE86E122D308D2BE6AA61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889877, "uuid": "f650c4bd-14de-49b2-9101-ea0695f0cd50", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889877, "uuid": "a2471d26-b087-4867-ad1f-5aee2b5e8a6c", "value": "24576:a6Zv2ivhBVnFys7wuVW2r/ku73hUSkwgOglRQq/0cYjGNTen:aE2ivhQs7tW2zku73bFgVlRlba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889877, "uuid": "c8f9173a-3da7-41fa-993a-1c750f153247", "value": 1238323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889877, "uuid": "41136bf0-ca56-48e8-a387-ca05241f7eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889877, "uuid": "14070e02-c0a0-4822-80e0-0ae98bf45717", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0b350e-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889878, "uuid": "1cb63a3a-1662-45f4-a1ef-0f88747499ef", "comment": "Malware payload (Simda)", "value": "191ad287bbbc3d71035b05d5d938d20a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889878, "uuid": "75df6fd9-cdc6-44f4-a4ce-e59390fd0ec8", "comment": "Malware payload (Simda)", "value": "7aea59ccfaac88d0ee52eb55b92e862868d97a29d1d0b02e3e5fea762fe23f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889878, "uuid": "cf73f210-c537-425f-8cbc-6bb9c0435a26", "comment": "Malware payload (Simda)", "value": "af20439d091ad478745f16070434b02af35d47d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889878, "uuid": "4a53bd28-a638-4e6a-97e1-7045e2009093", "comment": "Malware payload (Simda)", "value": "d4b96e990d62ad30bd7794cb93ea5804c3e5c867961ccc69939313badc6447b8b25a366b12c45c39ed6aa6feb684aa0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889878, "uuid": "43031cbd-c289-4679-b39f-ff64eec2c20c", "value": "T1CA341244DA0E51F5C5641F3B49BA3F1733F9C0D6934BE287A588816C54AAFC8BF2A431", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889878, "uuid": "6ae5546f-aed5-49ae-a563-bafb6f67ab16", "value": "77eb68348ee30e01ec09fce3582c5f76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889878, "uuid": "9fa923af-c573-4e8b-88fb-9e0ba582fa47", "value": "6144:iD8okEvTyoZVOgd2QZiw5NLclL5orfQH:4sjCF2QZiOU+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889878, "uuid": "7da9bcf6-a993-4d3a-b6d5-3fbe4e92da24", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889878, "uuid": "dc44b882-b7f9-4f32-94ba-cef40e41496f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889878, "uuid": "d723a9e2-e8d3-48fb-83a8-6b500c3cbad5", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cab2439-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889879, "uuid": "b0582ea3-840e-4950-a938-530c921861d7", "comment": "Malware payload", "value": "e6258f52356ee50238485b12f4ebae6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889879, "uuid": "619a8565-9bfe-42d0-bae2-41f85f8757de", "comment": "Malware payload", "value": "7b191e8af43085c74a5df0dac269171b5a1219d48012aa0ff31cce0dd8df380c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889879, "uuid": "0748aac3-3158-4f3c-a6d9-91d1619e5c6e", "comment": "Malware payload", "value": "a42f69058b4833a89675cdf9cec8c91880ab0271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889879, "uuid": "4970a3a6-85e8-4d00-8a35-86540251fae8", "comment": "Malware payload", "value": "2d045a7abef997a55607d7fff01802e3191f1186aed3eaac80380b8620f314a964cc49a8169208b968b66a0a381ad29c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889879, "uuid": "596510aa-2c03-434f-a5ae-92de832f5e52", "value": "T15874C07377C08DB2C8470530029767669EB3FA3A19718857FBE857272C74D50BE6AB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889879, "uuid": "9f20d352-acd6-4272-897d-d54a62f1c0d1", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889879, "uuid": "296219ab-354f-471f-ba29-1e8ce8034849", "value": "3072:BtKe6LMiDdv3mn37rnOgybD00Lb/hbp3TbuM5TKReF935P59VJBNKD:BtKe6YiDdv3m3mgKHDjSeeR2h9JBNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889879, "uuid": "0030b34b-d567-4661-8853-157be244e86a", "value": 342870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889879, "uuid": "930e442f-6b26-4d1c-91ad-001671729dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889879, "uuid": "53342881-29b3-48e3-889b-4b3a80915b86", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d453c88-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889880, "uuid": "570740de-05db-4ef6-8678-2153a5771a92", "comment": "Malware payload (Simda)", "value": "1a9abda4b848534e3d16f30465615572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889880, "uuid": "c3dc79c6-4d66-49b4-adef-c46b18ef8cb4", "comment": "Malware payload (Simda)", "value": "7b19dd7f9df99cd0398810b9acf7d6b6802e72dc23aa67c5f5915a12c331cf9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889880, "uuid": "1ae79dac-2836-45a9-b590-debc3641f043", "comment": "Malware payload (Simda)", "value": "1ff32dbb4c2740b7e9d8e8f8f1242ffc2b7e8c2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889880, "uuid": "29988974-3451-43e8-a9a9-de3eb5cc30b4", "comment": "Malware payload (Simda)", "value": "0cc69651626ccc6ffc0b1cb8ecff25142ea07bfecdb831fe1be15b1619cda4f552ada29d1e79a2823bb583e38cdd48ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889880, "uuid": "72911cb3-d0bb-4077-8c71-2f5704be55ca", "value": "T19DE41252E8971D32D0C6027B46FEB71263749D6913BEC4ABDE106E28ACB7460B970F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889880, "uuid": "4555e66e-5fa3-4df1-834d-2c44a4c2d3bc", "value": "3b42f9693bdd770281b738cfac146ecf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889880, "uuid": "cefce21f-0a9c-406c-90a9-476050e33c58", "value": "3072:Q1g2ZB+GEhO118/bPyKxM4QTJt2cWGsNPKisJoyjK7yGAe9Q0enyU8GZqaP+wPm/:qhYzxMlNNsAisDRGAL0eyUBnPrPOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889880, "uuid": "09079ab0-e793-46cd-929c-e50583b1facc", "value": 664480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889880, "uuid": "527938ef-54a4-4c4b-8004-483aaa880f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889880, "uuid": "9ec35b88-7ef7-481b-9226-5c4fbbea541a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddb0e2d-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889881, "uuid": "169d5113-31e4-4161-8756-e5acf2b51074", "comment": "Malware payload (Simda)", "value": "67a46b04940509e1063a7d5b2b4c1a38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889881, "uuid": "a23d612d-a78d-4373-a5b5-d49d73b378b6", "comment": "Malware payload (Simda)", "value": "7b7facba08d67d7d0998d7416ff2e22e428de4c680b87217031f7167ca10fdb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889881, "uuid": "c34e2019-d491-447e-a64b-674d464acd9a", "comment": "Malware payload (Simda)", "value": "a7d3dd8cfcad238e46c87fa5fd0d2d54452abb50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889881, "uuid": "03d1a9fa-574c-49d6-8351-c4557c0fc6c9", "comment": "Malware payload (Simda)", "value": "9273607c0c2151613cbf33bc596fcb0f071cde6426f570eca64fefd30ea4b1392d1fc1992f52c2b19e3c3247ed39393e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889881, "uuid": "9810d757-cfea-48f1-9f29-154289a84070", "value": "T103C4123253088DE2D9120DB704F1974225E9E638D3F5C2876926098F796ABA37C7DF1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889881, "uuid": "979698e7-0e19-4c48-96db-8f74c16aca8d", "value": "98aa7065495f35513795744857924eba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889881, "uuid": "2f936aea-53f6-4805-83d3-fd54dadbca1d", "value": "6144:Et++Jbojf5Vq5OC4qZhZcKYhc/ZfUozYE:3+cff22qZhZcKYhc/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889881, "uuid": "2d980c7b-dd48-48f2-854e-55b6ebb5b33a", "value": 593468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889881, "uuid": "f17c59c6-1d0b-4b54-8e13-43d962f835ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889881, "uuid": "27771913-8f7e-476b-abe9-921326876a15", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8510b1fa-c898-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763921784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921784, "uuid": "2d3c0d27-2a71-4cad-b4b0-332a265022da", "comment": "Malware payload (Mirai)", "value": "77c2c758c1a99f2752ad55c7eb3ab29f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921784, "uuid": "f031a600-03be-4d94-ad2b-ef899db64bfa", "comment": "Malware payload (Mirai)", "value": "7b8f46ac7977c711dfee86501f1eeb904159d07eb0536f68bebda9c354a5d00f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921784, "uuid": "1e737023-78aa-4249-bc9e-c7cd0b25e848", "comment": "Malware payload (Mirai)", "value": "b28ec83d428d4fbe9eb3371f4f2a7d219ec2e1a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763921784, "uuid": "397a3abb-b7db-4e6b-8c3a-b850fdc3a20b", "comment": "Malware payload (Mirai)", "value": "e1ae84a3202f6050cd30c23909f2ef5685070590180810e4fef0326beaa4924d60252798c834e2667f43f5ed88ebfebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921784, "uuid": "d99b7de4-b92a-40cf-9601-2999713254f1", "value": "T1CC432885F8D2996EC6D013BAA72E358E33A1B3E0D1CB3603CC945B2573896CF5D66B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921784, "uuid": "ad26fd3c-68b1-40a0-946a-569d41a22313", "value": "768:wcyVCdqxTAO4tblNNYy3vwQoy2EFMe6Bn5oXRe4dW8lQob950oNpmvnMeI7BNlTt:wa40rNj3vTWEFMvoJlvb95LmvnWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763921784, "uuid": "ecc56231-96f4-4bfe-a723-7cdbde5a52ad", "value": 55896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763921784, "uuid": "6841181c-50b3-4116-ba81-d3a8549cda33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763921784, "uuid": "e653fa6c-2c63-43d6-b1ee-1e0fa131860d", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e74cbdd-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Simda)", "timestamp": 1763889882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889882, "uuid": "501be3bf-9497-44d5-86f0-4bdd9e5bbd8d", "comment": "Malware payload (Simda)", "value": "8f3f1c288651c1239cd6baf1a0f6c703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889882, "uuid": "49e7cc27-a7a0-4854-9f22-4ad358c30dec", "comment": "Malware payload (Simda)", "value": "7b9e36a79f4b655d95b898e232e214c1b2480315415799c310a286ef5d951bac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889882, "uuid": "c375fdf9-37ba-4549-957e-abda227da5ee", "comment": "Malware payload (Simda)", "value": "12dfba4f1d6c3dc0a06650a22344ebe7ab23fd81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889882, "uuid": "754f0af5-8fec-4c50-9e56-073712c0191c", "comment": "Malware payload (Simda)", "value": "98998f8e66ceac9d79119b260773228d7e5a018deb6d09bb8b7f7fef879a55e17276598723b7a59fa956ffbbbca709a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889882, "uuid": "4c188888-05fd-4cd6-a091-01e6565dc523", "value": "T1222412247E8A2814E671CFB018F771858B7CD26D1345037EBA1A1F494EDB14ADE863EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889882, "uuid": "b6cd1e4e-86a8-42a2-8e59-50583642f36d", "value": "752e1ad839fdd9d87e202c92c2bee710", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889882, "uuid": "9db9f5c7-c9d6-4873-aca7-dcf1e542fbe5", "value": "6144:fnyiqVQBf0EaIp8fkTJJsK1eEzEB1XjrkXb:wEdp8csKpE7XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889882, "uuid": "1dae9206-cc8f-481b-bb48-b3e07a17d129", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889882, "uuid": "0fa1e8c9-5313-4eaf-9671-0ac509ef9ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889882, "uuid": "0d1b21da-ae3c-4b38-8224-194e690cb78e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f178af9-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889883, "uuid": "4b4cf37e-a929-4399-b180-0814ce15e6e2", "comment": "Malware payload (Worm.Mofksys)", "value": "6541a1fca9fafb0b65c2148e1d1b1d43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889883, "uuid": "512667d1-0a8e-4ee3-bdb1-f21ab3ba980f", "comment": "Malware payload (Worm.Mofksys)", "value": "7bfdb16a2809d3e99c3d380b70e2e5af4fd7029457348ddc6dbdcac870232195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889883, "uuid": "3ce35d9d-043f-42c0-97ae-ac5dc14630fe", "comment": "Malware payload (Worm.Mofksys)", "value": "3c8f4eeb4ab2e0b6b562724f5e05f4d2dcb13031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889883, "uuid": "7304ed7d-8a92-4664-8558-79ee02741365", "comment": "Malware payload (Worm.Mofksys)", "value": "7b9f050b64886437e77ec7b49122e7100ab5279d639b099db1d25aa4d118fee8bf2ef25d368bcfc217c596e14e35eb4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889883, "uuid": "2ed5ceb2-b94b-42d4-9f92-49d6ad4b8ae0", "value": "T1D524082BFE81A02EE497C2F01863A6A6BA216D350B91AC0F1391AF4934F5553F5F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889883, "uuid": "6b4fdad0-aad5-463d-a48c-3f4baaa2ee9b", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889883, "uuid": "ff429404-6513-4673-9674-8468946917d1", "value": "3072:avEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unFm:avEN2U+T6i5LirrllHy4HUcMQY6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889883, "uuid": "dc68bda2-eb1b-4c3a-bb64-456cd6ebf450", "value": 211921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889883, "uuid": "454aaa28-a579-4fe8-9c5a-8f4e36e1a577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889883, "uuid": "9b7f2cec-0042-426d-971e-d10268b34d42", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc7b2e4-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889885, "uuid": "3f0b4234-9e03-426b-b5d2-719cceafc812", "comment": "Malware payload (Worm.Mofksys)", "value": "e113044231820e6a156f0ea3934f89df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889885, "uuid": "58f5cadf-e02f-4686-a69a-ed53ea8f7a7a", "comment": "Malware payload (Worm.Mofksys)", "value": "7c578f9c1e7de514bbea624a91b497f987c0b9f9eb39494601620832401a4d0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889885, "uuid": "ae7b2488-3e61-4de9-9bf7-923e421cc0d1", "comment": "Malware payload (Worm.Mofksys)", "value": "be114735b597de6d10f6db9883a54a0cb8a47c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889885, "uuid": "2a85ce5d-03f9-4cac-926d-3d9eff4eb6b5", "comment": "Malware payload (Worm.Mofksys)", "value": "b71d62d953f05676acaa8e79556bad96a1ca9a2b44c3b0cf5a73079cd48da68ed425a16cdb869d7df3ea2062e61d131a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889885, "uuid": "eb05478c-e621-4cb0-8402-7f262f236c1b", "value": "T15624F967E600712EE893CAF0246AB1A6B5312D350BD6BC1B63D1AB4974B2953F1F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889885, "uuid": "6d90b5fc-ae5c-4b8a-8f62-290825849226", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889885, "uuid": "b1c59be8-a62d-4485-b8c1-723734785463", "value": "3072:zmvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4Pmu4:CvEN2U+T6i5LirrllHy4HUcMQY6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889885, "uuid": "82f08391-b4f0-453b-9ff7-2e5c15723e61", "value": 221925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889885, "uuid": "3e0b72d8-1bac-490c-ab4b-43d7f51360cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889885, "uuid": "8cf82c9a-7f11-4c36-b880-f7dd325d4c11", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405dc78f-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1763889886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889886, "uuid": "41712430-b278-47ab-b7f8-22c991c2144f", "comment": "Malware payload (Worm.Mofksys)", "value": "3a2a1fd462b18532692a2353e09f45a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889886, "uuid": "c26f84b7-e8f1-464d-b08b-a8d1cb2d9ed5", "comment": "Malware payload (Worm.Mofksys)", "value": "7cd7c4dab49e4b2a2c38a60e850f614d2b7c27eb12cc1d61ce9a32c59fce4243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889886, "uuid": "8c1f5cb6-0cd5-488e-bf4a-eac787ad46c2", "comment": "Malware payload (Worm.Mofksys)", "value": "afa5e10d61e260305e671d5ec395c8c4acf5a67c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889886, "uuid": "7efc2658-940d-4f0e-a18a-34e9b0a60fd3", "comment": "Malware payload (Worm.Mofksys)", "value": "f47f7948f0894fcc27ccddd552df4502cf00f17ca626f1e39109bcea5542f7f460f7db1e7a07048a4fabb3c4c20c1a27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889886, "uuid": "8d912e33-932d-4d68-95d9-1148af094b89", "value": "T15D241A6BEA00A02FE862C9F15421F5A7BA262D660FE18C4B17D09F4A7971513F1F631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889886, "uuid": "aeeedda5-62ab-4c81-9597-a0773780efdc", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889886, "uuid": "118a7426-942b-467d-8d42-ebe6a0cd1569", "value": "3072:9vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4Pmux:9vEN2U+T6i5LirrllHy4HUcMQY6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889886, "uuid": "ecb37ceb-2c7e-4469-bbbf-6ad3179c3b3e", "value": 230054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889886, "uuid": "5e9962b1-facc-4de3-9cf1-34ade21bbefa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889886, "uuid": "9235804f-f1bc-4587-b2e7-539c826a8fe6", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410b2aa1-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889887, "uuid": "c7ee0668-1f48-4e56-a985-36fdc8c27900", "comment": "Malware payload", "value": "e9896cb7e0efa773cff66451b852d1ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889887, "uuid": "d58b2b9f-7399-4b7b-bd11-301a046fc86c", "comment": "Malware payload", "value": "7cd81c2ddda95f42cb8ca2fe116083dfc8b6afb6052e2f29e5796861263e2f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889887, "uuid": "7ae2f483-db83-4348-aa70-141fb22a4d67", "comment": "Malware payload", "value": "e06b73bebfd6b2e9f656aabbdf9d71ac17ea8d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889887, "uuid": "42eb6cea-f4f8-4676-87d8-1cb00540041e", "comment": "Malware payload", "value": "a69eb1fc568e79e7c448a8bff86ad83ae14f88c43a9fa48f58d4d95a5e3350efc692672b84bad185c0ffc9a23defa3e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889887, "uuid": "90219a7b-1adf-415f-ba88-2e2032ddefa0", "value": "T1DAB5D0AA0D1E02BFCD55E3F2377B84346ED24E43662FC69C520ADF2D1C985C98E09976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889887, "uuid": "669b983d-e838-4df3-9887-fca53ee0ac56", "value": "37c6c0cc4d20c311c793c6b743da8942", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889887, "uuid": "da49dd8b-e826-4800-90e4-45a9a0111a78", "value": "49152:SLcEfWcnLJ6I3BUz8fsK5CdoQmTZMCpylljS:eXnL73XHdFHpqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889887, "uuid": "eed4c013-cd8b-4e27-8b94-081ecf51bac1", "value": 2430246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889887, "uuid": "5d54da67-35c5-4566-aeb1-8e4a25131748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889887, "uuid": "9c592c8e-afdb-450b-9f6a-20732ec62b27", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3ad75f-c850-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763890979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890979, "uuid": "8e0ffd04-de08-4571-9958-91c7e249a139", "comment": "Malware payload", "value": "0c66f51da5cdaaf0bd79f4874169e320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890979, "uuid": "57b0a351-0eba-4af2-903a-7511149e7b80", "comment": "Malware payload", "value": "7d45fb8113c684277016bc7f5993b971c45a6796162a8aa4fd2554ab4b449755", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890979, "uuid": "2aa01a14-dc8d-42b1-899d-753980f3aaf7", "comment": "Malware payload", "value": "5e02dec6b930bd0dd6fa51417993d86c0a094229", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763890979, "uuid": "8ef07b0b-035c-4593-810d-9d8fde8def51", "comment": "Malware payload", "value": "03be198bab9a9bed88a53645a9ce316758a18cbf2ca1f27a2333a28f4eef136a4ba72cb20532bed43de9363e691ddf39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890979, "uuid": "acde44d9-b091-4dc1-8661-c16ec2b06a01", "value": "T1F245330B33C1A371CE4D127202473AA16FB3ABBD1770983AB7D8650719B5908AFF5796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890979, "uuid": "061c9e69-2462-4dfb-96c0-f68f16ce8d1d", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890979, "uuid": "a9761136-3551-4d34-91a5-15ccd3329e8c", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgApGaF5+mjC/QjxD/ua57TT:qE27hQs7tWVToP0Hs0/htDH3pGaF5+Ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763890979, "uuid": "ddc5804f-1d23-44f3-83ec-c95e474cc8c7", "value": 1276453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763890979, "uuid": "633a6c36-f33e-45ca-b45b-5f75dd7100c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763890979, "uuid": "e4d53176-ca4c-40e2-bbcf-16629fed4c79", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a93eff-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889888, "uuid": "54a43842-f9db-4a2d-b413-ab00de402e23", "comment": "Malware payload", "value": "565875a8ba7d8a5895116c81a298d9aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889888, "uuid": "3bf31e2c-c6e4-4fee-906c-cfff0f13ea71", "comment": "Malware payload", "value": "7d757b249bb08391fcfcc8b8ff74ad19f5a522887394c905bc224aca4331d5cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889888, "uuid": "09e690ac-9d1c-479c-8e0c-792b33481996", "comment": "Malware payload", "value": "8fe6d9a6741a2356a6a9d564112330cd6164d792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889888, "uuid": "9054184f-a6a6-4905-b84d-b803599b832f", "comment": "Malware payload", "value": "aeebec7cab82e8aa40b0c7d2dbd9efac231b09e2202c6e1bfe9c84bb1177ad561904501ec80b17c6ce728019d7dfc5fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889888, "uuid": "3541ef6f-3348-46a4-ae1c-e2784cd5d776", "value": "T1E335334216C73E84EEFCF2F787C262A9397A3A980395E83AB55DC94F01F0515F56807A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889888, "uuid": "5ad1955a-14ec-4059-a81b-7b5f74408466", "value": "ee98eef4340fdc659d6537f8155633ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889888, "uuid": "d8c35e4a-b912-4956-be0f-c46ca49be152", "value": "24576:+YhBVnFys7wuVWVT0PAW0duYW3YZzHdbCwuWTuNpLF:+YhQs7tWVToP0Hekxbl5TuLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889888, "uuid": "a1c112a6-f4df-470f-9674-007a26320c74", "value": 1080729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889888, "uuid": "a6ed2ce0-87c1-4157-affd-4ebbbe2fd435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889888, "uuid": "52befbb0-a134-4d43-9588-5a6fee4768d7", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424a5772-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889889, "uuid": "ee3b3408-2ce7-4454-98e4-56f9ea0ab180", "comment": "Malware payload", "value": "87235af6cc712227a29c14deb0b0a1ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889889, "uuid": "feba7213-0302-4363-88ee-f3e014030bd4", "comment": "Malware payload", "value": "7db7359ce90c0557cfc037494e9f739fc46f6fb319f2ad43d348fdc51cfc03b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889889, "uuid": "09080f9f-7318-4715-a639-aab7a8f22bea", "comment": "Malware payload", "value": "01270e61c11aeea89a5eccd2bcbc15a30b3b5f00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889889, "uuid": "43bb9599-f5dd-48cc-a8fb-afed61c3e6ae", "comment": "Malware payload", "value": "32545200da5f84be771eef6d941acc81e73a5952392b01174ca3183c952bdbbc8ee648ef3c65c7b45fd5481134215e01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889889, "uuid": "beeedeb6-14d7-4a82-ae78-f277cf62bc7a", "value": "T1C2653333799090FCC88B1E36006DDBF59BB2AAB335B47135AFED086A1D714925A1FB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889889, "uuid": "2a081e2a-4db2-4514-8202-8dfc97665995", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889889, "uuid": "71f556bb-df52-4681-ac2e-c1d6f6df4136", "value": "24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lANCPrHQ0VfgHZhI0a:7E2lVL3Ze+/F5ndjFWmrjyx1cmbbxgA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889889, "uuid": "0c60cca4-d9be-4d64-8dde-c5df13a368cf", "value": 1458360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889889, "uuid": "c76a8d58-5824-470c-917a-e81bf7f84a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889889, "uuid": "3566e29f-545a-4ef8-bc82-dc73956744d8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a05884b-c868-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763901015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763901015, "uuid": "23df632b-5c20-4a73-8aad-3c9b23fc2dfd", "comment": "Malware payload (Mirai)", "value": "56193a308db5cd8ca4e6147f5c81faa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763901015, "uuid": "1023f66f-7c89-4a52-b899-781a3c047289", "comment": "Malware payload (Mirai)", "value": "7df1c3149696c1edadebca4f72173f7c6feadbdb325c5c7d163d2801ccef3ec8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763901015, "uuid": "39daa4fb-31d9-4471-af4d-9e1491c14f7f", "comment": "Malware payload (Mirai)", "value": "3adddfcd98dfd2f10aeb05831bb6a0cc4922bd0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763901015, "uuid": "e38aa4e7-6d7e-4031-8666-537d6213de87", "comment": "Malware payload (Mirai)", "value": "4b3c4d7b3e63de37ffcd8f90289ca8999eb17ffe0213bbc7bbeeac41c2a7032de4f823921e19f12a5f10ff5a370c377e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763901015, "uuid": "d48886ba-ef78-484e-b9af-e439beacf205", "value": "T1BAA33B56BD92DA12C6C16277FB1E424D372713FCD2EA72038E255F31728A91B0E7B581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763901015, "uuid": "ba59ab06-10c3-4b5b-b4cc-367116f113f6", "value": "1536:h/hJFQl2wlsLwKyL5HlhXwp4Vtfid7QRNMpr/jOdA5LH4rkNyPvNmyemh:h/hwldcwKyLx7NtfityNMFURsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763901015, "uuid": "832bcf30-2ad0-45c8-8e25-97d502ee0056", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763901015, "uuid": "1fc9171b-c590-42e7-ab51-5e6566013244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763901015, "uuid": "7e414836-beb3-4c17-b200-53c1dde6ca96", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ed418d-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889890, "uuid": "a6b5358c-c4e3-4851-9e1e-9725fec31a4b", "comment": "Malware payload", "value": "f40b23725f7304db3dfdc74d6685e863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889890, "uuid": "68ab814c-d47d-4b4a-bc18-615eebf3cdfb", "comment": "Malware payload", "value": "7df4ad0446ef0531a4cc97c08a96ea24abf67d63592a40738467ff5984743a9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889890, "uuid": "9468f4f7-b036-49e8-ba22-ff39cb042495", "comment": "Malware payload", "value": "4e45bccdfa7756adf028a8f44d27921a80578a0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889890, "uuid": "26153255-a076-4287-abf7-d453cd1c44bd", "comment": "Malware payload", "value": "1b5e3522bceedbec78f5bec8487970d030aa0363bb1c7b3326d038b893bc279b718a7265c5709f6b4c364f5cadbfc7bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889890, "uuid": "306e65b2-64f2-4e25-a8d2-b7a88f125455", "value": "T1A40523201DD64815F06B193E151C5377C66FF67A062A6E7B17808CB4BD37029DBEE38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889890, "uuid": "b0449d0a-8e8d-4b81-a393-37948c0d0319", "value": "cfb373e3071730a3a5a9b37af5002099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889890, "uuid": "dc5d81e7-68e5-422d-b4bb-b86ce729b52c", "value": "24576:LuGtcjN3lRfEyB9MBhavuS5ia0Gj3EUZFIY3EBRb:fiB3ffDBvdDpZrARb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889890, "uuid": "93b18e9b-aa85-4049-bb15-d5daa1c2b17e", "value": 801414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889890, "uuid": "9fbbc3ad-16a5-45d9-967a-ec61cebf5d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889890, "uuid": "3f12cc7d-54e4-4aaf-b8d3-8d68014b7916", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a0d33b-c851-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763891257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891257, "uuid": "e7e47090-2dd8-4f46-86d7-bc15f60240d0", "comment": "Malware payload", "value": "6d4e41eed522282fc2ce0beba3a5d3df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891257, "uuid": "3e04eabe-dc1e-432c-8499-c2c7f72c5465", "comment": "Malware payload", "value": "7ec28124789ee681736f8e56beadb566626f571bde728f264392fa376dd838c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891257, "uuid": "670be643-5145-401f-a997-1a0fcda5d8c3", "comment": "Malware payload", "value": "cce0b89cfd7475786cf1092f7d8652ff2310dc27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763891257, "uuid": "b705d8da-b9e1-4c07-99da-4740dd11759a", "comment": "Malware payload", "value": "e3ec15fe0476b417593df985cbe1d77b57058f6120285f0358398d502f3b650e98d943aa36015e25bca045481eb4f60d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891257, "uuid": "660c55f2-de54-46cd-b6ae-08a60c732c65", "value": "T18935231B32C262B1CE89133107461A986E73E77E2BB0941BB3D895072DF2D447F79B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891257, "uuid": "e5d46c6e-7f20-4f1e-8823-c16a2f6c26eb", "value": "9dffaeb4de0f0899dcc332737abce907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891257, "uuid": "7ab015c5-7050-415e-8378-d5bdee70b1f0", "value": "24576:q6Zv27hBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1BPx:qE27hQs7tWVToP0Hs0/htDHit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763891257, "uuid": "98bfbe9a-8b39-4205-b835-d7b371e6b531", "value": 1119687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763891257, "uuid": "db8be6ad-9d5c-421d-b130-19b5a531cf42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763891257, "uuid": "66a1a70d-ba4d-40f9-b0af-147a4a79452d", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438d215e-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889891, "uuid": "5607acf9-7569-48df-a5ed-820acf015b2a", "comment": "Malware payload", "value": "645bfeab7806d2302c7a79ee2c5e66f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889891, "uuid": "1d1a7a31-2390-40f6-8590-8e3496e545b7", "comment": "Malware payload", "value": "7eed074dbf972b521eae96e80fde9855704beddb6e345678ede45eb6b832586a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889891, "uuid": "b48e911d-8b5b-4cb8-b459-742886c2f1a8", "comment": "Malware payload", "value": "136568e64a4fa2a46f999c9b475007ea377dde49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889891, "uuid": "b2da1095-6043-4679-b65f-ec47ca7d224e", "comment": "Malware payload", "value": "85056adbb7de075c3d31ec338f412502993da1b0e6f312223f1415efb217ee6c5f768ea18aced56dae875ea9ebd966c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889891, "uuid": "7844c41f-1880-4c20-a3ca-fedd0a14125e", "value": "T12345235B32C11AB2CE481732074726A95E73E67E1770842B73D864072DF2D84BF7AB99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889891, "uuid": "4f5aacbb-d80c-4ef2-975a-55f8cdb61f6d", "value": "4d41beacc76045fb1924c6d5c7349c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889891, "uuid": "9a980ae6-52f2-4d1b-9097-b48887790cbc", "value": "24576:a6Zv2ivhBVnFys7wuVWVT0PAW0duYHM0/JTk6/DHSKgQg1ZXq:aE2ivhQs7tWVToP0Hs0/htDHi76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763889891, "uuid": "9c5b59de-2b62-432e-91fa-efa8a186d1dd", "value": 1215977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763889891, "uuid": "d2af14a9-3509-4dc4-94e3-757978e6ad31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889891, "uuid": "3823cd99-8db6-49a4-96d9-9ae9ed3f2e51", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec5dc44-c894-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1763920055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920055, "uuid": "4a50464b-7da3-4751-9ff3-8b22d763e16e", "comment": "Malware payload (DonutLoader)", "value": "2b09fb08ee7a5e9828589f02788c6e81", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920055, "uuid": "27b14935-654d-447d-bfbf-b7fddc55bce5", "comment": "Malware payload (DonutLoader)", "value": "7f10f89aa85390897db6a03be54a54e7a73b5a78239452192415d69e8951039d", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920055, "uuid": "f24d242e-59c0-4c9b-8a74-7ba44e362065", "comment": "Malware payload (DonutLoader)", "value": "b8fcd8e73eec3e03a5bfdb0fc8b317d346af39f2", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763920055, "uuid": "8379dd16-8ccf-46de-9e81-5037160bce26", "comment": "Malware payload (DonutLoader)", "value": "4706caa1697b27a6a55f0a229823fa6dc78a5489774a9ffbecea9fa2138d3e68b6e4dfb4dbf7e1ff06b44e44d5ec187c", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763920055, "uuid": "e04e0fa9-e994-4ffa-82f6-7acaa52f7e87", "value": "T12CC36D5B73E530F9E1B78239C8A60A45E776B8361760AFEF03A046565F236D08D3DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763920055, "uuid": "4e0b3078-16f5-4944-af35-9d7457b6ad84", "value": "16b044231e4b12a9ad7fc7d47095646f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763920055, "uuid": "488f68e1-9dcf-4b81-85be-c59bde5c1abb", "value": "3072:Oe3Co6YLc3fyoqvKBZm1n61Vh4pCPjIS:OdYQ3z5BZmwVh1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763920055, "uuid": "1f07aa27-8569-44f3-a224-8509519979be", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763920055, "uuid": "6d55848e-e00c-4020-a588-809eaed20f0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763920055, "uuid": "5868af67-3901-4bbe-b7c8-298b13a49fce", "value": "SecuriteInfo.com.Win64.MalwareX-gen.45147977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441fdf1a-c84e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763889892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889892, "uuid": "e9ac9a69-9e2a-4fcb-8826-6a5a2a5384f4", "comment": "Malware payload", "value": "c4638f8ea46fa6954e0b5589f231c769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889892, "uuid": "5f3f51df-2617-4480-8d8b-efafcdb34780", "comment": "Malware payload", "value": "7f138ed8d121160dd1d3c08d77a0075540a90c0d3da75dfa5a0f19979b8a7380", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889892, "uuid": "9a7d828b-6ad6-40e2-9e59-dcb9dbe20b97", "comment": "Malware payload", "value": "6eeced94995d65a319091a60d324cf9c21fc9a93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763889892, "uuid": "a3215222-da17-4ad7-a640-67bf60d05bb2", "comment": "Malware payload", "value": "91eee41884249e2703f1fbfca18d0898691ca0daf546a471032144dd7290bec5b9d778b48a3b51df9c38ab2d2c9b66f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763889892, "uuid": "8e6321c9-ac1f-4a58-bd1e-190c532a4584", "value": "T16B73BF09B7E98692C43E167944535B000370FD226A4BDB972FE174AF2D663818BB2F5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp"