{ "Event": { "published": true, "date": "2026-04-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-27", "timestamp": 1777334582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e0f7d20e-36b6-4cf9-b772-8c29a57e508c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9379a86f-4276-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321247, "uuid": "d6ce86f3-686e-437a-b49b-7975337f9c19", "comment": "Malware payload", "value": "df9c10da9ee2184f365c25ab15211d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321247, "uuid": "02ddf658-938d-44af-b0ff-2fd626ab0b41", "comment": "Malware payload", "value": "00a5638b8e6b30946cccae6a193dff85657331a97f866938a1b1c7d1be0943e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321247, "uuid": "4516964a-94c7-4578-a66c-136aabea6eba", "comment": "Malware payload", "value": "ef446f5317c775cfffb7ed230040692c7bbdee76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321247, "uuid": "bda0b5bd-5d74-4699-8e53-2df4dbd1d0ff", "comment": "Malware payload", "value": "e9290acad581db2b3164ed0151c214f2a8411b5bc417d020dd93a0cfb9e960a3d3e437c03513126a5c9526891fcfea36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321247, "uuid": "dd211d45-3673-4782-addd-ef945dac7971", "value": "T1AAA75B31324AC52FE96201B0192C9A9B552CBF760BB254CBB3DC2E7E1BB55C21736E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321247, "uuid": "246f84e7-f805-4a8f-b243-436a2e441ba2", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321247, "uuid": "71d4112b-a60a-4b2d-b533-b76314362d70", "value": "49152:sWbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l5ciOw4PAELcpB2Mpu:sr99u4kc8Hao8eRjYBU4UAir2Y5LOw4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321247, "uuid": "abf33033-d9d8-40f7-87cd-7f55baef74b9", "value": 47197544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321247, "uuid": "a654cf30-6092-49ec-baae-e4d03f9f6319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321247, "uuid": "c44c9d1f-e9f1-4610-91a4-5f39ced5f992", "value": "Pratfall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca1ea22-4252-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777305559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305559, "uuid": "be855454-5e95-4953-a313-1f3792f4e421", "comment": "Malware payload (NanoCore)", "value": "2edfd05dbd0c859a8e21d4b3dfe77bde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305559, "uuid": "4b1f4003-3315-4598-b539-aae6c913a684", "comment": "Malware payload (NanoCore)", "value": "0108f3118daa6d62a313608ee54c71edc7ded853ba29719715fdcfce4c271fe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305559, "uuid": "ce371c31-e14e-471f-a46a-2451674a34ef", "comment": "Malware payload (NanoCore)", "value": "4090851788b580ba183726cceec65531a7a56f37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305559, "uuid": "3341fce5-c71f-4fc5-9fe9-92f7f8b43f83", "comment": "Malware payload (NanoCore)", "value": "0fa2c55446aebbb418eaae16d72a72b6284da0b2ba96f0b65d42290bc5439e56a8fffd78029f8f97acb026800bdefa5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305559, "uuid": "f817ee16-9572-4958-9628-faba5edc41f0", "value": "T15F14CF6537E4492FE3DE8678701242028379C2E3A8D3F3EE28D461B79B667E44A471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305559, "uuid": "b19a40b2-b3df-4e24-89c9-65d1225cd0a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305559, "uuid": "267ee903-2d86-47a6-bcaa-5cc5e5164b1f", "value": "6144:MLV6Bta6dtJmakIM5s6fA+eXcTTacsRy3Cj+/q:MLV6BtpmkNuA+eXsaDCU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777305559, "uuid": "8edd27a6-8dc1-4352-ad8e-7dd28745a58b", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777305559, "uuid": "04368cc7-1532-41b5-a765-c43dc6674088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305559, "uuid": "673c372e-07ae-4f24-85c9-191578a3a6e7", "value": "snetrat88nano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3e0443-4206-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777273265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273265, "uuid": "be2e1c76-052e-4097-b97d-0423d986f24f", "comment": "Malware payload", "value": "5982f28a1aae7700b45363e1623c0115", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273265, "uuid": "28513915-d4dd-4314-975a-5fff7ef3de03", "comment": "Malware payload", "value": "0202f2e46d6b3c60685a5529c1aaaabdfc957384d125eb25e8c16227062a3f56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273265, "uuid": "4eda7c97-e560-4648-b94b-e909876d2672", "comment": "Malware payload", "value": "70c06c2087dd17d97f166b6f4d970b13c8ef48ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273265, "uuid": "c0ee179e-bb7e-4809-80f6-6b95429140c7", "comment": "Malware payload", "value": "8c117d02894b22c6e2b0ddfd34adddce717861c3ae3c743544b1f2dcea33690099c73635a6441849caf404ec75025308", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273265, "uuid": "0ec981cb-1928-456c-893e-bab84b9a2c4b", "value": "T166A68C02FDCB50FAEA031A3005ABA27F23315C064F65EBD7EB407B29F9BB5951936149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273265, "uuid": "16172c5b-fa98-4314-9de5-b9b74f79bd24", "value": "98304:z9UoCPf1JAPEkuM+Rrt14Wt38kz1YEybu2n0vCVWkUj3nqbIHunywM1QQe:nG1I0M+Rrt3t71RyKHOUj4IH+ywSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777273265, "uuid": "9b098bbc-389b-4546-8cc1-7b1be3abb887", "value": 10269009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777273265, "uuid": "c478724d-96c3-44cd-a252-58627c2559f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273265, "uuid": "68956ef2-3f47-4b07-b813-f0e1e6613bde", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f08dad-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302722, "uuid": "3f8f0056-5347-4ee2-a890-f9e87ef4f63c", "comment": "Malware payload (AgentTesla)", "value": "edf8876c88b267fa78e76a47cc5038af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302722, "uuid": "8c164b23-39b9-43b2-a360-92726a0ca21c", "comment": "Malware payload (AgentTesla)", "value": "0252a5d15be16a504792c9bc0d3b508e692d081c877c826e41819770e6cc2e30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302722, "uuid": "904bf022-a806-4e94-87e2-c7748f271080", "comment": "Malware payload (AgentTesla)", "value": "8857389bf4ff9635587636a3ab9c059fcfeb784a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302722, "uuid": "2a6a235e-1f0b-45a3-9fe9-00ed4866b953", "comment": "Malware payload (AgentTesla)", "value": "fbd2f9b25862e4ed2e6726a9c766b1008b11685d6ceb8991e6e6f0b5c99e2a0f8801386715cc07e7ca47439c05fed145", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302722, "uuid": "1839f0c8-a7f9-4a26-ae0b-621f9f79049a", "value": "T1AE253361DB4CD5254CE8C329A27B6F1B8FA5D9E21840A30EC3C878CF5E503A2D7ABD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302722, "uuid": "70eef377-7411-4483-8eb0-437591485dd4", "value": "24576:61IyDDNI90WuPvomSoRWI+C1tFyvIjyFHjrLNi9:KpG1tqF7tpyFLNi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302722, "uuid": "eed44175-3091-4145-b5f3-a7cecafc726b", "value": 1017697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302722, "uuid": "b049e1d2-1c87-407a-b9d1-0129b00e705c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302722, "uuid": "c7f81c94-0d7e-4711-bf7e-fe94d6b9a6d5", "value": "ps_r3cNQkY6LKqb_1776149278654.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74628526-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276956, "uuid": "6762cdc9-96fa-48ce-8aea-5e717ee96205", "comment": "Malware payload", "value": "47780b3c392b59932e42810a9c20fcc0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276956, "uuid": "324ba4ec-9347-4b65-a6fc-d10294810ba2", "comment": "Malware payload", "value": "02fdd9201b8e390e6a8a4da410564e47a9ce88c55684a135fdf8cb476cc201da", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276956, "uuid": "787f55e8-85e7-45cb-9666-cc525c43c482", "comment": "Malware payload", "value": "8ade1a9e643b9eee97cf08b44353bde29d66681f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276956, "uuid": "dee0926e-dc8b-4a26-abe6-56b778ba07dd", "comment": "Malware payload", "value": "548cea1868c69216aef769ca1f6e571c1a0338546292f77c9508ef3f905802a3e4b43cd23158b974340efd9eef8686b0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276956, "uuid": "5b7279a0-3deb-4eb3-8d80-800153e6d56b", "value": "T1FA372315CB36899D8D6D50DC1A396B1828E44E0F26B4FCCAAEDD911FC2CF85191E3C9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276956, "uuid": "4d91ece9-5490-4c2d-b139-b73db97034d8", "value": "49152:rj8jVjMjxj3jBjHjajSjJj0j+qAnjGjXjZjVj8qAGjijFjcj/j2jKjIjcjVjgjam:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276956, "uuid": "5698c44d-df2c-4866-a11f-5d71d7f9c108", "value": 23424197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276956, "uuid": "49126d1b-1aaa-4ee1-a55d-6bdc6368a756", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276956, "uuid": "34d16a7c-e91e-43a9-ac33-9883e8d7d2d1", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b85f31-41d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777253450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253450, "uuid": "9ef97f14-0c73-4b8d-b58c-55375392c98f", "comment": "Malware payload", "value": "fb801cf93ac62c76ef74fe742b7b8b54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253450, "uuid": "b693b4ac-13a4-4223-9bd4-ba718835b951", "comment": "Malware payload", "value": "043675aa01acc869a78590befba137ba77e45a7509926739f7d13b75042d4119", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253450, "uuid": "fdbec532-4cfb-4b86-9a90-485f2a762abb", "comment": "Malware payload", "value": "1b2607e5b4c2c7627ffae24c1894040fce6deb68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253450, "uuid": "5f26a701-ff50-4c8c-80b3-34d632f4df07", "comment": "Malware payload", "value": "619b6e14d39fc502478f6623d31cfe635cf648d1512e2972181e7f6a074a72daa69a9f22d31e9aab3c92658572af2ab3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253450, "uuid": "1712f967-3246-4f32-a544-2c1c23701b22", "value": "T110E68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253450, "uuid": "d607f649-80bd-4dcf-b036-0f73e9224c11", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQa:cqYUQuVDt0TZEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777253450, "uuid": "5afb5e41-8097-4c2e-bf96-aa0fe2996279", "value": 14123008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777253450, "uuid": "3ce07d76-fa96-46f0-a921-724e925f056e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253450, "uuid": "85b89d30-b5d8-4b45-9d2d-22ac6d94432e", "value": "043675aa01acc869a78590befba137ba77e45a7509926739f7d13b75042d4119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a577f4d5-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277039, "uuid": "ee829e6e-2058-4414-9970-aea87eca8a21", "comment": "Malware payload", "value": "04f277fe610f7ab1c7292cb7445db5dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277039, "uuid": "a5f62ae8-a13f-43fd-99d2-a934c5bbebc0", "comment": "Malware payload", "value": "046940eec62fcfb0f1548ed0e235e87225b6fa6bf51ba975bc7910574cfc99f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277039, "uuid": "02380f3e-bdc5-47e4-9925-20766772b528", "comment": "Malware payload", "value": "e9fc478de9b35ef7cc5c5f2eb735cb38b0b4e588", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277039, "uuid": "32813103-fb52-4853-a0b8-fdbfcd408045", "comment": "Malware payload", "value": "84c01e53a8c0e672323e6e05fa1c6998737e8a16eeec2c2766daf31d7d6139c376d0f1e76396ce0cbfcd53d037f76a17", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277039, "uuid": "d4d99dbb-f4a9-4ea3-8000-920bf6330983", "value": "T1FE3712CD6D9FECEE47EC009410FE07EA26A94F008546D5DBC181EC669652F5B2CA72EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277039, "uuid": "9772a08d-20c0-4aa8-9454-1fe9ab655b8f", "value": "49152:C3WkRtm3WkRth3WkRt73WkRtz3WkRtA3WkRtS3WkRtT3WkRtp3WkRtt3WkRtd3WA:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277039, "uuid": "e1dfcdee-3732-404f-8876-112423871191", "value": 22903954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277039, "uuid": "fe00d8e7-a4a2-4845-81cb-81c25baf7eb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277039, "uuid": "0be309b8-ef10-4535-a8e8-2212bb078240", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f98c42f-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302611, "uuid": "e12843f5-189d-43ea-b085-3980cb29e657", "comment": "Malware payload (AgentTesla)", "value": "81dcae88e07d0327cfeaeb6707d93eec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302611, "uuid": "6ca29176-6201-44c1-b16a-507db2369e91", "comment": "Malware payload (AgentTesla)", "value": "04e076fa2c82050cc4e89d7ba58b3cedbdccc5995b7e414fbaa04f6f2c1e77c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302611, "uuid": "e1ca7380-6566-4c0d-af13-8900e06ede4b", "comment": "Malware payload (AgentTesla)", "value": "2179cbcda0d727eb7e371554bc895c31dd5605a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302611, "uuid": "064bb7e9-8fb6-4285-b392-95f4d4fb979b", "comment": "Malware payload (AgentTesla)", "value": "aa179754233a3afe7f1373f5012fd430056d79540caab70d7b7dd32c1525efb9a74e479b4e404c3b3604d244c3b2f203", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302611, "uuid": "86da05bb-6a99-4e44-abb9-cce482b8d37d", "value": "T151253303BE16B56F59358B1CE1ADFE0A83D15E832518A0D7708650CF13FF3A89AAD45B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302611, "uuid": "52c8c73b-3f23-4e6c-8af0-2064b2309a03", "value": "24576:NZW95ClB97Eq6kDsqXvHE3kHxfWEGPfOeFppoWasyK8GzhX:E52BK4x+z3O145B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302611, "uuid": "c7cdf712-7e4f-45c9-962b-c6364fa9b48a", "value": 1016222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302611, "uuid": "b917e2c3-b2d9-434e-b061-6cf75079b786", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302611, "uuid": "78d9bd8e-150e-47d4-849b-6221d958187a", "value": "ps_fyqhm5rTX6wJ_1776443205885.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a71b07e-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276027, "uuid": "42996f28-8e5b-4f53-882f-daec97dd34e5", "comment": "Malware payload", "value": "74fe18c3242eef8ea2152450b674418a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276027, "uuid": "818a998d-003b-456e-bd93-689835a979e7", "comment": "Malware payload", "value": "056ab653784e322db338252f6ca8cfd534d5aa6507b3d1e8ba0cca28339b61a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276027, "uuid": "c23d5c24-791e-4727-9d09-8157d129cb49", "comment": "Malware payload", "value": "84382fba630d50756c893957e12b6d30a8c51342", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276027, "uuid": "96bb477d-3bea-406d-9b82-a4a728425bb8", "comment": "Malware payload", "value": "52d9761d83624bd5949a414cfe11c3d8532d0ca9436df28ade7a5b57e9d7fd6ddc8e03a5f06b21858b59d57bea0f3db7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276027, "uuid": "277f2339-0d5b-4b80-9bd4-46abde8aa637", "value": "T19E37239F6738677B85DC25A3025E890FCB588B4C810DB655F792B40FCB8D628BD898F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276027, "uuid": "d2232a4f-85fb-4f0e-93e2-2d2b0a3c19d8", "value": "49152:ANktjfNktjDNktjkNktj5NktjFNktjzNktjBNktjLNktjaNktj7NktjRNktjFiBL:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276027, "uuid": "70cd0c96-9bf4-4819-9910-b430249b119c", "value": 22903945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276027, "uuid": "95fda66f-1ece-419e-b72f-b45501b8e104", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276027, "uuid": "6ca4b246-d8bb-49b7-b3f5-019204d6f8d1", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355571a0-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284152, "uuid": "6d218aae-ae43-4739-a7b1-1f560b77887f", "comment": "Malware payload", "value": "289acc7ad00613e0a428d34293f34bb2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284152, "uuid": "e2b23749-e47a-421f-8bfd-9513aa90a49f", "comment": "Malware payload", "value": "05b82f29094f8eb4b6d56a2d1f1eb4d939e43e32f2280b14c6a5ceb7c1bac952", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284152, "uuid": "0bc2422a-a34a-4c3b-abff-a2deccb5b5f4", "comment": "Malware payload", "value": "1b703c30fe26c47cba2b4a1bafcf5ce4c4b5f607", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284152, "uuid": "413bee29-a85d-49bb-90c3-fab83c0fed24", "comment": "Malware payload", "value": "f4de42762b1f63c9a284eeeca7414cd1f6f9b146a9e268d7a9ceb3a17c6e75e34f5cc0b2ea3dba1a8342aada6fbd6ed0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284152, "uuid": "cce63d9e-dfd4-4aed-ad87-0e42d4e85953", "value": "T13627230B8C029E5D5BFC32BB1CBD954E4AD41DC006D6F12111F96C52BBADE6EC27B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284152, "uuid": "7cf07fba-d79a-491c-a80b-535c1c2ffdde", "value": "49152:xZCyHPqnZCyHPqrZCyHPqKZCyHPq5ZCyHPqPZCyHPqVZCyHPqLZCyHPqQZCyHPqq:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284152, "uuid": "430d6372-5f5b-452c-a0d9-c6675c44ae9e", "value": 21863429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284152, "uuid": "46146e46-ed9a-434d-8073-5ce65eab956a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284152, "uuid": "aaa4359b-eadd-421a-9399-5f39f7dc9af7", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e542d14a-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285736, "uuid": "5b5cfdeb-f566-4e11-a829-f3317534e53b", "comment": "Malware payload", "value": "b5f464a2806e68c2f071a142dc8d678f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285736, "uuid": "0dfe6b7f-d524-4c57-994a-a018acbefa7d", "comment": "Malware payload", "value": "05fcda898d711fbd9bfaa1da5625b5b9d12d0740779e318298b603922b3592a8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285736, "uuid": "92a9fe20-e8ba-402b-a013-59317b55189c", "comment": "Malware payload", "value": "3da29421ab01fe5853656191844081df88f6ff9c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285736, "uuid": "680b7a4e-723a-4e53-ad44-5e8a1a8fb571", "comment": "Malware payload", "value": "48683a3e26190bbf52e80cf8d5a20056de2694ca5ce6944f73e07f6b696e4dadf4ce41ddf122824dcfa8d2e596f6ddc5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285736, "uuid": "a51de3dd-9832-4570-bbc3-8680b1ee9e67", "value": "T12737230B9E633D6E883C61B590992B4FC8701D1CD501E7CD85A114E8CADEEADE05F7BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285736, "uuid": "2a0ecd18-4d5e-4ebf-a0ee-8055cc118abb", "value": "49152:4AhlW7AhlWjAhlWZAhlWbAhlW4AhlWqAhlWPAhlWDAhlWfAhlWNAhlWtAhlWlAhn:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285736, "uuid": "3b5edae2-4492-4f4e-b37a-4c11db6b223b", "value": 22903922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285736, "uuid": "8a824367-cad6-4320-bd5d-2d08d5ed955c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285736, "uuid": "ef804b71-52d3-4999-aa3c-4ac1372e2583", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53315993-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276042, "uuid": "6138f1c7-f51f-48b0-86e2-64836837572a", "comment": "Malware payload", "value": "852343ee252149d62ca45439ad730810", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276042, "uuid": "2d7ace01-b59d-4f3a-822a-e3bd3289dc04", "comment": "Malware payload", "value": "066dfba61e199fe20676065a451410cdae0a2a7f848a28e4499ca98b90ff4c4f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276042, "uuid": "f8d6ed35-ea89-4beb-90a8-fee514247294", "comment": "Malware payload", "value": "6b7ef2fc89bd31228610768ae74edd0441c167c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276042, "uuid": "4a58f38f-5fb5-408f-a2d5-d55470dfa5c2", "comment": "Malware payload", "value": "d570923181ebeaf2ad88d00329a6a619261d4c1b212ee17e7575ecf398d523c43fbef4da43d25fb8dabfae6c1d2d2ec6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276042, "uuid": "ed5b8ac2-a380-4a64-89cc-52761ff435b9", "value": "T16F372200CD4A1F6FDBD8631D08742F4D2BDA4B75794DBAA003E9726F879AF790406AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276042, "uuid": "19f9f583-bbf7-4a78-ac79-4e8cb5ef53b0", "value": "49152:KvyLvyQvy6vyXvyXvyZvyXvyXvykvylvylvyly9zZvyevyFvyrvyTvyQy9zOvyrD:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276042, "uuid": "040aec1e-a239-4229-895b-a56c31fc3a86", "value": 23424190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276042, "uuid": "e3d8b63a-b96d-4947-a0bb-5349dc438b0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276042, "uuid": "d07648f3-54b7-4bde-bbcb-f82a22795805", "value": "invoice-1645080830.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9ee437-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777291652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291652, "uuid": "a3b03ae5-fd87-4452-a4c0-64808c0dcfb5", "comment": "Malware payload (Mirai)", "value": "7f88d2c1d3b69be12442f0f940a4a08f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291652, "uuid": "1aafefb3-a739-4a5f-b9f4-b5f5941f5a8c", "comment": "Malware payload (Mirai)", "value": "06d0cf11f50ae7491c7eb30c9fa5b6f97babd2630ce0647ce8d6b1b8b12aef0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291652, "uuid": "ea9292fd-5b9f-4176-9419-6a19de28cdd8", "comment": "Malware payload (Mirai)", "value": "b084a5e0d82b76b9e852cd1047f6dd2127b1dc05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291652, "uuid": "5b12a757-c20c-4478-aa71-0d8736e6a9d8", "comment": "Malware payload (Mirai)", "value": "6396e822f60464ea6f6fd1510082cfa21d485e9096c1a5863a4ba3b7aeaf520ac79221b62eb04892ba48cb29945e909e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291652, "uuid": "fc9e530b-94f8-40a8-a8de-d7e53c6c7fc1", "value": "T163E31945FC415F23C6C612BBFB5E428D3B2A17E8D2EA32078D215F21379A95B0D7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291652, "uuid": "e5f90d63-e488-4951-afe5-b91d0dae78e5", "value": "1536:KcMpvUKzjmSDwZEqZxWvWdTGs7G/dC2bEUt4VMtO873N49ILElFuwywNmaPYHpbW:KcoqVFUdCV648O8q9IuYRLp0HAcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291652, "uuid": "e361101f-6495-4a6f-b820-e293a87640b4", "value": 145984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291652, "uuid": "18f238be-c6c5-4497-82f4-42586ea2302e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291652, "uuid": "f0a90faa-6ff6-4388-8829-c8c508c858ca", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36874041-4225-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777286302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777286302, "uuid": "87173b61-03e3-4739-9a58-09fcee4adc8b", "comment": "Malware payload", "value": "a0373df8eebb345eb5e373977bcc64d1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777286302, "uuid": "e0e93aa1-dd60-4f5e-9590-e4cf8eed1911", "comment": "Malware payload", "value": "06d15713defdbf91ca14f00fea126bf773b3df2020a90fdb8c3d1222d1962a84", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777286302, "uuid": "0d119a7c-0378-4610-b903-7d5fa1dd01dd", "comment": "Malware payload", "value": "db57002304cfab4160d95b9953a80a5d850c75e4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777286302, "uuid": "b80b2657-59a6-44be-aa30-42019fed89c4", "comment": "Malware payload", "value": "08b1d412e2f54e0a1b30614ec168da7ddd502fc6f226b24a53262017805e98d7aa8892f826f6435524e42465d45c6e16", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777286302, "uuid": "b2a5afba-a944-4cb9-ac2f-1e7debe64899", "value": "T10FB2E71AC814AFF00A6F6162DD572C468590032566387A0EB5CE9AEC3F79365CFC52EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777286302, "uuid": "5d76abbb-70a3-4d4e-90e9-deeba237c21c", "value": "384:Kw46kDMThRRABrhYHQtI3X9CCI/lLzJq6rTz0CddEXViQNyFQC5CvuRabW:KB6kgFRKbQgOX9CLdLzr4CDELNyHKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777286302, "uuid": "0e2659f7-3e48-4d4a-a55d-c5e063ffd74a", "value": 24571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777286302, "uuid": "2b706fa7-5a7e-4bcc-afdc-af5631c4baa0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777286302, "uuid": "69bcc6b7-ee2a-408a-8efb-e13099763958", "value": "920130.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6312369-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276208, "uuid": "8989c8ad-8cbc-48d6-a1d3-f7d89baa3db7", "comment": "Malware payload", "value": "66944a5cf820d2c648fe8f9ce6b3e99c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276208, "uuid": "0e0c1784-d24c-4833-9233-e0a40d1b6a11", "comment": "Malware payload", "value": "06fe5fa6e4a049207dc033c049ec4036323427a81cadc7c29eafee740ec3884a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276208, "uuid": "7d71196f-6d8d-4108-aa4c-d7e4c5f75b42", "comment": "Malware payload", "value": "cfe3a8f8b7c3ebd7134236c0cc69a3a1d5360706", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276208, "uuid": "a565e030-e9c4-4d8c-a9a1-6a306500b40b", "comment": "Malware payload", "value": "48451de81b12993f06128fabfd4e543858ff828b7afb01267df572d1dc3b392be049072255592a8fa008f709607b65e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276208, "uuid": "d9d3caef-933d-4ccd-b960-98a9583b9b38", "value": "T15837230C9A3A4B3AE9BC65AD18AE5B8F4FC94954A411D7F3FFCA6D4F168A10C1DC3214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276208, "uuid": "cb337581-5e4b-4f21-ba20-a825f4ce6a9c", "value": "49152:tCOCdC2ClC/CdC1CiCsCHCsCpMACMCPC9C9CVMbCDCFCqC+C0CwCZCTCICGCACcj:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276208, "uuid": "3fb22f6a-dd3d-4f35-b87a-203e4efb0f54", "value": 23424220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276208, "uuid": "f3b435d1-732e-4d6b-88d9-eecabbd6437f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276208, "uuid": "becd1a33-1c8c-4fa8-93a4-ccc6792d44a2", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff85ef54-426e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777317992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317992, "uuid": "d0f43527-85d0-452d-a844-61b87708ca75", "comment": "Malware payload", "value": "4a19951704cb123793ecbb4870b33066", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "maconecli-gitlab-io", "colour": "#DEE4C2", "exportable": true, "hide_tag": false }, { "name": "mendalik-com", "colour": "#11D539", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "SHubStealer", "colour": "#C8ACD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317992, "uuid": "32c1e6b6-e56a-46c8-83d9-c4a03727385c", "comment": "Malware payload", "value": "072685679e7fb7c40cb73cb549512f274dec69cc5972f086356ccc5948825bf9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "maconecli-gitlab-io", "colour": "#DEE4C2", "exportable": true, "hide_tag": false }, { "name": "mendalik-com", "colour": "#11D539", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "SHubStealer", "colour": "#C8ACD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317992, "uuid": "21e1f03a-c3d0-4242-8f74-aa9bd1498da7", "comment": "Malware payload", "value": "becc126467106092e00705c4a690e3b1ee46842b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "maconecli-gitlab-io", "colour": "#DEE4C2", "exportable": true, "hide_tag": false }, { "name": "mendalik-com", "colour": "#11D539", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "SHubStealer", "colour": "#C8ACD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317992, "uuid": "86297ba3-5cac-48b0-b00a-d6cd2798c15a", "comment": "Malware payload", "value": "d4dfc1025c377037c3bc8c8f9e0bdcf39358287446c496de77ce41f769273e75de6b7b5f19ea1e133d20088fac51887d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "maconecli-gitlab-io", "colour": "#DEE4C2", "exportable": true, "hide_tag": false }, { "name": "mendalik-com", "colour": "#11D539", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "SHubStealer", "colour": "#C8ACD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777317992, "uuid": "634b818f-9bac-4501-8ca1-eaef71b900b0", "value": "T137210A2908D11762D0A40FF4FE33B7A5D8CA0728C40CE288352A652D082409492F3371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777317992, "uuid": "9927377f-1777-4c62-bc0c-a30a57ebea79", "value": "24:ILh/sI5QcN01qQdPqdCZRf4fC1A2+SP8OV2Jij835ta199RRbzR:ahEaNSDt7nfQC1A2+Sr2R35w39RtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777317992, "uuid": "eb4702a3-762e-469f-9587-2dff39352c26", "value": 1197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777317992, "uuid": "71b8c345-6f0c-49c4-8269-05bc95cb32e3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777317992, "uuid": "75a4e5c5-e13e-428f-afdc-77d8b8ac0b19", "value": "loader.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38db8a11-41d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777253664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253664, "uuid": "deeb1336-ffe4-4523-a4b7-00aee1727434", "comment": "Malware payload (Mirai)", "value": "15eed769de2533baa310ae625ba88af9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253664, "uuid": "683ddcc0-7928-4399-9619-eb109156c328", "comment": "Malware payload (Mirai)", "value": "0753aafcf245bd9048d0e3495175aa377dc24b606d5a6422020ce651d8a7472f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253664, "uuid": "b5db40a1-1674-4de1-9a54-fe79cd7908c0", "comment": "Malware payload (Mirai)", "value": "03dbd764deae9951c86931113cb234d9bf25981d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253664, "uuid": "59d6fbe2-1555-4673-8bba-e9caabc81c1c", "comment": "Malware payload (Mirai)", "value": "017780757db2099ec1187211b7ee182afecbac94026fa20be25e22cc0a7e53acc3dd77fae2180dfaea4cdae568b9978a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253664, "uuid": "c8bea4bd-bfb2-4692-a76e-196321daf7cd", "value": "T13C258D2AB2B2B2BDD017C03447DBCB715532F0755A312DBB22C4DB343E9ADA41769B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253664, "uuid": "7d5da305-4d15-457f-8b4f-238b4c1c53de", "value": "12288:6+yFZfNgSafmVSFd9HTBcz8L5/wxcoVIkEwsUK0cKAgayE2f9SHXK7mxf+eBZg:9ybfNg2KRmZ/BK0cKfzGf+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777253664, "uuid": "f8794295-8460-4d7a-921c-b01192181be9", "value": 1000600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777253664, "uuid": "1c28eafe-1ac4-4e6c-93ca-a3abb88fbc71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253664, "uuid": "7a07ea70-7486-4c04-bba4-09afd648013f", "value": "SecuriteInfo.com.ELF.Mirai-BTD.18936311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361048f0-4200-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777270409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777270409, "uuid": "dc2ab7c1-8b30-4293-ae2e-30290fc1ead5", "comment": "Malware payload", "value": "0ff6abe0252d4f37a196a1231fae5f26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false }, { "name": "OT", "colour": "#FA7F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777270409, "uuid": "ae2c697a-f8d7-40fa-b225-4aaed646388c", "comment": "Malware payload", "value": "07c69fc33271cf5a2ce03ac1fed7a3b16357aec093c5bf9ef61fbfa4348d0529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false }, { "name": "OT", "colour": "#FA7F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777270409, "uuid": "80dd28ff-3873-463a-96a6-2226e2026867", "comment": "Malware payload", "value": "92e9dcaf7249110047ef121b7586c81d4b8cb4e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false }, { "name": "OT", "colour": "#FA7F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777270409, "uuid": "254872fd-61cc-480d-a63f-66292be7e1b7", "comment": "Malware payload", "value": "2a941bd0b52cafdc784b5fac2f9252983f8f7f0df3347b385100a76ad40fa8377a4c7405fa0fa13c46a826c44778c8fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false }, { "name": "OT", "colour": "#FA7F30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777270409, "uuid": "ebc62612-bcfc-459b-a83d-ba6e49668c5d", "value": "T18C13FB95B7C64812ECAA0D30DACA2331B7BBF4053E5B4F03525913AD1E577817E9AF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777270409, "uuid": "5b1802b6-25da-4516-9cd2-9112aa47bdde", "value": "c8bf06793ceb6bc97d4c171ba233a333", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777270409, "uuid": "fbf25140-61bd-40ec-b7f9-0ff0705bfb55", "value": "384:sdSiaLb/N8c7FX9X7vnwApsb69uGENx9uGENvisRj3aOf7JhpIHohwIHuENv7i6U:sIF8c7Ft73psb4nfV/IHkwIKPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777270409, "uuid": "9fc19823-385d-4182-80d4-42b4d0854091", "value": 44580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777270409, "uuid": "c04da949-15ff-4263-9a56-48ea7c658064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777270409, "uuid": "cd0aaa92-3f59-4eca-a26e-a041dbe32b82", "value": "07c69fc33271cf5a2ce03ac1fed7a3b16357aec093c5bf9ef61fbfa4348d0529.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904e952e-422b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777289029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289029, "uuid": "80075f17-4035-4ae7-b5dd-4227fe65b269", "comment": "Malware payload", "value": "d8f4dc8f9b6a8ef713ea7778750887c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289029, "uuid": "b57faa67-6b65-4abf-a0c5-176d0f46ecdd", "comment": "Malware payload", "value": "091f853ac25e57906556f9b126221be7039479f9018c87c6241613d2f8a0a7c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289029, "uuid": "77f181dc-42ad-4d6a-9411-f0efee5cc31a", "comment": "Malware payload", "value": "cb95366aba602b55ec3ce044eaa93321c565a69c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289029, "uuid": "35ebfe2c-67f7-4623-bc4d-871dc488e59f", "comment": "Malware payload", "value": "b80464a34bef87707be8a56c5a443536baf2f7bb92c2ff661ce2f62ba41773a23f206885ed7677e531ffe2f4605c8f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289029, "uuid": "65001c0d-5def-4895-8677-524c70a30cbf", "value": "T171651263F7820A8ECB79153D22C1AB4686DB0C2F59F21CCE046368E36D5E907D91E6DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289029, "uuid": "385cee3e-e022-4bce-aef6-01e757525891", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289029, "uuid": "e5be96b1-2bed-4676-8fd6-8bf7985a5189", "value": "24576:hRQLK/5ekCQU8eEscqva7WPqp+jskREWsgLmPdCA5FEL39IdJe0f/uvr4nChA:w2/AkPtFsbvaWqp+w8mFCA5FET9Bpz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777289029, "uuid": "486fc1cc-2e44-4be7-b6c5-3fbab8e2babe", "value": 1498112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777289029, "uuid": "e6f10cb0-d79c-4a07-b651-51b71c032cb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289029, "uuid": "e4fe8e61-24e1-49a6-9ca7-2b3f62bcb031", "value": "ky2t20mu.az3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7040ddd9-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280386, "uuid": "203896d6-117e-45cb-bf8a-6d92632a3cbe", "comment": "Malware payload", "value": "23351e01b04cf15e043a9703c03b0576", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280386, "uuid": "83b4f6a8-a1bf-4d6d-bef8-86751bda807e", "comment": "Malware payload", "value": "09d141ab72b26a56bb6f0c89523b051ec39b61541e0ac2f0aa5daebfb4dd6b73", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280386, "uuid": "233c2e3c-99bf-44ea-8fda-239278fecf74", "comment": "Malware payload", "value": "0dfd9a6e0ed53d20705ae7aba6bcfadab493a6ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280386, "uuid": "cbf8d9d3-f9cf-41b4-9458-65f3d538b3ee", "comment": "Malware payload", "value": "3db50c18cbb6a367d5ad5fb07ee0ae4256b0e44814d222f15d08f3473f1c7bafbb6ffcf5e5723bed2a03f69a1c9a33a9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280386, "uuid": "5b6da878-a886-4d42-8885-0bdf02e37e78", "value": "T1CE372302AB7A5C9F44BA8630247B6E284FE1C34C942AE7E0535AC54E47C5B578D2EF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280386, "uuid": "1fc1c6cd-aa35-4a0c-ab1a-42b3741c4180", "value": "49152:AlElslwlQlRlPlflyl+l5lYlK1YSlXlVl+lylJ1YZlslil5lllqlKl/l0lrlwlg6:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280386, "uuid": "1214fa8d-35ee-499a-99f8-9d52c92b4a23", "value": 22383682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280386, "uuid": "a3687fb5-6e82-4c25-8806-d08717b3c734", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280386, "uuid": "8dfbc635-b9d9-422c-bfef-4e8979aa7652", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac130479-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284351, "uuid": "9d98dd5d-2348-4ba3-8722-a85e670fb9ba", "comment": "Malware payload", "value": "60beeb520cfb7bd68454e7b4e483ec71", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284351, "uuid": "6336032a-dd80-4562-9cc4-25b97d82e452", "comment": "Malware payload", "value": "0a8774c9b8b7d98446b74202dc40aea0cfe568f783194f1d453bf77753b02854", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284351, "uuid": "f90cc5c8-925d-41dd-86c4-2c13d3ecaeba", "comment": "Malware payload", "value": "e5d93fc140160cca16bb2b794e32228b6994ea94", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284351, "uuid": "7ef3c926-3596-4931-bd96-7e3dc269f080", "comment": "Malware payload", "value": "3f34ad594380949a6da4b05a05f024cc9ea1982f3cd1824c3223da23db7111a59d15760027725d8dac32fefdd262f590", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284351, "uuid": "e7bd251d-45ad-4e0b-abbc-23b916521e3b", "value": "T1CF37225E0A336E2B09D1647D74BB09027ABD5E84CA1937F2B3B42D35635DF1D003EA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284351, "uuid": "0ad06b5d-87ca-478e-8350-a8b28f62120d", "value": "49152:Bp27ap27hp27Fp27fp27Kp27Yp27Lp275p27zp27Rp27jp278HFp27ep27sp275P:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284351, "uuid": "68aaf244-58d8-4101-8a14-f54bd09d2182", "value": 23424208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284351, "uuid": "3dc24e51-eef6-4c87-a2cd-ea4d62e61046", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284351, "uuid": "37ec8e40-d8d9-4067-a05e-c0b5dbc6c35b", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949e9c61-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777291613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291613, "uuid": "0de29ac8-1db9-4293-bbcc-f31309e61e56", "comment": "Malware payload (Mirai)", "value": "073cdcfdda3c8d7915f2c541d972fdcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291613, "uuid": "bdea2622-ef3d-4966-8216-56d3c4ebb138", "comment": "Malware payload (Mirai)", "value": "0bd30e1a4bd760717536bb70bd4f8abaf585819a8f7ee92a63cf5cb269108ec7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291613, "uuid": "da2ff1f3-8721-4fbf-b331-4fa1c0db52e1", "comment": "Malware payload (Mirai)", "value": "f44fad5cc3205666cb9014ca39991000d033ce34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291613, "uuid": "cf808610-a41f-44be-94bf-d3936f5c0200", "comment": "Malware payload (Mirai)", "value": "215205374370a148c21c2c835dd985fa2c1d18b40ea181a1417f6e33da025e71fdbf53acee1bfdfa3a5a9d5507a6bde4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291613, "uuid": "55b72d12-9422-4038-a207-5455cc77fc5f", "value": "T1453302209F54449BC049D4F52FBC2F214A790E89F5827946F4DAD9430D87A9C33BB9EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291613, "uuid": "3c09051d-e1fb-49f5-81b2-f4b04e181275", "value": "1536:RpEKBtQY8NkO5R+SxjHy3f5eviEdmXPpHf1WOsKSXVJut:3RB+Y8NkO/xG3fUBWHfjSXVQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291613, "uuid": "f963c939-2ecc-4f22-905e-3fe36827c773", "value": 54928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291613, "uuid": "9f6a8b40-3c46-4eda-af5b-69154eae2111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291613, "uuid": "dffce83d-b028-4fe2-88fc-4e58db9652c8", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bc816d-4204-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777272070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777272070, "uuid": "d7a05fd8-4932-492f-ac72-fd2bf12228e1", "comment": "Malware payload (Mirai)", "value": "2de3835bc11c006b54f7b8637cedcf71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777272070, "uuid": "12f7ca67-330f-4bde-b8a2-c20ac5408dac", "comment": "Malware payload (Mirai)", "value": "0bdd6e94c14556ace9c10f239251ae409737783725fe0d1664235c3cdaf48b04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777272070, "uuid": "2dd6dd3f-ac67-49df-bfa1-1c01600242a1", "comment": "Malware payload (Mirai)", "value": "df2a513b593da546c2ffc1d153e0f68d4bef076b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777272070, "uuid": "634287cd-d776-4cfd-8131-61878e7f7165", "comment": "Malware payload (Mirai)", "value": "01fa2d6022e0cab07d0551eb7d6aa72ebfcd663f8d5fb0bcface44a65300702d278ad39ef536dd171235a6cfffd2db50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777272070, "uuid": "a49e7c9b-aff4-4fc5-acb4-6f626354591e", "value": "T15FD4E64B6E328F5DF674C6318AB70925E76833D723E18685D1ACE5205E2068F941FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777272070, "uuid": "cf99d96a-067c-4cb8-ad10-cbc2c264ff25", "value": "6144:SXkr8V6DJd9nhzqp9JM4xmdj447BPM5chpTb23cuYEdQMY2wL/H5KpxY8eK6GJWn:SUpQG/dSYEdhYx/4xVeKTJhwqn25r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777272070, "uuid": "6e80266e-a01b-4694-96e4-3a131d85b3f6", "value": 615116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777272070, "uuid": "02f6d3af-0219-47bb-900f-fbfda512f27d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777272070, "uuid": "97f413a0-5354-4fc8-a269-d6f2ca4f203d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c322bf05-4206-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777273223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273223, "uuid": "867cec16-311f-46c8-a8ff-bcb63c37ab90", "comment": "Malware payload", "value": "bd2bd09faf1673639c91550e2c600f7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273223, "uuid": "34d35a25-fbd8-47cd-8f34-06b9527904ea", "comment": "Malware payload", "value": "0be92183c73f8728dafeb363c7c8fa481eb47c06af44fbe0132cd85ef04b54ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273223, "uuid": "90a756ff-1e1b-4b31-9ea0-a8340ea70199", "comment": "Malware payload", "value": "2c924a3204896f28366256b80dc9c4b5413f1b9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273223, "uuid": "dc5df4cb-a612-4fc2-bc5b-1aa79e8f2b56", "comment": "Malware payload", "value": "873527a41425ef8cbf3e1d0f792a6842a2d763dc961423d9a1789c817efd9148d553fccd51b3d6cedf27e97dcd31b3d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273223, "uuid": "3b54cbcf-4d12-40fb-8b29-02e0d448a556", "value": "T1C5B66A137B6CEB1FC228223409F2DA946B695C9201D7A517B385F31DE9F20AC496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273223, "uuid": "08b7231e-6d6d-4290-8fa4-016966a85fef", "value": "196608:/p2o4mspeR4KNEzs/H9PRzDKxquGJq4nvBkT3yj59k/QOLF7:/p2o4mspeR4KNEzsP9PRzDKxquf4nvB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777273223, "uuid": "e6484cc6-0d0e-43de-b885-cd635d8597a9", "value": 10967157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777273223, "uuid": "4d0f456c-fffb-4f9b-aa13-9edb19224715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273223, "uuid": "d7b8ca28-f344-4d1d-b48d-f5dcb5cd3e2e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ba777b-421e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283614, "uuid": "943d032d-51a3-4369-b90c-0a0684371dbc", "comment": "Malware payload", "value": "17905220545e3e48e4df8e0db25b120d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283614, "uuid": "b64058dd-4d4c-4911-a7de-8fec072cffd4", "comment": "Malware payload", "value": "0bfb2f31ddffaa67781b7f56dc4b41004dc9392056a052e40edc84a09d05ba6b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283614, "uuid": "55e87ce6-dc2f-4470-b572-cc9b9962c8ab", "comment": "Malware payload", "value": "f57ee76a3d356a1108c631a1c831f1e681d61ecb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283614, "uuid": "be61a946-8f10-4dbe-bf98-106ef7cca5ae", "comment": "Malware payload", "value": "1c28d075428465d5f72dcd64c1f4be989e6b3c61ccf988040aaa9518f7148e8d40da0f06bb7808f07fe65d000f96eb7b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283614, "uuid": "7d3cdc39-d7b3-48a0-8cf5-96bb060d8188", "value": "T1DF3723774E663F7F8930E2B41A5B0FEE23614485C4C238AB73E61C7D8B7DD89162A464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283614, "uuid": "de3e3027-d0c5-46fd-a09d-e5533831a2bb", "value": "49152:T0d0g0D0b0C0I0I0x0Z0q0X0j0l0U0s0Q060P0K0b0G0A090100070W0c0Q0H02b:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283614, "uuid": "a4cae421-afb4-4ecd-a8d0-7d0b66de0127", "value": 23684343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283614, "uuid": "912cdc94-9aa9-48f3-8d2d-781f74e7e2b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283614, "uuid": "91ad7d5a-d754-4550-a24a-8a77c495617d", "value": "invoice-1645080830.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecbe6b8-4237-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777294154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294154, "uuid": "71a69095-02b3-4290-bac6-d8cdf21873a9", "comment": "Malware payload (Mirai)", "value": "626509bed1679135586e5271b2e8fbe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294154, "uuid": "3a3dae84-6d6b-42f4-a674-ee319866b68b", "comment": "Malware payload (Mirai)", "value": "0d00d55a672af4a017a0fb227a329d130a3818aaf243802a148443568a534c02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294154, "uuid": "19fd9ab9-0607-4104-b36d-14168ce5989d", "comment": "Malware payload (Mirai)", "value": "18d4010c203160c0cf2b8a001839cd18016561a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294154, "uuid": "9e25efae-2a29-406f-bf04-d48db2e995c2", "comment": "Malware payload (Mirai)", "value": "0b71d64ed3fb4fe5772b1d742f5af167b1e772ec60f8191bd30d4bfbeaad1ceb202577b711c41ab3743f2b452f53c4b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294154, "uuid": "e0b4716e-a14e-4717-9bf3-b771eb9108de", "value": "T17FB38DEBF2470190C8624AF007CB4BED3E2322815F27C5E77D6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294154, "uuid": "f7ea1176-6395-4d68-9418-f64a3a7bda1e", "value": "1536:/yEiaWrXxUSpyxOeXLzYeGEhOlW4gwUV/LWf:/V/MBUyYOeXLgEhOlW4gwUVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294154, "uuid": "767132f5-a3b3-43b8-8862-3c25ec3c1540", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294154, "uuid": "6fce585a-167d-4d72-b636-0f0a85b0789a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294154, "uuid": "3b95e77d-4914-4ba2-81a2-7c02d284ba82", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec23240-4289-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777329480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777329480, "uuid": "323380f7-0107-438c-893b-c035bad0a1ce", "comment": "Malware payload", "value": "0970e509827a6b84f9a27e3a35aca2dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777329480, "uuid": "1b85c3df-3e47-44b0-8044-59f8ed02688f", "comment": "Malware payload", "value": "0ede21a79a1be8869ea9f13fe1b6cace588e1724ccba76060cf2ff1e7fedc0d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777329480, "uuid": "da962b61-b412-4508-97c9-21b6fc155e91", "comment": "Malware payload", "value": "1540f309a3f22ba605c8bf0f0102936f3a722967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777329480, "uuid": "f080dadf-2ff2-4b06-afc9-2ac731c4c2a4", "comment": "Malware payload", "value": "6af061d890b8253556382ae4acede40be66963bcdece87990598a6af2938e621be4af98e8cbf21cef4db82d452ffe173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777329480, "uuid": "2f93b73d-780d-438d-b409-0cf996cfe9e2", "value": "T15308331D68788322F9DA2CB625D3B431D75DBA460AB03C1CBE5C80F069E776446BC7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777329480, "uuid": "c617a3fa-4a47-4458-9b8b-a7bdf7421ce1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777329480, "uuid": "41edaa58-82c3-4202-af66-e5af4276492a", "value": "1572864:yt9IKPTzTva/OfyTD6O20sXrUNUPT5Uv0pGXyevMAR7:yUKbzTvtfmg0erUNUPT5UvujevMAR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777329480, "uuid": "7c58ffcd-d6b1-4299-8c32-8a2197fbe670", "value": 77586360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777329480, "uuid": "0f65b615-2555-4de5-953d-34aaef48548c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777329480, "uuid": "09b48def-f103-4f0c-8401-36e730f90e85", "value": "Dreamfall_V11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb76b5c-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280648, "uuid": "04c380d6-d281-4e70-9598-478b69c7f93a", "comment": "Malware payload", "value": "ee741a4f35dba03e4cdaaea8d65b3e57", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280648, "uuid": "100590c9-9751-4460-9148-f3d784e18759", "comment": "Malware payload", "value": "0fe67e768019183b4ee96bd30ccf34f9545e1d30bccff186705674eef47bdb9d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280648, "uuid": "26391b55-9796-4443-9593-7fc4098f88e0", "comment": "Malware payload", "value": "4eacca443ca1a8086ea4a08c3cbfdf18bae9a96f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280648, "uuid": "22eeb32d-c9aa-43d1-b7df-43ae4e9800eb", "comment": "Malware payload", "value": "5d885b4d102fdd1906589943b770d8bb5d1a293516941f77b561ec0541200def17b4c5e5a72524c4d9527cc9861aa205", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280648, "uuid": "edc22fb0-5591-40bf-9166-818022273d98", "value": "T1243723859DFF4A7F83FC6A34AC4A170E26D4BE0540358A5EB7E1BD96F31FB110296188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280648, "uuid": "4c5d865d-f716-4728-81d5-2f2aabd38154", "value": "49152:CDQD4DxD0DSDQD8D0DLDSD6DNZnDrDlDkD4D4Z2DcDADVDXDoDvD9D1DYDWDWDoy:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280648, "uuid": "502e9925-9a27-4001-b4ea-b78c917612d6", "value": 22903942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280648, "uuid": "000e8938-821d-481c-92e7-f27391313602", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280648, "uuid": "740606a4-3ec6-4830-9ba3-f8074997cc71", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d79ee6-41f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777266089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266089, "uuid": "961c3d4e-94c2-4c9b-a7d0-89f916d93978", "comment": "Malware payload", "value": "7987d8f63c8cb0ea0b0ebc6ba006678e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266089, "uuid": "b25e1758-cb9f-4ecb-9267-31628bcdf51e", "comment": "Malware payload", "value": "1076f17e3ddae1510e663e081db50ca035c1340f92ebf22f17d57802a0137763", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266089, "uuid": "09333721-4dc4-49ae-8883-1791b0fe42b3", "comment": "Malware payload", "value": "975cfb7fc1c9a0e570f3c8f753b745da61647081", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266089, "uuid": "f2aee252-dba0-4496-8ce9-449f5d392637", "comment": "Malware payload", "value": "2ef408ce60a3d193ee3b1b076ed16bc33db4986bbbcde68bed107f179c344ad12cf7a920bea38297d459de79f0a91ea5", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777266089, "uuid": "bf4af787-ba71-4356-a75a-21f050d25751", "value": "T1A191189F8AA423831EB6CF596A0D3505DA4C6F0316674CA8A8FDCA52430D43F7A27676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777266089, "uuid": "88004e8c-958c-41ff-89eb-987eb726657a", "value": "96:trceQGtG2ZKEPv8ZRx52Li4w8CtpaemDhBvJ1wVNE/y/:eOKqv8ZRq+8NhBvJE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777266089, "uuid": "915cfd8b-41e7-4ebe-bb8c-dde20225f015", "value": 4379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777266089, "uuid": "ec24ea21-dff7-461d-bcfa-645508e6c181", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777266089, "uuid": "c25301ed-e5ef-48cd-ba98-fa19e03f220b", "value": "1076f17e3ddae1510e663e081db50ca035c1340f92ebf22f17d57802a0137763.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f9c5b5-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284252, "uuid": "ba4a31eb-04d4-485f-8462-5fb1e9cc88b8", "comment": "Malware payload", "value": "3074e06743c70d5e23aedf918204722d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284252, "uuid": "3b09d59d-beb0-4335-969a-4835daf2f49f", "comment": "Malware payload", "value": "113fb63f6edf1d6efe4d04cd7a0df745fde493a0e511d2a8f8e389fad2af9f02", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284252, "uuid": "105c3111-6812-45b7-b5a4-d077b7110247", "comment": "Malware payload", "value": "bd0d9433361ae8e3c38c584ae695f3be5c48749e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284252, "uuid": "9932f424-757a-4556-a6cf-9d0b8ee24ae4", "comment": "Malware payload", "value": "a47ec1c8841d4198eb82575205540cb5f66eaac916bdc2cdd26c2e734763d0961a6bce2d65d1061aa49d6080da567004", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284252, "uuid": "6a765d65-63b5-4a13-8304-04a469f21088", "value": "T12611940800BFB191F40871366D224A0B1CECA068775DE97E4A970F5D9C42282654F324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284252, "uuid": "54a7a40a-3939-4836-bb5b-888d59fca4e1", "value": "24:9fK3oPkwgD3pKbTAkSd4HA4T5cDIycxcIqXZWlGMKBFY:9fK3e0kgzYAY5xFqMKBFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284252, "uuid": "5a108226-c756-4fee-b9ad-5d81373a5a02", "value": 972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284252, "uuid": "888da4d9-c27d-43c0-bb8b-93b68f97f824", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284252, "uuid": "6f522dc5-6ab0-42b4-b658-ace4689c76ca", "value": "111.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9397a486-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285169, "uuid": "fe8b1a6d-40de-427c-84c8-4700f6d71a61", "comment": "Malware payload (Mirai)", "value": "7050e4a9a97631db1a85cd80560698c8", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285169, "uuid": "0389454c-0b3a-4ff2-ba05-22fd16d93ab0", "comment": "Malware payload (Mirai)", "value": "119ed92bd7f59bff2c457eb604c10176fb20640250f51d7c720cb6f252fdf158", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285169, "uuid": "f3129e69-466b-41e2-b6aa-107eb3477f9b", "comment": "Malware payload (Mirai)", "value": "76ba97d47173c26d240d89c21288243f48adb788", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285169, "uuid": "a7b9bbff-53ed-4a35-810e-38cd58f59e3c", "comment": "Malware payload (Mirai)", "value": "5dc009aade807a8543cf134464c4ec51341a7f6c4f6f699113ce7f9b80a78240318ee715b7a549629227300b79ce6011", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285169, "uuid": "df145633-3509-426e-a6c9-3949f3c0c411", "value": "T1E1058D227B11CFA8E314D2B005F3C6A55AD425A21AE244C5B2BCD71C7E6162E2D5FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285169, "uuid": "6edbdcd9-3bb4-4c65-a375-38fab1c4bb7c", "value": "12288:bjUOAE4yxXC2D51oWD2Di0mzCtLJPaeEOP/zSpPDflcUZPUU8pl4AZ8fR:N4yBCY1oFDMmttPaTOP7Sp7dcUZ7AZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285169, "uuid": "23b63258-9f7a-4b2f-ba07-a01014dd8560", "value": 828952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285169, "uuid": "85c7ad43-59f6-491e-8f92-a67683348972", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285169, "uuid": "9a3e4891-c202-4199-8f27-ac67cc3111ab", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7fc861-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271523, "uuid": "f7f0aafe-fc05-497d-bc76-28a775074e6f", "comment": "Malware payload", "value": "f1b55c3d1ff0c79ecbc3fd44bee33601", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271523, "uuid": "c3ab544a-8349-4b66-a10b-54a00fade232", "comment": "Malware payload", "value": "121dc81f895fbc45a9ee8f364264d06d6636808d0825d683c54da985d0db35b5", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271523, "uuid": "af47305b-f3df-4e75-a5af-a4c6bd6f418b", "comment": "Malware payload", "value": "0ea4351b9550ac0a3a3985138f3a4f8bb14eb15a", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271523, "uuid": "35d52ca8-0760-4c43-bbdb-3311161194f4", "comment": "Malware payload", "value": "d20703aff12eb8bf91cbd729041c738f7020aab0a0cdef3ef7ebaf2145563d3258d2867462bd55b51065fbfb10c13ba2", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271523, "uuid": "e9d8eab1-a952-4001-befe-0496b8e92cc8", "value": "T18C3722277FF3A53F0F2C2DA108AF590D95D8D80A4D69F1F6CA50B986E50AC4368AF315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271523, "uuid": "b5af52bb-16ad-45e3-83ed-6e02c82b7440", "value": "49152:fCzvk6Czvk+CzvkuCzvkzCzvkpCzvkzCzvkjCzvk0CzvkQCzvkRCzvk+CzvkPlBl:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271523, "uuid": "a2922c30-cdf9-4e52-ace5-79f776fd471b", "value": 22903923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271523, "uuid": "a1c09d90-6869-4ebe-a60a-7f290a574388", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271523, "uuid": "38c71729-33e5-4d2c-991e-520187ab4b8b", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4864948e-422a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777288479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288479, "uuid": "9ab92c24-0862-427c-b23e-71d5eca2a990", "comment": "Malware payload", "value": "e80282e26d1a4c05133a2b427c67dbfe", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288479, "uuid": "02902639-e122-4930-99c3-55679ce9266e", "comment": "Malware payload", "value": "12565cf9e990d3164f4bb9816b052df1b92376a3dadb7aac9b616b7671c7dcee", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288479, "uuid": "fcd654bd-a788-44fe-8e03-411e7f794a64", "comment": "Malware payload", "value": "8ca033f802581a40cc4c0fcb84833a386b364a71", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288479, "uuid": "ce833348-6be9-488e-82bc-d997dd8dd7d6", "comment": "Malware payload", "value": "608d3e6bc2c4d76dbe39d5525aabeec6ef513716972c3f90ac411cbea1add37aab0195d9c7ea0237b2e11d43ad39d4d2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288479, "uuid": "93ae9067-5d81-4d10-a07c-a88a3672fee2", "value": "T16ED27D56B605C336CA820B35491FEBE48F75AC48CF523106366A739C3E7299036F65E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288479, "uuid": "30c73452-bafd-44e9-b7bb-c776d0fcc2dd", "value": "384:4wareDFGNwcooWGMa2F+vbwvanwv37h3y87K9Le9Mey3M5JC0ioXnmrNoYG+OwR5:HhgNwXUvXnwv37hiwKc6eWMbCRiN/nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777288479, "uuid": "ba1cfda7-3daf-436d-8b50-8d699132b65f", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777288479, "uuid": "9b3e8d24-6a9b-4c8a-9d82-927859d6ec59", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288479, "uuid": "83bd1e7c-83ee-43e3-828a-751438a8c807", "value": "nssm.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec4efda-4222-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285215, "uuid": "4ee99487-a880-41a1-8067-454552e4cc1f", "comment": "Malware payload", "value": "749845b1831c407168034adc6657e78d", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285215, "uuid": "226f1068-19eb-4fb1-9193-0553dd8a528b", "comment": "Malware payload", "value": "12e4cf3c4de7423dd23ef0c5ccffb679c81e3c3665fa732133a4face9fa0a72d", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285215, "uuid": "956a94c6-af54-4913-9703-4f69dabe4019", "comment": "Malware payload", "value": "1bbe8cd00aa381303022509f1f532600c4b27801", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285215, "uuid": "11f825a8-4066-422a-beeb-51b76ffd0a3f", "comment": "Malware payload", "value": "d203f635fd75c6d5cc7a34d69248f162372c96e0c7e3c2df702f7cdca4988d2f6daa6933f9e8ef6936923c33ebf87b11", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285215, "uuid": "648b9be7-b587-42f0-a398-93d3f7ab995b", "value": "T1E6133B1AA34354FDC20BD17446EB6733F932BC7346219E7F1AA4EA751E10E506B2E628", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285215, "uuid": "023b64c0-273d-48ee-b4db-80c07fd21eae", "value": "b7db2c1461db7e22f93080e8e113775b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285215, "uuid": "d1df5e01-0420-4e94-98f2-0b51a77ba950", "value": "768:kcab8eeZJypDOua/SAA/u0xsm2uRxcZUNzCXu5uvo1bXgb9:Vab8NZUExSJbNUON0uUvoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285215, "uuid": "cd31be86-a591-4530-989e-2285aa312706", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285215, "uuid": "6f469979-68cc-41ef-ba55-fe264d1ab776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285215, "uuid": "64ae9781-4ead-4dd0-9831-40543e431b13", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556547d3-41d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777250276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250276, "uuid": "b2a5f4dd-ffd8-4ffd-b194-1f3e77db88c7", "comment": "Malware payload (Mirai)", "value": "0130a41950e1a3f0e1d26665c8bb21db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250276, "uuid": "635e0395-226a-4a1e-83d7-98c9670f0dd6", "comment": "Malware payload (Mirai)", "value": "12e635b297dd8b8dd20a58b7c57fd87343c6724a75eadfe255ef181732022b98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250276, "uuid": "53e4eb91-c14a-4c8a-bf0b-b1a362fb8edf", "comment": "Malware payload (Mirai)", "value": "c0fd1857d7c74ed6a3a7d7e79cb95eca2e03118b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250276, "uuid": "55b339b8-a0de-41ad-a780-d3fffce0a4b3", "comment": "Malware payload (Mirai)", "value": "5dc9b966ae69a473b68e9f755305fe09497f9bf4c936915e11fa90d59617ac58bb3c7f1dfd6919dcd8a195e399bdbd28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250276, "uuid": "d79bc26c-da17-4bbf-82ac-9ae1612862b6", "value": "T133E43A56F880DF62C5D1257AF65F8268731347B8C3EB720689198B383BD786F4B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250276, "uuid": "db47efc4-c6ea-42e3-9b0f-f896738bf69e", "value": "12288:CdJrqyodzeTt9Tf9b++fI/9RHwMz31ogpkIt0UsSo4ziPd4lqZ:mqyodaTt3+F/LH1zlrqUsStzi14lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250276, "uuid": "d2be9fa9-1366-4267-a5ff-c043d3a2f525", "value": 667444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250276, "uuid": "206ed189-dcd2-484b-b484-db71c3af0604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250276, "uuid": "cb61993d-db3d-4863-a19d-ed1bcec7be7f", "value": "SecuriteInfo.com.Heur.16386.8332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b130af8-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280699, "uuid": "80428a7f-06d9-4dd3-8561-5e85e93e2f3c", "comment": "Malware payload", "value": "993b0b994aa2b853d496918af9ab96fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280699, "uuid": "5d9630e3-8787-43af-89b6-a12ac0751c47", "comment": "Malware payload", "value": "147a564df7f44c0c48117a5a290963e2c8e105dd4dea3268129e9d3f602153b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280699, "uuid": "8d7829c0-6477-473b-aaa3-117a84f8c4e0", "comment": "Malware payload", "value": "fbe906491ae6cbbd42ddf51252ede06038d844a7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280699, "uuid": "62ca58e0-4f9c-41b4-b603-9396a0c19e55", "comment": "Malware payload", "value": "331b07935118ea52f741303f60983f614221b1b930a3a0363b5876933d653286bef164a2761f3155a6e6d7b8d215c98a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280699, "uuid": "fc2eb239-5e77-471a-9296-4cd6b402a447", "value": "T10A37228D7E68AD584369206C5486CF0FD6DDCD8C1492EFF637D23CE1572A80AF218A6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280699, "uuid": "27377700-ec2c-4b7b-a7af-a92919c7b628", "value": "49152:gZV/ZV0ZVyZVcZVjZV1ZV2ZVWZVQZVcZVEZVmJ7ZVYZVeZVJZVpZViJAZV0ZV/Z9:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280699, "uuid": "c961138f-b631-42d0-91c7-4567cb170b23", "value": 22903937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280699, "uuid": "214ced36-83f1-4c8a-aa17-42f56564f85b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280699, "uuid": "f27329f7-7b4f-4ecb-a174-81e8d33229a2", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010bb358-427b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323149, "uuid": "aa552310-c5ab-4028-b489-068ea1cf61ca", "comment": "Malware payload (Mirai)", "value": "fd9e025b6c7c2a5f813712ebee90ebae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323149, "uuid": "280e12da-8406-4dce-b84a-6b11993773bf", "comment": "Malware payload (Mirai)", "value": "14a84d3e313b628be5764ca0d88f2680a4a083ef255dc22bd33f825a773cead1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323149, "uuid": "974237bc-a931-4c63-acc5-85d1eca129ba", "comment": "Malware payload (Mirai)", "value": "efc6d30518905f33d4c6a2f3b06063a70c7bec08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323149, "uuid": "0ccce7d7-1632-415c-a46d-99c4c8dd99f8", "comment": "Malware payload (Mirai)", "value": "efda36e5286e4a6124144999a2ecf7f16d3570b3f19fc57db4a70ed2bffa30b27e12c539f9b4b21d5afba12e6ec7b96f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323149, "uuid": "2b7494cd-fabd-4701-983c-5880af47408b", "value": "T13F834B0273580D43D1675EF02A3F37E5C3EBD59111E4FA89660E9A4A81B6EF3158AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323149, "uuid": "5740fb07-0994-45aa-a10a-5a4737565315", "value": "1536:pcV1nMuVe5BNppp8O6Fy+wmC2oyntcTu5:pcHZeBReFom/ou5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323149, "uuid": "f6cc3dc9-df90-4535-8b1e-7eb23da3f0af", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323149, "uuid": "d345bfe5-6260-4f31-9b1f-463dd1ffe1c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323149, "uuid": "bc34c9d8-fe49-4a42-a7a3-047ead98361d", "value": "vaxstresser.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c524ea20-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323048, "uuid": "25b1c494-3f74-4574-82b7-30e1c67cbfdc", "comment": "Malware payload (Mirai)", "value": "94a7e95c232f0b5c5f6698f082881292", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323048, "uuid": "c9edcabc-227a-4d8e-8220-7ddd8293fb36", "comment": "Malware payload (Mirai)", "value": "157ec2205a2b31abe647f4172a21e9a4fd3095f0f7c635aac6de7207ac268273", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323048, "uuid": "a233bcd5-37cf-4711-b637-4dff36e04be8", "comment": "Malware payload (Mirai)", "value": "f46303ef089baa5bcfd457620545f42051a8d2ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323048, "uuid": "d7f567f0-f83b-47cc-90d6-eb49fbcfcaac", "comment": "Malware payload (Mirai)", "value": "7a4ea9ca13951ea2cd4a9f7e9ac70292f65efcf3a0862908cf30933a0ed04ca71c5f771fea4c04e94e8e975eef0234db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323048, "uuid": "f970f4f0-50e2-4da8-b3ca-11de6b859dde", "value": "T1C7739E23CCA61998C25C42B8B170FF3A6763E91056536FF6059BCA7AA047EDCF8053B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323048, "uuid": "e72ecaab-90e1-4509-9130-4d5d20b828d2", "value": "1536:9/P/lVA7lTCiQbizKIJCk74Y/dAC9CM51UzW:9X9VUMiQbi2IRx/dA9+SzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323048, "uuid": "d0222c25-fd58-4057-a04e-95334dfaadb8", "value": 80376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323048, "uuid": "9cadeccc-4cfb-4eb7-93e5-ea30fcdd65b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323048, "uuid": "35d4f3b3-911b-4772-a812-11b8ad743897", "value": "vaxstresser.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e754321b-424a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777302490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302490, "uuid": "ffcfae76-bd60-4b2a-aaf6-3e4eed762198", "comment": "Malware payload", "value": "44ace45679a7f776442268a3b97ea164", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302490, "uuid": "5b5c3228-ef30-4191-a8a9-854ce4c2822b", "comment": "Malware payload", "value": "15b5eb73b69a3a8356bdb5200be3b3f352384147e8197c6ba7165853c0dc7e11", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302490, "uuid": "76506ae1-6a14-4462-a4bb-dc793bd96d98", "comment": "Malware payload", "value": "d9f7a9d665799307bc1a90adff4d26122bbe859c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302490, "uuid": "42f42a26-e1c9-4d77-8583-108def814911", "comment": "Malware payload", "value": "28e03e318c5e7de8470768d49692cfd62724fc6170565aaf128cb603c1ad71df3359b9236b3b04232567faffe7876ee8", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302490, "uuid": "2687c70d-38cc-4dcd-888a-59bbb68f34fe", "value": "T14D2110897AE6A722C5724F184E46D294C51F123620A7250077EC8341FF7869FC669BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302490, "uuid": "097d3d27-0b5c-464a-a3a7-71a84d822d74", "value": "24:2XTody/GELm8hLNnLak88WFiOIRIbj23OA5WQxoUWTV/0LjnC3:2jodKGYm8FNLVWSinNKWSWmnC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302490, "uuid": "80ec34a3-a3ff-4ef8-bc98-b198cb3dc983", "value": 1374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302490, "uuid": "702c89d9-37bf-42c2-8564-0107312a8313", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302490, "uuid": "e3904d12-2ea6-4e6c-872b-d8d4400fa8ec", "value": "2p1spxpm21d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69db9cb0-41fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777269637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269637, "uuid": "4367ee66-516b-4104-934b-7005403a14bb", "comment": "Malware payload", "value": "52896876f5729d551a5a954e2c319435", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269637, "uuid": "dd9a2b3b-74bc-479d-90ca-c30a325ba392", "comment": "Malware payload", "value": "15c4dcc2250d24b24cf388f73bb679dc0eedb18a30759e5365404eb9531a8d20", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269637, "uuid": "5d354ff3-11c3-4ed5-ab50-4b7863342b90", "comment": "Malware payload", "value": "3948ed1bf2102768d95c85cefc9f9541828af375", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269637, "uuid": "e342cfd5-ff5b-48f4-9f3a-07c9c58d3c99", "comment": "Malware payload", "value": "503e1336166fec9d182c2ba99dad71c821ec18de239bc8ee6d9892b1ee48fbccfd9f566059a1eb6e71b3c64d7e11fb2d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777269637, "uuid": "7fdf4148-553d-4870-8492-044af30bd8c6", "value": "T171137D6966817C24AE9988371C7E2F0CB9A9C3E1310451EDBFCB3CF58C59A9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777269637, "uuid": "dd9cb216-9e9c-444a-aacf-cd88088487df", "value": "768:bm++9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bm+rco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777269637, "uuid": "4b388c7e-9ab3-4ccf-9eb0-326dc0e7907a", "value": 45428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777269637, "uuid": "5efd2ad4-9abe-4723-a2a8-c8142e46e283", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777269637, "uuid": "1f2939bf-a26d-493c-bc21-9a4edbb24b1f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a9440d-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276051, "uuid": "5cce010f-82b5-460c-8b14-c6f33386fd3f", "comment": "Malware payload", "value": "d3abc41798f8838019f0a8c63a780591", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276051, "uuid": "edf932a0-6856-47d4-ab8c-f66a77e89b92", "comment": "Malware payload", "value": "15ea5c913d6cc79d2ebb44511c6e848cebd577e2a3844f7503e9735c4416cd8e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276051, "uuid": "74bd25d5-242c-4ae3-b946-2647e2da735e", "comment": "Malware payload", "value": "d9eb70a051c0e75b0d7396c4dc837c0ff0068d17", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276051, "uuid": "effbdaf8-f9f6-469e-84e0-0e0aacd95504", "comment": "Malware payload", "value": "ce64b490839d94e40b439345e83d35a6c70e33d249c6d9a362ff538fe3c02fab4583e4d90d052090a02caa5ba09482c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276051, "uuid": "1b9a2e81-f2c0-41a2-ae3c-326f963fb10a", "value": "T1AA3723424DF8EF7DA1F40D5C180D2EE5DEAE870586A998511AB7A0CB270AF5B10F633D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276051, "uuid": "edf6b95e-322e-4ae2-a691-6773900925ca", "value": "49152:B5Hwv5Hwl5Hwx5HwK5Hwi5Hwo5Hw55Hwe5Hwf5Hw/5Hwo5HwSE1PD5HwO5Hwp5Hr:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276051, "uuid": "07a7f93e-d42c-4fee-8c0f-759d42c12798", "value": 24204584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276051, "uuid": "13aee561-af89-434f-a876-6b32e63687b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276051, "uuid": "f3263a53-55fe-4e40-8fe2-38893e1581b6", "value": "invoice-1645080830.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be70b6c-41f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777265346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265346, "uuid": "b3f411b6-8a5b-402d-8d55-099fe26531a5", "comment": "Malware payload", "value": "9fe76fadb0fda6b0eabd48dff9bd5d9a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265346, "uuid": "8b2dbee8-4140-4a95-b793-5a3264ceb252", "comment": "Malware payload", "value": "16273d75acd148d8958bac22d3655acf24f2e6d430c4a39e0e15ef0f49f28e47", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265346, "uuid": "edddbc7e-4c72-4024-860f-4253c65c1eab", "comment": "Malware payload", "value": "6d6cf439582201d4afe226bd17a9a7eb945cd855", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265346, "uuid": "43fd04b9-1258-4061-8fbb-6e7bd7788c57", "comment": "Malware payload", "value": "5aa8d65851f0e19ca5dc6f586bbfa672619ed5ebea2a2a35a967d690c713f275de5d541d67e85f70c3f6309361a9b5a4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265346, "uuid": "46e9043e-59ac-4330-9a3a-9c9d984b7acc", "value": "T1B9A45C15D3A501FCE0A7D23C8AA39902E67678494761E7DF13A8D6361F637D0AE3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265346, "uuid": "20f8eae0-7ebf-4c41-8d25-15c34127b7b3", "value": "5220194da888f7a400d46d88743e7582", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265346, "uuid": "7589594c-52c0-4ba5-bd12-074bdf4d1cd9", "value": "6144:7enCAYHli90YWFp00+CUGIQ/fTXrgUi7JJpmGwRHpjqwj3:7thHlzY2RIIbkUUJDmGwjjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265346, "uuid": "6b12f462-6c89-4e57-a79f-6fd013018c52", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265346, "uuid": "4cbeee5f-894b-4da1-b771-aaa33d2e3574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265346, "uuid": "b6ed92e3-17c9-4dc9-984a-01de70b20dfb", "value": "16273d75acd148d8958bac22d3655acf24f2e6d430c4a39e0e15ef0f49f28e47.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a251f7f-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283704, "uuid": "0a4fe5fd-d644-41fe-8653-42edc46d15d6", "comment": "Malware payload", "value": "c44a02b1dd480e529e1771490b657361", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283704, "uuid": "f1fb7f57-0ae4-47d5-99e1-3584b13fee48", "comment": "Malware payload", "value": "16d6552098cce435115b18bc4c4858ba801bdb0f40d749b1b70d99ea8fc23774", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283704, "uuid": "4a8c6bf2-ed3c-4aa0-b1ba-7912a9bffa3a", "comment": "Malware payload", "value": "ab2855e5b01d195c628a49efef16ab223a5ccea6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283704, "uuid": "56a31f04-a7b9-43fc-a927-1eefcc924738", "comment": "Malware payload", "value": "02c28e96ae7e684b3166d6e1543cb7b770d2b075a7ed20866de579df9edc11b3c653fd8ab7a080cf89d16f9247f789f7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283704, "uuid": "cad7b106-fbc9-4f8d-8575-92cd673193d4", "value": "T16E3723070FB1EF33CF3414A620BF1A2D418CAC459949DCADA7DA686D85A670E375E13E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283704, "uuid": "7c1a3b95-ee78-408c-a37f-58d8555e2606", "value": "49152:rSfXpcywWVS8pfKcFly2RfK1ijjjw/Al8mElhSfKZfKVmukfKoxC5b+OhVpDlWXP:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283704, "uuid": "ec3f8983-0038-45e8-9e12-88b776d11784", "value": 22903938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283704, "uuid": "c9a41d80-f7eb-4553-9c62-09ca9cc0301e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283704, "uuid": "abeff59b-0829-40f1-94db-648d78dac9ce", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47dc3f47-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280318, "uuid": "9ab5ab6b-7ec6-4536-a093-04337cb05533", "comment": "Malware payload", "value": "05b5aae132d2fabf8a2c640274e34724", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280318, "uuid": "814e3e45-aa64-4de3-9c09-be512905d61b", "comment": "Malware payload", "value": "17590a13375b5f767a4f298c6b4cb4bd4481c05056255c17b5d335b0299abee4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280318, "uuid": "76626e56-68fb-48e1-8a99-47e71dc103bd", "comment": "Malware payload", "value": "c917bb8d581fee8711ad52a5002ba12544d21ac0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280318, "uuid": "c8b86b03-02ee-44cb-982f-b29293346c96", "comment": "Malware payload", "value": "2f2708e000199ad146e7328cb2b411077513ea9b5c40d2992839596ba7d1e9d228b02cd1acc57dcffac132b3d3f99e56", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280318, "uuid": "f4f0d27b-ed65-4967-a5d0-930d8cfac24c", "value": "T1753723032D971D3DC7AC96FD7EF9290F1EF64DD50808DD639340B6C1AA86A1B3A1C296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280318, "uuid": "22c1a3d4-10c4-4c19-8262-c81b646e3d0e", "value": "49152:lVhVCV7VDV6VgVLVMV1VNViVQ1X3eHKV/VAVuVyVf1X3eHdV1V8VJV8VrVMVnVKU:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280318, "uuid": "2807807e-f74f-481b-acc9-5e69b84b44c8", "value": 23424199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280318, "uuid": "58b3f975-d2e2-4d97-8efd-aed69e4ee4fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280318, "uuid": "813378bb-d44f-466f-9979-8c996c150648", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c85a04f-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294445, "uuid": "ec176d2c-0ca4-408e-9b3f-b42de86e553d", "comment": "Malware payload", "value": "2d0901fd58ee230e488c72e23ec6b52c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294445, "uuid": "31369943-c424-47e7-a463-ec1280afed67", "comment": "Malware payload", "value": "183cbac9b11fc112fa62072b1db0a729d207852e4cc5cf94a187cbd3e58056a7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294445, "uuid": "46e766f7-4aa1-4209-86ef-08f5f8501e19", "comment": "Malware payload", "value": "0d9ecf026da91b610bc84d2919d6531c67e026fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294445, "uuid": "17d3db12-e0f1-414f-a08f-33be0d7a3020", "comment": "Malware payload", "value": "82e5ac28313cebe555482d1ae0144af6a145ddbc3e8b2d9b1235a60b5756d0a41398a2250554de6775d8c32081baecd3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294445, "uuid": "dc3f2818-2cfb-4b80-bebd-f3a861e8cec7", "value": "T1BB372252AC3F4F6F43BD182A14380B6D5BE18E8341E1CED6EA157CDA45E9A0914F0B7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294445, "uuid": "8588ab71-21a3-4041-9f5f-2e4f05e930b1", "value": "49152:sFqFbFfF1FGFAFOF6FRFsFQFboBk6YFeFyF3F7FFoBk6vFbFNFEFgFqFEFiFTFAU:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294445, "uuid": "ce5c58ff-e7a6-4414-af56-a83ea3f2715f", "value": 23164078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294445, "uuid": "35e0ed07-c82c-4fc1-a81b-519e8fd3bce5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294445, "uuid": "f936652e-a0d9-4d64-b68f-e3785dbaefec", "value": "invoice-1645080830.pdf (64).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0439a2cb-4249-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777301679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301679, "uuid": "d388ac87-bd37-42a2-8079-5e6bc149eccc", "comment": "Malware payload", "value": "4406ada0491e50e39fdf9fb2b3349f97", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301679, "uuid": "6056019f-49a3-42b1-8a0c-4dc22dcbfc14", "comment": "Malware payload", "value": "190d8223ba2c01bc71fa3aecd3488547ba5a9114ccc9ccb594f4f6fc0a85f1ae", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301679, "uuid": "45463062-9c81-4383-bef3-1c08cc0475b1", "comment": "Malware payload", "value": "1a1ee5c83dc1b50629834bb52ca23d2eb98547b2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301679, "uuid": "106beeac-d24e-4e79-80ed-08eb68f06635", "comment": "Malware payload", "value": "7aeffa702eafb1196745aae626d6afbd7b638383a3166e55d4f9d27897fa2632293ef8299f86f54f278478a9026ac386", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301679, "uuid": "fcda6d81-2c85-4f3e-8c98-37c18e5b0c4d", "value": "T1C0E612A3F72CA92FC8775471DD686332812D5F548A43A35B2908B74E39A39C45FA8FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301679, "uuid": "6742a544-adef-4c5d-a8b0-d48b79086dbb", "value": "393216:MWNSYRdUoAo2WMmLxxWU2KPP8g6luuwhB3beE:MWNvgDk4URP2AxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777301679, "uuid": "39ff845f-95e5-4055-9848-99320d1e3214", "value": 15191459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777301679, "uuid": "bf905528-5e5d-4d40-bcff-85ee1483b6a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301679, "uuid": "8131c474-e0f1-4795-abf0-690a8972eb5d", "value": "Cool SMS Messenger_1.2.6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95e28c4-41d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777250953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250953, "uuid": "915e13ff-3298-4d48-8715-6ca84d562cee", "comment": "Malware payload", "value": "c45751a661015470f253bca1b9a36e22", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250953, "uuid": "3825a256-0a8e-4e98-87fc-1cc09fbc6c08", "comment": "Malware payload", "value": "1974e109c61e2b781604b79854fa6471e1b1f02019814256d3bbbc07b002e53e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250953, "uuid": "bb1998e5-7e90-4b21-a5e5-b85756874e80", "comment": "Malware payload", "value": "20e3a786a47f023466e6291781cd15cb1213d448", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250953, "uuid": "b9e6f332-c1ab-48cf-b59b-21382fe78655", "comment": "Malware payload", "value": "388dc450cfe737e0f4821be0e0f7ac0884ee0c420bd0a0d41bc35849163dbbc9b74cb34eef2934eea33fb56c08cfd9b3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250953, "uuid": "66b51169-b38e-4f44-9f52-b623b7e457d9", "value": "T18DB2D822524536B6220E45B8D897A0402A67106B411C393CB6DEB7487F6CFAC73FF7B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250953, "uuid": "7bdfa32a-32b8-4f0e-83c9-90f3326204ae", "value": "384:hOUS1SKKJW78zTxR0Q/+c7+F68gHdVf+0+0tSJyqeW1VTed0:wUS1SxJW78fJN7+F6thqyqeW1Jee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250953, "uuid": "0167aa88-7108-4e8a-956d-99967f0d393a", "value": 23408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250953, "uuid": "205bb9af-9a60-42b9-ab9c-f2882d0c0216", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250953, "uuid": "78d167c6-51d2-49b0-a678-3f9a10574a5c", "value": "4thepool_miner.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbea906-421e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283574, "uuid": "8935d479-d563-494d-b581-137be9c4fe7a", "comment": "Malware payload", "value": "ef90390b34793c5d61167f5afcf9cce7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283574, "uuid": "68508139-26eb-49e6-ac77-493a06c6e2b7", "comment": "Malware payload", "value": "1a55f874d02f40f23591e9e2621c6725ebc6cfe93be15fbaa4bf9ac62239c4ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283574, "uuid": "50efada8-d93b-414e-8043-1ef406b59668", "comment": "Malware payload", "value": "86bbad8a1c09e696918ea9d93ac28c37bc30e809", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283574, "uuid": "5c00d552-1680-4128-8b2a-8372a1095594", "comment": "Malware payload", "value": "2b286b870746eb33a050675b9e51265bc043fa2fc5031b822c14c640b5bf04fa0e8f0b601fcc4dbb41132b2b7ec85bbd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283574, "uuid": "5e7a72a9-956c-4f0a-ae35-2c9183d197ae", "value": "T10737231062FEBEDD8EA89155043F075D9BBE8F3534AB6912C5E9F489A1DFA0A100737C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283574, "uuid": "b18be1e2-bd03-4076-8253-9d790db6e57c", "value": "49152:tF1/FmULS5dEu3YnRu6+3znJBSrU6qVt95273S3TPxB3EWbOHggJx93pvmgwgghs:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283574, "uuid": "460addec-0601-44fa-ba97-4188baa38722", "value": 24204592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283574, "uuid": "06fd2176-19c6-4a31-8af0-a79690bb2a2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283574, "uuid": "fd322f16-0743-4a56-92cc-7e0b22c388ba", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d4487c-41f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777265844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265844, "uuid": "131db9fc-e845-43e6-9a5b-ce57ffe6ef50", "comment": "Malware payload", "value": "b45a7f18a6083f24820df427f3271c47", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265844, "uuid": "bbbc7009-a837-4caa-b664-2f9b51d4e0d6", "comment": "Malware payload", "value": "1af3a4460ff0e26ec404fa847fdf7ad90590bb98ee915e590e72920e4e148e05", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265844, "uuid": "fc05fb96-30e4-4aa8-b72f-13cc8756058c", "comment": "Malware payload", "value": "d140a3db9056d11f6eb069308088f9d8f1bf294f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265844, "uuid": "c14edf99-67d0-4c30-9dbf-f9c59180596a", "comment": "Malware payload", "value": "6f790e1a66db0de0499aae493fd707e5c0f7078e3b8b2450090042a35098a032b628f4fe1a47b6a66ec3a6c09ea9ee39", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265844, "uuid": "a69398fa-f9a2-4085-ae80-873b082e383e", "value": "T10FF55D23F349653ED46B1A3A583BF650583F7E602A128D877FF4385C4F3A2812D2A657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265844, "uuid": "5981f1be-ec78-49fe-a51b-48e655525097", "value": "2fb78cb437b16ebc74dde7f89c3ed7f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265844, "uuid": "b1d2c14d-6d90-4ff2-8bd2-19c4706c9c49", "value": "24576:uqYeo6u7CBca5GZk1ly315Tt2mfFmjpRXFpndJBySiCcHKGFZZxP552SRcBeHHce:ZoHndtuxJISiC7aZxLTHsu9DrM64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265844, "uuid": "cf829a1b-4a37-4609-b1b0-587214fefb75", "value": 3339776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265844, "uuid": "b6ccb74d-d3ac-4e53-aa47-f52475a210fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265844, "uuid": "2dc9adb3-9950-47bf-9b88-4fabcf8e040b", "value": "1af3a4460ff0e26ec404fa847fdf7ad90590bb98ee915e590e72920e4e148e05.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61594c9a-4252-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777305701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305701, "uuid": "669ea248-9576-4461-a3e5-49f551e22a24", "comment": "Malware payload (DCRat)", "value": "27384be5e8e5158d562e71a0bc38dc51", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305701, "uuid": "5f5aac1f-92ce-4469-92fe-117453cc8840", "comment": "Malware payload (DCRat)", "value": "1b85830a054e28f28336d16a2ee6158944fac131c9529afc37bbdd19252e2b45", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305701, "uuid": "cbd61350-e815-4d07-9275-4b1d628fee4f", "comment": "Malware payload (DCRat)", "value": "0d8ee704369ea39672782050dbe2adc6910e20dd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305701, "uuid": "5a71586b-bc6f-4761-8824-ccb80b95a65b", "comment": "Malware payload (DCRat)", "value": "3f275b7479ff19230117e3979ca4e8ab175c369b2833248a189e1fbdee63ab71517bd1571a3e1dd77b004e76cf5d7c3d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305701, "uuid": "148b5905-63be-4711-a0af-3404c5030fc5", "value": "T1E4B5AD5172433531DAC00F3C83AA45E1F42D67CB6F13BBCAD664B9A9A8D00D65BBC3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305701, "uuid": "b8fd7321-3ee5-40a2-b9de-c520e5ab2231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305701, "uuid": "1226d309-3d79-428d-9dcd-5cba6a21e261", "value": "49152:f7nKv/sPdsutJCQbdeoQx4aiiqpOfNLETmeRdtF1Nkst81pYKjx:GputxJh/OFLsvnt7es+pYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777305701, "uuid": "223662e5-2722-48ab-882b-65169f8904e6", "value": 2389504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777305701, "uuid": "43400d18-0556-41ee-a53e-ffd15deb4bb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305701, "uuid": "0233ac64-19b3-49db-bff1-5e1b35cdc98f", "value": "27384be5e8e5158d562e71a0bc38dc51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054c65d1-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284072, "uuid": "a720a496-f3c8-4512-8776-72a19430e238", "comment": "Malware payload", "value": "70c970b476beedac66463daf6c77e1a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284072, "uuid": "8e023c38-825c-4c11-8f62-82866b4b9ce8", "comment": "Malware payload", "value": "1b92e5e63c31d4d30221fc5ad9167afd8328ad859e0436a4adc8121f8a19449d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284072, "uuid": "96e84adc-ba96-465c-b19d-c55325b64efb", "comment": "Malware payload", "value": "972cb3b7ce6e08463905057e33db50ee2ce3e4a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284072, "uuid": "4353283c-b984-4973-9749-d76036c357b8", "comment": "Malware payload", "value": "c4114e31476b3df4272207cca4660a7849655bca3024324184e6bfda56aa4fce17f9f5304a825629194b43fd6903f820", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284072, "uuid": "6fd2a59e-b3e8-4d0e-9cc9-73f548b5703b", "value": "T1E73723878D4C07FD936963C409671E4C3FD916093250978BD78AF0993A0EF4529EBAFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284072, "uuid": "30afcab9-ee42-40e0-af29-f839688fffb4", "value": "49152:OLdLFLqL1LbLhLHLIL4LhLmLuMzpLMLCLlLJL5MzOLALOLSLdLvL3LbLWLVLVLLA:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284072, "uuid": "5785e33e-d147-494c-93f0-2f4cd749962d", "value": 23164073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284072, "uuid": "bce2fec0-0589-40e8-b52d-0ebf25e27794", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284072, "uuid": "f0c8013d-9ca6-4457-b828-9c7c20aa7013", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3986bcd7-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276858, "uuid": "c725523e-46e8-4491-9b03-ef6abaf989b5", "comment": "Malware payload", "value": "d1ee9a2ec5716560a3c4165a2d7a0d5e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276858, "uuid": "8314f991-8a98-4695-bc60-1a2707ec4d4e", "comment": "Malware payload", "value": "1b9640297fa69ffff0e5f1fd559f08fa88412c564eec529fd2bb0b0e5bc0219d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276858, "uuid": "8cfd22bb-ec16-4f3f-9092-ed9aaba0a959", "comment": "Malware payload", "value": "c0638cc5638909298114b0d9f011d86ab8de117d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276858, "uuid": "9b89f78e-3f6b-4bf2-8428-a8c8dd93c498", "comment": "Malware payload", "value": "3ce2b9060a26db27d4b2f8c2a2d5a44c79cc71bcc7268b333f3dbfd6aa932f47f0f06b5394a2d11394e02010cf9dd9ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276858, "uuid": "619306a9-adf0-40ff-ad65-eaad9bfe42c1", "value": "T1033723900F7B576E873C246CBD751FCC26B09B50A092954F9C8E742BF65FB3E122A681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276858, "uuid": "876b853f-c60b-49d2-8432-fefd8e9f4c24", "value": "49152:7WdWZWjWnWeW8WjWQWBW5W2WiDVWqWTWPWnWmDuWOWzWcWlW6WmWBWxWmWoW+WA+:Xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276858, "uuid": "262a924c-60ac-4bd6-9f28-09711ea55eef", "value": 23164064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276858, "uuid": "0c4a8658-dd4a-4eb8-815f-1c7e2e13e85e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276858, "uuid": "b37a56fd-64ff-464f-a8ad-6332ead2d81d", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ee2cfd-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285715, "uuid": "e356d7fc-ed9d-47f3-a9c4-ad1c8785271a", "comment": "Malware payload", "value": "6751b38c166d7328b4dd708b4e69883d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285715, "uuid": "83e1e6a3-d87a-44b5-ad06-50eac86c03b6", "comment": "Malware payload", "value": "1ba4f813684e641381fb0772e4ff7777867778de8c5b3f0d37798c072d9bcf6c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285715, "uuid": "4c2201ab-a1f1-4c63-a255-6eb32377768f", "comment": "Malware payload", "value": "639ab4b2232f90c109f04de80fa079e12fe336de", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285715, "uuid": "1232293b-dbf8-4a04-a51a-44cba83b702c", "comment": "Malware payload", "value": "7f298fa7c46dbb66786061d1ad2453f596bfae1256f222094af0749645792f3092ac4ecc75faa9a4d27d63459a99b344", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285715, "uuid": "e43ff8ea-4a85-4306-9c61-34dedda1da3f", "value": "T12B3723126EBD8C6516680CF105FF075E2A79179848977DFABAB2A8DE931BF1CC147320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285715, "uuid": "ffbd9e0d-58b5-441e-b3af-90ac922be93b", "value": "49152:1GxoGx+GxhGxZGx2Gx8GxaGx4Gx/GxsGxuGxaiCGx2Gx+GxhGxpGxiiLGx0GxlGu:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285715, "uuid": "8a516b0d-2017-4976-9bda-39d8558a2b4d", "value": 22643809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285715, "uuid": "1ae363d3-09df-4d29-b488-0dfab93e5cd5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285715, "uuid": "fd80e00e-ce9d-41cd-aa54-7a464e8f9fe8", "value": "invoice-1645080830.pdf (52).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32b1a7f-41d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777250943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250943, "uuid": "a28ce665-2aa3-4a06-8e06-260293b6cc85", "comment": "Malware payload (Mirai)", "value": "63306af8fd1d90700e15615d20584371", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250943, "uuid": "2b3d99fb-34df-4895-a53d-28e3f8f4f7ce", "comment": "Malware payload (Mirai)", "value": "1bbad068578f90dcb89f35801a7307067c1f0d3112ac45a7361e87ca307258be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250943, "uuid": "99052e47-ee78-43c0-91a6-09cc80c98548", "comment": "Malware payload (Mirai)", "value": "d9b79aa571adecef1dbcb930879d1039f99ab2ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250943, "uuid": "255c2641-1ca1-4e84-9983-b02f2712c4ec", "comment": "Malware payload (Mirai)", "value": "ff01d00467a148529dd5648b28311cec4bbf7960bde883779572bce9ddb2382cafc9b67e0595294130a94890852ea64e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250943, "uuid": "52966ab3-e8bc-4a1a-aad7-e2c32ee6c662", "value": "T163259D2AB2B2B2BDD017C03447DBCBB15532F0355A312D7B26C4DB343E9ADA51769B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250943, "uuid": "f893bc3f-c784-47c9-b21b-88861f493fa1", "value": "12288:pKLQD+3nNgaafJxMHKdsHXUNR8tYg2oHp+XlrgdEYESgdpayEc2ttHXjRmqfzeBG:dDunNgTMrPI1EdJESgZgJRBfze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250943, "uuid": "f219eb40-990f-4d2f-b342-8ee9e4f1cc8c", "value": 991224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250943, "uuid": "2fdcb275-c713-4132-b454-139ef4dc1e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250943, "uuid": "d2284936-d62c-47a0-949a-404e7e1f4f88", "value": "agent_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db8678b-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279039, "uuid": "c7aefee5-798c-4420-a7da-2166eb546341", "comment": "Malware payload", "value": "ad3a4e3862e6396020619d98701d83b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279039, "uuid": "ebee3bed-3be7-4ca6-81d9-05b08bb75361", "comment": "Malware payload", "value": "1c3dfbab6a8e88dc75b44f43c1bf7c0737ea89654251eba0c561b75bb187cbed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279039, "uuid": "aac83442-b06c-4c05-a605-684a1bcfc4c7", "comment": "Malware payload", "value": "db4daa2ca6f8cde561f67a1f00162bf5e3142f20", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279039, "uuid": "8343046c-2ad9-4677-bb28-8ec93c8f0863", "comment": "Malware payload", "value": "724655528c9ba1bf19a5eb319117bf980fffb9529dc3ff7b07dfbf8cc965fe0d365ea81ff56d4a7114bff01a88540a32", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279039, "uuid": "95eb388b-0e65-4dd2-aa8c-3e77a2847de3", "value": "T1C637231D57AC0FDF891C0368243B534A2ED41DD8C090ACEF7BBDAD9B6A4FA53621E059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279039, "uuid": "7740f09a-1973-4f08-9fb1-4bf356d6952a", "value": "49152:ijlNjjlNbjlNZjlNqjlNYjlN2jlNhjlNcjlNHjlNXjlNejlNjAJjlN0jlNojlN1G:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279039, "uuid": "34693981-9adc-47b5-976f-616bacf041c4", "value": 23424199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279039, "uuid": "86dac7e5-8a6d-47c0-9072-bcf3d9001058", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279039, "uuid": "07ff34e8-9525-40eb-9882-73bb2a3bb137", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51819c2-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279266, "uuid": "8f5ff97e-ce88-48c3-ac73-c58523e76544", "comment": "Malware payload", "value": "28306f297205f2c442376032877a6f29", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279266, "uuid": "b29e76ae-2c66-4874-888a-3c17d9dbb9e3", "comment": "Malware payload", "value": "1c64b1359fc881735bcae948caab52b0410bf383de29624d91a50325d43ae3f3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279266, "uuid": "7df818fd-3bb6-45e6-9c93-8bc07ebbc02d", "comment": "Malware payload", "value": "cfa62faa49c4a75ead10f1bc4bfb25149e907528", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279266, "uuid": "8da0a4d9-a4e5-49f2-bee5-bbe9be25137a", "comment": "Malware payload", "value": "543b8287a63f6ecca35ed8c3283d65372aa3673a3e418580ae0532cd7caadb128321ee898122675006974cd8be722585", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279266, "uuid": "7a1818ac-f897-4357-b110-cdf735406a48", "value": "T1C73723014F449BB58B70492728EC7EAF74AC6E802605AD2BC6C535DA374DF1B186B6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279266, "uuid": "603885a6-f47e-45e1-bd72-2ab30be6bbf5", "value": "49152:IqzudKZ6qzudKZJqzudKZQqzudKZNqzudKZRqzudKZfqzudKZ5qzudKZ5qzudKZ6:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279266, "uuid": "d6d8e972-7838-4b66-bc56-162cd7558c02", "value": 23164081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279266, "uuid": "0ab37c87-00fa-49dc-8a12-1602acf02134", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279266, "uuid": "3ff1893e-c722-458b-b4f0-6eed9fa8976a", "value": "invoice-1645080830.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5223955c-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279476, "uuid": "c6e2fc9e-f678-4a4b-b0c4-61590b9baf5d", "comment": "Malware payload", "value": "f2c0c3f5b0bad28e761d83e048bc9084", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279476, "uuid": "e2e4bbec-a8f4-4697-ab7f-032610a379d0", "comment": "Malware payload", "value": "1cafdba78aeee87604c90b0bf8c1217fcd2bde20e4bfc36cd3fb3243f9be9e95", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279476, "uuid": "95503700-b0cc-4af8-b895-9aeeb103cba2", "comment": "Malware payload", "value": "52fc650349af194a02ca34d948d95474b0e55b0d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279476, "uuid": "46339744-df09-48bb-92ba-1f67930b73e3", "comment": "Malware payload", "value": "7058a4562d8231d81c0176481623bad31c908eec8782c633439177f16c57d3f408cfe6d27d7990c5f3ea1c5551e34aae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279476, "uuid": "f6d916cc-75a3-4472-bd66-7d3c85ccb336", "value": "T15737131ADE3945BF0799723020764BDCB75E4A082697EEEA4B8574EBD80DF0F186E05C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279476, "uuid": "9ddd8289-1a85-4934-bc6c-33176d6738b5", "value": "49152:NGAGiGLGzGUGaGvGKGNG5GIGC37GVGdGeG+GY3+GRGpGHGCG2GyGrG/G+G4GSGQo:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279476, "uuid": "bfcd2d8a-b17f-4cfd-974d-cc0dff2e2e2c", "value": 22643834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279476, "uuid": "f01401bc-de09-493d-8908-370c0ebbf987", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279476, "uuid": "a2a697ca-ff78-4749-9add-0c345474c027", "value": "invoice-1645080830.pdf (56).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db78a2dc-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276270, "uuid": "457bc7fe-df96-4ae5-80e4-8df668ed9eec", "comment": "Malware payload", "value": "118939ca52a0c08883ade09f7d18354c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276270, "uuid": "2d6eed0a-db44-49ea-a657-5a10c360a171", "comment": "Malware payload", "value": "1d3742a905d999a330cc179e9d4a4a51fe4f6caef20e6f0c534cdc18d4a54b7d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276270, "uuid": "4572915c-4ffa-476d-918b-b0fcbfc9f440", "comment": "Malware payload", "value": "e358250a4b79eb5a4e21bd9b6e31e788d1ae4793", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276270, "uuid": "e3c38765-6574-47d7-b8e6-df9c2cad9e47", "comment": "Malware payload", "value": "354b8022a39c4ba70a5232d4fdad78b72c7a86248eacf9febd9302eb9bed56eb2a3fbd36c3f2ce5128df6428e51badf7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276270, "uuid": "90cf5266-3e5a-4f89-a87a-2ecd58435353", "value": "T1483722138EEF1B2D9BA1A27446B76BDBBCE846D0040225CD753491ED7FB1B4F201B968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276270, "uuid": "e748782b-e4e2-4270-8443-fed517404232", "value": "49152:g7HyM7Hy97Hys7HyE7Hyl7HyX7HyE7Hy87Hy+7Hyu7Hya7HyyHx7Hyq7HyC7HyjX:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276270, "uuid": "64a649da-d2c5-4764-8809-4806785d9a24", "value": 23424198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276270, "uuid": "47b7c8ca-f5b2-491f-86d2-1425195219d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276270, "uuid": "56b50ee1-1c33-4073-b16d-f7802e69dd2f", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7360f6fc-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777291558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291558, "uuid": "bb45c20f-e21d-4fe7-9409-a41517a88c17", "comment": "Malware payload (Mirai)", "value": "93dc665b9521a37301a5f0b86a9ddae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291558, "uuid": "337f0df7-21fc-4c7c-92f5-9917e4cf8702", "comment": "Malware payload (Mirai)", "value": "1d4987172b677858a4fd013c597544b83ec604b81ff537d5817456837c9242c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291558, "uuid": "44f69171-0450-49dc-9a6a-c7fcf930c921", "comment": "Malware payload (Mirai)", "value": "54a2d15c57244058d1ba693097cec328c9cbf16e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291558, "uuid": "2fef05ba-cbbe-4173-b491-d521ff18642e", "comment": "Malware payload (Mirai)", "value": "50d1c8d140abcd256c48a532780727e48759960f219eb0fdc46c1328a9fc964809465d5c495563d3c345ee171f8b7bce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291558, "uuid": "615f32e5-c29c-4f5f-86e6-e73d056d5960", "value": "T1F0230156DB960BFAECB446BAFC7980C31124DD74E87E32D127509B2CD652B1C06EC067", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291558, "uuid": "59fa8398-2eef-43cc-967e-e2abe4a8f9ce", "value": "768:U4TrGz6QLKpygLsbsmhkuyEkNq6w0jw3B+j9q3UELJyVMpDxglCN+1qg/KpoRnq:3TrGzvK3hmhkU+w1R+iLnDeEw1+poRnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291558, "uuid": "0abef912-9f77-4738-b815-a199a773eade", "value": 47468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291558, "uuid": "8628d1a5-6778-42c5-9d2c-475dccaf54e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291558, "uuid": "ad0cc7f1-e7dc-4993-b9d0-a0fad39735f6", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bae2d4-426f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777318214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777318214, "uuid": "43a09658-e706-44b8-9470-3779101ad6b4", "comment": "Malware payload", "value": "c110933f8b0e3dc6ef142b469558fea3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777318214, "uuid": "7ad313eb-c8b2-4f0a-b8ab-23dbd19b991c", "comment": "Malware payload", "value": "1dc06ce95be5a3bf0bdd45227070daa7e356f3fd462640d0ca6f5d73a9939aee", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777318214, "uuid": "324845ae-0055-444b-88bd-691c5e8287b4", "comment": "Malware payload", "value": "d2b28f59f16768a9295604217cfbcacf457fc3b4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777318214, "uuid": "3e8c2aff-5325-471d-ac5a-815bf3f8100c", "comment": "Malware payload", "value": "e603cd22904a2da32fb845172577dfc97e8df02f270a59d9cd1d063385333b29bdad223a1b3b4235c5370e40f3f3c0bc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777318214, "uuid": "4c13b5a8-fc37-4729-916e-7e5265515fa6", "value": "T1178502AC74B6B95AF5C4437BC6842CB6DB2CB640DBA93D9B8F2041567D8300F5F2AC61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777318214, "uuid": "c6689400-2283-496f-8ea4-fd2432e10a8b", "value": "49152:4LdGEW41g8OND0YmT6vGwNj8HW8/MZq1q9p:4JGo1PONJmT0GwNjgWQMk1qH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777318214, "uuid": "bba9007c-bd84-466b-8c0c-9baf36856e65", "value": 1746397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777318214, "uuid": "5d4a6012-f0f9-4695-b1ff-156efc0e5258", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777318214, "uuid": "16e6a363-3626-4a24-a167-3896d533ea38", "value": "He is coming.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b352c495-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271479, "uuid": "b0ad30bd-ef9c-45f3-b967-e3e48b511e1d", "comment": "Malware payload", "value": "d619ef529bed0fd952ba7239b29f71b3", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271479, "uuid": "cb268c18-f3f3-45aa-bb0d-bb894720123c", "comment": "Malware payload", "value": "1eacf45a2568aa64fa89a00ee1566e64ca8c22b12892875caf83a313697c888b", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271479, "uuid": "01e584da-fc39-453b-9c23-860d7b211476", "comment": "Malware payload", "value": "0680894180b1464c2f77e00d1babe66f70f4be0c", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271479, "uuid": "bdade985-b301-4f2c-8e74-daead349d6b9", "comment": "Malware payload", "value": "74bf40bedf95419d52d5ae6c8174d92720a7c97e556cf6f87796173d1bc079909223a041ed0fe2055096e72fd0107c84", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271479, "uuid": "fd683651-03b8-43eb-893f-6cbfbbad487a", "value": "T1E4372316CE621EBA832C6292407F259F39D40B6945C57DE7CBF3FAC9531FA22409607B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271479, "uuid": "f7e44eed-b376-406a-b95c-81787b747598", "value": "49152:tWqIWqgWqxWqCWqUWq2Wq5WqyWqLWqrWqkWqlgQmWqtWqmWqQWqAWqUgQtWqjWqz:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271479, "uuid": "99d0e26f-75a4-4e0e-bb7e-f8fa8243d122", "value": 23424219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271479, "uuid": "d6dc28dd-7fb3-4aff-b77b-6a09b58e071f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271479, "uuid": "68c429ad-bd5d-41c4-a0e3-ab4114235a0f", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53021b0e-4292-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777333165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333165, "uuid": "7a4817f8-9d3b-49a5-84b8-bf0f725b6510", "comment": "Malware payload", "value": "42f21cf994acb1c90b7b3959825a3cc3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333165, "uuid": "d1dee17f-a269-4440-b011-19547b33f476", "comment": "Malware payload", "value": "1ed1386c05972c6efbe7026e8f6fe4493222afe7dcd5d780cb2419a3e6969ea0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333165, "uuid": "d2a5862d-bfc9-4303-b5ea-d92b2606a0e5", "comment": "Malware payload", "value": "b2161ccaf8c00811e292f1a2f82fdc0563a37692", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333165, "uuid": "bd9c78e5-f0d3-4546-b0c9-01877bf6208a", "comment": "Malware payload", "value": "befe807151dcc102bc63584d2a1857d98a26be60af8cc2b10177da3c74a4e8a857b9ee1fea9d1ca39f8676c8681009a2", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333165, "uuid": "4af6d271-4893-4640-9d24-bf1d88634f19", "value": "T1ADD312CC5A9989E18B1F2428091F5C178A8EE123061ECDD4BEDEEF453F11AF079BA5D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333165, "uuid": "3fcfb093-5ce1-48c9-b2db-87d45a5fe960", "value": "768:hWWIdHPAXMwmZ/I9ZUbk/ikO8+fS6j606w6r6be1twOtGYUhgg6v76bQN+mwY6GU:RIxj06KgHH89W+ULT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777333165, "uuid": "1a4b27f0-224c-4f70-b30d-f3c2c74c5ece", "value": 135267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777333165, "uuid": "c3199ee9-da73-4eba-b7e9-30abe378dda9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333165, "uuid": "46773c41-9722-4718-a8de-dfd4e8711a8b", "value": "Security_Config_Monthly_6556.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c57380-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276362, "uuid": "b64d2395-8277-40d7-bdae-b815ce6cf072", "comment": "Malware payload", "value": "cc49b6a21f2785327555f371f950df83", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276362, "uuid": "8ab55f5a-50f5-4703-85a3-f9115d2c966c", "comment": "Malware payload", "value": "1ef70d6c8abda5fa853008648ce3d248f3d9ebfc27fbc560a569072d5e0ea80d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276362, "uuid": "3e5cd4a8-8d17-48fc-8746-eda16db57841", "comment": "Malware payload", "value": "31cd2c88f7b4b2dabe117cf761148efcb421ec6f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276362, "uuid": "cc0f9a5d-212f-42d9-a3df-448494569b60", "comment": "Malware payload", "value": "7d64723da010f7ed3216c82bb9521747047b0c392e71a736e708e76e26b2b461fe5ed15c57438cbdf3d869920a47f5a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276362, "uuid": "0bc38663-eb7a-4312-b6b1-56e38768a856", "value": "T1E53723412A570C3F46BC125C75BA4B0D6DC0CE49902EB7C6E2B9EABDA44FD1E07DA05E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276362, "uuid": "f84f0d23-1b23-48ec-beb7-a9f339089102", "value": "49152:RTPTGTlTMTWTsTTTtT7TBTXTQKpOPQLTLTCTsTQTZKpOPQaTNTtThT2TpTpT3Ter:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276362, "uuid": "a0f4daa0-dade-48ae-badf-f87a77e1eda5", "value": 23164062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276362, "uuid": "80c2d6a5-059a-49cd-9ad0-2b19a4342868", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276362, "uuid": "5af50ddc-d82e-46fe-80cf-715f03a48ac9", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c8ce44-4237-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777294276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294276, "uuid": "3a90d2ab-fb48-4902-9498-60007f5de0e4", "comment": "Malware payload (Mirai)", "value": "4d17e298626cee0babb43129a0e71980", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294276, "uuid": "b353515a-e509-4f3d-87b6-371e2df921c5", "comment": "Malware payload (Mirai)", "value": "1f338006738d9ec77c21b45b646bb5fef8c13f708b85d604bbb076033d482eee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294276, "uuid": "29396d85-7005-456a-b4cc-582063ad3e53", "comment": "Malware payload (Mirai)", "value": "727a474b93e443f505488cacdb39ce351c5833ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294276, "uuid": "140517aa-c0a2-4339-9138-fdd897d5e1bf", "comment": "Malware payload (Mirai)", "value": "7b8ffc1abb4a466948b13b370800ea716a8f04fd21af2a90a6d9eb674aefa1f145607e7d9f630077edd0c37934f29fb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294276, "uuid": "702ebbda-e6b3-4fcb-99b7-3f4eb6e9919b", "value": "T1B2935CC4F543D8F9EC4309746036FB379B33E1BE212ADB87D3A959326C91641D90AA6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294276, "uuid": "1ba83831-c60b-4132-98e3-efb49517ed60", "value": "1536:FzXCqZbRT6AXf5uLx09NvNWbzWqTDW6MMsMaysIL7uBBSH1jvUSGGj:FmqZNT6AXf5Ix0/yzlr+yseWIH1jvQGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294276, "uuid": "c60c88a2-adf8-46e3-9ee6-9282891bda00", "value": 93576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294276, "uuid": "58756b71-aa5c-4516-aa6b-b44de93e3ca2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294276, "uuid": "120d64d3-c272-4fc9-b899-9a10818f6430", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54663127-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1777291506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291506, "uuid": "1d9d207e-2113-4bf0-a9c8-3571db75c4a2", "comment": "Malware payload (DarkTortilla)", "value": "33a4b13a15804193d6b06fb95789d2a5", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291506, "uuid": "2fbf4eb8-dc16-40d1-b7cc-90882fa6b0d0", "comment": "Malware payload (DarkTortilla)", "value": "1fb2cc9dfc779e2fc568f02670a48730e8f54485d8ce4927e6506ef19e02efab", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291506, "uuid": "b9889ba6-2299-4892-80cb-fc875ac0afbc", "comment": "Malware payload (DarkTortilla)", "value": "de3bc37ff1d3f23b495a0b3b54adb4ae5f6f4cad", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291506, "uuid": "79337a11-0bce-4b74-aef9-d33e2b0b752d", "comment": "Malware payload (DarkTortilla)", "value": "2ebf59d9fbac771a2ef43ad30e0fb1ab7555f7b4f505f6bbbc59dc742b5c695df21d4f6f23390c370f9469ca7ea5c851", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291506, "uuid": "92083b73-a864-45d7-97df-8dbd718a9e02", "value": "T1D255E11A9DC31A64D5E94FB4C26608BD6BF0CA271241F3AF6FED01F4EE53B8A5C06152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291506, "uuid": "2afab896-1298-47e4-b3e8-49e6a3f5c801", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291506, "uuid": "97c9a614-1681-4699-90f5-c0e84868daf5", "value": "24576:j5XczC20YQ4GhjWUJYL4DH02kscHVRyNGjlFk18L1x:chGhqUJYW0Z1MYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291506, "uuid": "0e9df46d-8a45-4b89-8846-f7b73bb51255", "value": 1336320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291506, "uuid": "42625356-50fe-45ce-aa9a-0683ff5ffdb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291506, "uuid": "ad19ebbb-3fa9-4701-8491-4acdb1217159", "value": "Informacion de precios solicitada___Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f72b599-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280250, "uuid": "151443ec-4000-4c1b-8926-dad600d428c0", "comment": "Malware payload", "value": "02051ab32d84b718e918f1d1d316a8e5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280250, "uuid": "de14d003-cb84-4320-bb05-7e3b1275a914", "comment": "Malware payload", "value": "201bcd3876b83c225a102491cd29070e56bcae577a0815052895f940dc0cbd49", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280250, "uuid": "65392aab-231c-4780-a632-07ab9d294ec4", "comment": "Malware payload", "value": "a60d046a93c656155f145c279e970231eed40ae2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280250, "uuid": "452e1971-dae5-4d2f-9338-fc62c74152ff", "comment": "Malware payload", "value": "a273a15820d76e6b0b4f188e7456dba5f44222df1b81b2dedf7ce252c3839926985fb0ca09ed662e0393d272d5f09f9d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280250, "uuid": "12d9e464-9663-4675-afb8-b8b34e5a2b7a", "value": "T11937230B2EBD5F1EE2BC968C38AF098909C49F73D65079C616BDBCC117DDE5410AA22D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280250, "uuid": "88371072-54e1-4b3a-bff8-41dc8b67b1fc", "value": "49152:pmk/Co6V21bA1eFtVzHtDR8oieFtVzH8OCZfFspn6DLmipeFtVzH6eFtVzHo74Kg:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280250, "uuid": "16f67e89-1b88-4081-97e4-18038d4c8ce1", "value": 23164077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280250, "uuid": "1ddd4020-3fb4-44a5-bd5d-63377dd65140", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280250, "uuid": "b4bb36d1-1468-4c5b-8546-6ea3094062b4", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1ddc0c-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277048, "uuid": "6063053a-303c-4a58-bbe7-e99d9400e1c8", "comment": "Malware payload", "value": "26b8f70db2a36928158c076e52e1a153", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277048, "uuid": "ba633020-e9b7-4b6c-af0a-69838d08cb28", "comment": "Malware payload", "value": "206de8b6fecb14b080602663f28b4e0291d68f48f9a5ff9a7b33490548e6793d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277048, "uuid": "dfe07214-728a-4b54-8d17-bf3ea25851ec", "comment": "Malware payload", "value": "bfc702ee43de14ab242e622e9d826c646a86a1c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277048, "uuid": "9d06682c-2c84-4aa0-8a32-7c7f0fdabbe9", "comment": "Malware payload", "value": "679740f01b49d384343bb3be27b6e3a542bfe1cf8caa97094db565d69bad5c8cc9cfd6cb1078c85e045bb550309d6858", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277048, "uuid": "4a0dc0e0-6ac8-43ec-ab16-4ecfc290f4ab", "value": "T1D4372306178E9F9AC4387A7D10AE6E4D36980DBB4045FFEE36D41E4F520CD0E266B396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277048, "uuid": "9c75d62e-0655-4795-a211-885016ada5f4", "value": "49152:y0n8CdnFxi3/QKpqoRplpKppkVexaTDA7IQMBmKp3KpdZC8KpO8V0NWWT3n7HVt8:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277048, "uuid": "420f2f9e-ca6c-404d-8923-a7e0bb3075d4", "value": 23944466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277048, "uuid": "38033a41-cc1c-4edb-a3a9-ae124d678935", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277048, "uuid": "daac4665-42e8-4d7a-aee5-d09743a5d281", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d325d65e-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276686, "uuid": "a45b3b8a-f63a-4089-a762-c84b9a9667fd", "comment": "Malware payload", "value": "ed15f0636ba8d2366d7ba37ffa972ad3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276686, "uuid": "f5fac913-8ed8-4271-b938-51d311aa05c8", "comment": "Malware payload", "value": "213b01607e8b8301bb3494c990297d2885ea9b716a8f3482b944cb120500da01", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276686, "uuid": "99834f94-65f8-4483-b39f-a9392bf46922", "comment": "Malware payload", "value": "a00fef1bb689d899b95b91a886e76d59e43fe6a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276686, "uuid": "512e033b-53a6-4ad3-8b53-7e4d03855b91", "comment": "Malware payload", "value": "d246057ca7f0f8ac0c661931dd8805d8ac2ecf7b8eff2626dfa64592f5c5fc70c2065adbd5c7649ad3c640df14846114", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276686, "uuid": "0dde3480-8cdb-4456-a37a-4f3caf2fa6e7", "value": "T17237231D49397D160AD461AD20BB8E08DDA84E2A33C7CFDA55CB3DCB042EF17251B69B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276686, "uuid": "92d7008f-8084-42cd-bbc7-5798024d6711", "value": "49152:haaoYaaolaaonaaopaaosaaoGaaogaaofaao9aao6aao1aaoebqaaodaaotaaoa0:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276686, "uuid": "44d572be-cedd-416f-a0c3-cf62b5d69811", "value": 22383687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276686, "uuid": "78e1bcd7-ef0b-4f59-9d3d-94b662063214", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276686, "uuid": "e236acf2-0bc4-4d34-805c-72ccfdb54a20", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f27cd36-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278988, "uuid": "5faffc48-c1e0-4e2b-93ea-fb94280cc303", "comment": "Malware payload", "value": "b4a0c270ff9d0fc952be6459c5f0490f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278988, "uuid": "6f15ebe6-391d-46b0-acde-18fc0a01a30e", "comment": "Malware payload", "value": "21d90520e6a4a7a669c2da6e53c585ca1f60fe67ac59442def4f25c599b5d2e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278988, "uuid": "0f5626d6-5536-44e5-a97d-c0631bd31ce7", "comment": "Malware payload", "value": "3f61afdd51313ffc72705abff564b706759e2b8e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278988, "uuid": "00e350f5-120c-4591-a90a-c8858aa387ab", "comment": "Malware payload", "value": "cb862a847eb8f67945251235a5442c4014efb0b2920ba0a214d8a8a0c08dbc598465f908e3057080c6965921b5e8f57a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278988, "uuid": "ef19ef8e-4bbb-4122-993c-4cc38b965696", "value": "T1F63723062EA7AE3B06F190085473176F1BFB4A0E0C45BEAD15C72BA7ED1DF15B01A92C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278988, "uuid": "53fd6657-fb8d-45ac-93d7-3943a7255d72", "value": "49152:3BO6BOLBOOBOqBO7BOlBOiBOrBO0BOABOJBOQkkLRBOUBOMBO5BOtBOKkkLeBOCv:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278988, "uuid": "c56371f1-83e4-4c2d-882f-2e294c078fe2", "value": 23424216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278988, "uuid": "83d19845-9e08-43fc-bc97-d78285702bd1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278988, "uuid": "dba7cbb8-e084-454b-bc65-64343f761258", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc505fe6-4206-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777273239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273239, "uuid": "bc84ab26-21b3-4d7f-b187-c361cad200b5", "comment": "Malware payload (Mirai)", "value": "ab6270b37dbf472153199c59f2493ef3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273239, "uuid": "7d170b85-c0a3-4a4a-9a29-a7a1c8e6f354", "comment": "Malware payload (Mirai)", "value": "224a541b2c20c94fd60113739a5a9730fbcc49fc635f61e3078fea2b87cd9022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273239, "uuid": "adefed5d-4ece-4524-a98e-2539d848ef07", "comment": "Malware payload (Mirai)", "value": "87d0cc40d25a775987fa6b00e4c1cb16f8edff7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273239, "uuid": "68d56b36-624b-4caf-bd0c-02f2bf2c72ac", "comment": "Malware payload (Mirai)", "value": "6511fce95d4815f21b0d8ec33782c86db87d6bfda3db0b06c5c6ae4401dfb63c4b240799448644e81160972a9a25eed8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273239, "uuid": "2a536460-9f10-46dc-9f6a-204a83676aac", "value": "T16AB45C03EE94657AC0C6C2768FEF9237A774F4AE2334752B1746AF516E05E90DB0A381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273239, "uuid": "e3e241ac-77ef-46f0-a16f-27e299464fbf", "value": "6144:faNChh4J9LVr20NVUN90DuI7TC1aOB8K4G1KXG9OO1RWzv3je4pYZ5y:Sg8rl7TC1xwO1RWzva4pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777273239, "uuid": "2263e37d-c116-405c-b072-df35e31b918c", "value": 512840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777273239, "uuid": "e19f8189-1014-45c9-bc85-caaff827df29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273239, "uuid": "efdab91b-17be-457a-a5d3-2d3a1ea1ec91", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6485164d-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276071, "uuid": "14c6515e-7244-4021-87a1-e6fa1f7d2eb1", "comment": "Malware payload", "value": "028fb09fc4bc5b4175860e164cd11fbf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276071, "uuid": "d4169b43-8f57-4147-820f-ed29d0863e24", "comment": "Malware payload", "value": "226e2fb22e03e7dce03c4c83a8f6498ecd97b3316cf1f26b3064ee71f4dd6923", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276071, "uuid": "7575b438-be4f-4d04-82f5-bfc826551f8a", "comment": "Malware payload", "value": "3d20c3c4f24013ea875e5d010c389a8df2506943", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276071, "uuid": "0ec261a2-627d-4668-9085-9fec1d96a3b1", "comment": "Malware payload", "value": "437d3ec67f14904f1ba96cd720639343d5810c3b93fa48cb65c093e1a07420871a5437392c77316afd9cb1e8fda2648c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276071, "uuid": "a1c0384c-30f2-4c01-b4d3-c05f1c5ec7a2", "value": "T1EB372346DADFBF2FA65CC0A910FD3CAFA1C2434912A7CA25DBA7318E555C1E100C6ADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276071, "uuid": "b2d97b89-86f0-4fd5-bbc2-37ca71fb5199", "value": "49152:Qq7qTqOquqNqDq8qZqQqmqbqGqisxqtqaquqiqLqis8qWqtqTqZqvqYqEqvqWqxF:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276071, "uuid": "26cdfb16-8794-4cdc-93b5-b4e3a66c8326", "value": 23944469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276071, "uuid": "f026a27f-e69f-45c4-bf91-20ccf2f74826", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276071, "uuid": "a26f3683-f08d-4cb8-b57d-ff2e1406fbbd", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f8a681-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277085, "uuid": "d8d17d59-0f29-4db3-8257-dc4724c915df", "comment": "Malware payload", "value": "d2f1727baf3c5c23767e66c7818fc85a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277085, "uuid": "31a12a6c-0caf-4345-9f70-39b02c1d42d6", "comment": "Malware payload", "value": "22cb10f9fed27eec9ded4a3be462934e88f42ad0aa72d1d3620b43f49dc1bc93", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277085, "uuid": "f69bc481-2a42-4783-8af2-4b8fad989895", "comment": "Malware payload", "value": "e8daae461db4f7d01485d4aa4c32071b973c4dae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277085, "uuid": "ad1541a5-28a2-4343-bb24-e6f885e5e79b", "comment": "Malware payload", "value": "898a851a038cc22164250802bac16e2ffc9ec26c43531102dba5aff3ffa45e95f545ecce0588027f2989c617eef6bbd6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277085, "uuid": "b5c4ef2d-25b9-4c37-b269-fa8c176129c9", "value": "T1FF372200DE3EA97E436D2AE860F76F9657D98E741808C67B25C12F8E590FB250C5B43B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277085, "uuid": "e5570004-bb2e-448b-a8a6-0a42731163e3", "value": "49152:6w/mw/Zw/Aw/Sw/Tw/Fw/fw/5w/uw/hw/Tw/486VMkw/Gw/Lw/xw/5w/G86VMFwo:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277085, "uuid": "5e6d2795-94ee-4e1d-ba02-99d815414032", "value": 23164076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277085, "uuid": "b43c5af7-c04b-4aa3-9b56-d8d0f766c9fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277085, "uuid": "4fc08c41-e35f-49cb-b903-63dad1c5a408", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf5e37a-41cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777248649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777248649, "uuid": "c751ecb0-0ab6-4f60-a505-82dd750335fd", "comment": "Malware payload (Mirai)", "value": "22bcd5c6f4b2d61d70a061b74d9029fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777248649, "uuid": "fd70cd38-ad0d-462b-ae4b-b69d4df3cb6b", "comment": "Malware payload (Mirai)", "value": "232c3f1f4c35cd4ba17bb2f3ac7893f0202eeacb122415dfd90377649c9e230e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777248649, "uuid": "f3430a24-7907-4697-85b5-4bf2538bf17e", "comment": "Malware payload (Mirai)", "value": "7bb719958836469e76b61764d7e657f0e7304f0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777248649, "uuid": "d713c2a1-9c0b-4af0-a832-a46f0ee9c6d0", "comment": "Malware payload (Mirai)", "value": "f60c9613975c8e2567eafbe30e3488f91c59c8ab0a54c1248efa196b93c95c9171694b12d791825ca27b7c01cde0b8de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777248649, "uuid": "b5a3ec5c-5a83-4d3b-a9f7-fa8fcacc3552", "value": "T1A2F49E9EFD5E3C43D2DBD37D9B4A83B1A22BB150C31351633581432C94C6ADD8BB16AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777248649, "uuid": "7b2e73f9-55b5-4325-aa06-261a0f845482", "value": "12288:qFJBc4+iFvBlB+sURgXs1aO+55/HJwpX3Jgw5C6iEvR3wOQrg/teYDP:qF/ztT+sJs1/+5/QHJjbvRCgVeYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777248649, "uuid": "bef98d1d-b850-4428-b6b1-dc844ba3b88c", "value": 778536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777248649, "uuid": "66eb23fa-8e3a-4800-b08e-364525b878ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777248649, "uuid": "e8055add-97b9-4c7f-acbd-b91afb96801f", "value": "agent_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b517d13-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280431, "uuid": "a82aeaf7-ffd2-47e2-9d24-ebfeadc9c724", "comment": "Malware payload", "value": "ba748a4a52b504cafd8e9233b427c389", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280431, "uuid": "8303fcd2-1213-448c-90b3-d59394f296e5", "comment": "Malware payload", "value": "23d9152604080716dd8457ff1afaa06391be58ae3cd89c83cad57425d432de64", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280431, "uuid": "db1e42ab-d0f5-45cc-9bd2-731476562939", "comment": "Malware payload", "value": "6a56687c1b40d4945b16c5503f6c6e51b623686b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280431, "uuid": "ef2764d4-3788-4b1a-a77d-94d1ae825aa4", "comment": "Malware payload", "value": "dae392f29df8795aaad0acf9b8f5916b7940397d82ae39b55bdbf2ab7fdff7d0e3e7ec1fd1f1caf73ab72f3043bb5f83", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280431, "uuid": "a6305f74-3e4b-44fb-b367-290096576bb2", "value": "T1D23723478CC6EB6E59FC722420B70D8EA4D18B0C8006E89FDAF9BC894B5BF217557974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280431, "uuid": "376023ac-f532-4bb9-b565-5c78617a270f", "value": "49152:XfdIVb5H3K9ZOPHCP9JUPieO0/rOghQZRVcfPSPePc2Pjcrkb2uBVZTlzVmemSMP:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280431, "uuid": "0306973b-bf74-4529-99b2-6cf431934791", "value": 22383661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280431, "uuid": "a6223eaa-d18e-4ba2-8bdc-ae5deed6bfb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280431, "uuid": "6b558059-eb89-4ef8-be10-1f7666f41ab2", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a057056a-41e3-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777258132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258132, "uuid": "175b9f08-503f-4952-935a-2fdc6c98e70c", "comment": "Malware payload (MassLogger)", "value": "44f12568e269e12959a4ac4d91dcef87", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258132, "uuid": "7bcf8587-abca-4fa2-a020-1edc153867be", "comment": "Malware payload (MassLogger)", "value": "248812accf82ca745dd93e7f825be990dec0dfdce44ec3e1d8475f523962fa5c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258132, "uuid": "582d050c-70c8-4768-9165-3c59723f8bc6", "comment": "Malware payload (MassLogger)", "value": "7b87eeb6faa8e90a919333e1c494a1ac7912a513", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258132, "uuid": "d73cbf94-b16b-4d9b-925f-89b5f9e1a2f9", "comment": "Malware payload (MassLogger)", "value": "4540adb9876c0299c763bf4ec885dfee289d5f3a7f0a7311607baf7640ac5a7ed89e1c86e0e65cb0be0411e944b18d95", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258132, "uuid": "e8ddebd3-daaf-4169-86b7-7db6c4599040", "value": "T1EFC3E1138DD96F74DEB8473500F83A62FBB0868A6151778AB7436C99AFFA504034E1DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258132, "uuid": "475c627e-55bb-4b37-9130-8af369cd0c34", "value": "1536:QYJd+UtGpRzxyld/VwQNdr2jcVRMXeOeotTngXTqSbVMy9SFbYZZ9TsTe:QYL7Up4/VwQNcjKqtTnCLVMy9SFu7Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777258132, "uuid": "28116e9f-0704-410d-8f16-b317b75d432e", "value": 124980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777258132, "uuid": "718a6b6d-319e-4658-9f4e-b96e4cd7f16d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258132, "uuid": "ed64e7b0-31c1-47e7-9e2e-bccc5c20ff0b", "value": "Request for Quotation-BD00900M.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb15aa66-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276297, "uuid": "d0231e7f-7ed4-41fc-992c-fb1da0015ea2", "comment": "Malware payload", "value": "379557c5cd0365d18e4120c66f072376", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276297, "uuid": "a62cdaff-b0ba-4ef9-bc48-a62466ee880f", "comment": "Malware payload", "value": "24d200685c6c8e7c4bc7edb4d2676129ebf68c1a2bdb77ae9288cb18fd97bcbd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276297, "uuid": "410556e7-015c-4931-9d3a-319f896491bf", "comment": "Malware payload", "value": "3e1fde7c801e7d37bce603fe47a4d8b8a6fbcf9f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276297, "uuid": "77d39548-6c91-4b8e-a9ad-639022ff34c2", "comment": "Malware payload", "value": "86f08aa79aadf58ec4e7ef1196bc4c3d7c531de3bbd520df9101839b1a92f0ea23a9b6021f56360cb175329b4c4fbb2f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276297, "uuid": "5e172919-b6e6-4ac6-bf34-f84db06120f0", "value": "T14537230E8EAB99AB4AFE710C34170BC77ACA1D955145ADDA62439C0F9F4E7060CDB0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276297, "uuid": "7c2541b6-38e3-4150-a97c-9dd0bef7325f", "value": "49152:TVtVNVwVcVrVRVPVFVKVlVLVM6fVTVXVYVoVR6SV6VDVxVrV6VYVQV1V8VAVuVVi:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276297, "uuid": "cd6c07cb-7529-49bd-b545-a430bb0dc5a2", "value": 22643810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276297, "uuid": "0246abb1-c54a-4ae5-9fb4-03d574ff8f28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276297, "uuid": "263d3f1b-2dfb-4b06-a1b1-d5a15c737ee8", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1c94ea-423d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777296725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296725, "uuid": "a237cd72-7b2c-4775-a395-dc2d87c24517", "comment": "Malware payload (Mirai)", "value": "fd7f470d455d8d4884b7363ce8996b66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296725, "uuid": "60ca1fc0-9846-49aa-a01c-0c392a7f1b7e", "comment": "Malware payload (Mirai)", "value": "251acef3eb67202c82e5969eb22ab4902b1ba53df362dc486511657d3ce51b3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296725, "uuid": "14e2fee2-9e3d-4fda-9ae2-b40caec028e4", "comment": "Malware payload (Mirai)", "value": "05d90184cdf69417e2394af1367f61fac353fb74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296725, "uuid": "b703ca66-801c-4b55-b3fd-0245da6cbd14", "comment": "Malware payload (Mirai)", "value": "ceb19b329688dc05f0e82d6dae628bcd1625ce44ea98e962387ba53adebb80533d4b244ef1877dfe443a4110422e2486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296725, "uuid": "3ee26176-6589-4825-9815-c9404e18b54a", "value": "T1B0458E5AB2F374FDC057C030839BDB626835F46541326E7B71C4DA342EA6EA01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296725, "uuid": "cadf8f74-28b4-4702-9174-65fb077c633b", "value": "12288:NAPcvFRGLQYbfh2bomts+aq2p9n6vwRFmyjtcHWp5k6SgJ8CWh:N4cvFRGLP52bomtsRq2pXRGWtLJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777296725, "uuid": "1b81ec42-53c4-4cc4-8b52-8f0a13116d56", "value": 1173144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777296725, "uuid": "65d781cd-68c6-4bbf-b282-5c50aed4e375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296725, "uuid": "aadd55af-2ba9-4650-a21e-4930910eacd8", "value": "client", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb38f342-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271492, "uuid": "825988ff-9325-4a0d-a297-e6bd46857bd2", "comment": "Malware payload", "value": "4294764614c607cfba243891a5697e98", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271492, "uuid": "9c68692e-d655-41fb-89f8-58c808869556", "comment": "Malware payload", "value": "25683258e5780d3a3a288b4a551dae130f4d86b168bfc4023b8a1882112d5c77", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271492, "uuid": "ea069331-0daa-4bce-a438-91ab9ac9b231", "comment": "Malware payload", "value": "11b43966401691e4227cf933251d81a34b4a9e22", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271492, "uuid": "47cf4538-b31f-4f5f-ad73-9e5fc08f3f7a", "comment": "Malware payload", "value": "63bcd7a36d6bdb9b0a1a93ae25d0076dd2c7012b420b8315e0cd7168526a426bdcf13706767b5c81f2a336e75740ed8c", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271492, "uuid": "9d0a8901-8bfc-4239-a3d6-f4e97897b45a", "value": "T1163723121E3BFD7E5B3CA06D3452230E97ED4DB5946E0F0AAC7532D9620DA1750BA0BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271492, "uuid": "09beb998-4167-463a-bedf-2ff5e3adbf58", "value": "49152:vhaf94phaf94jhaf94Mhaf94Ghaf94Thaf94Jhaf94ghaf94xhaf94Ghaf94Shak:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271492, "uuid": "1613e7c2-6074-495b-9beb-bb29b7523797", "value": 22643834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271492, "uuid": "7d23fd10-871d-40dc-8584-d74a7fdb0be7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271492, "uuid": "dabe177e-1923-45f5-baaf-137581fcf8a9", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53dbb608-41d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777250273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250273, "uuid": "3fbfec96-a667-4e4a-810c-26d15467b1bf", "comment": "Malware payload", "value": "b958d8d2ebd04ef2d9283e8f1f1422e1", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250273, "uuid": "455fbf52-d7a4-4556-ac85-c10692e5b90f", "comment": "Malware payload", "value": "25c1a8fc9af1968ffd093944d947c845b98f5d15b5d127548a9d50e96d083b26", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250273, "uuid": "d537d6db-06ac-4f89-a070-05ae4163248f", "comment": "Malware payload", "value": "1c22704abb810bf72755e53097e6360c6fbd47ea", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250273, "uuid": "10b7e4ef-db34-4d6f-886d-777454e514a7", "comment": "Malware payload", "value": "adc387baaa0ffa2f7a6bbade792e17832b77d32593d0c940b9e14552b2c076e5471eef2c07745a21866509e66f4cb0ac", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250273, "uuid": "438c8777-0fab-4677-af17-9ddfbd46c9b0", "value": "T151E026103CA586B8CAA3C877729AAB70CA63D83C330D1101736A4A4FF600A29886D95C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250273, "uuid": "6b595c0b-a8c0-4960-afd5-b0def98e9297", "value": "6:htdL82cTn+R9e2jInytGQO0cZAuBn2nKMdZXKZX5d8ZX5WIU28boArtH2cG:hoTn89jjInGHpc+e2FdZaZz8ZFUFboyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250273, "uuid": "2447710e-ecbb-4b54-980a-3a9bfc6ae032", "value": 323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250273, "uuid": "77acd68c-c01c-429f-a14a-f4a26ad22235", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250273, "uuid": "ff603d6a-af8d-48a7-bfc5-2b091c089f5c", "value": "ooydn.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5706cefe-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280343, "uuid": "823f6588-8fee-4ddb-b8f1-e83ffd17d39b", "comment": "Malware payload", "value": "407da7a52b2fa1ee1407429020c24d8a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280343, "uuid": "f45d36e4-bee0-427c-9163-1dcfd7d57896", "comment": "Malware payload", "value": "266527510db960f90e21711f7b53949692fd962a4c578a1c706f9f9e1ccf0ccb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280343, "uuid": "6815a8f6-d8df-45d6-a883-f53b5ca01ab8", "comment": "Malware payload", "value": "2a2f8144e9c189efe0384f1c21a4bad9a448ee1d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280343, "uuid": "02551ea3-1e2e-4a91-80d9-a5629f4c582f", "comment": "Malware payload", "value": "caa538968c111052c308c690e82bd49e4f08ff8c3a5493caf4ec9e7d346a41bf69169d6ac44e7322f04303b92aa9705d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280343, "uuid": "8dd70d54-c45c-427c-998c-b54082a70f14", "value": "T1AF2713164E4D9A43CB7DB43B346F0F6B2969859E16D6FC99E2C73422750EF3E252300A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280343, "uuid": "4e46f5c4-5937-4302-a9d6-72930766abd2", "value": "49152:aKGjKGLKGXKGdKGOKG8KGLKGsKGRKGNKGyKG+FKKGCKGeKG7KGbKGoFxKGhKGnK7:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280343, "uuid": "bd76477d-8e8d-48ae-8527-d08460e3e882", "value": 22123567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280343, "uuid": "8afba29f-f09d-4727-a348-548d6ecda7c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280343, "uuid": "28c3940b-8f52-4077-860f-f393da2dd6cc", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bcc58b-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321954, "uuid": "e16389b1-5ea8-4a38-a393-9121d425e1f0", "comment": "Malware payload", "value": "667aefe63fb5a663f4af6403c99361aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321954, "uuid": "ebb9eccd-d74e-4aff-8ffc-92fc1703da18", "comment": "Malware payload", "value": "26e7f1ca4893ea428a1dce9bf97993d52846debf34b3c85a0e61a25539db741b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321954, "uuid": "1d30dd78-2c0d-46e9-b7f5-30ea6b151fe9", "comment": "Malware payload", "value": "c0f9d5a4f4aae25a5ccbc2f07dc8dab6339cd87e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321954, "uuid": "7177a77c-f073-48b4-9215-4c3a9296196e", "comment": "Malware payload", "value": "9340a68f2057e5959bccb3a3f76965287e38eaaa4cff621c5883e724c98a784eba9e01e7c851ea378fd1a489c92aac61", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321954, "uuid": "faabca3d-6406-4d9c-ae0e-f6e503c215ce", "value": "T19AB01219A04DFC3993C76BC58E6472A5952BC41F02594CD7039556DC84E0D4C75F7853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321954, "uuid": "ef78bd7f-a962-4044-a581-a8b7e6d4c967", "value": "3:gdQTtQ8wVWTKc0HMTDNkxLNBkMxhJH0fJH6tM:gdhRWTKrs1gf/jUfJH6tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321954, "uuid": "9e699335-d07c-432b-9194-8bed9eceec1c", "value": 112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321954, "uuid": "63614f0a-a48d-4fba-852b-15b364c128b7", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321954, "uuid": "851cb50d-87db-4e0d-be94-b37574e843e2", "value": "164.90.195.107_1777321922734156_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c75f33a-4260-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777311813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777311813, "uuid": "8abbf539-02c1-414c-8f74-c6dfce9c51bd", "comment": "Malware payload", "value": "74cdf48266b8a0c68556270ac432d2c4", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "sec-ailos-com", "colour": "#8F6E8C", "exportable": true, "hide_tag": false }, { "name": "webhook-sec-ailos-com", "colour": "#25F878", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777311813, "uuid": "d78ee317-6a8e-4e6f-9651-4bb3a86147ff", "comment": "Malware payload", "value": "273ffcccedc11027b5dd29ed295ec894e10cc062a2893c213a626908b0abb454", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "sec-ailos-com", "colour": "#8F6E8C", "exportable": true, "hide_tag": false }, { "name": "webhook-sec-ailos-com", "colour": "#25F878", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777311813, "uuid": "1a09a26b-e824-49f7-b761-a40111221c01", "comment": "Malware payload", "value": "ff04de7cd221609e33d388d63ff7d93cb36c2c0c", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "sec-ailos-com", "colour": "#8F6E8C", "exportable": true, "hide_tag": false }, { "name": "webhook-sec-ailos-com", "colour": "#25F878", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777311813, "uuid": "0ad16661-067d-471b-920e-dd833b6d4ab2", "comment": "Malware payload", "value": "32a9c2e157917d4dac28a0430a04485aad704815de734cfdb769623844cec0ac3f387bea88272f4fd1f2d4dfea2ea2af", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "sec-ailos-com", "colour": "#8F6E8C", "exportable": true, "hide_tag": false }, { "name": "webhook-sec-ailos-com", "colour": "#25F878", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777311813, "uuid": "7a10599a-74d6-4063-8369-49139fe28507", "value": "T1D8766C46BC1D3963C6C975746F7702A47639BC089BC2C7266A24FB3CA9F27948F13261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777311813, "uuid": "0d20b4e6-13c8-4592-8813-87ae27876afa", "value": "98304:+tX319bpMSY20qF4FPZW0CnqfT7vmBjbK6uNtOqPOVLWRutNGaBl3/EU:+tVCfT7eBjgtTuL2uteU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777311813, "uuid": "c530286a-7495-4a35-a550-13187835b230", "value": 7798946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777311813, "uuid": "e0367ce7-253f-4556-ab5d-1ef2ce66a33f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777311813, "uuid": "1e6256ed-3d18-4055-997b-cb1f1a2027ff", "value": "ll-arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7801d46-426c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777316985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316985, "uuid": "58c309e5-3348-477e-90c6-74551ffa9ea0", "comment": "Malware payload (Mirai)", "value": "716dc738efb83d79bb27ec93129d3fee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316985, "uuid": "d944e5d8-d4c7-4f81-bc25-d9694b562e15", "comment": "Malware payload (Mirai)", "value": "296e2cfe4738eee834bc900e70f5c39907dd8d16ae9155c279891e144b31d3a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316985, "uuid": "fe657b52-f19d-4260-826d-7e3fcb5d4ddc", "comment": "Malware payload (Mirai)", "value": "b634bbdca936f87e0b9fc243a1b24bc345cb95b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316985, "uuid": "df2054a7-cf6f-4496-9f23-03637e8cb884", "comment": "Malware payload (Mirai)", "value": "11bf05f18c80a5164a141dd7f1dfd492a030dee7a6b8a3726a550803915ab59e0d61954ca031d59b146d2d6e5bd6b7f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316985, "uuid": "aaa47299-8f91-473d-bdef-67faf9e4cb0e", "value": "T1C6D2E1BBD79B2263DC1985F3CA6CDC95CC790B91459FC4462A6C0782789227083BCA9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316985, "uuid": "b2e5cc93-4e7d-4fad-8fb5-cb38b5f3062c", "value": "768:nCGR0q1Ql7F7b1i8mFG6cU26asdg2PHqH0BzntZTn:CGR0LlxHk8Pb3mmOztZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777316985, "uuid": "e1987c6a-ea46-4109-b508-8adcbbc83133", "value": 30724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777316985, "uuid": "66c8c206-d0ed-4a19-b0e3-b153c90210bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316985, "uuid": "32224df5-5a46-4ec0-adee-bcb816413bf8", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fbd3b4-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777265066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265066, "uuid": "40b1e8d9-fcb5-4205-ae96-ea39ec6eee38", "comment": "Malware payload (ValleyRAT)", "value": "1e60f0775ac98714ab08388abd30e44a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265066, "uuid": "a1431be6-0172-4101-ac96-bde4810a854d", "comment": "Malware payload (ValleyRAT)", "value": "298fed5a7e12c093d51c3dd055257bf0b0e1c46be2939908bc428c4a0e38c411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265066, "uuid": "e7ea7403-a38c-4a56-aef7-e91fcbd23da2", "comment": "Malware payload (ValleyRAT)", "value": "5d49c7c50cde3fa251c406e4808f381f69045e52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265066, "uuid": "f574ad27-f38f-471e-acaa-97cff3ddc9b9", "comment": "Malware payload (ValleyRAT)", "value": "9e7c0598254ed7d9504a7bdcd351c54cdfe73b3bbdd5dd6c6c56664442768d6ed637601965ca023e0581233981a440bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265066, "uuid": "bce03280-7744-46fe-a174-0ae1648633e5", "value": "T190369D213DE74436C66323314F5AB73923FDAD631B35C28B5788FB1D2E342A2662516B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265066, "uuid": "12744872-4c20-47d7-a4f4-2184eedf2ab5", "value": "7b6b4fe24bab6839b31e7009674b287b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265066, "uuid": "bc972439-c440-4f4c-ac41-13c211c08a4b", "value": "98304:NDlUvvuzDcPNgqytLLArrccXkZx4ZilmAb6aE+8ynJ:BexNgtcXkZxUS/iAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265066, "uuid": "6213d2bf-8549-4dcb-9695-b715a00f5c45", "value": 4913080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265066, "uuid": "629af57d-a900-4611-81f9-33a95b87c7d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265066, "uuid": "f4855398-24cb-4502-b621-4f0f7c1da089", "value": "1E60F0775AC98714AB08388ABD30E44A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee2fe00-422c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777289617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289617, "uuid": "d4f7339b-d1c7-499c-905f-612065ffe227", "comment": "Malware payload", "value": "63e9553316562113069e28bc808ad0b4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289617, "uuid": "2cc26a3e-7b34-4d14-a98d-32c15bbd6088", "comment": "Malware payload", "value": "2990fd397db77eadbc1bc81063ec6c470b4365a70fdcc0656fdd6db2942c1100", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289617, "uuid": "a09d3077-03eb-4220-b01b-ec9d16a19148", "comment": "Malware payload", "value": "3d70c45cb005247dd8c37704f707fc66b04e4810", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289617, "uuid": "c27fb326-1ede-49fd-bce5-b3cd61247c0a", "comment": "Malware payload", "value": "c2df6261c9c5ec5ae11b435d11fad68a14ee58c2204b801d84972c995179813f1dba27b2189c5b60df42a2cd930b8f42", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289617, "uuid": "e7e26f9f-710e-4b37-a576-ed8cb88d1c0a", "value": "T1CB373322A7CBC525D65C017BE668FE1E093A7D67433081E372F4797A58F54C1A3BAE02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289617, "uuid": "77f08af7-4215-4be1-800e-68ff413b46f5", "value": "393216:1tb1wYwN/eixCpRLIxFx6fKp2WkSHFrpf96+WhN07Tfd6dJ7dg1YTVveAL7HhJH:1zwYwZxuVwTxpf9YN07TV6dtdg1IeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777289617, "uuid": "750bf6d2-da52-4694-ad87-333eda32ca63", "value": 24476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777289617, "uuid": "328dea15-5d61-467c-954c-4658788f7e8b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289617, "uuid": "7aa41d46-57a3-411a-9756-080b076b27c9", "value": "doc-pedido_6432404.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6e3737-4213-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278881, "uuid": "a7047590-20db-4442-bece-3c00e1bcd264", "comment": "Malware payload", "value": "fcd98bf3d17abcd20d3c3ad79450590d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278881, "uuid": "aca814b4-ac11-413f-a58d-5b931e0b3e20", "comment": "Malware payload", "value": "29d4cce18788e4ec0861e36d4ea37b8b3563c9acac0b5bcd0d80d1dc0972661a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278881, "uuid": "362e414c-71e4-4a57-8aa4-3045c34561a0", "comment": "Malware payload", "value": "98a93709d452756b2a6f1acc6003be0a881c73bf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278881, "uuid": "6c9956c7-fbf0-426d-b90a-7a0e82cdfd33", "comment": "Malware payload", "value": "c0c34b298521b798ed44b46a2e9c7a13986d8667f70947a076a86c03e1033af07fd6bace7079ec2830e6f02359273044", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278881, "uuid": "40a1ab05-d703-4097-bcbd-4e0903b83a9a", "value": "T1C83723B1D7426FE3E1BA3B59EE1E8E1F1F588720901AE99FC772B05A57CF7152422006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278881, "uuid": "5e160c14-846f-40ab-9be9-bb7ee338ab54", "value": "49152:hftfdf1frfEf6frfMfbfZfGftmvfkf/fVfNf6m8fLf8f+fGfKfYfEfbfUfAfuf35:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278881, "uuid": "7965cb05-b8cc-419e-9d62-a9883ffb652a", "value": 22903935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278881, "uuid": "adaeca9c-7336-485b-adf2-385ee52e87b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278881, "uuid": "647d5c84-22f5-4abe-95a7-499ca0beacba", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58fc8c6-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276287, "uuid": "6993df97-14a6-4c91-9318-e87be5832f8a", "comment": "Malware payload", "value": "f9e3e148cd67fa97080bc78f914c0b13", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276287, "uuid": "ff0adc62-ce93-4e7c-927d-63ad19a698ed", "comment": "Malware payload", "value": "2a102704c6a60bc3c8f7be8c4f93db530e8f45bdc68f4fdd52a2a15951429d7f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276287, "uuid": "28b37947-c4c9-4a0d-a7d9-ebbe2dfb0518", "comment": "Malware payload", "value": "8446ed9c462ef591dede10a983b7827a8e6d1617", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276287, "uuid": "e23d27d4-8a5a-48f8-a396-1d03fac794d3", "comment": "Malware payload", "value": "e14824c5d14a1ef8f8b60b26133a0895735e35afbae0f16edc23cd526775b91cabe9b0682caa6a11788c16ff988a2874", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276287, "uuid": "021c3b30-1a7c-4c7d-8ab7-e333a91feb1e", "value": "T1FF372306493DAEFF5B7971C969FD1C0EE59087517449BBF06BA312EE88CF0D2128AC94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276287, "uuid": "5aca8911-669a-48d5-b739-1a4cbf199979", "value": "49152:mfhrfhhfhpfhVfhAfh+fhJfh4fhHfhPfhyfhlOpfhvfhAfhmfhmfh3OyfhWfhXfw:uH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276287, "uuid": "2517c0f9-76a8-4944-81c0-6d44eee761ae", "value": 23424215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276287, "uuid": "4cf94c57-3e2e-4b10-8495-e2d7487e0888", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276287, "uuid": "a7faae74-1cf6-4486-a3cb-eb20d7e2a5a0", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934df15f-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285598, "uuid": "0681d739-c4e3-4994-9094-216f303cb3ef", "comment": "Malware payload", "value": "c213ead77f5d3d59002580aade8253b2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285598, "uuid": "097c327a-d898-4637-a2a7-6f566f0bedb2", "comment": "Malware payload", "value": "2a8e6180320fef4b2f59e9b22e63cfd743e18b2dc3e53609823f9d2afa4b7aba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285598, "uuid": "ebfd01c4-498e-4aed-bb37-bc93467f9bba", "comment": "Malware payload", "value": "34ac2f93ee1b112c094adae68b492bea94e2d747", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285598, "uuid": "4ac49841-056c-4852-b53d-f84c295e0706", "comment": "Malware payload", "value": "bdc804ae52aed0cf19c78044a9caca4559192cc8149233e383b19519820d250400c9126ab9716928e4a2e2e4f0651be7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285598, "uuid": "f7d4e17b-14ee-453d-a0bc-41e1b089a0d6", "value": "T1503723830F684E5EC194217948FF4D565B9C48428056A3CA9FBB946A4F0FF8F6CBF528", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285598, "uuid": "4e54be9c-e499-49e1-a48d-52f05bf0f2f6", "value": "49152:2nb1unb1Tnb1gnb16nb1Enb1vnb1Gnb12nb1Fnb1Bnb1vnb1Vnb16nb1Q:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285598, "uuid": "98260317-96f9-41ad-ae6c-3fe263de07fb", "value": 22643816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285598, "uuid": "f94f2d1b-2ccd-4518-a91b-8241a2c6f722", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285598, "uuid": "e965c14c-1230-456f-ad75-9467f0494d0a", "value": "invoice-1645080830.pdf (61).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f823ef8b-422c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777289633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289633, "uuid": "ba8e4057-bd5a-4664-8bdf-471caee9ff13", "comment": "Malware payload (Mirai)", "value": "3f4904dbe9deb3b5add54dc1a742d322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289633, "uuid": "7012f333-302a-42bc-8c50-e71bf45249ea", "comment": "Malware payload (Mirai)", "value": "2ab56ab4567123396d47bc58923f67427f27c00e4a10000f70e8f21915911fdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289633, "uuid": "7eb619a4-b3d9-41a7-b6dd-97d7b6d5cd52", "comment": "Malware payload (Mirai)", "value": "f4fbcaaee5717b9f1af7e9aea32bdd771bbc3dbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289633, "uuid": "92d277b5-db65-4e48-8fe6-6a9d446babfa", "comment": "Malware payload (Mirai)", "value": "fa06b2bb9cd86b9d3de8c9fad6dc264d47a48576426ee3c26f10f515686c5b6d5a2fb0eb9abe52a9973f846839cbc5d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289633, "uuid": "0b8648ef-12fe-4c1e-9bff-0f1282ceea84", "value": "T1FD334B49EB47C9F0DC4305B0116EFB37A932E8A62364CE77DBE0FE6778B16425416A18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289633, "uuid": "386cb012-4663-4af2-810b-e78e7b8992a9", "value": "1536:0KfXJffPupLBfw5NXsE4D1bUVXKu0Erj+G:0C5nOLF84D+8IiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777289633, "uuid": "9a1fd138-18c8-4bb9-b5b6-783c27851fef", "value": 54876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777289633, "uuid": "42852e7a-c7ca-4cb3-99f1-ec5dba644931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289633, "uuid": "3d4dccba-7bf4-4576-a32d-f39b321ad65a", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b4e615-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276789, "uuid": "ec5b2f9c-7c68-4553-8789-f6aec80df460", "comment": "Malware payload", "value": "1affb68f91b56f4d2796ce8c5853c0af", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276789, "uuid": "b5fec507-f13a-4292-9b80-a402e73fb4cd", "comment": "Malware payload", "value": "2c0b261529ad19660d11410515e6fb0097efd03ad4d1d270908c096999a94e3d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276789, "uuid": "a615561a-d0bb-4357-9c77-cf12b208517f", "comment": "Malware payload", "value": "da984b4bdae849194da439a45c93f9a288d5ebb6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276789, "uuid": "a143d863-5e6e-4135-98e2-6a499555eef5", "comment": "Malware payload", "value": "6e47f36979732963fe3a6fbc38048bf9c7b02cda6cb1fa4a64d35bf3de447e7692d355a6d2a1dab95667aa3ca2c5dc1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276789, "uuid": "24c6b121-201d-4708-8b4d-3bbe4210f0be", "value": "T10C3722499F6D9BCF803C659014BA47890EED4F0C604BAACA14B7BD2B11DB76D1037EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276789, "uuid": "f3f1cbf7-fc8d-445b-8a16-71aba4ac2afe", "value": "49152:2oXKoXLoXToX8oXaoXwoXZoXzoX1oXLoXVoXX9UToeoXyoXSoXLoXjoXx9UTotoq:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276789, "uuid": "993635e4-e20d-44b3-8c46-c5a06ca01eed", "value": 23944456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276789, "uuid": "db5f8331-4d3b-4d23-9e82-2ce3a21baf19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276789, "uuid": "edbc5351-be2a-4b78-acf9-c43a2774d173", "value": "invoice-1645080830.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7587d1-4251-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777305451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305451, "uuid": "0ec922a5-1714-4cd5-a500-c2f6dc2b0857", "comment": "Malware payload (NanoCore)", "value": "ec0381bf2a31d2ce2e4a00f809db6266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305451, "uuid": "079541d9-2fcd-4d1e-ae85-747edd2e9131", "comment": "Malware payload (NanoCore)", "value": "2c14151d8f546aed480a7eda9be556bd37831020a3ab6d40eb993c260c9ee26b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305451, "uuid": "1488b267-04c3-44ec-bf3f-f8b6339fe45e", "comment": "Malware payload (NanoCore)", "value": "cbb5b6fc88aa57b1675a71a7e1d9eede95238315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305451, "uuid": "462b6536-f35c-4463-91a7-0b1beeb0a668", "comment": "Malware payload (NanoCore)", "value": "ec3dce417ea77de9d5ffe299d314856d9fe313aef6f2d0756bd3c1d5189229fa7ec47b248eca9b4b3e92aa5ea87b0095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305451, "uuid": "0fe6d880-e1a0-4a3c-be62-dc1758bd8526", "value": "T1D814C01577A94A2FD2DE82B961221143937CC2E399C3F7EE28D864B74F267E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305451, "uuid": "b2515d0c-730b-447a-b0c0-1322c5134b13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305451, "uuid": "154d7114-7687-4e47-8aec-215e478ff56a", "value": "6144:sLV6Bta6dtJmakIM5PMBrwBJnaMC8xFev7y4QT1ta:sLV6BtpmkKMFIPHPe2Dta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777305451, "uuid": "af95010e-0c00-45a7-868c-5c7b33573756", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777305451, "uuid": "d3cfc632-cbf7-45d8-bd14-0dc2b1173eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305451, "uuid": "f8cedcf6-7805-496d-b081-c165109308a6", "value": "sex1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f709908a-422a-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1777288772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288772, "uuid": "43a5ddf1-6bea-4cea-bb7c-623965413e6d", "comment": "Malware payload (Stealc)", "value": "001fc7dd74478b4f64568dd2a8aa2cad", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288772, "uuid": "991a175f-7cba-4e08-b846-56a3b6822605", "comment": "Malware payload (Stealc)", "value": "2cd3507909391d0a8cbea8300ffc5d77805a3f475e9991c43a105913095725ae", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288772, "uuid": "49bae712-85d1-4699-b072-00fdaba586ee", "comment": "Malware payload (Stealc)", "value": "bbee4a282f113b3f2f8753cc9150b46f3d7391aa", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288772, "uuid": "0c5ebe44-694f-43c2-b100-da18c69cfc02", "comment": "Malware payload (Stealc)", "value": "6d46447fe3e3a2e14e9c841becd065934034aa714d39533ef0e27ef3be3493bac3d40a5a31f740db112b1b00a1604770", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288772, "uuid": "c82ee383-0b24-42f2-979c-630440c79516", "value": "T1550633FD0F16E8DFC71C6BB13E18CD8CA960CA018DA4CD9B33D53E6A649950FC6A5861", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288772, "uuid": "f3b8a263-4208-4eca-9b8a-e02c6e9b3752", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288772, "uuid": "a04ca049-a4db-43fc-b027-5d56de1e3725", "value": "98304:GfFxvxSRiXoTFVXYGAOkQcfUkPb4aXAE7+kLC:cEqoTFVX/AOPcIurJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777288772, "uuid": "e862fc62-58fb-4813-9353-3402591de4bb", "value": 3778576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777288772, "uuid": "824aeb08-8a7e-4692-ad91-e9ab186f55a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288772, "uuid": "1ec4be9b-f780-4be2-b255-a6a63e84854d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4154ca49-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279448, "uuid": "87309de0-0afb-4457-9b3d-8a2357004c87", "comment": "Malware payload", "value": "038fd7d9ae0552d06a6a205cfa756d9c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279448, "uuid": "be429731-1f83-4f62-ac57-50e69566cd5a", "comment": "Malware payload", "value": "2d6a8fe21948fb631eb1e76a66624b2b94bff57fb53f38147863c33aeb7531d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279448, "uuid": "26c38691-8bad-4a91-8d8f-e48776b933d5", "comment": "Malware payload", "value": "4babbe191e2d0eb20c095e5a89f61efb7339865b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279448, "uuid": "ca60fd32-56b2-4df7-a9b1-3f4673d5af3c", "comment": "Malware payload", "value": "b83542e7fb5c3c18790042f4c987101035379cfc550d608887894202507883b7242f6a5f4af234a2ccfce71d908d38b1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279448, "uuid": "e439a4a1-8ef0-4bba-8b08-91f59243f297", "value": "T1BF37238A4F769F6A4ABD25BD96FF0D8EC3C93F601040FE32985AB4C43A86E90751D174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279448, "uuid": "774d9ba7-7018-446d-b371-edd5e0170ef4", "value": "49152:1vovIeAdcV7ukiC453xa4mJ3DZiC453xa/ZqYAFTCTUD7lduiC453xauiC453xaj:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279448, "uuid": "9d314dda-6ca4-4d58-bdc8-e7637fff2974", "value": 22903935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279448, "uuid": "95b6f294-8560-4033-b0e6-a75a9245820f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279448, "uuid": "f7c29ec2-9764-4f1b-9339-886bb73d8841", "value": "invoice-1645080830.pdf (53).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300f423a-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777264816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264816, "uuid": "8bf82424-7d67-49fa-b5fa-e0710956ca90", "comment": "Malware payload (NanoCore)", "value": "3d466a3ae8ddb6f22fae721642a6da4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264816, "uuid": "d65c31e6-f45e-4e31-bfff-ab9d1f9d5641", "comment": "Malware payload (NanoCore)", "value": "2dd9b9ea3a5afc1f3b0f36dd64b16444fcfa49284c18d34159b1b43b8460554d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264816, "uuid": "7d3df7da-3803-4bfd-b582-26347cb6a9bc", "comment": "Malware payload (NanoCore)", "value": "2240acc0f64bb50797687d6429d325e6cdd823a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264816, "uuid": "e391c4ac-1166-4e97-9834-4eaeea2dfc98", "comment": "Malware payload (NanoCore)", "value": "c8136bbf4977d41aa3b9dab67e033fc77b13ee572182c1a1de6cd28eb62317864cf8acd275c4b28e2505b42371aad7cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264816, "uuid": "a9bf3e32-2fa1-4e70-a823-889371bd7a4d", "value": "T12D64AF1537A8B52FD28D457427126176533889D2ACC3E7DA28CC72EB7A7EAE0053B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264816, "uuid": "8c705f53-cbe5-407b-8ef5-4ddc3a2ebacc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264816, "uuid": "98874e18-31b9-43ed-97cb-5170e58be470", "value": "6144:WLV6Bta6dtJmakIM55E1KZWi6cdCiLQY0B:WLV6Btpmkr15vcBB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777264816, "uuid": "a905181b-7033-4c57-916c-5761c0debc65", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777264816, "uuid": "6941d60f-52db-4149-99bd-0e1de9674039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264816, "uuid": "cb34fc64-0961-45ee-b481-85aaff417479", "value": "au88school.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138676fc-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278941, "uuid": "7dbf7675-d36d-459c-b8f7-abc0130366b2", "comment": "Malware payload", "value": "d68c3d9c5bb45f4f890d447c90ce70ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278941, "uuid": "35e9b6bc-a54c-49d3-9454-44fbf74b5c95", "comment": "Malware payload", "value": "2e24e94d3f230ba6a6e27c21b2b7b3808d136e4d49e4489e5c0045e3ed978e2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278941, "uuid": "9ce5a09b-0392-4df4-936b-0bcc37cd9b9e", "comment": "Malware payload", "value": "d6d898ffd5271ce27c3c1c0789ab9d81a101a622", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278941, "uuid": "067e3eec-ee78-4c95-9e61-454d05dc9c21", "comment": "Malware payload", "value": "ae7df5669045c16675f117e5fffd96ac3360de051dbd7963dc8a6ffef7a68e65f147e5b6bf82d28c29ea477cf06b9ac2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278941, "uuid": "0b997b92-72a6-41c0-9163-541ddc18974f", "value": "T1043723044A796D0E88348FB8A46F571F2BF4821CBEE47AE5D6D149CFBA0FD26315035A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278941, "uuid": "bd4b0e62-4741-4a5c-86f7-1170f4d6f7dc", "value": "49152:xCNTCNjCNnCN2CNUCNOCNQCNtCNtCN6CNnCNEJ0f4CNDCNjCNACNUCNIJ0fZCNWe:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278941, "uuid": "2c7abc29-de2c-4bc6-ac0b-eb52f7b409af", "value": 23944473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278941, "uuid": "be76d7dc-0832-4b5e-ad95-6db48cd9c180", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278941, "uuid": "cf4e398a-8bc4-4666-940a-01135520acf7", "value": "invoice-1645080830.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb59d33-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285136, "uuid": "baa62125-6bc4-4c01-bbd0-febc8c18715f", "comment": "Malware payload (Mirai)", "value": "44a7ee1a9fd94fd894fbc6dd36139e7f", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285136, "uuid": "af2e3dca-f5ac-4905-acbf-01d2165d5b34", "comment": "Malware payload (Mirai)", "value": "2ed3425be9ef6ad3cfa774cc0c076b84bc4ce39971a7fd625f305beff8a66bde", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285136, "uuid": "34ff2687-5729-4245-8a6c-c976bd70a2da", "comment": "Malware payload (Mirai)", "value": "2deb1d936601dce8c6351dc2af5b72c7adf080ca", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285136, "uuid": "aa45b60a-11d8-4157-8b4f-8a73083e4d7b", "comment": "Malware payload (Mirai)", "value": "c217753ddb6562526c8c59832598847c5ea7c7772091fe0db7b727d6c56172e3e09da577c6e09df4d3ebdea381a0779c", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285136, "uuid": "918bdc50-c2ca-4fbe-9881-e719946f0db6", "value": "T195E43955F8809F61C6C539B6F74D42A873074B79D3EB72069A245B343BEB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285136, "uuid": "919aaaed-8a02-44dd-8199-6eb6f82c41b7", "value": "12288:+t0q4jmujT9dN8DTXIIa8LLBevGSLaRthwDImGbbvLTr8pQcCjy:g0muj5AX+OL4vGO+teDgYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285136, "uuid": "07961d28-e644-471f-aef6-ec5f892275a6", "value": 666632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285136, "uuid": "0f5612ec-eb74-4704-b830-e5de081fbd78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285136, "uuid": "3c9cfc7b-10e9-4021-afdb-5860d4356eec", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b6143e-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284198, "uuid": "a32c3b76-e016-4d5b-8cd6-84e30429326b", "comment": "Malware payload", "value": "1e9b28f25664ad2af723790cbe06032e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284198, "uuid": "a97c9983-ea65-4b05-95f9-6056d5679563", "comment": "Malware payload", "value": "2f141bb63946c29b6ebf7d4bbf70a64178101d77edd505d0bbc18f0667ba5dd5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284198, "uuid": "f13a6835-b9ff-441b-b9e8-6e96a46591ef", "comment": "Malware payload", "value": "fd5984455f9468756a615669957dafd9d26499b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284198, "uuid": "ec0c2587-291e-4631-b878-f61f6b37a369", "comment": "Malware payload", "value": "fa69c03b16a098af08a17372b8cb37b177ba90a7f1feb5cc935219d6ac6df36916b78d194b6d350484db1aa8f385ca39", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284198, "uuid": "9d38bd70-e94b-421c-8012-409973d779d2", "value": "T18037134E49AE3C7B49FD621C6A2F8D5A73BACE944059E2C81193115B9F1EB0F630D2CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284198, "uuid": "478887ce-e65f-4ba9-99a1-6524ff43ef3c", "value": "49152:glU1slU1ZlU1GlU1wlU1flU1VlU19lU10lU1QlU1TlU1KlU1JkMYlU1DlU1hlU1E:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284198, "uuid": "2110ddde-2466-4986-b1f8-454fda2fd31c", "value": 23164063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284198, "uuid": "38f514b1-c362-49d1-b952-8800570d4d63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284198, "uuid": "5203ae8f-05a1-4591-bcba-76a8396182a2", "value": "invoice-1645080830.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575c7b02-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285498, "uuid": "9919ab1e-2caa-4c2d-8534-73a5366ecdd7", "comment": "Malware payload", "value": "6dd799c3c2355c2f329567b120536dda", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285498, "uuid": "f29154af-e768-448d-918d-cf9d110be0b3", "comment": "Malware payload", "value": "2f5ad7351172ad252b555a8364d83b7cc805f55ade41bacceaf4bfe224321095", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285498, "uuid": "117fb876-12b7-4a61-bb86-40284e897810", "comment": "Malware payload", "value": "0fa941ede74fdcf39eb5609948051ed4900ef301", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285498, "uuid": "237eb783-74ff-4357-8e6d-1aa294473239", "comment": "Malware payload", "value": "3e844dc9634fbbf2400d11bdeb1e21e70465d6ce808f376b6a70b97107750e32688d230c68a720298ebde32e2f57bd96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285498, "uuid": "560a0b9d-29f1-47bf-b86b-8f540ae5d0c6", "value": "T1DD372300CC35FD9BCA1D029CA0DF0B1E18AAE34191A768EA5BBBBD55217B70C2197777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285498, "uuid": "42c150ce-9dd0-47ed-b795-427424e84632", "value": "49152:fxrxtxux4xLxtx+xpxMx0xrx/T9W2xExuxBxdxQT9WlxXxbxKxqxlx5xpxkxDxvz:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285498, "uuid": "5f51d14c-e604-44f9-8ac8-3b61a78d210f", "value": 23424193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285498, "uuid": "898dcec2-ba14-4bef-9adc-de9130639d32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285498, "uuid": "b66198d7-85ee-469b-aaab-0d07efe3215e", "value": "invoice-1645080830.pdf (63).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b982fb-4227-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777287233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287233, "uuid": "ee0ae0af-75b8-4520-b979-27c3d0d444e9", "comment": "Malware payload", "value": "afc208aa46b78f56bd530ed955ff8f2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287233, "uuid": "dcec49c5-3112-4076-9ca1-cd79c41cdbb3", "comment": "Malware payload", "value": "2fcc2db37c0c78d06a71002c1ac287fd68f024ec0717306629166c9b2225756e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287233, "uuid": "231377c9-f296-43c3-800a-606d27ba3ae3", "comment": "Malware payload", "value": "3d413a69f1c292886e3fe8d7c046fdd64a9dcb07", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287233, "uuid": "af5cb592-3ecb-43f4-a6f6-fff0f85ef1fb", "comment": "Malware payload", "value": "470eae302c3a6d82591873703fc33128390396071b67f396c9a889113f6a644ec664e156a3a79befb0bef29f1c153111", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287233, "uuid": "4f1b2c22-c15b-4400-938d-7692fd9bb20c", "value": "T1C3352300BD884B2BC4B50B3ADE26868222186D64DEAA4D5FBF71335CE531F8D1F87785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287233, "uuid": "d61113e8-48d7-4544-ae27-bbffb42b252c", "value": "24576:Atdzb70sRG80z4V3C/BHLm4SOD5E+OxA9Ks+Y+719GICsLEyr:Mpb70bLz48/XSOtE+OoD+X719Gg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777287233, "uuid": "c170af7f-3208-41b6-9e79-f2c05b4db8a7", "value": 1144588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777287233, "uuid": "cdc21daa-7cb1-4e85-94e2-aa813d51e414", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287233, "uuid": "004ea4fa-c589-48ea-b7fc-54788b3a5633", "value": "Intimvideolararxivi20_042026.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47168092-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276021, "uuid": "4368fe1b-2f98-4427-afa7-8684435c97e8", "comment": "Malware payload", "value": "c25b462b9823fa04fdbbf1609edacd75", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276021, "uuid": "f5df44fe-12c8-4493-b231-082b0c6eaf27", "comment": "Malware payload", "value": "2fe201d324f1c708afd17a57e32e2590146b505e53f69a0e39b7455afec40fac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276021, "uuid": "538bea40-47cf-4a9c-9a56-209d6990ae07", "comment": "Malware payload", "value": "0953cabee3ccc31e53c43b920f297676676c19c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276021, "uuid": "da596111-49a6-4acd-a86b-2991fa31bf0a", "comment": "Malware payload", "value": "76cda06768ff1fc9ae43c414f74c85d0528683b2e92391bc5ab9da5b5f90858e95f68418064e82372e58e73aeb32c290", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276021, "uuid": "da6e8069-2d0e-47e2-aa2c-2f371c1a9828", "value": "T15337234C4719AE6B066CB7B4242F0F0AA5990E844BBC4DF972D6391E56DEA8C334F374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276021, "uuid": "02ec01f2-2ef7-4373-b6a2-71a7ef3f4205", "value": "49152:wZjIjIZjIjsZjIjxZjIj2ZjIjSZjIjAZjIjVZjIj1ZjIjvZjIjrZjIjnZjIjV98u:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276021, "uuid": "0a175370-225c-4aa4-8f4a-ea8856421021", "value": 23684340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276021, "uuid": "100ce4d0-f7a1-43f0-a80e-4a7f72f85b89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276021, "uuid": "9be4ffd1-2844-4487-89c1-43ffe4c75363", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6918c6d-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283993, "uuid": "65204653-4aa3-4946-9d7a-09129a1851ab", "comment": "Malware payload", "value": "fbc055bb9846b028c0dec472bca271d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283993, "uuid": "6418202e-bc85-490c-b2cd-6ebb119eb93b", "comment": "Malware payload", "value": "30ce1ac0b765e561c5ed708e6c90dd77ae43d31eaf6cd074564f57e21b1a543c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283993, "uuid": "9e804d4d-5049-4934-9396-eb5bb8617193", "comment": "Malware payload", "value": "9f54ba223969748dd03a57a556f3721d8678270c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283993, "uuid": "c637315e-6cf8-45de-9133-eccd1cbda14d", "comment": "Malware payload", "value": "c603f58bfc7533ef95ba8ae66cfbf833894795a1fe487d3b6850d7794f411cd036799e1e9b4f72936829ab2b8efaa6c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283993, "uuid": "be7d0715-f334-48f5-8326-6eaf3e88a595", "value": "T1693723260D7F8FB98AF59DB4003B43DB6DD63A0A9C6D816855EB6D17237FF1A010A138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283993, "uuid": "c2f536a7-7c8f-41bb-a174-9df00d7331d7", "value": "49152:hqKuIqKu3qKumqKuHqKurqKuFqKu9qKu1qKuIqKu7qKu/qKu1MkT3qKuhqKuWqKp:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283993, "uuid": "935238b1-acf0-4375-9795-736cf5dc8028", "value": 22903947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283993, "uuid": "e0a68c9d-2b30-46aa-8773-dd0bb00dffaa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283993, "uuid": "79932c25-c516-471f-9029-63f7142b76f3", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd274ba-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283656, "uuid": "b7346796-9304-41e0-bdd4-c948fc94749d", "comment": "Malware payload", "value": "201ed27b0120ce446d6329066e6357bb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283656, "uuid": "7459a895-7e35-4060-a08d-775fb428e590", "comment": "Malware payload", "value": "30e3bbdf7d0344a7006f783d8331cab42fd6a693ab8ec6acc6c8e6cb517a5944", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283656, "uuid": "76511aea-428b-487f-ad99-35be50683436", "comment": "Malware payload", "value": "30a37f6b15f6c5c8c144d4486b2afbb6a8a68bae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283656, "uuid": "e91a8b36-35d8-4316-9ece-b11356dec69f", "comment": "Malware payload", "value": "90868b2bd57e6d3fe2f51f446a49fc2762a0ffe49c5d23aec1baa2d24785aec5601f6b5b7e1387b2f68152030e153115", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283656, "uuid": "06a86806-ef60-4384-97de-800db7fd69a9", "value": "T1073723072D1E5D3F4AE95220F97DC70D0BFD46807258DA9C269E3DEF4E1AF0291A74A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283656, "uuid": "e1d8b445-d3d1-498f-aefe-d79d818e4a44", "value": "49152:qRrDlqgh/9zpC66VsNE79ZX66VsiohKtEJvbEiSoPk66Vs666Vsy4Zu66VsRvMhF:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283656, "uuid": "dd647d14-726d-4239-8372-d1317bb9208d", "value": 22903951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283656, "uuid": "b17e00cc-84ae-4766-86c7-a5b122a769ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283656, "uuid": "e32c0fef-1662-4906-a7b5-547d27b99921", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce97774b-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323064, "uuid": "b316ec83-7151-42b1-8325-b365e2039cee", "comment": "Malware payload (Mirai)", "value": "9c9580b8e597934ed47dbd6e860a9085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323064, "uuid": "7437eef1-a5d7-46d6-a90f-45dc67617298", "comment": "Malware payload (Mirai)", "value": "3157b88f032a54db0b4ad6928afe148c138190b45942d7e48065a313eaae211d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323064, "uuid": "4cb220c6-148a-4c00-894a-a7708a855890", "comment": "Malware payload (Mirai)", "value": "a487a31d336539694b0d8ddd9693679770b3a7aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323064, "uuid": "1c2793df-f326-4895-a9c6-1513981c8ca1", "comment": "Malware payload (Mirai)", "value": "b3af19a6cfd189e208f21b2b1eeea758cdcace1f841abbb91d05c48f0074a8de1638ba4399b81180e222bfb8521d3107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323064, "uuid": "1e222c27-4c39-43b6-959f-b27d806d69e0", "value": "T1D3432885FCD2996AC6D013BAA72F358E33A1B3E4D1CB3603CC945B25738968F1D66B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323064, "uuid": "a35cbd7f-f930-4a7f-b8bd-5c337d74360c", "value": "1536:nRpDfwhNTvjG82EFMH81AMLjRKDt5Z79:nRpDIhNTviTUZIZ79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323064, "uuid": "2f5f11c5-aeee-4582-895e-a1c5f0ce5a45", "value": 55884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323064, "uuid": "177df2a6-d307-4542-a9be-172ca90b6498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323064, "uuid": "17368902-5a67-472e-97dd-9ce6588ffac4", "value": "vaxstresser.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b671c698-4243-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777299401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777299401, "uuid": "c0e63d62-4d32-40b5-98da-0a62982bc07b", "comment": "Malware payload", "value": "262371a03aa9660e8693238a32f8307b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777299401, "uuid": "524e8d75-2e11-4427-b990-dae722aef549", "comment": "Malware payload", "value": "31786fcba1527c44ef0ba424f897958767f98b76274f563235d2fa9ea33c013f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777299401, "uuid": "56567c73-11cb-4e59-a3c6-4eee77504e81", "comment": "Malware payload", "value": "5ae1d3aed4e8fae75956fc33e2e67c9f7204a7e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777299401, "uuid": "86914f04-fb67-4cdc-8d12-d1d0a10b87bb", "comment": "Malware payload", "value": "1b233c880bd2085422a977b452a63d008517bed75cce8a14e146839d6d12404f9b42ba6af992b296f05b855ecf1a0ebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777299401, "uuid": "2a526970-e056-4821-86e7-0bd87b4517e8", "value": "T1B045B021B6C5B036C2A712B15F7AF37556397D260722C29737C83AE63E7C5812A39723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777299401, "uuid": "75957613-116c-45ed-af16-457440334175", "value": "996ba3d23338d63c8825c8141d814e4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777299401, "uuid": "f646cf9e-635c-430a-877e-7867469a3c16", "value": "12288:chkDgouVA21xKko6vdRgQriDwOIlmxiZnYQE7PJc+NoRybqy7rFPOeOJ2uGE:URmrk1oQricOI0xiZY1bNMaqyxOpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777299401, "uuid": "09f6d15d-29dd-4d53-8e8d-3b6ceff2bd0e", "value": 1234008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777299401, "uuid": "b990ceb4-b8d1-43f3-bcab-2fa38450b38e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777299401, "uuid": "25d45ff3-0d8b-443b-98a3-9a0c86d677ac", "value": "M3Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cce762-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777275969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275969, "uuid": "505c2316-1a77-4efc-9377-957a109b704a", "comment": "Malware payload", "value": "471ce4b063cb500b17e04acd9a8d4ff1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275969, "uuid": "2e590a6c-aff9-4d9d-a333-df800948d29e", "comment": "Malware payload", "value": "31871a6edc410041b8160e3d7acc6f8b369dd975e08ced0a90d15bb19698ee59", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275969, "uuid": "ab238ce5-da07-44ea-9181-3006c473549e", "comment": "Malware payload", "value": "139ccf809ba7347932028fc0e209a273149e900d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275969, "uuid": "be257d8a-9871-4a2a-b75b-b96b999a7d0c", "comment": "Malware payload", "value": "a9a7f484250177ebebb1d15b6869f7aa6f851ad3afc769c2090d4bcc3dea238c9bc7707cc708bbd1d53038e15580b799", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275969, "uuid": "31e6e9f3-ec99-46d2-a93a-9dafbd56aaee", "value": "T161372313593E065F8D3C811AC66F6F4921BF28590312EBC1BE312D875E2EFAB506259F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275969, "uuid": "81784c6c-b4ac-450b-8b29-1c14071d0ef8", "value": "49152:KN8R2N8R1N8RdN8RMN8RsN8RmN8RIN8RiN8R/N8RGN8RkN8RzsiUdN8RtN8RPN8U:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777275969, "uuid": "c7c11b6e-6ac1-4375-a068-bd5d650eda9b", "value": 23424199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777275969, "uuid": "da649d66-48a0-42da-b9c8-95dad2efbb1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275969, "uuid": "a911c63c-0606-4131-a72c-ebaf891512e4", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a5ee48-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280750, "uuid": "a67e6eb7-21c8-4a4b-a4e4-e612eca32ad7", "comment": "Malware payload", "value": "af22ac2b21a30450c69fe8bdec73bf89", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280750, "uuid": "973d4eb5-48db-407b-bf04-dfc35c7f33ea", "comment": "Malware payload", "value": "319a722e907eebf9c0d17ab29f6e01b2f61c6b3ad87ebd70674ee4daa4b170bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280750, "uuid": "facd941e-9ed3-418c-90b9-4812d171a00e", "comment": "Malware payload", "value": "255e6ab37fed1c85429518254de52d496c7ab2db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280750, "uuid": "2f149aaf-57b0-4460-8f15-d0f714f77d08", "comment": "Malware payload", "value": "1f2892844197ca181869ffb505be42eaa4486ee070f10473108f4cdf2186cb74996db68c67e36dfa187aa7c63ce83862", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280750, "uuid": "431fa662-1081-465f-90eb-3a3f4e34e7f8", "value": "T109271351DDD4E279C9CAA62C14FB1F4B6708BE021270CA7986B774FF820BF14459F2A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280750, "uuid": "362e8b30-c66d-47de-8804-8d54a86aeb57", "value": "49152:w4fW4f34fV4fV4fG4fA4fi4fh4fH4fI4ff4fw6o4fr4fi4fE4fc4fC6t4f64fW41:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280750, "uuid": "f5b97b37-0c7d-400e-ab53-2a0e4c202658", "value": 21863410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280750, "uuid": "55bd66b6-b741-4f22-abed-d4b023a5aa50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280750, "uuid": "626c7968-eee4-416f-9be4-9d1143da4357", "value": "invoice-1645080830.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca0419e-422b-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777288969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288969, "uuid": "27ff04c8-dd56-4453-8cad-f2cfa8bdb2e7", "comment": "Malware payload (XWorm)", "value": "922df61382eb4bed710252307ecc5d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288969, "uuid": "9e6f67ad-0e41-4433-b715-fd87ee4ae385", "comment": "Malware payload (XWorm)", "value": "328fee4b831d3c568f90f3ce2468d9b1816d6a212891e207bff154461f5a737e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288969, "uuid": "4c2388c1-4259-4192-9b27-2efd50d12629", "comment": "Malware payload (XWorm)", "value": "35aa5ebc0fc413bda5091b93accfe0327bef5f09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288969, "uuid": "1b47cbc1-30a2-4173-9149-6c6b130802eb", "comment": "Malware payload (XWorm)", "value": "7790cf94d245c62bf2a7cb0916ce05cf5ed2b30027323b8a89b3fd3c98da9d552da6ed72db8591721703665af360eace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288969, "uuid": "d264ce5b-7d3f-4939-9301-47cca23b6fee", "value": "T1CF95122553D0592AED7F5774C0E067202B78BB1A0825FA0672DC1EF9EB663C1EE0166F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288969, "uuid": "8a05ea6c-e7d0-43d0-b381-b782270ab880", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288969, "uuid": "0f23ca4c-b2a5-434d-926f-b0abb88a7d08", "value": "49152:mHPgx503dnlXrEttRXFQ2Jsgx+9rLYxJFw0Jv6qwB/U3y2:mHPs0tlb2tReOQ0FXtwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777288969, "uuid": "69ebcd57-42f3-4adf-b140-340dbaaae4f4", "value": 1915904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777288969, "uuid": "26a3d5e8-870f-4428-a8f2-4db2fea71ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288969, "uuid": "e8c694ad-4b09-4494-a2ad-e372f7e9432b", "value": "injection.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4c2bea-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283791, "uuid": "d2e34a42-fdf7-4f7f-980f-538e0a980e58", "comment": "Malware payload", "value": "2f50a24762227898a43d15a5c6c3cee1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283791, "uuid": "f94ca4d6-6923-4e8a-ad75-b6d70360fa82", "comment": "Malware payload", "value": "335d50f8758cdab8cfba686bc3856941cfb24ef0c01868e211fafdc292bde050", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283791, "uuid": "4092da6b-83a1-4a88-b437-6c63f71c972b", "comment": "Malware payload", "value": "09968a19a22c5f55fa754ec07e37a70ed383f3e5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283791, "uuid": "d5053e8d-6c2e-484b-a275-65215da3748e", "comment": "Malware payload", "value": "1ebdcefe58f81881ede2c2813b4f36b9e004dc0a032c9cd723e1bc645e7043d5184917b17178f81a187b6a9d66f10aee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283791, "uuid": "c2491d40-8fbd-4a22-a8fa-6f1e58a6a65e", "value": "T1CD372313AF06EF3762552900383B0B0C16BA4F7CD9559CCA2AE1B89B43EDF4837D9599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283791, "uuid": "ed3d22b0-0e4b-46b0-8508-df13f24641e2", "value": "49152:dUEUVUAUZUXUxU7UjUyUhUBUNUKUPURUpUbUHU9UcUUUCU1UyUjUOUgU2UTUHU/W:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283791, "uuid": "d67cdf43-2133-44d5-9030-55b15d7c50aa", "value": 22903934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283791, "uuid": "51536c0e-2c6c-42aa-8fb6-1dc4ed4d4839", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283791, "uuid": "f1313b99-7465-46ac-99d7-f591910391f0", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fa45a1-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276375, "uuid": "ddd96e6b-f2d6-4967-aabe-97b89508f70f", "comment": "Malware payload", "value": "37f507b8f0ca0756efd3e4182e8c4dc7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276375, "uuid": "4f7a7f91-ae7d-4051-aeb9-024a41a2f62f", "comment": "Malware payload", "value": "33663e7cef16aa21ba6d496f20915d9889823149a627e56a0fff440e40fc89ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276375, "uuid": "ad1d8199-f89a-4ce8-98dd-81bda13eee79", "comment": "Malware payload", "value": "a47b6d87cadd0d0cad119e989836ea408b0a9d5e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276375, "uuid": "d6c221e0-a326-49f1-8f0f-98abf6f4ec44", "comment": "Malware payload", "value": "20c35c82f26f591d8dc2ca3a0a31ecb66e76de8cc3ba5ee1fb1f01153d740d9b3e7fa78c970239e88b97dc1b9cae88a4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276375, "uuid": "c54d92fb-dc63-4f79-bea8-68d3bec4be38", "value": "T1DD3722C14C659B1F88B807EF183F873931F5AF400504B696B7B268BA4E1F61D127A6F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276375, "uuid": "ba5a1079-05fa-4a23-87d6-b4fc3097474d", "value": "49152:9dRqB2udRqB2EdRqB2+dRqB2GdRqB2DdRqB2NdRqB2UdRqB2/dRqB2AdRqB2edRl:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276375, "uuid": "4dbbce39-f13c-4c78-8208-0fbb25893f63", "value": 22903931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276375, "uuid": "a416053d-af66-43a9-b444-95495ef8c8f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276375, "uuid": "49a4ee52-e058-45de-85ce-5e35b53b11a1", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c681500e-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276665, "uuid": "55d0b55f-89eb-441d-ab23-33a52d5ec34d", "comment": "Malware payload", "value": "efcd7b35c6ef8930c2df2965ab0797cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276665, "uuid": "9faf8633-3b72-4b5e-8462-4525526819ee", "comment": "Malware payload", "value": "345e08e6a94ad322f25bcb1ceb94057ae46e943845629a984f549bd6409d53e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276665, "uuid": "9c0382ad-9d3c-4fb2-b31b-f679a1751ba5", "comment": "Malware payload", "value": "a3f3014eda98565118b4345a39c59cb3dadc8ed3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276665, "uuid": "be41a55c-3913-4437-99a5-f4961526dd1c", "comment": "Malware payload", "value": "564e3daab17e1e2e86d3866b84c50cf85c6281603e624af42047127765bac948fe5d8f433ba896553be92ff9603c5df8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276665, "uuid": "fbe1ff21-2777-4e9b-a246-2b609d5b7253", "value": "T1E93723115B3FC8AEA46812BC249B37676FF90B885B98777A9F127D0C583CF06117A427", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276665, "uuid": "eae2ae1e-f1a7-4803-b7d0-698805e10d65", "value": "49152:jwfUZwfUswfUCwfUswfUbwfUpwfU9wfUAwfU0wfUbwfUOwfU0Aq+R7hwfURwfU/M:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276665, "uuid": "ea2aa5ca-a4dd-4617-bbb1-73a37cd06846", "value": 22643805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276665, "uuid": "8c3c09a8-ea1f-4dab-84e9-897f30a388ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276665, "uuid": "931859e1-d526-4e0e-8964-007247824008", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33a5c9e-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285276, "uuid": "bd9bdd37-1cd9-46e4-87b5-e7d371a5455f", "comment": "Malware payload (Mirai)", "value": "d09fbad34564dc4d0b94036cc8e63444", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285276, "uuid": "edff5d98-52b5-4b72-95e0-378ba0820413", "comment": "Malware payload (Mirai)", "value": "34c642d25fecc20acdc305f63e4d4c507cc841223a80a778ceadb2251e331792", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285276, "uuid": "af802452-bb6d-4b7b-85a8-b91663b18555", "comment": "Malware payload (Mirai)", "value": "96a46a6784990d19a0fde84e362469dcd9f72df4", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285276, "uuid": "d6c5b516-f334-4387-8170-b41471373147", "comment": "Malware payload (Mirai)", "value": "f4f02608ae3f9ed8e06520f63e945bf7448b9f7f1bb1cbc516d13a952c24b03291e4e539d651d14d74f3f44714a906af", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285276, "uuid": "b524efbe-1e73-4cf3-8930-05a5cebc1704", "value": "T137055B46FF184562C9571DF01A3F43D9F7207A4340F5922A270F6B572632E3AAAD378A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285276, "uuid": "3a84790b-8ddf-4ac4-85e4-bfcb8fdd76ba", "value": "24576:kNxL6YcUO07XrfBrPxrWY6W8JNe5hlhG14:kNxmYcUO07XrfRPxj6WHXlhG14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285276, "uuid": "2c7e74cb-fc35-40bd-9403-b2d22b7ec5e2", "value": 858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285276, "uuid": "a4ff0346-4452-4235-82ff-5b1b3242235e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285276, "uuid": "f4381b8f-d651-49ca-8b89-1631f092dbbc", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0d4049-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276191, "uuid": "dd442196-a6a6-4999-8d38-73a0ba63f687", "comment": "Malware payload", "value": "4ac170a87483df96d9be4a25be6d515a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276191, "uuid": "d8471c59-89dd-431e-8968-0c15bc47dc89", "comment": "Malware payload", "value": "34f3bfca5f31fe5645a3482bcff73e1aa77243b81a7d8c631857b06d08dfeb8f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276191, "uuid": "32e0c5be-f18b-48c1-be4e-69ff224f74e1", "comment": "Malware payload", "value": "559c8175a3a073d5678a35383b0ab54b49d97708", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276191, "uuid": "a41653f6-a706-427e-afe7-faea31e6d35d", "comment": "Malware payload", "value": "a7457abdbe4a4aa856d13f3b42735f0023c67779eaee8cc90e2c6a44fc1cdc0dd931060e5306f023ab87eb8c2c915341", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276191, "uuid": "6993efe6-3027-4c80-8d86-fe5259fe1331", "value": "T17727225AFF9C4BEECBE8731D00B91F8E7B744A0109133DE6A74625C9956FF0051AC29A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276191, "uuid": "1ffd63f8-1fb9-4021-ad7c-5daffb448a16", "value": "49152:MxZgxZ/xZixZlxZrxZpxZAxZSxZ0xZKxZMxZ1zpDpxZvxZmxZGxZSxZtzpD6xZ4S:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276191, "uuid": "98a5415d-5a65-4156-9e75-4052cebee343", "value": 21603288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276191, "uuid": "528dc859-3f95-4706-b1f4-ba6fc41695d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276191, "uuid": "b033aead-ac79-4b39-a02d-3429f4fa7603", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407b0c19-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321967, "uuid": "36d58b51-230e-421c-9b8e-5fc6ab7935b2", "comment": "Malware payload", "value": "3a36c26575c8761551aeafa4a958595d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321967, "uuid": "e8eb6f8c-abdb-4f98-ae4d-97534b2fe86c", "comment": "Malware payload", "value": "35023f6a553624d4005bf1b759376d5c9cf59991de6b3199a95311e98a4c7560", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321967, "uuid": "f9b90194-ced4-4e02-b84a-17cb0da1e91a", "comment": "Malware payload", "value": "142d95258d7c9d011cf539ab8b004d69283d16bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321967, "uuid": "0ea5fb25-8506-481a-b17e-24c50a9643ff", "comment": "Malware payload", "value": "27a2b423fdd88a16b1046330f89fbc346da594f74d7a967bd3d7bf7b4c364c53b015a0e05e9d44683c8047b1eb0ccda5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321967, "uuid": "866cdfcb-2e4a-414b-a013-8c78a2d42e4a", "value": "T15251F9A8C7421632FFA7182FFAA1645847C6AC03EB61154D5EFB5CCE01E0A06A67DB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321967, "uuid": "fcfdc911-936a-4066-b3db-962537d1dfb3", "value": "48:j+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:jkatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321967, "uuid": "2b3d9d29-a2a7-48c9-ab21-ac6b3c1f4b43", "value": 2495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321967, "uuid": "65670a3c-6402-4a03-9e4a-889424d1264e", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321967, "uuid": "6591364e-13ec-46fe-bbaa-bf88e7903212", "value": "164.90.195.107_1777321926612115_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88142bd5-423c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777296317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296317, "uuid": "fde35aa7-ba2a-4c7b-b393-db65f4caa47e", "comment": "Malware payload", "value": "28714c4828af3d27afe683dcbeb0d035", "object_relation": "md5", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-rpscontabil-pro", "colour": "#FF6AD0", "exportable": true, "hide_tag": false }, { "name": "rpscontabil-pro", "colour": "#C2634F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296317, "uuid": "0ad21f8c-6bd9-47ad-9548-3fc2a45c240c", "comment": "Malware payload", "value": "35b4ee8c29e1ab8ee1297f735e1499a71bc2a7e2e5844e7c3a9d420835aa0082", "object_relation": "sha256", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-rpscontabil-pro", "colour": "#FF6AD0", "exportable": true, "hide_tag": false }, { "name": "rpscontabil-pro", "colour": "#C2634F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296317, "uuid": "bc658e2a-8693-4af6-b2bd-297cb35ffd61", "comment": "Malware payload", "value": "6915bf96a4382d7aceaec4258dc56c7e108f73a7", "object_relation": "sha1", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-rpscontabil-pro", "colour": "#FF6AD0", "exportable": true, "hide_tag": false }, { "name": "rpscontabil-pro", "colour": "#C2634F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296317, "uuid": "14d8185c-adbc-4721-95f6-301e8f54f1fa", "comment": "Malware payload", "value": "e8994d3d5f2421146f4b90430d1272625cbc9b75b5e9d7c349e83756d48f648dd6881a291cf28bec2f02b13b2cb522e4", "object_relation": "sha3-384", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-rpscontabil-pro", "colour": "#FF6AD0", "exportable": true, "hide_tag": false }, { "name": "rpscontabil-pro", "colour": "#C2634F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296317, "uuid": "c0d98257-71d0-4afb-b815-9282e93d4967", "value": "T10771FA13AD261C0683B1D10942CE95C65C2D43C591934EDE3277DB798A6923EA1F77CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296317, "uuid": "b01d5e6f-24dc-437f-a051-4fda6c495abf", "value": "48:NyNfEJEl8wy3KMipwUCFD+vuTAuXV+Q2mXB8fzmJ9C6Akf2SKaXcLKFs7lhXLS:NyfevKMi6w+4g9C6HfXsLK2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777296317, "uuid": "5cce9002-fdf6-498d-9070-780bd8c5f24d", "value": 3760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777296317, "uuid": "56521f5a-11e6-41a1-8fd9-cd96ac9b3055", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296317, "uuid": "560db08f-533d-405b-9f72-12706cd96b99", "value": "tacvwan.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afda7811-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1777323012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323012, "uuid": "ec50d8a6-b25e-491a-9352-0e4a1cbb36d2", "comment": "Malware payload (EternalRocks)", "value": "b10a8162385d7576a0b17fdf141f3ea5", "object_relation": "md5", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323012, "uuid": "62e04c20-ebf0-4f6e-934f-611d26b40d46", "comment": "Malware payload (EternalRocks)", "value": "35b69e08b49d193026c6de3e823ae87dfe3e28513985e7b3848912ec259491e8", "object_relation": "sha256", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323012, "uuid": "f6a0357b-4905-428c-9104-391ed56eb5ab", "comment": "Malware payload (EternalRocks)", "value": "f22c8cbcc950a8a0785e5dc42afe75a903e64654", "object_relation": "sha1", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323012, "uuid": "8f45ab96-5b46-4818-9562-166a51b21642", "comment": "Malware payload (EternalRocks)", "value": "f505ebe293331c90dcac784eb16215c620f9c88ced283178e726d771dd3292c9638e80b96119c1460dbd7a1a3d32a294", "object_relation": "sha3-384", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323012, "uuid": "0dc255d6-3a5a-4f77-b11a-cfbf8dcd128d", "value": "T1BA45230FF5086AF2CA062FB4E5BB36E55B1A7D790E0E5C092489BF414DB21F541ACC67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323012, "uuid": "ae9272f5-3579-4875-bae1-208bba096ac0", "value": "24576:UFLGnpVGnK96lE57UoJK2FbKGnDDKPNAnS2OV3+heGy40Z4XO0l:ZIS2EJzj4CD4fpVusR40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323012, "uuid": "1daf88b2-fa6b-4912-8966-3b05257431f4", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323012, "uuid": "19a0361a-b91d-40c0-afa9-8cb85e2c5b33", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323012, "uuid": "aabfac06-2e2a-4cf5-8f32-3cbd5fd668af", "value": "install.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea6417d-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280356, "uuid": "317a6fcc-b734-42d6-a064-2d3aef676653", "comment": "Malware payload", "value": "85581a05a365ef675b3a010659241820", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280356, "uuid": "27b107e7-55ae-4db0-9cef-625b477f76fa", "comment": "Malware payload", "value": "3613044fbc6d01abe32fdb87422bc86065989511621d9418be9bc29ff44bed0b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280356, "uuid": "e6fa1f22-eafe-400d-8fb5-9443413939b0", "comment": "Malware payload", "value": "3e6998ef2e31a27f952b70e25e09cde511164ca6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280356, "uuid": "f57bd6c5-4dc0-4c39-947d-1e3cffa5572e", "comment": "Malware payload", "value": "a2f7a4a8e9b68a40d57f0f9459a9ff655e3a5943efac69f92ee764ac3db6a9ae7e45758bde136a21a7b4bfbe5e474050", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280356, "uuid": "08754eb1-ae19-4acb-97ac-858776fd3006", "value": "T13F3723985F2E6EEB813C6138107B6B0B67DA0B2693116C315F643D6EDA5ECA110CF736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280356, "uuid": "79431855-5b2b-4f47-94da-35d103a803fb", "value": "49152:/OOGMb9czkyZNcSan3H7T0AGVhfmhn3mfqcbhW3wRNaNaS/vTtXjderAirEr0H7u:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280356, "uuid": "8d7be4c0-5570-4702-a670-35ca91e45827", "value": 22903951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280356, "uuid": "6f9aa8e5-7d26-4f09-a4e0-210c0d0d87f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280356, "uuid": "7165dba8-45a6-450f-85bb-066c696442d5", "value": "invoice-1645080830.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd434e23-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279280, "uuid": "0cbd8357-4d8f-41c0-a4b5-845e5b0b3800", "comment": "Malware payload", "value": "670cffef00f7c8de24ed89183e103599", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279280, "uuid": "7575932c-a82c-40f5-90f7-c9b26d715100", "comment": "Malware payload", "value": "3668c8fc72b5eab96d6b7790134af00284efb6b18f72d576fd1be287ab6409a5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279280, "uuid": "02787cd6-7521-4cba-8ed7-72290b1bd821", "comment": "Malware payload", "value": "3da941d2994097a918aad2e3ec69ad3032096576", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279280, "uuid": "15492789-f139-4701-9835-a2afdef78c13", "comment": "Malware payload", "value": "8df5fb47cdec9e24a4b6537e64de4bdeaf2b52bd6cdb14bb624abf27835d0a434406daa2d56944baa28d2b733e7ca6c7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279280, "uuid": "5ac7bfca-e530-47d4-8076-00ec525c9bc2", "value": "T1F72722489A368F6B472815E84CFEDF4E00B28D326890DAB353DD94CF07AEE5355179CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279280, "uuid": "d39edaf6-2153-4aad-b34d-4c29e5d88387", "value": "49152:3uJu6u7uyuWuouduCuNuHuYuTeSYuuMuNuhu9uyeSYFuuuguiuhutuWuVudu2uHT:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279280, "uuid": "601decb5-a3fa-4f9e-9d19-3f90228dfc45", "value": 21863408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279280, "uuid": "cdc90a4f-41e7-4831-bee8-151755e06779", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279280, "uuid": "389c678c-463c-4633-9097-cc714515e1ab", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ee99d2-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323016, "uuid": "68b3848b-0f7d-494d-bd35-4cff007b1958", "comment": "Malware payload (Mirai)", "value": "654a40094dfd51d7d07db7b11695fa5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323016, "uuid": "7983c8af-b59b-40bc-9807-1f74add9a224", "comment": "Malware payload (Mirai)", "value": "3687e3b1afd0a4f567aea4d4bc0520b3e876e5c5223741e5ac6f07e4aab84676", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323016, "uuid": "18e36005-1b3a-45ef-a298-2389ea0f97c1", "comment": "Malware payload (Mirai)", "value": "b87df83514b77492212992b8c8837ad52b957fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323016, "uuid": "41aa11ef-648b-43cd-bd5f-128a7201f628", "comment": "Malware payload (Mirai)", "value": "a413e1a37bfbd4bec515a1296003b5a7a65d2f8e1e41a929809411adcc29085dbc127b1ee3fa2af2d4e9d97966e6d71e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323016, "uuid": "bf22fe79-d539-453c-b315-b5caaae9c534", "value": "T192C3BE97F68B24A1CC6146F007C77B8D2E6362119E6BE9E76C0E763B097A0DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323016, "uuid": "eedb8eb4-2451-4769-a801-abdb0d4c8623", "value": "1536:r5LQvJrKIEcfzXBo4BB45+LaLWqEICjCotZ0eVCUxZJmGg0z/LWA:r5LQv5gqrGqq5+LetUCokeVC9Gg0zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323016, "uuid": "1901cd76-d81b-4c3b-9e6a-09cce92ee8c6", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323016, "uuid": "9c497944-1303-4cee-8830-c0b799250c10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323016, "uuid": "51678671-1474-4b42-ae43-f5d8456a53d1", "value": "vaxstresser.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d6e2c3-4292-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777333173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333173, "uuid": "d0cecb34-8193-433a-9294-282844b7cbfd", "comment": "Malware payload", "value": "9fcbce11d7d326c3f08c024e94091158", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333173, "uuid": "1fc6e4e1-4607-48f3-8630-d881adfa7853", "comment": "Malware payload", "value": "36ab608144e29bdf3bb7e0a3f0f6c3a9c6973f1f5e9cbd8883dfdd15cb600e19", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333173, "uuid": "806ce9a5-d68b-4f9e-8f31-f7695bd0f673", "comment": "Malware payload", "value": "4159b1a26535b4762897dd663b6fd753e83cb9a6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333173, "uuid": "d8db4308-7fd7-47a6-90dc-db6b89ebf6f2", "comment": "Malware payload", "value": "07dc37f6fc3acaff4558d549ff705a6903f59a80983dcebfff7a7db3bd52e5db43958dbd5202a4f0f0fdae5c85d214ab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333173, "uuid": "8f971663-275e-44b2-9173-76dffa13b1d5", "value": "T1DA136D6556913C28AE9998371D7E1F0CBDAA83E23104A1DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333173, "uuid": "46c0d307-c101-430c-9f8b-499527b02443", "value": "768:bXXRWNGxVz9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bxlxycy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777333173, "uuid": "9f9b634c-c3e3-42b3-aec7-842310439d8b", "value": 45417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777333173, "uuid": "c9e17b68-c7be-4141-82f5-6d8d1a4482c0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333173, "uuid": "3c66ea48-153d-40a6-a8bc-35c5167aa703", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bae4c6b-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302551, "uuid": "181f6c25-1dfa-4431-a35a-2abd85a93026", "comment": "Malware payload (AgentTesla)", "value": "c6faba3c3e22a65b9e1550a640a1988d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302551, "uuid": "29032994-9cf1-405e-9daf-c53c82e6fcbe", "comment": "Malware payload (AgentTesla)", "value": "378158cca48818aaf9ee05f19a6195836aeaa82fe5d7d65d6a4ae6e20700103e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302551, "uuid": "201bd5d6-5860-4f1e-9e4b-3f0bccb807d4", "comment": "Malware payload (AgentTesla)", "value": "147d69b478a89777760201a427923d04577f9a61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302551, "uuid": "179826d0-ef13-4566-9068-934346a1f52a", "comment": "Malware payload (AgentTesla)", "value": "c9a7e194522e364e1d8ac90d1d89b02a9357ebed8b5f2e6ef2d9c3b02c01fb6114869f4304a0053ba025aa4d95ab773e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302551, "uuid": "226b6317-cbab-471a-8e2e-9cedf0aeb50f", "value": "T1AD2533D0FFE5AE61C359E7ADE038BF2C56E2BF45C804B25755A634C3928D6408375C2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302551, "uuid": "cb038802-0660-4a99-b2d6-ef3606e639f2", "value": "24576:jLn63bKes3NFKbzSoEwc9GLelAy1zEUukb26qsO/:f6rKN3N6o2yZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302551, "uuid": "28227f76-e27d-45e2-995d-e8e048df89dd", "value": 1037172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302551, "uuid": "425edde3-4e84-4d6b-8def-b468f5df4f65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302551, "uuid": "7a57e31e-2c8f-4837-8b9f-d1305b4217ad", "value": "ps_95M1Hcb4erDp_1776241418785.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7332df6b-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276095, "uuid": "48c10a3d-7bd6-4820-9a25-10d8ceaf1e48", "comment": "Malware payload", "value": "d7304eef97b89244ed642232af3b609e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276095, "uuid": "6c3a260d-cfbb-41f1-a6d1-a31f291c0d30", "comment": "Malware payload", "value": "37f03b9318719b18a1424fef74824f300e30be753e3c72de05e8c57496e74a91", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276095, "uuid": "0d359d07-d223-4eac-8cd4-6248b2648939", "comment": "Malware payload", "value": "82f310f824d1843911bdc6f24aaba596e87a5ede", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276095, "uuid": "f8b72cc0-f7a7-4ac7-af0f-b7e575d87e40", "comment": "Malware payload", "value": "056538b1222c991e17f1a9fb7caa76d7b1cfacebc4d646149a5bfa78843b4edd0c957802e3dc031253a4706f8b8d1575", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276095, "uuid": "d54c8d1e-67d9-432e-9b30-f5652e330927", "value": "T17E3723224EB8C9A96BFC6274457A090D0ED7FD01D01267FA630EB56F4A77C9C811F72A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276095, "uuid": "a6bbcef8-ce7d-4871-9001-3f6bac4ea3e1", "value": "49152:unK/c2ktkhXCFHowU51YH30wuZxkP5GvNQ+THVH71b8Hs5JXjUMBxhxRa4fXpwfO:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276095, "uuid": "5c57a243-9821-46ea-8e66-a8c390d7ea8a", "value": 22903937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276095, "uuid": "d16b8e57-df5f-423a-b41f-b20da127336d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276095, "uuid": "164af760-7a57-4b77-a5ed-9fab5fa847fa", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52caa77-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323021, "uuid": "5094e7c6-0ec8-43e3-8fba-0cf521a67221", "comment": "Malware payload (Mirai)", "value": "68e7efa7e26293ab9b3b0ef983a0aac0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323021, "uuid": "908bb1d9-f3be-403b-9535-5abddc36d977", "comment": "Malware payload (Mirai)", "value": "383fd1219320d0c93351aff0c75200af0678fdd9ebebd585b5af1180c940a9ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323021, "uuid": "d62003ef-3ae1-4be5-9fd4-58a78159a9f9", "comment": "Malware payload (Mirai)", "value": "a92f6ccbd00337abb03c65d4fccae9eed9a7deb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323021, "uuid": "6eee1c56-7c68-4b0d-a1e4-8c3fbbdbdcf4", "comment": "Malware payload (Mirai)", "value": "a3890b176c517b1471cc309065653c75b1694f67797728c76ad57597626581592c70577d24ae92da860b7f35b20725a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323021, "uuid": "8611cd27-20b5-4d30-97c2-2ed9d9a892ae", "value": "T1F613E0AD508A9A12FC650C756DBD0E866B858EB850BF73AB3034C99C4AD5C8FA1F01D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323021, "uuid": "470c9131-04dd-48f9-b314-a3a5c3e8096c", "value": "768:A6kNdsuHy0d3O7KRgn9V+LgzSCyaez1B9cjZxPGDRxdjs3Uozn:OzLy0d3O7KRgn9ALgqaezf9cjLPSRKzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323021, "uuid": "49f7d25e-b99f-4c16-ab94-6601f3cced75", "value": 41644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323021, "uuid": "f7afa18b-477b-4272-b6a6-551e036805e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323021, "uuid": "e39343f0-8c47-46ef-8606-3921d562950a", "value": "vaxstresser.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecb9e07-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285349, "uuid": "a1f325e9-c8e6-4a59-9b8e-996c6d7c1623", "comment": "Malware payload (Mirai)", "value": "c71549e3d2c117e838240112912bed3d", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285349, "uuid": "1dedce96-4b8d-4e02-ae06-dd9b4623a454", "comment": "Malware payload (Mirai)", "value": "38536ef3cd33878061bb5242d917e95cb1b2c5ccdeab3f26bb627fbefcd353e6", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285349, "uuid": "c73acaa6-83e1-409e-a3a3-d1738b392642", "comment": "Malware payload (Mirai)", "value": "3573221d5c1822b21228186b5993f4f01af651d0", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285349, "uuid": "b109d7ac-612f-4041-b2d4-68074a7b6740", "comment": "Malware payload (Mirai)", "value": "226387e01007405fec357e11e70532e5945ea4359d55f4bf80cb5f5adbb271039153f97a83fe9436bab19d5d83af82ff", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285349, "uuid": "b240e39e-18fa-4547-b5cd-69f7d848a97a", "value": "T1E0968C03ECA415E9C0DD923189629252BB71BC494B3163D73FA0F7386F76BD4AAB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285349, "uuid": "6bc8c456-60f6-4bea-bf20-4a8955161b4b", "value": "98304:epYWr83E7rxMQ1S9gETaaBn9ZEQwDsY7D9t3Rf2dkGtoPPJXBJhTI:e8Ox11S2K7T6QwwY75/fiKRXlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285349, "uuid": "55ab866e-820c-48c7-af9f-b51c5ba53900", "value": 8864698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285349, "uuid": "167dfa3c-9ce3-4f0f-aa7c-878602c8f2bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285349, "uuid": "99371eae-ec9d-49e1-a5a8-6eb0195d833a", "value": "scanner", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47e2c2d-4206-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777273252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273252, "uuid": "8e0199a3-dfa8-44b5-9988-e518c3cc9083", "comment": "Malware payload (Mirai)", "value": "9c0ae4d71c896ea3b4ba407b824ff8af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273252, "uuid": "c0f6e2d3-6078-46d6-8cca-d193bd377a7b", "comment": "Malware payload (Mirai)", "value": "385b0e85bdb9dc598af3fecc36a83990c661e8210d2e4b5a461325aa04833644", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273252, "uuid": "b8bf0dca-b242-4107-84ee-00a93dc9181e", "comment": "Malware payload (Mirai)", "value": "46feae912884e5a8752e6b9356f913a500b2645a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273252, "uuid": "72d2ab59-2691-4f6e-8ef1-f84b4b65ee8d", "comment": "Malware payload (Mirai)", "value": "2d5e93842b4b1924ff226567c9a80343b5a0daeb91f07e4369f7dd7dd9b964eb3de1348899fb601695d9e753a4fdb5c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273252, "uuid": "bfc34947-ee1d-4cd7-a401-3059a961e938", "value": "T133D41B0AAF540EFBD82FCD3706A91A1634CC685372963B3A3535D914BE5B90B89D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273252, "uuid": "7639c317-c3e7-4b40-8db9-a1c7473835c8", "value": "6144:yqT6gjUz2I2d1+tGxkjm1avo7fwgH0g4JPMCslxPPVZI/AJz3/Pz+ibOMjD:yqmVAkjiUo7f14JkCsnPt4AJzqMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777273252, "uuid": "70d663bb-2c21-43ef-a18d-1d11dc70e1fe", "value": 648172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777273252, "uuid": "e63a6733-888e-4768-a673-da50667672df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273252, "uuid": "d3f8d6ea-9330-424c-94ed-2f823c11456d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31def08a-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777275986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275986, "uuid": "d52c90a9-6508-4468-acc3-b6fb5bbdfc2c", "comment": "Malware payload", "value": "c0d4aec8008f238032be329f85595080", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275986, "uuid": "64132455-95fb-4f6a-8983-3a6b262aae10", "comment": "Malware payload", "value": "388839426fedd3bcdbf71122f64029dbe586bbf4e96f610e55238737fd476ffd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275986, "uuid": "610e97ad-5c4b-4cc7-84e6-11dc23e96439", "comment": "Malware payload", "value": "7a83860963bd9a6cba0d8d15c81a2c81ca8a94ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275986, "uuid": "d3f51283-71b2-46ba-abcf-75fde4f8f726", "comment": "Malware payload", "value": "17198cfb239207f35bda8812c0cd1d23e991b79e95b4d7b07cb78395abdb19c632485e6593a32d469e40e9b8b2aaead0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275986, "uuid": "2d24fb91-4c52-4ec7-87d9-9423af7050ee", "value": "T14B3723964D4B6F2E5FCD66B710BF0DCF7BA2C54645A4CC87F6B1D80AB42AF18408992C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275986, "uuid": "90cec0a2-ffc8-41ef-9745-e42ba3e84a7c", "value": "49152:Jc0clcdcAc0cmcJcxcPczcnc2k+crc6cicGcZkhc/c5c9c6cicpcYcJc6cscmcH+:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777275986, "uuid": "9d2cb956-6c59-49ab-a998-7f0f1f76b977", "value": 22383679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777275986, "uuid": "09ac14d6-3c98-4ed0-b2bb-a9dabef5f1c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275986, "uuid": "e0ac592b-3da1-4325-b191-7cf9c567ec19", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7cbdb7a-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271486, "uuid": "4ee0cb34-5e1c-49be-b818-4a90d05385ff", "comment": "Malware payload", "value": "eaa746458db61833c27ca2c1f3e609e7", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271486, "uuid": "36104470-513a-4190-993b-642ebcc46f78", "comment": "Malware payload", "value": "397093aa0cd7979f5733cae715c4608f84b69a20281891a84aca50e23615e383", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271486, "uuid": "24d6cc1e-00bf-45c0-bc99-4f5f575dea58", "comment": "Malware payload", "value": "c4e827ce3118c7ef93435b2d24866ebcb6e6c148", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271486, "uuid": "77289def-a9a0-48ec-84d6-e4bd0a66d55f", "comment": "Malware payload", "value": "09af2a85cd01d93a31ee5d559ba9be10c935525d32b90691a887b65a8afa7a46984ffeefe14d9422a30a246c12d08029", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271486, "uuid": "488e7c68-2a47-4821-ad03-8e668459cc7c", "value": "T16B37230ECFE80FBDC5D1B989287A210B6764C94E7574EF6AA7F1A548C26FD1204530FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271486, "uuid": "0b6d8883-bc3f-427b-8913-d06fc9da0655", "value": "49152:R2ktl4+9+z7EEXR88sGY9DXwA+ezoeUlsO/sLLbjLnC344NFZHN/wBHxVBHBBMYk:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271486, "uuid": "9dbb6a85-c555-4184-aa6e-6de0a47a659d", "value": 24204584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271486, "uuid": "2471e67b-71ff-46dc-b97f-393ffe7e91c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271486, "uuid": "43e23868-76fd-430e-9318-fbb05d2d2330", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe154c64-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280623, "uuid": "23b89d41-6d86-4565-ac07-8ae2ac2073a1", "comment": "Malware payload", "value": "2699efa59fadbd6d82345c99ff74fbea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280623, "uuid": "fc67c8ba-0f9e-4a3c-a591-5d14fdc483ef", "comment": "Malware payload", "value": "39a6c243bcf79765bc1a3dbc9ee5808bcecd653278ca72df41e4fc84f546c27b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280623, "uuid": "7c4a9c5d-20da-48cc-9fc3-bff6433738cd", "comment": "Malware payload", "value": "8c98ec7c9b61c586a76555e88bd294601f2da072", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280623, "uuid": "b90a5d21-6679-4932-b455-9cbc5022077e", "comment": "Malware payload", "value": "68072ed27a1e78120498575d80e8cf22fe4ee06e6d673175133fe16d849be78a45e8113d725686f8198aae014f773e1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280623, "uuid": "193087fe-6098-498a-9a1f-ee390bd94edb", "value": "T1C33712184E756A6F1E5CAD5514590DBA42C54D33309CF8D1E6FBB8E3CBAF62CB24B028", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280623, "uuid": "6ba16a40-5e3f-49f5-ba0f-f697567e2e94", "value": "49152:kif26rRYe4KgmU6JXa9iZ5OEEjU6JXa9iOPQH8QnkN2KS15EU6JXa9irU6JXa9iQ:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280623, "uuid": "2af7abf5-ecfc-4ebe-829a-2616bba2714e", "value": 24204591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280623, "uuid": "b6623c0d-f6e9-4f4c-801c-208fdc51592c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280623, "uuid": "177f5183-e933-4c4f-9dd5-1532af76b1a5", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a787d8b-41d2-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1777250579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250579, "uuid": "ccb42e68-8795-4f32-a372-4fe227898694", "comment": "Malware payload (GuLoader)", "value": "7d784ec37ec7bcac8a9c735a35b06449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250579, "uuid": "31edd868-45a4-40ca-b51e-c5b66731bb52", "comment": "Malware payload (GuLoader)", "value": "39c0135a0e8d46053fbcaa4efe6cbc83d33cf8e7be43efbca1622b2f77c7b9c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250579, "uuid": "c76921ec-9c1b-49f0-a1b2-2fdfeefaabd9", "comment": "Malware payload (GuLoader)", "value": "35598ba9c5fe760a427ea07fd2a3f72c5ec765c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250579, "uuid": "eefb5e81-9753-4cda-97a1-a1b3968730e8", "comment": "Malware payload (GuLoader)", "value": "87e9a69cc0c42627e16fce4b107d4efd2d4b5e0327e251f8d5e662bc544f5593aada3ef81bb55da055980ccebf1d78ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250579, "uuid": "5eb549bb-f637-426d-92ad-27ec8edbec7c", "value": "T1432512C47347B291CEE8357439B59EBE498C7C6B89A115036A407E7BAF3C1064B4F26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250579, "uuid": "8f1963f1-e150-40b5-8abc-c50099f2facf", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250579, "uuid": "14bdc1c4-e2cc-4cad-8859-515f3720ba14", "value": "24576:yTAUoiC4oE/d+bgP1h5C5gf/pAKXN3mbbcz6s5:wDZ/d+bgf5CufBtdWbbcWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250579, "uuid": "87e590ce-6e67-4c23-b6d5-154ed8188713", "value": 1043029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250579, "uuid": "460646b8-fa9d-4d52-850a-999102b43294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250579, "uuid": "f7d7f2ee-865f-4a84-bbec-815a846653b2", "value": "RFQ__________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e5e994-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302569, "uuid": "f88733df-8df9-4cb2-ba15-7343f1aeb206", "comment": "Malware payload (AgentTesla)", "value": "56dadd0ae2c9557323af6e1ed013b090", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302569, "uuid": "eaa6c96b-d428-4d1d-88ec-0875e33296af", "comment": "Malware payload (AgentTesla)", "value": "39d4234b797a97d84c28521de5143b1815d3b9601a377362251f615547df2ae0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302569, "uuid": "7b2b9319-fb9b-4986-8987-9dbf5479a19e", "comment": "Malware payload (AgentTesla)", "value": "d91f6caf682d37ed569feca6ca372edce2d773f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302569, "uuid": "40bd6410-dae9-4e23-ada6-8fe74eac2e24", "comment": "Malware payload (AgentTesla)", "value": "53bd8cc8298869a6263ab807484e11068750ecd9bbf2607e897033c472ff1d953b0a72b2ff96932b4bcd08fe2741f71e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302569, "uuid": "23342ee6-b55e-4d17-9312-3a83023ddce8", "value": "T1352533D12FB87A7143CC830F625B9C61647699F3980DB1A763C7D98381A921187BB4BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302569, "uuid": "3167e500-f0ba-4941-ad44-90e552489828", "value": "24576:6CmB46As5jTA1BK4TtmOHlefi+nAJ0+AyRA+K0v7/XZ+aF:MtGthgfiMSAgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302569, "uuid": "0c22c047-5383-4b45-9e31-56c63a41dfc0", "value": 1035962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302569, "uuid": "30bfa881-eb72-4927-991a-c6fcafdf4fc2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302569, "uuid": "9f15f61c-4fb8-4942-92c1-4a038e476cb4", "value": "ps_d2hzVbK2W8T9_1776165619721.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a342299-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777291623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291623, "uuid": "8e9d9e38-e93e-4326-b9da-74006b95f359", "comment": "Malware payload (Mirai)", "value": "6bf05eb4b753f17123830bc359096d88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291623, "uuid": "3d8abef6-73c4-45d6-8511-ec21014e6a20", "comment": "Malware payload (Mirai)", "value": "3b03a25100862f9fc6e9382abd602dc74a6aff0a8b38279c3007bfbd49eb2352", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291623, "uuid": "e5973995-6e05-4731-bcab-d0b39999101f", "comment": "Malware payload (Mirai)", "value": "3a31ed9232536adcd5d36f1a9889ef56865f9198", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291623, "uuid": "d9087c8e-6de5-4a8d-8d2b-3815f59c3c39", "comment": "Malware payload (Mirai)", "value": "544afb7448084b8b26e180523d73d0866f7b959a6aee8c01c6c1a5f5a81f3f809bf56ed3f7558eaa713f626ab807c8cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291623, "uuid": "08afb293-e6a2-44b9-971d-1ec467243531", "value": "T106D35C46EA414F13C0D6177AB6EF424A3322A795A3DB730699249FB43F8279F0E53E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291623, "uuid": "cf3fa65c-71d4-42f1-a9a5-4143401ed567", "value": "3072:07iJgNtZkpNO/kvVr6JZkX8qECagsAyeOMTM/9ZiGv:EiJgNtZkpNOsNr6JZkXrEssneOyM/9Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291623, "uuid": "2cc2b13f-0073-40c5-9188-56c45499decf", "value": 132351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291623, "uuid": "214960bd-896d-4164-a0e5-96d19a281cc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291623, "uuid": "5f908b8b-dade-4b70-8146-c804fda60d3f", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23be120-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276174, "uuid": "df7be071-155f-447b-9854-92e296861c78", "comment": "Malware payload", "value": "147f05e757b46f13bce44cd149b72ec5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276174, "uuid": "de215383-6538-4fce-9660-134f7f83c2e9", "comment": "Malware payload", "value": "3b86cad57e048354438689233373a6c3694d872c216001893c4971a775744132", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276174, "uuid": "df9098a3-362c-4a39-815a-e162ab90cc6a", "comment": "Malware payload", "value": "c5b8c7688740bb6de392b3bc9e9f25c4c40deedc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276174, "uuid": "39033565-9b02-46be-8ae8-6c8c6d8ec5a3", "comment": "Malware payload", "value": "fa5a16f51140f01699c3dfba22544b3863b782cd80135c774f76cc0405d847a445b2e948abdacdfdb11166be86d42590", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276174, "uuid": "f8aa6dcd-5e19-4915-945d-db3b23782d32", "value": "T1513723251A69996F1BE8113C083F2F0E66D10D298921DAB6B3D3F6B4C25EF1D119B3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276174, "uuid": "890592d2-f26e-42ea-a37e-23e8df636b34", "value": "49152:g7RGk7RG67RGw7RGi7RGn7RG97RGz7RGT7RGO7RG97RGl7RG7paR7RGu7RGg7RG9:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276174, "uuid": "c16536c6-7e1e-46e0-b9f6-45147113a53a", "value": 22383665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276174, "uuid": "de4eb594-bf25-4495-ab4f-510ec421eca6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276174, "uuid": "2585471a-7b2d-4815-a330-a93bd579765c", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f437be5-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280330, "uuid": "5acf795e-6652-4ac6-8027-39a8ba4f62cf", "comment": "Malware payload", "value": "c290a588971f5cc441a675315bad5b02", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280330, "uuid": "e5548aed-4ace-410e-900e-6b2e96806e63", "comment": "Malware payload", "value": "3b913251d53b0d5030e6090357c49729a73857cd5f58e8f3078ce2fd3655758d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280330, "uuid": "bae50e81-61db-46e7-8c12-7b92bc46a2b3", "comment": "Malware payload", "value": "94815742ca47fed1b0c34ee5cd7ce594ed8b285e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280330, "uuid": "60d29d63-7939-437d-8590-c6cea6c046c0", "comment": "Malware payload", "value": "83707e5ca925ba04d75c226de474ea1b80ab6e509f005aa2df2bbff7d38ff80f6308cd002aa7ebf7b868755fb9a67d88", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280330, "uuid": "c3e41eb3-9cb5-4553-856c-9f07d456dcc4", "value": "T16837230B4B06EA3B42F05BE5707F465F82E40B9C915879FB07E3999E491DB43A33349A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280330, "uuid": "403cc663-9164-4966-8f3f-cf3ac5f47b07", "value": "49152:BVyoVy/VygVy5VyTvVyRVy7VyJVy2VyNVy3VyNLTSVy5VyPVyeVy+VyaLTHVySVY:Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280330, "uuid": "f1cadd88-59bd-4c2f-812e-6820f6adb881", "value": 22903959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280330, "uuid": "83988b63-2599-4c19-879b-5a9bcfecba9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280330, "uuid": "91af8b88-de7c-455a-a972-2b30d7136a4b", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ece7aa-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323068, "uuid": "83d9e703-afcb-4b87-887c-abd55947d09a", "comment": "Malware payload (Mirai)", "value": "a1357b429112a9acd050b1b84eb4c456", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323068, "uuid": "10e27e3d-2744-40e7-bfaa-6eca7749de94", "comment": "Malware payload (Mirai)", "value": "3c210c1262426dec58f6ea9bec9d333405cbb09159b230935a167122bbc22fc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323068, "uuid": "66f98d82-71d9-4e21-a567-bef54b8b0730", "comment": "Malware payload (Mirai)", "value": "b75949dd711c4d7c2563dea868e9fbdcf91c40a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323068, "uuid": "28ad6530-0c14-4f2f-a7f9-2c842b348e67", "comment": "Malware payload (Mirai)", "value": "88f002d944469863f6247b82d97fbb3c9c88daa5957aa277a0383299a8aa99a858df4b7485f17674bb218daa08319243", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323068, "uuid": "31b00375-cde5-462b-b754-310e05eaac42", "value": "T10F13E1B91F4A6BC9D5B854B10EBB9B712D990D21FD1BB1DE5EB044EA1C41AFC202CB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323068, "uuid": "7406ecf9-2e5a-4179-9ff4-89df8d79ce8c", "value": "768:56/jZfcIpzKgxirQHTDnEjVOWhfuyKQRyNGlcPyTLdx7+MqK73LSJgGlzDpbuR1w:4jZ3OxGRWhfTKe6fPylcMqKeVJuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323068, "uuid": "18d6b40c-6261-4a33-bf88-d31c0768f7d9", "value": 43264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323068, "uuid": "36bd740c-a987-4ee6-897a-f77542e0b0d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323068, "uuid": "630749fc-e6c9-431c-8677-8eb43b5ce484", "value": "vaxstresser.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5a21d5-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279335, "uuid": "978cd787-3f69-4377-9b95-fdba09355c97", "comment": "Malware payload", "value": "e6fcb77d7cd87bf7363e272692c24dfd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279335, "uuid": "c76aefde-984b-4784-9f3e-7c4509158ade", "comment": "Malware payload", "value": "3c974d8ab133127822bcf6503e824a11b25d79f1e147461695399cb5199244ab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279335, "uuid": "1cf14d9b-a472-41d9-a6b8-38cb4d43e265", "comment": "Malware payload", "value": "20109cc8e8c9529a1e1d3682f8a5150d00625732", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279335, "uuid": "368c903d-5905-4019-b709-d373b74a07ef", "comment": "Malware payload", "value": "d33fc0d5c941f54ef081aa66554976d5e52a104bb4564f7c69d3df8d805e3b0df3e2398d5ac456a52963560a244ebc67", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279335, "uuid": "e0a9fc81-6ff9-4f16-9f78-144505c16d33", "value": "T16B3713424F3E9A53015C139A341C2E6D2B962D42936FF60583CC6BEAE57EF45231F3A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279335, "uuid": "62ce47b2-020b-48fe-9c6d-371ff51ccbe1", "value": "49152:JmuxbmuxJmuxCmuxumuxxmuxLmuxKmuxYmuxwmuxQmuxymuxjTgxWmuxymuxcmug:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279335, "uuid": "9972fe1c-bd43-41a4-b53c-7d6314590eef", "value": 23944455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279335, "uuid": "192389b0-396c-4d32-89bc-b5ac1f992d4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279335, "uuid": "13022119-777a-4112-9776-f2489a53408e", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41208410-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321968, "uuid": "51e18400-944f-4c0e-8e01-6ddbb21e270a", "comment": "Malware payload", "value": "dc47b60f855f153c406c54bd10015c3d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321968, "uuid": "fb252841-2aeb-4148-a0de-373117e20200", "comment": "Malware payload", "value": "3cbcb5676f8b41ecaa73fcd6c9c0df5bf37cf5094c7566fee6bce65e33865afa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321968, "uuid": "3a2968fa-1ec9-497a-b853-d77a88836ef7", "comment": "Malware payload", "value": "7fc89b038a9367404d933c3b67959b7cdb17c2bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321968, "uuid": "671d5193-2b7c-47a0-a496-a5b426bc71e9", "comment": "Malware payload", "value": "2cd196896d7e22d2962bfe48cd597011ff031e2816beab8c7e6f05c43b4af91d6b7144d48a80adcc6137086edda23839", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321968, "uuid": "30e98828-e180-45a2-87a4-5abbe52a2eb2", "value": "T16C51FAA8C7421532FF67182FFAA1645847C6AC03EB51154D5EFB5CCE01E0A06A67DB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321968, "uuid": "cbe573d0-8e5a-4ebe-a6c1-975f7be26465", "value": "48:c+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:ckatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321968, "uuid": "ff63cc70-dab7-435f-8666-821e656dd730", "value": 2498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321968, "uuid": "2916dc25-a579-466b-a258-5daa3111226d", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321968, "uuid": "8c890b56-2199-4890-aee8-90e17882934d", "value": "164.90.195.107_1777321927337964_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e319e9d3-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323098, "uuid": "2d0da19c-2418-4bb6-abe0-0730af41bc57", "comment": "Malware payload (Mirai)", "value": "eb65634dae30749c5fd7b54f361543d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323098, "uuid": "d1c11762-f1d7-4eaa-85c6-0a0731aeeaa6", "comment": "Malware payload (Mirai)", "value": "3d0ca38f9c9ea70e8ffb229c38c5783e8253d380cfc59f9abc5e8c477fb10e5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323098, "uuid": "2f707869-7f5b-4e5a-84d7-dbb208449d52", "comment": "Malware payload (Mirai)", "value": "fabd620438b60a4367ae810a1caba60ed9c5bb1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323098, "uuid": "6e838f94-510b-4aaa-ac4c-62d410fb6969", "comment": "Malware payload (Mirai)", "value": "df7dd101241eeee4a803a50b55a6c4340b45ea43f21a75abf14496bd4222e92503f659017e0f116544154651361c7d95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323098, "uuid": "d1194cbb-2970-40f2-811c-2205c7781e5e", "value": "T1D413F140AC634BE7EC7B50FA297FB5846811721EB74889D3ED886D7EC6935342A323D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323098, "uuid": "13b75a4f-173a-4dc1-888d-40cbf4e6ad4c", "value": "768:Bi0Ga0taRyEEUpUO3YpKy3o3283hzF3E2eWzTy4nbcuyD7UHQRjHb:BTGeETO3YL3ophhlzm4nouy8Hy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323098, "uuid": "f9bf4944-90d9-4fb4-af80-b9dc3246fbd5", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323098, "uuid": "5142c81f-9eca-472f-8c76-5f5ec71442a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323098, "uuid": "43cef8c2-f171-45b7-b51c-679cd00d5aba", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec7b278-4228-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777287899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287899, "uuid": "6d39753b-5927-483a-a4c6-96ce89ab0ae7", "comment": "Malware payload", "value": "29ea4a5c24c739727d46941a471f80d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287899, "uuid": "833a3e42-0bfd-4cc3-94cd-446f5868bc0e", "comment": "Malware payload", "value": "3d531def7ecef3f29b4542eb28db21e7ebae4da29c77cd762147135f5a014f87", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287899, "uuid": "a49bd570-fd80-47cf-87c1-f82657298503", "comment": "Malware payload", "value": "4085fdd2fcfe3d722facf396990674dd14f80e67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287899, "uuid": "919be1ef-ec42-4a0f-b179-2ee9328e0ce8", "comment": "Malware payload", "value": "714b4cabcd2dd1db08179b894609f718c1c529e4b4dc17e14017faf17837f3d882b2514700194527d4d8756946416250", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287899, "uuid": "0939c752-089a-45ca-abca-97f33cb56626", "value": "T126953A57BCA108F5C4AE9632896691527A61BC450F3223D73FA0B77C2FB3BD09A79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287899, "uuid": "43d649c1-8986-4129-a89f-fd1bfef33812", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287899, "uuid": "86757cf6-6310-4c4e-baa2-1e58b1f7aa1b", "value": "24576:aF2YBLzULtZnWrbYl+2YQygzfWRJnQsoGyyt1Qd:aXV4LvWrbG+YdMt1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777287899, "uuid": "8c35eb00-c9d7-493f-a221-a486ee41fad5", "value": 1947136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777287899, "uuid": "c67569b3-1fd2-41a3-a91c-03bcf9599069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287899, "uuid": "6a3dcda6-ae6f-4b86-a215-197612324310", "value": "ws37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fc12ac-4213-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278899, "uuid": "25d0a104-de45-4745-b381-832c035aacd1", "comment": "Malware payload", "value": "9f011118b22e8992ed97d3302efd9ad9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278899, "uuid": "b0c236c4-4648-4d95-8971-4c212dde22bd", "comment": "Malware payload", "value": "3da3ffb6ef72a62fabf0719fde6cbb6765eaa4dc7492795886b05fb4ebbf23f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278899, "uuid": "4339ffab-eccb-4adf-8b7f-f036b9834496", "comment": "Malware payload", "value": "4eb473e45d67dde9ab1599566a80a1aae92f79e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278899, "uuid": "6c66b44d-09ad-4559-8341-baa83b98970b", "comment": "Malware payload", "value": "5eafc0599bb5487f0793cb1838cba97115f67f2cf3a6564d6d1cc0483945a939d08024cdc10fd8c06242e4540fcbfc1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278899, "uuid": "2236ef68-4b89-482a-8337-15fa4b5e6087", "value": "T19F3722101FE48E6FC9D43AC82A7E4957712A8F5C8191B22C1FD26F87CB12E29553E7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278899, "uuid": "877c203c-5bec-4d43-832c-42cbdd3556bb", "value": "49152:s6oKXbJdo0zODJCLYixJLJCc1p6KHXidSBDXpFJCyJCMTJnJCHuXCIT7S+awuzyf:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278899, "uuid": "b18a39ab-e134-4fb9-801c-39ade7b7db48", "value": 23164076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278899, "uuid": "b87f4677-a554-4224-b3c2-ce6ad7d69761", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278899, "uuid": "05f17960-992e-4f12-a9eb-03b618823cdc", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93776cf0-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280445, "uuid": "a3677861-b5c3-4aff-b069-233025d4485f", "comment": "Malware payload", "value": "d17afb5ea0546307af1cdfd2a8c254b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280445, "uuid": "ea69e868-6c8a-418e-99db-e664db3ccf98", "comment": "Malware payload", "value": "3dc1c27750808edb8fb7a727618472ad1d3be16df082f82c2339cd9636fb0c93", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280445, "uuid": "69f895d6-2bb6-47d8-837f-9ecb225737cb", "comment": "Malware payload", "value": "104379a63be1da5c8c9c4214b89162dc1b8f9af7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280445, "uuid": "9dc1dc0f-a552-4074-9ab2-485bb74acf42", "comment": "Malware payload", "value": "fc7abd79b581a7d9638b0b85fb24218e957428fe93c6ef5f93c55cd4ce25bcf35e355e79a62d9de5a9eeab612ee19aed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280445, "uuid": "748b5ec4-8fb0-4f11-b7c7-86bda18fd68e", "value": "T1CB3723885F9ECE3E88BC11E52D2F0E49F55C0F1A47E9AD66C3F964468E8C2160CD36E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280445, "uuid": "758ffe9f-8ee5-4eb1-ae1b-2d0076d43f81", "value": "49152:EJueq7dCm84cYz1FWm8jfqz1FJk5kxJjKa5/VDBoz1FUz1F9VYjz1FK/5F7YYR9y:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280445, "uuid": "2aacd18f-6c06-4654-8a13-3e4298295201", "value": 22643819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280445, "uuid": "dc32b0bc-40c7-43e5-9373-91438d262025", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280445, "uuid": "089346d1-21f3-4dea-a72f-46af23b85d9e", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2175fad1-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284119, "uuid": "2f3ac57a-5464-4a69-816c-53ba8e0f2af8", "comment": "Malware payload", "value": "d4247b2be3411f37741e94342b846d2e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284119, "uuid": "45f9f10e-81aa-4597-9083-867b69565777", "comment": "Malware payload", "value": "3de04e3634372e0440ecedba6668c83ece200e86c547515068e679f35930bd2a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284119, "uuid": "9dd6aef3-0ba1-4661-8780-cf1c537b3602", "comment": "Malware payload", "value": "971df1c12b4216ad1260d92691082adf10a04d4c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284119, "uuid": "3c52274a-8c3a-467f-940f-ed83d6323498", "comment": "Malware payload", "value": "9c9a01a3abd2c5c12347933e3a19da01ae4afae4a4be00aa7706b2df5bed6e96846c5d40b32a156822e7269c073f2bb1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284119, "uuid": "1367669f-0a56-4803-b5fc-2e41756bac10", "value": "T193372313AD258D2EF7AC3CD8503A5C8B3B0D1DBA78198DD397D79849E93B7210B69039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284119, "uuid": "a21f055b-8bc9-4bc6-848b-fff21f0acc5e", "value": "49152:Ekx7kxBkxhkxOkxQkxSkx4kxXkxXkxikxhkxs6XHkx5kxXkxokxwkxi6XIkxkkxL:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284119, "uuid": "a790efa4-53b3-4fc9-894d-a9366bf7310b", "value": 22383669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284119, "uuid": "492077d9-3f07-4c83-8aa8-d3e6bc1fe877", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284119, "uuid": "d5823311-e2bb-489b-a064-ed8126c6fbb5", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70a9028-41d2-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777250950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250950, "uuid": "dd2fbb95-0cde-4b2f-a42e-7bc15fc68255", "comment": "Malware payload (CoinMiner)", "value": "084da35c11f4dc3c3decd29505138495", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250950, "uuid": "b43f9ef3-080c-407e-b3b2-59d35c977275", "comment": "Malware payload (CoinMiner)", "value": "3eac84b7dbf64329e899735f731b10f617f6348a8e1fced37fa4b664e7a1b6f3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250950, "uuid": "edd290b5-6b56-43da-b0cc-0c8fa5385230", "comment": "Malware payload (CoinMiner)", "value": "6916f6731b64ca48df0e2dcc4c7d478fb20930f1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250950, "uuid": "af74cf9b-d239-4cf5-82cc-e23bc84d4fdc", "comment": "Malware payload (CoinMiner)", "value": "99eed1a68fcdbb348677ec12a4516b7948497290a5c5a7a2a2d3b936ff4841a7cb7e4556ed111f43ddf66a5c26aeec80", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250950, "uuid": "5bda77a5-9392-42a4-a80c-9a5049d8619d", "value": "T12D432C07A59360FCC28BC074869E9522BE73786412303D7F5BC8FD352EA5E52276DB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250950, "uuid": "ee3ad410-c6f3-48f0-8be8-e97d478b8b37", "value": "1536:iGixmZuZobTj94dlfg0EWtw9X8QqVe78jyKEh7Urt:/i6uZyTj94dlfgEtOce7rE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250950, "uuid": "a6462e07-9e11-4557-8178-95ee5a3cd847", "value": 58528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250950, "uuid": "aa477ce7-949d-4e58-aa37-62939b2adcf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250950, "uuid": "2f5f7dd7-d8d6-4034-beef-1cccf0ca8de0", "value": "watcher", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536a51f9-4290-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777332306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332306, "uuid": "8e6bd8c8-6211-41cb-ab4f-7905881783c4", "comment": "Malware payload (Mirai)", "value": "7bd44268b08fee62c4ecbffdb0eb687c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332306, "uuid": "aa1ec507-4381-49c0-870a-b94930a1a89e", "comment": "Malware payload (Mirai)", "value": "3fa092682741365d3704f8692f28e19d890c8d4bc76bca53e23cd874ed09897c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332306, "uuid": "5f56ae54-a599-4b04-89ec-e5911d72d194", "comment": "Malware payload (Mirai)", "value": "054706d787254559bf7edf1a616baf3fcd752d35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332306, "uuid": "369e7974-fdbc-451d-b167-f77c9ddeb04e", "comment": "Malware payload (Mirai)", "value": "692c31419587a536c631db716f65ccba06c5b1f542efebef4ea0346cf2e03bd747598163d6fe426d024d4499d9e97d67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332306, "uuid": "7456df51-d137-4457-9854-26bb78499568", "value": "T173F2F19122FAF02AD54BFE39A7E6484D5AD867231B17B7230DF221D2F8AE46C4215D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332306, "uuid": "4e11ab23-e79a-4301-b7b0-674e335f46fc", "value": "768:Zo6JDkMsTVJKJpnflKQ4fjQyo2J2UvYIVjPUzygvte4bD/JHsD:ZpgTLKJpnQMyo2gUvlMpv1RMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777332306, "uuid": "9c9ccbfd-669f-4510-ba78-62ab8010e721", "value": 34320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777332306, "uuid": "67cdee0f-ba05-4192-a8d8-37c439960261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332306, "uuid": "8e8a23ff-045d-4547-9c16-2d42b8b8d0e8", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524b7301-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280765, "uuid": "b74d294b-2041-488c-bceb-af85c91741bd", "comment": "Malware payload", "value": "c0a08604473722f6b2e312f5005aac63", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280765, "uuid": "a7729ea2-34e6-4e26-b598-e5b03551f9ca", "comment": "Malware payload", "value": "3fcc4b97270cb04e0f4a188ca6e60cfa137f2be8a5e9062fd997dd2df3dd33f3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280765, "uuid": "f87c120e-d0fd-47f0-b813-d7009c936fe2", "comment": "Malware payload", "value": "3f46b8a1b92ed3f912a5b05c9f5322e767f1759b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280765, "uuid": "0994832d-83d7-4923-a6af-1191315af2a5", "comment": "Malware payload", "value": "051862f1f9a7e4e2610a7268d4492e0830789aed9321961d1355d5af30e9ad42c46c5e7ccf04c1e29c7f3848e1a1831a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280765, "uuid": "1cd79b32-8872-4abe-bbfa-288bcb734bbf", "value": "T1BE37230F0FDD7E8E84F4717015695F8F2AE0D7D4937C2A7163E2A989722CA7D80A7A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280765, "uuid": "19b55c39-f0cf-4724-a022-81bfdb56b65f", "value": "49152:ah7h9hWhNhhhrhMhdh4hehjh5plXh9hdhShihFpl2h2hIh7hphohmhOh5h0h6hKU:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280765, "uuid": "a367a780-8572-4263-a5c0-0db0b0a8de43", "value": 22903941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280765, "uuid": "0040af76-fb61-4889-a0e1-da4a6299f6a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280765, "uuid": "3ac4e6c7-7240-40de-8c17-95f5fa9ed527", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096edeef-427b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323163, "uuid": "0700283d-5643-4e04-8555-8e4cba3c745f", "comment": "Malware payload (Mirai)", "value": "16049d8c02084ba7c01d74d409fb5b14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323163, "uuid": "ac95a048-38d3-4588-83da-2ed7c91d120e", "comment": "Malware payload (Mirai)", "value": "41faa8e14ca4417ea57332f233e670ff0ba29b59b6f4ff065a8a1fa29027f4b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323163, "uuid": "e42bc99c-5557-4f56-a72c-991c1fc529f8", "comment": "Malware payload (Mirai)", "value": "2475445242e49a5e2831269766de26db3b72261b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323163, "uuid": "6908e4f6-73de-4f6c-b16e-7212812a2486", "comment": "Malware payload (Mirai)", "value": "8ea29ab2d6c667f3322783c1f2e39591edf129b30bb73b8580ec2efc152859712c623b543e8beb6116e3701d221852bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323163, "uuid": "d4f5c69e-53ce-4ef2-8e66-c6caf3095820", "value": "T18F836DC5EAC3C8F5ED2209301172BB675AB3D13E2268EA83C3A6D975EC125C0F51679D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323163, "uuid": "49204bd3-f40e-43d4-b168-2315f48bd311", "value": "1536:mZtH7MIlsW4aoHG3eHO23tAjw19KHVd1YQRbBP:mvHzlsWxT3oOEti+9oYQpBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323163, "uuid": "b6e63c41-c848-4598-b03f-b1be70ee7fb0", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323163, "uuid": "98cb3d91-be36-4c27-8a99-e2722d70b944", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323163, "uuid": "f823f22c-8598-4311-b979-54cd81b87fcb", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20645c78-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294425, "uuid": "258df847-0f6f-4579-b9ee-c393a6782db0", "comment": "Malware payload", "value": "30565a15dff81ba3c9b7892d5c2bc608", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294425, "uuid": "f81a0dca-83e6-4be2-adfe-e8ee1ee70e8b", "comment": "Malware payload", "value": "422a24d4002cc7e94b2f17e9e0b647c226fdd848bb5c84f91c1eb4282f630235", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294425, "uuid": "28c32307-b4e5-4a40-af03-eeb823474bf1", "comment": "Malware payload", "value": "22273ead1b2021f80645af095fd120a04a091950", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294425, "uuid": "7d84bf9f-a049-4e5a-addd-a6d8b7ca2e9e", "comment": "Malware payload", "value": "d72ffc9fdf53dd00acd02a115f98bca3e9d4d5a1cbfce63aafbf1a0f27ef1dfbc2bdf437b369c2525846552553f244dc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294425, "uuid": "5b33e547-0d7e-4c44-9944-29ad1102ad16", "value": "T12B3723230EEF1C5651FC466825FF090E0A5C0984849EF7E17AFB2942AF09D63E5DB7A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294425, "uuid": "21d30a8a-ddc7-4dd8-b778-9fba2ce76f6b", "value": "49152:+882TQ882Ts882Ty882T8882T1882T7882Tu882TM882TY882Ts882Tq882TNGCu:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294425, "uuid": "370203cc-d5d5-4c78-85f1-224db352fdeb", "value": 22903943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294425, "uuid": "f0158138-d48f-43a2-b3a0-baa962e08ea1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294425, "uuid": "c578aa3f-f3cb-434d-a825-9f39abb6f87f", "value": "invoice-1645080830.pdf (56).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835417bb-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284283, "uuid": "3df70cb9-d455-46f6-91cb-a8f8710015ad", "comment": "Malware payload", "value": "2825491b18aa69e3abcd507847b85ecf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284283, "uuid": "b4cff684-a264-421c-bb69-7b56e6366083", "comment": "Malware payload", "value": "422c6399014472b6869e48990e4ffef2af684032cf89883a01adfc7e656cb52c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284283, "uuid": "f3c35dab-6f2e-4ec7-a95c-02a24c8b0362", "comment": "Malware payload", "value": "9dc8e9654882f56f11a10c303e0c6fd7b22cf29a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284283, "uuid": "18a199ab-7435-433a-b1c6-bd9605d1a755", "comment": "Malware payload", "value": "ffec84c89dd0a97963d8f35707530a9727f8bf81da8f77f409d041d5677079ed9fc8cde94cc2b19b80d50e82ff8ceea8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284283, "uuid": "1012c4a1-7e6a-4d86-ac06-1482cdc77e67", "value": "T1B1372356AE26EF7B84740BB452FD0E4905D54DC57193A0B8FEA28F9E256A70033233BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284283, "uuid": "fd4d8c1f-ad7c-4ac8-9f93-6bc531f53f63", "value": "49152:w23hg23h/23hb23he23hG23hY23hG23ht23h123hM23hP23h+5vDB23hz23hh23h:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284283, "uuid": "9b7c1419-72a7-4f9e-850e-a9b4c5bb506b", "value": 23684319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284283, "uuid": "eeb1d920-3378-4770-8052-9f601f2750ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284283, "uuid": "716d10bb-b2a0-42a8-9925-0a849441f3d4", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6155a3f9-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276066, "uuid": "069286ad-c48c-4cc7-8a63-c308dcb1adb5", "comment": "Malware payload", "value": "692a56f4fbba62bb984161b0d2573956", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276066, "uuid": "b10a4dc6-3f08-4a99-a5c8-c258cea9835c", "comment": "Malware payload", "value": "423a825a937784c8bfcd24aede7589e142d70e6c294a2ba0365c095375e8b570", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276066, "uuid": "83020bce-bd0a-4679-b7d4-1e8b8b779e8c", "comment": "Malware payload", "value": "0e45485450a9de5ae301e615287cb9126b79c8be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276066, "uuid": "31646f92-d94e-43f3-adb8-e194697d3790", "comment": "Malware payload", "value": "2c784c7d95549a241a1ae50f6efd7e58d3129690a557d025c36de79a8a1a71ecd56f29ec4d6a3a17e626d1de70fbf9e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276066, "uuid": "27dcf783-b564-40ed-9963-6be05c8d97b3", "value": "T1CC372315031FBD6ECB6E051C4A2E068F9DA49C04C038A5CD61E69D9FCF1FF2625EB64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276066, "uuid": "d8ba9160-8f74-4057-8489-8b78f17fe5ff", "value": "49152:prAerASrA6rA5rARrAHrAJrAzrAcrA/rAhrAtr7jrAjrAlrAkrAwrAAr7arAWrAN:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276066, "uuid": "9c254ef3-cc25-48bf-97b5-6a945024c6dc", "value": 22903942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276066, "uuid": "c5e787e8-b550-4222-9b3d-03737080a4b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276066, "uuid": "c6bf96b5-a83e-41a6-b03a-941a91d32112", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf85024-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285239, "uuid": "6b3addf2-8a60-40a5-887f-fb0113f462f5", "comment": "Malware payload (Mirai)", "value": "84ff224a2c13884d517185ff51a38525", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285239, "uuid": "f136100e-3cd7-4752-9334-86928344956b", "comment": "Malware payload (Mirai)", "value": "426da01d36e8d24de92433ecef911e91e9ee6489daeec7474e3460a6db2fcf93", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285239, "uuid": "05e9b68c-014b-471d-a639-0376d26e8a15", "comment": "Malware payload (Mirai)", "value": "c066a4aa46ed44beb52f16003c7d096da1506152", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285239, "uuid": "d644056f-a68b-4889-8943-615a873dcf57", "comment": "Malware payload (Mirai)", "value": "1f77f8eefe08e407d9ee0ae2db08b57c131c31f1e67dc7da758bd52b6173a2473fa7d661679d8cb58f5d04ef5fd06f52", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285239, "uuid": "8d6ebb8c-c6a8-41fc-9e01-e43ad4ba38a1", "value": "T13E157C98E787D4F1F25340F0024EDBE71970A5266013FAF6FF842A5774727922B1A26E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285239, "uuid": "99075719-803d-4fae-b44e-57f7fe42f21f", "value": "24576:0LzRXpLtyCB8hayhootPz5kdrcYlS7l4bRcpX:Olty08hayhRQUPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285239, "uuid": "2abebe87-8d01-44c4-95ec-0239b247bfc6", "value": 912392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285239, "uuid": "dd71d61c-4377-4463-af18-06ee11404868", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285239, "uuid": "40e0a243-a156-4baf-9ab0-91d4307dbc82", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e91b1e-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276102, "uuid": "39103cb0-21f8-4f92-9db8-7ea1383d23d3", "comment": "Malware payload", "value": "ea08cdaaadc024f8a84486abce713327", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276102, "uuid": "a6243e58-9ee2-49de-9a17-e37f988ce491", "comment": "Malware payload", "value": "427a07725d02c20db6df40acec91e3ef3b83c5a740e9f4ca012ea4d43bf7fe54", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276102, "uuid": "300d195c-5c33-4a46-8095-986ff5826f5b", "comment": "Malware payload", "value": "d220abfd1485ace236366a0916f8c7f5843e8cd8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276102, "uuid": "604407f3-aeeb-45b4-9afa-500e88439d8a", "comment": "Malware payload", "value": "42768357eeae125d0cf0bd37eb990dd31811decea10ce98b14186a53252b264318cf9318524e5bcb334dabfd6f70cf47", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276102, "uuid": "40c30732-222f-41be-87c4-ecedfdb3f4c9", "value": "T12637230957DA8D1F8EB8617801573FA45BD42FA409FBF1E030CB6B9BE54EB60A42785C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276102, "uuid": "5aea5df1-80d7-4f02-8b5e-d30d07672f6d", "value": "49152:pAs7mAs7+As7XAs7uAs7+As7cAs76As7hAs7xAs7QAs7PAs7CTgAs76As7NAs7DR:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276102, "uuid": "93c15b40-1202-41b4-a3a8-014a386527b8", "value": 22903934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276102, "uuid": "d56b7d66-bc49-46f1-b8ce-0a7be2101bd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276102, "uuid": "3e9d61b4-4ec5-4537-a07c-4881533cb76f", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f278862-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276035, "uuid": "3025b81e-aadc-48d5-abb5-6f44bbee94b3", "comment": "Malware payload", "value": "aa3c61dbfbd4c6ae8c90d1b27047e3dc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276035, "uuid": "9e83a4c5-4f54-4ce4-a08f-d042a49a68be", "comment": "Malware payload", "value": "429e39dfcbe81fc4d41084d656a7686ebdd7fdebfff69b919ab54d4bff26f50d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276035, "uuid": "30f1026e-1fbe-4091-9197-50d25bb5dcd6", "comment": "Malware payload", "value": "1bcee4e034ef21eec9e484d54513dc04e1214013", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276035, "uuid": "36db269d-857d-4bd5-9b71-f279db2cd101", "comment": "Malware payload", "value": "1373f906846f7d2ee344c6c69d37a40c194d0c377e42ab481b702991d20c43dc55bc048278e93312c4df031030cf27a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276035, "uuid": "0ebac9f2-6c6d-47ff-a389-c7bf2b5f784f", "value": "T1AC3723128F768D3FC88E3E59B5660F8107931D4A08D586F1FFB09E4ADD4DB25A3172A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276035, "uuid": "4a01c2a2-8fc4-4980-b556-ed47b6c5d6a0", "value": "49152:AF8opWeF8opW9F8opW4F8opWoF8opW5F8opWDF8opWnF8opWBF8opWaF8opWlF8Q:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276035, "uuid": "5e38b140-64c8-4c0d-8c07-2f3a05a03d57", "value": 22383667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276035, "uuid": "39e1db5e-4cab-447b-a352-039dafe7c4ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276035, "uuid": "f7732694-9eee-4aff-8734-347be0936b5b", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72680479-41e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777259773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777259773, "uuid": "35f90686-af2f-484f-8167-5075d9911267", "comment": "Malware payload", "value": "9e26470532eaec05f7817b37e9da1e80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777259773, "uuid": "7c333f40-9171-4342-9fff-6222e89201b3", "comment": "Malware payload", "value": "42a1aded85892a80c83f741a7ac00e7e75015166c3be0bae29d93d3a4714711d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777259773, "uuid": "4316d052-1d87-4518-a6fa-66c59c793422", "comment": "Malware payload", "value": "a1547b518c49e53ce168319a762b743e839a4274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777259773, "uuid": "8c98a867-5af1-40fa-857a-029f4e26728f", "comment": "Malware payload", "value": "961de2e9282eac47dbba5df11c60f6ca44a5e53fa71b0990eab88bb1530215cfd7a4c8f73e32df5c6a2ce75a5a9ac782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777259773, "uuid": "8f336483-8f91-4b7c-906e-8f43d914bf37", "value": "T15EE44B13FA9555ECC09DC074834A8673BA76B88A0B21B9FF17D046213F69EA42F3D719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777259773, "uuid": "2a7574c3-18df-411e-9d46-e7da4b3b2b82", "value": "9d8d190b46837e72af0496e03ed49c89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777259773, "uuid": "f6dea10b-7f3e-474a-89ed-69192f670e99", "value": "12288:tHp0iGEWKzkrDNOTsh4V+gArx4VHMGcjakh06W6Zw2lHBcUeNtObbDCZT/7Qb8gc:tiEWKkXNOT44V+gArxIHMGqakhQ4w2lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777259773, "uuid": "d1c58ca2-0474-4d3f-ad0a-ec8a357a0381", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777259773, "uuid": "ccdd93df-a5d3-48b0-8250-27a33b098032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777259773, "uuid": "50e774e3-c9ba-484f-8df9-95b1548f54a1", "value": "kiscldsrvupd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3483b613-428f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777331825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331825, "uuid": "609731f7-517d-4ef0-94e3-3ce1d91b1e09", "comment": "Malware payload (Mirai)", "value": "7c90038191d4e5318fda48fc69b9d200", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331825, "uuid": "28c638bb-fabc-4bec-b627-dfa35ce3a7c2", "comment": "Malware payload (Mirai)", "value": "435d0898ed929de724a77ba280246c72318cfeb47fa005e8b54ed336988c819f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331825, "uuid": "158e4839-d4cd-4687-a736-412c4043f8d8", "comment": "Malware payload (Mirai)", "value": "54cb1cf38ca9d7eabe374b9b0d78173e042f379e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331825, "uuid": "8b397b6a-e2b0-4e6f-98b3-635bd1134717", "comment": "Malware payload (Mirai)", "value": "50c1ad13d93083b9a1984b14dc89f0a17d7c3076f83b0ea7825b46a68eb635cfcf489931903c14f7f9e113232b08058d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331825, "uuid": "3e331704-0d67-4a81-9f29-277cd70b8066", "value": "T1B9E33A56E6418B03C0D22B7AFADF425533239B68D3EB73065928AFF43F8279D4E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331825, "uuid": "6b1b83f5-0f8d-431e-89b1-ba59e2c9e4af", "value": "3072:80arsfGP38y4XUqOW1rdr6Mjh8SQj2gbIM/9+wF2lmqwSINxIF/:80arMGP38y4Ea1hr6Mjh8Fj2gUM/9+wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777331825, "uuid": "f754c760-9920-4280-a5cd-d652aa422ae2", "value": 151887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777331825, "uuid": "9680f521-7acc-4eec-8eaf-b802095140c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331825, "uuid": "99d44400-de30-4e0b-b0a9-1b20bbab4375", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3023c3a-4222-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285329, "uuid": "653968d3-7a5c-4000-8744-156f1cf167fc", "comment": "Malware payload", "value": "631b7fed7267b0942fcdb816f2267704", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285329, "uuid": "6695401b-5cf4-4684-9078-f9a31633c981", "comment": "Malware payload", "value": "4397cdada0d472e55e9981b975f3518f0bf377f091b377b412429b39bfd52f3b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285329, "uuid": "908e129e-4d73-432c-99ba-976201e7ef69", "comment": "Malware payload", "value": "eb7dc018275bd723ab50fb75f4858d76e86c2968", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285329, "uuid": "88327c9a-03fb-4271-abef-dbff384617fa", "comment": "Malware payload", "value": "62315d9fad7fa639243964a928f1ea4d25ea72507b71ef011f4b68d2d4bc4992c23e117cf3ae70b5084078bc1c7a6904", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285329, "uuid": "f3e79168-5d03-4e94-b04d-e0e1cb8be9bd", "value": "T1CE1157B254A6AC33F38B44F99E9DF1192A52396E24B16F6D70CFA8748F6E6003305A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285329, "uuid": "5fe4b0d3-bf80-43dd-8570-7ec64f5be6ab", "value": "24:bXX14DyMzMnMqmMUwFbcMO/fLtnGRfwFFdMTQ312up12DKY12uX9L2:zaOGwyocRpnGR4deQ3131M51C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285329, "uuid": "dbb5f6a5-5e86-459d-a154-e631efe57d15", "value": 936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285329, "uuid": "42c228c0-56f7-4bea-ab11-099802504248", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285329, "uuid": "c3d17e33-b9ff-4460-9e7f-80dfcb926ae2", "value": "run", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fffec2-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279328, "uuid": "6510ea2b-2add-4dfb-b0c8-93bac79ff22c", "comment": "Malware payload", "value": "49de8a184156c95de445d3cb7392ae64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279328, "uuid": "b8682bac-a2ec-4273-bb73-c60e03c2bba3", "comment": "Malware payload", "value": "43ec8485030f56a20ec77239ce245ca53ff25eafffb5cfc2cff8f1f68540192c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279328, "uuid": "81dbbfff-eb93-4d3e-9dc3-e4b008466175", "comment": "Malware payload", "value": "916741b3259cfb1e4b7fdf078acd1bc68e67095b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279328, "uuid": "c8152819-b650-49e1-9f61-cdc65a205821", "comment": "Malware payload", "value": "9cf85f7b557a19f5a61d4a4f9b7605cacd6c2e830f1cf7b44768469115ba569eb61d334333374e7b2f7d8560f201d83c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279328, "uuid": "8a1ad3b8-00eb-4e37-b9bc-0a6598c867f8", "value": "T1083723122D9D6CC71549512858BF0EDED39ECE0945820BF3D7C9B8E6CB8AE34279B706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279328, "uuid": "b1d30365-a430-4ced-8bfa-203221767b1f", "value": "49152:EhYGBlLgEYi6a6zmP3sSjRVz6zmP3tQGEHVr8tAPxnVk6zmP3O6zmP3RX+76zmPQ:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279328, "uuid": "006d9d51-a454-4d60-bb24-a030c0dd75d7", "value": 22643810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279328, "uuid": "27e5152e-4928-441e-afe0-f44f3aa2739e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279328, "uuid": "973937f7-20b5-4b69-ba76-6e9c2486c760", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff55ab3d-424d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777303818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777303818, "uuid": "2832b278-71ff-49f0-9b04-d818ea4439ee", "comment": "Malware payload", "value": "c5b1ad31ae9e855ce910c0b19be0d4f7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777303818, "uuid": "8252becf-621f-4fc6-8f8a-d815282bbc14", "comment": "Malware payload", "value": "4424e0b4d8f5953a615f6d8fe5999e3afde5938f79a47eb916a24bebc37c28e5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777303818, "uuid": "2673b219-b5c5-4574-b743-d9205e319e21", "comment": "Malware payload", "value": "26e8c5a0cdf53e1f5615408865f3d8a986479890", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777303818, "uuid": "b5f93205-a03b-42ae-bc85-128a393ad8e9", "comment": "Malware payload", "value": "fc3704307d0187d091334bbfbac92ec0ed2debde24bd52455574721dd5d36194202d59c6df7a303f0a67b533d51d61f1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777303818, "uuid": "33cf9624-52f3-480a-9ec4-e0f042412415", "value": "T1E1741E347AFE501DB2B3AF949FF475DAC92FFAA32E0A545D0051034A4623E41DDA1B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777303818, "uuid": "9ebda8ba-bfa9-44fb-84c4-888c2dc83f39", "value": "6144:CbeB7xp77A5Hunwgehd3bqeUmIM613y/1GBVD0dzDrhJC:JBD4Hrgehd3bqeUmf61q1G/Qd3rhJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777303818, "uuid": "8afef210-becf-4d2b-a6f3-97deec68b8bd", "value": 349788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777303818, "uuid": "35e1fde9-49cc-459e-84c9-c1f4ef345890", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777303818, "uuid": "3dac1ec2-beb8-450d-aa42-6b4979903fce", "value": "rPEDIDO_4500003209_APR2026_xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f9bce2-41d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777250946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250946, "uuid": "a2f5104a-77bc-42b4-8725-cd77ab3a04f7", "comment": "Malware payload", "value": "ef51e4be68caca9d8ebbe03bdad8099a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250946, "uuid": "aa05a6cb-bc5e-463a-843b-8cb96872f693", "comment": "Malware payload", "value": "442f2564c9fabc4e76bd4b80b581d7c301a81d9c484fab201364acf8c471be42", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250946, "uuid": "e895977c-512e-4c1e-b6e5-d7fb2bedd0f4", "comment": "Malware payload", "value": "924025032cd46d2cfc08f535db36b60e58e8eeb2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250946, "uuid": "2e75b463-965e-4a98-8e14-71093b83bf66", "comment": "Malware payload", "value": "01054610ac60ba4df2f2acd05234cd7727941afb4102693a88595a68c656955eb5c9b9d0857e5ad29c331c67354a002d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250946, "uuid": "8d238e86-c018-45f0-8831-61dfb7ddceb5", "value": "T16931255960813731743E4C775C269C0CE2429233AA712F147DCFF821ABF47FB6868A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250946, "uuid": "baa32dab-c57a-4b63-b141-1c8c37c7dd39", "value": "24:TgumeE/YrxygJaf/p78j4rCKH1fi4Kb6jif9qRwIIelfqCI4/shgI4sIOvruCyzT:Cem8WiVqRwIJI4EKI4sODGUkLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250946, "uuid": "10b76677-334a-4bb2-9e8b-6dfa4f85c940", "value": 1496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250946, "uuid": "b7989043-bc75-4e4b-bca8-e2d08942613e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250946, "uuid": "591a0080-f042-49c1-8f26-7304b01f3855", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea2d5e0-4237-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777294261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294261, "uuid": "2e6d2c0c-dfe0-48e9-adf3-8994e39c442f", "comment": "Malware payload (Mirai)", "value": "0f0a5ecb190434836ec0936d8dfd3d32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294261, "uuid": "06a49300-428a-4a1a-9a95-eb9481c2077c", "comment": "Malware payload (Mirai)", "value": "44eb980597dc639c7c0f0bd581bbb68030f0deb6861194819340193b110f7994", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294261, "uuid": "9bed97f3-cdee-4b39-af81-093df2e9e65a", "comment": "Malware payload (Mirai)", "value": "31072d76af0b127b0065e978636b9a825e3d295d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294261, "uuid": "93d6d9a8-5674-4b52-abe6-32b4545d0b66", "comment": "Malware payload (Mirai)", "value": "1f0c4911c654e52acd8a9a76d90412b3ef68a23d13af529d43791e3994dc038b7498d72c86d90c04c3b12f0db0bdf722", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294261, "uuid": "710bff42-5926-441e-a22e-da2159ca6a9b", "value": "T1F5D30941FC414F23C6D512BBFB5E428D3B2927A9D2EE72039D215F21379A85B0D3BA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294261, "uuid": "8a95e8ad-20d9-492a-a527-46f81fcf7970", "value": "1536:q4U0t5oPARg/ozLuvbRBIqXhhd2iKXR4Vzg57DQcuqKblVmwywdmeXIk3c2T0Kwh:q4ihhdO465ruq+ITwj9mAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294261, "uuid": "6a8906f3-839b-4808-acfc-b41e932eb335", "value": 141888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294261, "uuid": "c2f9e51b-c43f-4902-8a20-d5f558ec602b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294261, "uuid": "3acfb861-c864-40ba-a50e-fdd43a443e09", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd84131e-4294-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777334229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334229, "uuid": "9f919b01-8fa3-4d4f-941c-1e051a73f42c", "comment": "Malware payload", "value": "467af0fb89b3503a0b127a3c97027542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334229, "uuid": "2eaa60d1-81e7-4504-8af9-a6a1146b1450", "comment": "Malware payload", "value": "45126f4f4257f5ac9c9895800f01c1c7021deeca5a4ba8b43ed3fe1249a8a318", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334229, "uuid": "f0409b15-4b48-4e5f-acf6-5331181c4731", "comment": "Malware payload", "value": "37ee7eb1b57a5835bc35be3631e3984ad839d3ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334229, "uuid": "c69545cf-d206-4f87-8aaf-69b20e5ae08d", "comment": "Malware payload", "value": "4af9e951e8fe221417cb1de1c499930691f66c47eb9a2f836b12b49002ffd245eb1b4b5acce4457976f3964c2a066d06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334229, "uuid": "79e0a178-054a-429b-a6d6-24bcd013d5a7", "value": "T1A076123BB28B653AE06E56363AF2D130D43B7A6165128C5ED6E0C48DCF275F01E3E646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334229, "uuid": "beff775b-1230-4902-80b5-b467447b0db6", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334229, "uuid": "ff96ce35-495a-4dd6-8421-637ef3d2f9ae", "value": "196608:n4/10xloYw9lkVpqHdg+DxqZsqBzU0zy3HF36Z:neslz/I++DUZsqBzUtl36Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777334229, "uuid": "e4dc3425-b80e-43c3-917d-b402f5aa90f5", "value": 7427826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777334229, "uuid": "347e624f-bbed-49d5-827c-0e9575e2f520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334229, "uuid": "3007c2bd-2ebd-47e2-b809-44a1fd9b955b", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u6c49\u5316t\u8bed\u8a00zh-cn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0053bad-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777265084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265084, "uuid": "f5e1b723-f54f-49c4-a89c-01b387544e3e", "comment": "Malware payload (Formbook)", "value": "664e1e04acd4c6b54ed290d395961346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265084, "uuid": "eac4e5a7-e649-4365-bfce-1da0fd302a2d", "comment": "Malware payload (Formbook)", "value": "45fc07f4eca491881b53ca9ff1d02f0c9ae47569f9ca252eff2d5a93cdb15994", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265084, "uuid": "9f6cee9d-4753-4c39-9423-10152fc2c788", "comment": "Malware payload (Formbook)", "value": "eefcadb31b1fe865c991a265fd7471d310e35ffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265084, "uuid": "12fc1941-2afe-43df-aa52-c2e16eca1d75", "comment": "Malware payload (Formbook)", "value": "1683f049d4d3159b2da3ba359788baa62815f647e1c23a245399caf535e6e08a460caecbd833c9855c786544381a024c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265084, "uuid": "a9e0cc7f-c3d0-4643-9dd9-07bd72dfcfb9", "value": "T1D52523749B0BD502E4910B364DB2E7F022E1EF9AA162D366D5ECBCE738257B17C684C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265084, "uuid": "18928f39-c46d-47df-88c4-8a520db0f5c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265084, "uuid": "cb292a66-7a97-4742-a27f-26052b0b4386", "value": "24576:rq0fVzECH/GQ7GJVANwcGJkLG9RwqLRiy:j4Cu1ADGJkLep1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265084, "uuid": "d807a702-aa0c-49d8-85a9-7a6d6ae1af36", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265084, "uuid": "1b0b6120-c850-4cb1-b468-9f467d5081e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265084, "uuid": "18266700-199b-4417-a444-93e87ea7f35c", "value": "RFQ - 270306#08 pdf.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5f3850-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323087, "uuid": "530c96db-e1fb-4670-83ee-6785c6e8c140", "comment": "Malware payload (Mirai)", "value": "f336139517a286244b382390cc7e3699", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323087, "uuid": "8f59a356-3f9e-442b-8dab-7c349e4de2eb", "comment": "Malware payload (Mirai)", "value": "46438a5b7572e91340b414492e72528dcf32ee4a22a3b4dcc42c62ab8fbc7697", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323087, "uuid": "49189793-5a0a-4428-ab2b-5564f26324ef", "comment": "Malware payload (Mirai)", "value": "2e94d0916611bf78f27eabd164097f6958c60ec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323087, "uuid": "cf118125-00dc-46b5-bb36-d3fc8edad4b5", "comment": "Malware payload (Mirai)", "value": "5104615f3cd8f0cc609f009293ab48d5e8e9236088a242d97dea0c32d71d44d78fdea81a696c404f736a5ba13b3dbe20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323087, "uuid": "279a6fcf-63a6-47c1-9866-36bb3ed21da9", "value": "T1429328C6B401DC7DF80FDABB4463290EB631E36116931B26675BBE53AD321E05917F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323087, "uuid": "510abf02-aedf-46b1-80bf-510d382826fd", "value": "1536:XQ1JsIO7ywe3iyRBzPQRIIecan4UtAOtFW6O35Pb8bMThLbKrTsX5vH1M0zfTnV8:XUBDQLecan4qw6O3BfuAvVMqYuaB/wi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323087, "uuid": "0e239128-b996-4eb5-a596-cc24558fa5f1", "value": 96732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323087, "uuid": "f5eca18d-2f30-4c6e-8a29-c794f8a0fdf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323087, "uuid": "96e33a1c-f7ea-41ea-8fbb-9429b8385929", "value": "vaxstresser.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d92f2f8-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321962, "uuid": "6f663dd0-8093-42c2-955d-fedf8448f5af", "comment": "Malware payload", "value": "67e89404b4afa060a35381d58c93e9d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321962, "uuid": "ac2fc9a2-50ac-4e99-8c9e-5deb87859067", "comment": "Malware payload", "value": "46ad291f54a970a8d1b20abc4a6a9bde69605a9d66df4dc0cd10268276cb98fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321962, "uuid": "e5f6d007-edda-455c-bd04-1a9b48d690ba", "comment": "Malware payload", "value": "bb4c2308a7577c3e6840befe3219f2807e0aff24", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321962, "uuid": "b8b026fa-d2e4-425b-a21e-5ef5d2030159", "comment": "Malware payload", "value": "225b659043181a153cec135da31bfab90a8700c087fc6e7e00d97b85a5ad082210316a77dcaad39bf8f6c854e90fde01", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321962, "uuid": "40461715-a39c-4019-8b24-f036deaa6e16", "value": "T13551F9A8C7421632FFA7182FFAA1645847C6AC03DB61144D5EFB5CCE01E0A06A67DB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321962, "uuid": "9b5f8f6d-071d-4e76-b515-838be4757324", "value": "48:5+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:5katIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321962, "uuid": "94fbd183-9bcc-4843-8253-a434f288fd59", "value": 2489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321962, "uuid": "1632b785-df4b-4bf6-ba45-c35dac686c1b", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321962, "uuid": "3e4ea056-439b-49a5-9d74-9d7ef023868f", "value": "164.90.195.107_1777321925472601_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8213f2-423a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777295356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777295356, "uuid": "a36606a0-cdb4-4b34-b32d-c614e8e83c5d", "comment": "Malware payload", "value": "52e5b1bb9c2097c0a7bcdcc12ee20cdf", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777295356, "uuid": "4adbcf71-7838-47b3-82f4-095fdabd48e3", "comment": "Malware payload", "value": "46b2155c1e71b840d4b7a2e94410b89a61e2446523e6f497206d402eb02e0e93", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777295356, "uuid": "2527c985-4539-46e9-8ab7-8e50b47153eb", "comment": "Malware payload", "value": "6203eba07431bee32511851b42af7ec2d99961a5", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777295356, "uuid": "abad0f31-f6b2-4a38-97ba-6ef757f62653", "comment": "Malware payload", "value": "fa7de250e0f96113dc972c4c650605f3534290b3d429baf2f29adbf13499734941fbb718eb42eb18e08cdafa42f25fef", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777295356, "uuid": "3ef1a5d6-0105-40b8-ac75-ce9c1c0cd2e2", "value": "T14E452325DDD286F3F8AA80BCE50790A75124BC9F07F5A97F03EA2044BD786539EB1817", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777295356, "uuid": "f3cbc7d5-a597-459b-a0a3-74fda07ff2f6", "value": "24576:UlMTys7oYcbD5291OACm7njzauYBRzt/cgSxEutSavUqHMB7eSQKJE:UlMAB1291Olm7jzaXBRzt/c2QvUnJ1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777295356, "uuid": "4e7575d7-f86e-4875-8d18-d81dfb376c78", "value": 1266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777295356, "uuid": "ded8abdf-0efb-4085-99f5-0155b31f8b9f", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777295356, "uuid": "913fed40-ce4a-45d8-98a0-8c670357acd7", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16002538-4210-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277228, "uuid": "c79cd704-74fa-443e-b27b-628c78df4cb4", "comment": "Malware payload", "value": "3378340ed507564e94390e0f4ab94043", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277228, "uuid": "98319786-fafb-49e0-9ab6-3d6480552a54", "comment": "Malware payload", "value": "47e9ca63d2efaf063efb144fdf208fedc8184da06b0a5540414058e4b5c4d768", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277228, "uuid": "e3411c3d-d9e4-401b-921b-8fd07b4eb8f0", "comment": "Malware payload", "value": "8abfee8ffc966ed7aae5325997dbbf579c5b2fb1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277228, "uuid": "c57aac91-d2dc-4a3d-831e-c403d5b0ec51", "comment": "Malware payload", "value": "bb136afcadbbb563c7a4c9544f9b29b31811f4db904023789837a28283d0cee7f33acd0ac235224944771c6ec6267f82", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277228, "uuid": "e2aced0e-5684-48e5-a8f1-545831dd8686", "value": "T19A3723234F22AF2F0D69B41C04DE15CBE9A4EB50D087B8679FE245AFF58DE1247AE045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277228, "uuid": "1a0800d7-d8f9-4ec8-898b-20770e8782e1", "value": "49152:NNEGNEjNEONElNEnNEJNERNERNEwNE3NEDNE2xarNEeNEPNEXNEjNEUxaANEANEV:Bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277228, "uuid": "6001278c-dd35-49f3-a8cc-d9732be1cbb0", "value": 24464718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277228, "uuid": "78a5c55c-8b6c-495d-851b-e1842bb7f6fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277228, "uuid": "93e329e7-9dc1-4d4c-a2dc-9d9c147b0953", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af90a83e-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276197, "uuid": "ee7dc8d0-29e6-49e7-9e20-b665a9ba0743", "comment": "Malware payload", "value": "9f963639de732e322f4ad11a9bb0b3b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276197, "uuid": "89cdab13-16a7-4c95-bccc-b6a19ec787f1", "comment": "Malware payload", "value": "4814aad8013893c6124b4400c882451bf786ffeaed92d12bb5502d6876ec580a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276197, "uuid": "bc310ef8-b929-4447-b628-51de5fa5996b", "comment": "Malware payload", "value": "d9f94244621d11d8824817c97d3dd2e6a1f9b5a5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276197, "uuid": "b9b51899-2a93-4d0a-bcc5-57e63c0b654d", "comment": "Malware payload", "value": "c5a89d751850de38e26a5bf5633aadfcb8c99ada785819e6249ead126de9958a4e87f79f7dacbb1edf880fe440b33545", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276197, "uuid": "2bd47736-d185-4aff-9e1b-a4f321d0d005", "value": "T15737233ACBE549AE0A55665401FA8FDED997EF521920A40B03F17BCCA07CF2730B64E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276197, "uuid": "d60e7a45-177f-4f42-9d9d-aea23930d82a", "value": "49152:kGPGhGzGAGkGWGjG2GxGZGAGxItGMGAG7GbGLI4GNG3GGG4GFGGGGGgGxGPGpG5X:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276197, "uuid": "5d0a3e90-d873-49bb-8fa4-f94d26d2f8e1", "value": 23424213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276197, "uuid": "4a044681-18a2-45f2-9382-4b1d0c1623d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276197, "uuid": "a2aa7633-c75e-448a-9a23-2cc6fcb2ffa6", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36eca90-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279183, "uuid": "9672eeef-f23e-4e2b-aca5-19b041593545", "comment": "Malware payload", "value": "3423ddc77e2a5547c011d6847d066889", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279183, "uuid": "9e81ccf7-a1b5-43be-97b0-70ed14783ddd", "comment": "Malware payload", "value": "48a2f4ee6181b4710f0bd4caa7511817deb16d8ea8d8ad0f764d2998acb62c19", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279183, "uuid": "66d51373-8357-42e0-be8f-5d5dd7c01de7", "comment": "Malware payload", "value": "cef50fd8c1b726bf974c9fa4cad68b1f3c4f99d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279183, "uuid": "f1bca86a-45ed-4365-b4ee-46dc6843276c", "comment": "Malware payload", "value": "499bb1600d5d50e37f8c482cb85c71d534aabd8a8f736e9b41107e3e13af159025fd714bcc070f42364acf6145014014", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279183, "uuid": "03037cf8-954d-44f2-8abf-daf70ff823a7", "value": "T1433723069E0E9E7EC19C645D00278DFE63AD8FC74C46AE9EF5E589CF824BB44A047E14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279183, "uuid": "3e1109d6-2e0a-4b08-9831-5abff6a8b1fe", "value": "49152:/iEaiE2iEWiE3iE7iENiE2iEAiE8iEkiESiEI6liEciEwiE5iEliE16qiE3iEiii:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279183, "uuid": "056b0fa6-eb81-4d7b-ab31-4dfba8c16def", "value": 23164064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279183, "uuid": "4d52e19d-f012-4efd-8e2b-7df17549f067", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279183, "uuid": "c82f68e0-8353-41f2-a34a-78c3e1340434", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3726fe-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276134, "uuid": "6ba0a9ae-9124-4471-a6c0-f0af6f805efe", "comment": "Malware payload", "value": "b538b8b19528ae38c5be4db8e87c8507", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276134, "uuid": "fd0b11f1-9257-429a-94d5-561f5b0b9524", "comment": "Malware payload", "value": "48e4aa3e0ab35af8ef70b610e58c9ae93dd6aaa07eade8f63b2f0d3ec0ef81e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276134, "uuid": "6edcabd4-e425-4f4c-a923-9178d2b816f7", "comment": "Malware payload", "value": "d3df24b42776185ac09292f43eeb2f8f77acfa03", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276134, "uuid": "e707c387-ba59-4724-9cea-8b39aaad9eef", "comment": "Malware payload", "value": "c42e144c72831dfc966cd754cc49fea10e011f9cd888e7b772185deb54febc49b5b3120714f6a232cfc30f308606d156", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276134, "uuid": "3c46f912-9199-4281-b8d1-e43686cc8a7b", "value": "T11A3723431825466EC17A21AB35AC5F9F7BFC44540011E9FE1742EE3BF58AE29B04FA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276134, "uuid": "f99daf32-5788-4c2b-9d8a-fa01dea00a0f", "value": "24576:cSZbtbSZbtRSZbtaSZbtPSZbtHSZbtJSZbt2SZbtESZbtQSZbtUSZbtWSZbttTvc:ylelDlzlJlFl+lPl1lwlslilYlpla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276134, "uuid": "af57afea-6f78-4f05-993b-88b65dcf1ac2", "value": 22383684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276134, "uuid": "4c410c59-1445-45be-a7b9-995e2ea8e452", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276134, "uuid": "92f7b987-283f-43c5-884a-74d5706785fc", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42736c6-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323073, "uuid": "6a821c53-d3ab-480d-95c8-996482f91212", "comment": "Malware payload (Mirai)", "value": "6cd9f2b8d2e49741f7ea6567317d79ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323073, "uuid": "df2245e7-ebca-4af5-aca8-f42529c6d332", "comment": "Malware payload (Mirai)", "value": "495851855051a329c7044705eb9de80f778e96c529c97b0f76de41e65917b85a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323073, "uuid": "b5f42e65-b7d4-4a4e-8a68-b129c33126bd", "comment": "Malware payload (Mirai)", "value": "9590067f493257dd7a870328e6142891ba6ac247", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323073, "uuid": "b7a9ed2f-065d-4c1b-a7b9-27166e8cc326", "comment": "Malware payload (Mirai)", "value": "b2c519149640c291ff24d338248f55162896abba9b5eb2c4d23480fa5a38199e636a6f10d638e838420e1ae39f229d71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323073, "uuid": "014dd52c-28e2-4a44-91f2-8b488a05704a", "value": "T12B736DC9EA83D4F6EC130A351136BB3799B3E53E2169DB83C368A525DC125C2DA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323073, "uuid": "75c37e8f-2cc6-4d0d-a52d-ba520a3c0c92", "value": "1536:9sXS6v5iRk8Gnos1LNxVZW9Z3J8h3qaccSJZf:9sXX4kZnokLNx+9zs3sZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323073, "uuid": "34490729-1469-4073-b5ed-ecccd6143b63", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323073, "uuid": "6803d24e-3be3-4850-8e8d-fb5bbd6f64f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323073, "uuid": "95fe6a56-78d3-4a2f-baab-797fba0cc28f", "value": "vaxstresser.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c7c57b-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277165, "uuid": "28624ded-e085-4844-9386-e84a716a8892", "comment": "Malware payload", "value": "461b93ebbe2ce4f3d6f6657a3a0d116a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277165, "uuid": "159a2d14-0982-48c1-861c-0c7938a56aad", "comment": "Malware payload", "value": "49c6d8f77c4dc7f00a275a808374db36a13e762bd540b5f152b0ff86ad51d283", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277165, "uuid": "18eb7051-2633-4cf6-9992-4a2c3dcd876f", "comment": "Malware payload", "value": "66dc549058794e744d82bf7d7f88472e12bec4ea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277165, "uuid": "c33a1bf2-d03d-420b-b7e2-4ac31328186c", "comment": "Malware payload", "value": "5d766d8a086150bf619ecfb575f3b695c835b7833db28f57945e7af229a3c35699c060730ae1d9581611cd3dd0622194", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277165, "uuid": "3b755990-1e17-4297-a4df-78dd3cf6b1d7", "value": "T1E8372327ED7C557B4A29E7280A7F0ACB03AD0D85059078CD8BA3ED86171BF3B3D56258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277165, "uuid": "a616fe51-fc43-4518-9447-5ae28a1fed40", "value": "49152:LWYDZ6kkI1CykXERBYUNXH2wD9DBD3Qd1Ov5XCXneyYXQmyZk7TOiqGyAFxEGJEq:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277165, "uuid": "f55020b3-dbfd-4b63-bd0e-fdf9e4923879", "value": 22383682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277165, "uuid": "4755fd5d-02a1-420e-8915-a0f281b782ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277165, "uuid": "3aae28bb-f48f-48a1-b49b-9135d787772f", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665a3d2f-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276933, "uuid": "ada85037-b711-48b4-bb88-72341890a60f", "comment": "Malware payload", "value": "c2a12d28ef1a8d6499929bbffdd7399c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276933, "uuid": "59eaabae-a5b1-4280-b710-43920aae3a19", "comment": "Malware payload", "value": "49ca3373eeb7223243dfff6e0e1c32d893fa8aa1f524a31a202a0666a83d3859", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276933, "uuid": "e04e514b-46c9-4e28-bb01-e2c3c762babf", "comment": "Malware payload", "value": "d272f29ec69e34e78435c369e997360b3b91c514", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276933, "uuid": "8f73bfd9-568e-4042-bbe7-1e8e85d5d5c7", "comment": "Malware payload", "value": "5a34c0ad4eb6aec17b9e2912fade91f498a50c96bac678f334ae1f597cf31e94763c19cb18c3996c0718941ef6361ac7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276933, "uuid": "d34c11ba-1067-4bb1-8ad9-4b81199af1e3", "value": "T19B37231A0F888A67D56433079CF74F4C65888E0481A8B19852B37E5DF41E97FE77B22B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276933, "uuid": "4f9db22a-eee4-41ae-bdc1-e3511b216eda", "value": "49152:pDjXNqDjXNZDjXNmDjXNSDjXNkDjXNnDjXNwDjXNaDjXNJDjXN9DjXNPDjXNZDj5:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276933, "uuid": "874a88a6-e2a6-4865-99bc-90f76c9b1280", "value": 22903941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276933, "uuid": "67ef4b93-b984-4eb3-b074-b1537d8ecf89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276933, "uuid": "54f444e2-0016-45ab-ad08-71181b4ca40d", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e6731e-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294548, "uuid": "4815b523-fa85-43e5-b3cb-e33934e999c3", "comment": "Malware payload", "value": "9a57e948fbf78623ff921a39cdb1cd51", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294548, "uuid": "009540bf-bcc1-4485-91c5-3cd3db306d9a", "comment": "Malware payload", "value": "4a9097921378b120ed7bc671a48715bcc8583256dff616b2abe5dddb48eb9aa8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294548, "uuid": "d4341f6e-0fc5-46d7-8dcf-88e5c9803995", "comment": "Malware payload", "value": "a13195085673afccf077cb7d31dafc9368afb6c6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294548, "uuid": "11c151b2-b8b3-40fc-bd1a-f1fbcf053d8e", "comment": "Malware payload", "value": "6df8b056e0a804eec9ec3eb04a40c4da87cf65cc520366423d974fc3a07e616d8e7c762f3241fdb45d8ea80f5c752809", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294548, "uuid": "a9feef6b-120a-4bce-af9e-3d9f78f49825", "value": "T1A837236ACDDA89B6CB48115E44BB3F2F2CD9D9419066429B5371F8E7A3B92000D73B7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294548, "uuid": "2c31178e-8b28-427d-99d2-347d4365d32c", "value": "49152:AQavQaWQaaQamQaNQaLQadQaOQasQarQaYQaaqaxNQaaQaqQaNQaJQaSqaxUQaqV:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294548, "uuid": "682401b5-7b25-4326-8340-0be6393b8ee0", "value": 23684320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294548, "uuid": "985b197f-5242-4182-a810-80cde64e9b3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294548, "uuid": "5cccce34-5dd2-41d6-a394-72b6db0ea2f1", "value": "invoice-1645080830.pdf (57).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8ce8be-423d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777296621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296621, "uuid": "d84406a8-38d9-48c8-b6f9-43ba253adcbf", "comment": "Malware payload", "value": "321109554233cc67a316b812131e1bc3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296621, "uuid": "5e710e00-5135-4098-8e7e-089b1f699c7b", "comment": "Malware payload", "value": "4cd465ecc8e6022579105e247cef98e5fcc418b84eb5857a642bb179f74ae356", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296621, "uuid": "dd8eba4c-50a0-4b87-b877-6d097963a15d", "comment": "Malware payload", "value": "1caeddd6847e52c6b45fa0f6e1b642f6112db436", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296621, "uuid": "d9ac5108-714d-491b-9463-76bc38f80485", "comment": "Malware payload", "value": "5455fcdc2550bda15046380fa8f6859cfdc531fbdf23aa5ac0dc7aa11b397ec7d69ae179cdbc188871f288f82d9c4cd4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296621, "uuid": "3b049023-4074-4c04-9a81-7d86c35c174b", "value": "T12641FFCE60F46043E6DCDE0470F58DCB6706959163DF2A7AED812E67C4C9D54702AB3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296621, "uuid": "8450b1a8-92ac-47c6-90d4-16bbe4d8b034", "value": "48:spKpGpkpWpLp3qp8pw1lpLpg5pvpHapop+pspWp3pSpApSo78phpPqpSpqp/pep8:KoUikt3Iaw1Htg7RYmMKk5weSfDgwIhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777296621, "uuid": "0bb95a89-2183-4f64-81fc-c93f6935d63d", "value": 1901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777296621, "uuid": "5ce257d0-dd3b-46bd-bead-729a6455a3a9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296621, "uuid": "26336e34-c8fe-4aa5-8201-d4a5d1c9cba4", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc3919e-421e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283633, "uuid": "1e7de662-586a-4b6a-8b3c-729927978da3", "comment": "Malware payload", "value": "b6507c9b35170c9540a975c751d5c99d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283633, "uuid": "3168161d-f404-4cb8-b893-ee2e36bcd5e5", "comment": "Malware payload", "value": "4d35d3f74337ebd876c9dae1f2fff96e2b4238a582994c8bd3c651e0a962a85a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283633, "uuid": "158f80df-ee6f-450c-b94c-ef3368f3dc71", "comment": "Malware payload", "value": "01ca3bddb9e44d98589bfe49172058ae975b4797", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283633, "uuid": "c7344e39-a4d7-4d15-939f-461281888b93", "comment": "Malware payload", "value": "f8628e8c0a6950be5981692b7ae9ee54a5b8a286188897b6cb5383782eb27580daef0fe94da49125c878ddcde1db5c1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283633, "uuid": "ad31db01-0c7a-4399-b004-9b39dab3b4b7", "value": "T1D73723179F391B1BC3AC315424A81F8B97C58F14C2654AAF53F8284E70AD36D7DEA4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283633, "uuid": "b3e9b95b-9e8b-4655-ae83-7a129744fd66", "value": "49152:17Ti7Tz7TK7Ti7T17TP7T+7Tk7TQ7T87T+7T3OFZ7T/7Tt7T07Tw7TxOF47T17TM:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283633, "uuid": "a1bc9b3c-2569-41b4-8367-e9de5835801f", "value": 22643819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283633, "uuid": "2e447a02-5c36-4990-b61e-a92ef3d0ae48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283633, "uuid": "bf944609-b4ce-4607-acfe-b8c270018f9a", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f830b8-4252-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777305732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305732, "uuid": "e19b3275-341d-421e-8690-7f318bbeaa82", "comment": "Malware payload (DCRat)", "value": "018569d1fa9f3f0598cf2e53c9b8f049", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305732, "uuid": "3a462be9-7cc1-460c-87c5-e94c115c772a", "comment": "Malware payload (DCRat)", "value": "4d848fea50957af3d27e074433858402fd2bf9d61ad0ee532e0416fdb4a9f6a5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305732, "uuid": "6a28cc12-9291-48cd-bb4d-bfe4433e97c6", "comment": "Malware payload (DCRat)", "value": "45de71bf25e5285196c1c173068f7587b737637b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305732, "uuid": "b9d2b782-ba88-4949-9b6d-3c2c6cf073a6", "comment": "Malware payload (DCRat)", "value": "24f9523a84ec7d318173b1b2f7b8fa4b503ba6711cf190261dff694577b9da95aa43f4abe8d451acd2ebe268f45e0f90", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305732, "uuid": "ce1fc204-9a36-4cf9-bd5c-51d6ab727daa", "value": "T1FEB48C0A33F8AE11E1BF4775E4F55CAE8B70B852A6B2EF4F09C592991823740DD40B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305732, "uuid": "08a270da-aa5f-4f35-9c61-fd59b4e6ec4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305732, "uuid": "5228126e-bd93-48c8-982c-074b31c95f99", "value": "6144:FqqDLOXNroJwGgYGyExZHOqBULzLFvO51P3wetkVNsdA8qut8J7hAexO6tS7MyOd:oqnOFnYovBULlvOR+6jtGhtO6tQh6TGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777305732, "uuid": "b52e42f8-8621-48fd-a57e-edfcc6d3137d", "value": 519497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777305732, "uuid": "a04dbeb3-bfb6-4155-9db9-99ec9becc0b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305732, "uuid": "63764ab1-e995-4323-88b5-73562b61f016", "value": "018569d1fa9f3f0598cf2e53c9b8f049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d74792-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777291637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291637, "uuid": "0ed45c5b-f081-45a7-9eae-f94abbded1a2", "comment": "Malware payload (Mirai)", "value": "f15efb1795ad011c579bc4b16fd98eef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291637, "uuid": "7279f314-4ec4-4f3c-9fc3-856afd8deb78", "comment": "Malware payload (Mirai)", "value": "4df902886b55fb6e68aa6406f04725fab6eb2e26244b93f5c597fafaedf6d1b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291637, "uuid": "adb25c8b-84d0-4f6d-87a1-a47998188aee", "comment": "Malware payload (Mirai)", "value": "82d36611cb93abf23c19bc0a0092fb09028082a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291637, "uuid": "d05b9ae8-37ba-4392-b5c6-b8335db37d1e", "comment": "Malware payload (Mirai)", "value": "e090e6c77a68e71189630287527ecb7961675c5da3f412636cfab71f9db3e04f69e018487d3f68d273f3caeaab86f1ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291637, "uuid": "47d795ca-b39b-44f1-95a7-23fd3b51fb0e", "value": "T1F9A34985F987C0F6C44B08706066F73FCB31D9A98171CA5EEF99AF32DA67482C21665C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291637, "uuid": "003c8224-e52e-4b3b-8902-64b680420e73", "value": "1536:MTXIBdp/UtnqREg9vUMXAqnH6lHkiZXsjWso6m65PAGK:MT4Bv/UtnqREg9sMXzQHkiPtj+4GK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291637, "uuid": "46c6e9fa-fe00-4d71-bf25-f32b10033b36", "value": 100168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291637, "uuid": "d63d1906-37fe-4bef-bdd1-638b14c3fa58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291637, "uuid": "99cf345f-6003-4c3d-9d52-d1f673f78329", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a6b54c-4294-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777334030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334030, "uuid": "a17fe787-5908-4ec4-86a3-5dcf735f0bc3", "comment": "Malware payload", "value": "948635a26a09934263ea7f0d4f389a6f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334030, "uuid": "6c115024-5b12-4405-9357-77547c13a86d", "comment": "Malware payload", "value": "4ef4742c1a71cca9a3bfc4fe312e9ca6df120fec15f4f8dea4266f17340837b0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334030, "uuid": "4624e80f-4888-4f9c-9f3a-a420b2b5519a", "comment": "Malware payload", "value": "035250f79c5d98fc5a51d5fe4b3b696423aa3183", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334030, "uuid": "127ead4f-9a15-4c27-b63f-3eebc93e4150", "comment": "Malware payload", "value": "93e7fc8c8badccb85f56d23cb5fa6c63a78318974784a3f399f950500ae30e2af513fa7a3e978dcb2a8f854576876591", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334030, "uuid": "b8741128-7274-4e74-8815-8197e65c2753", "value": "T1AB752346E3BA1D7847A4B0BB7EBD4F0D9A694F2B8088844462D6DDB5524FF0360376F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334030, "uuid": "eedc2a9d-137e-4800-868d-5d09bc3cc8df", "value": "24576:jYglKxlaoXv+T3nELy7sd/xE87IqOnI+RCKQYaU0O0so8BP65wOa0rpFqsTDE7bF:RlEfl3IhONEP6La6mi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777334030, "uuid": "02bc8619-b58b-475a-bcd8-1ded259c39d8", "value": 1586296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777334030, "uuid": "bdf8fda8-8f78-48bf-af25-b808545e67d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334030, "uuid": "241e4e2d-8ee7-40b4-a1de-daa6e860b71f", "value": "wuauclt_2447.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ff5da9-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321972, "uuid": "77b84de1-0fe8-41e0-8526-7dd3d2551181", "comment": "Malware payload", "value": "e1260066f73e58da505e49ef13f857d6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321972, "uuid": "97f9afc5-3b09-45d2-af3f-cf6c48523e24", "comment": "Malware payload", "value": "4f193490fd195ffc1589f4e703b1cd500a7b535508e5ca5d7619bb4dd8077993", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321972, "uuid": "e877c6ea-aee6-44a2-aa8f-ac4fd1be5122", "comment": "Malware payload", "value": "858ff13b8c5e94d685e044187f1d255ca454b784", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321972, "uuid": "d5d74303-aca5-42a0-a7d7-dae9704fc188", "comment": "Malware payload", "value": "be16fe125d3cfe0f7b9ce3c11e8cbc2bcfa32bcd07bb67e14e32d22ffb4b6d5ec21bf603627295c4e70edbac10ab30c5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321972, "uuid": "7849854c-a958-4d88-a9ac-13c821edd114", "value": "T1B051FAB8C7422532FF67182FFAA1685847C6AC03EB51154D5EFF5CCE01E0A06A67DB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321972, "uuid": "9ae4d68b-84d6-4604-8530-8f8216d95ef0", "value": "48:u+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:ukatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321972, "uuid": "7419bd9d-67d2-4676-8c57-29fce43b63a2", "value": 2504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321972, "uuid": "387f18c2-290f-43b8-989f-9f769b2167f6", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321972, "uuid": "3cc75a3d-77ec-40d3-bf6a-7d5dc271800d", "value": "164.90.195.107_1777321928494543_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a3f9d3-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323074, "uuid": "29e00c5a-8368-489f-8d7a-cdcdca0957fc", "comment": "Malware payload (Mirai)", "value": "f8ead09e95c3b777f542a45989f02e6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323074, "uuid": "b0b1727a-f57c-4839-81cc-e87eb905e748", "comment": "Malware payload (Mirai)", "value": "5053ea23186cb3b96f3121ca0275e2fa39e5ee6c70a5479f7aa4e5f7a8a582c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323074, "uuid": "636c6db5-cf4c-4256-88c9-98922ec59b87", "comment": "Malware payload (Mirai)", "value": "316832646272e5ce5761a9ffd0fca9d295d84de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323074, "uuid": "0334be08-c3e9-41c9-b8d9-8396c7a09440", "comment": "Malware payload (Mirai)", "value": "6dc26b142cc300005259d370e55b48b2796ff35c7d693e3382c41072e537d49665f66e9731002a4ff03c8843abeac45d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323074, "uuid": "758c7cd4-a1a7-4b03-94a9-6a418937d57e", "value": "T19103F110E5522AF2F63CFDE44A18E5CD2BE4ABC6B4B11EE7B780DB14691392A75051A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323074, "uuid": "c9e89087-f918-47a0-be3b-fc21bbd4e9bc", "value": "768:40R6QVu+Mrck4GDNva2QcZuCgZvJosmIJDg870FeO1D/84uVcqgw09Y:hVswgva2PgjhFmMREJ1D/84u+qgw09Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323074, "uuid": "08b20cb4-0d88-46c7-9561-f8e95ede2860", "value": 40148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323074, "uuid": "cbba29e1-b645-418b-a80e-8c2ed94224f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323074, "uuid": "bd9d2b4d-f53c-47e1-920e-4fd4dda486ff", "value": "vaxstresser.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6106b2-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280599, "uuid": "936ab06e-c3b7-4f2a-a6df-9971cc789c56", "comment": "Malware payload", "value": "f81f2b4e28e4eecdea4c18be76fa6f8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280599, "uuid": "65611721-a3db-4762-87a1-94caa0f3fd77", "comment": "Malware payload", "value": "507fbdb7b2f199d10c14549d3023fb1e34632870b49b203cd1aa273027b0869c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280599, "uuid": "90bd4c03-d5e7-44a9-87ec-1f25ff79b0b4", "comment": "Malware payload", "value": "b6c4ae7e351fc17250bc609eb2b3a14b45dde1ad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280599, "uuid": "4974080a-48b7-4f82-b706-1863bb658ff0", "comment": "Malware payload", "value": "f60c588e670fc61fa438b51dbc27a154a5de60bde96894d753fdfda3a8c9d9bc07898f5ec3ed3951c9eba8707952927e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280599, "uuid": "4fa23c8b-12a4-4d97-a128-0a12a3951cc4", "value": "T196372347CE2D6B9AF1BC19092CB7890759E14552C1F8F876EF25B09E873DE24320BC66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280599, "uuid": "b4c1af25-75ce-4396-a92c-4b4b217133df", "value": "49152:Uakvwy4Bot/+PeqYnzg9nckUaEAgncsBKRlRyyKKAuutOWP/v/fLVv2Yg202pk9U:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280599, "uuid": "cc3fc8a9-a7c1-473a-836c-e5bbf4fc966f", "value": 22643797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280599, "uuid": "ceba68cb-2dce-4691-9d6b-e883b490d944", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280599, "uuid": "1449e216-2cff-402d-9303-f4e61e8207d3", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52c3a13-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280474, "uuid": "43b4bd38-b48b-413d-b4e6-fef77893b24b", "comment": "Malware payload", "value": "ab6d53ade98099079efc9b4b5432d52d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280474, "uuid": "730bfc42-a516-458e-b6fb-bd4ca6bce5d5", "comment": "Malware payload", "value": "50f2bc90aa45e6c6f310e1008a22a53ec955f10d670c2dd0c3b2a17646ab8ac3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280474, "uuid": "2237bedd-6745-46af-83e0-868d43a0db22", "comment": "Malware payload", "value": "9e50bdb559797475462539d101a0ca690e03dd46", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280474, "uuid": "c70e29b6-362c-42c4-bbed-e78cec38e92e", "comment": "Malware payload", "value": "23b66493e7199d7d3a1ad5de659ab72594aac5ea930f38721a4752d8e6e2d6105772ce108c915bdaed00f1799afdbaa6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280474, "uuid": "bee67d30-56c1-4e65-ad2e-7898719246fd", "value": "T17F372302CE658F4E8E5833A7587FAEDF46518A5150452B7FC68038FAADFB7024C8946F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280474, "uuid": "b7af8c56-61e4-48de-ab41-da547501d01f", "value": "49152:5mDo8mDokmDoAmDoBmDo9mDo7mDoGmDo8mDoimDoAmDoWmDoEqyrfmDoHmDoVmD+:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280474, "uuid": "85338289-00b8-40f5-8fe9-99833b65a24a", "value": 23684344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280474, "uuid": "4ccfbc51-15b4-4c9a-a7db-f13c6fba36e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280474, "uuid": "de8be635-fc59-4210-be56-7a15cfe4d883", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac6df06-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277021, "uuid": "00638a45-dc33-4a11-8626-dfa17ad08e80", "comment": "Malware payload", "value": "81c9d8ed619a1e34ceebcf51644937ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277021, "uuid": "8ded420d-7f5d-4606-bd9e-304346f7f6f3", "comment": "Malware payload", "value": "518e81ea3b49df39a3bc24f9acf467626f9114d5f85f60f7aaefc23932d6fb27", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277021, "uuid": "b048524e-b474-4d3d-9c52-a8f074b622f1", "comment": "Malware payload", "value": "84a33a872f9e8a0d9ffb92b1d3cb25407d863c97", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277021, "uuid": "2e87c201-a76a-46fa-8127-d4c2b2c9eb74", "comment": "Malware payload", "value": "e55406a66c5bf3aa6d0ce5eabdfb457e7535634288c1bcf94ce92585849480418829d8b2172501c1541db7dfaea1b67b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277021, "uuid": "d201e70a-2b74-457e-8512-d55964948325", "value": "T16E27234BE77D17EC94EC1190103E9D1B2A898C394A3896FA7BE5E8E554FDF0434E6A0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277021, "uuid": "2d7410d2-70d9-469d-9339-f5b7a78b2d1c", "value": "49152:h2d9pix2d9piJ2d9piY2d9pia2d9pif2d9piN2d9pi42d9pi02d9pi22d9pi+2dK:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277021, "uuid": "f2c16c26-cc87-40ca-a401-0b44b6298e75", "value": 22123545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277021, "uuid": "42651fc8-15b7-47ed-846e-257709e1383f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277021, "uuid": "6abd2d8a-dfd1-43be-9c33-369037c43fe8", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b140d9c-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284162, "uuid": "f1c4d42c-7da7-4f2e-af2d-23324c77c1ca", "comment": "Malware payload", "value": "cb366af3a5f0ff74c9da09cf7e763c6f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284162, "uuid": "31a48460-928f-4c4b-b864-1df0bcb5dc3e", "comment": "Malware payload", "value": "520d19a224f4ebb1ae9fb13e612d86ec1bb6ed334e390b732b190f0c993c36ab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284162, "uuid": "89cafca2-f6a7-4913-9e4a-3fe24d74d274", "comment": "Malware payload", "value": "ac433470f7853ab0aeaa00b269a38866f86d2792", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284162, "uuid": "378ddc83-e391-4006-b81f-e95e1ffc095d", "comment": "Malware payload", "value": "7db0f7ac4fb95bec1facb2ac7a782be56c0dfe2d3658c627900044a916b7a820041976772f2cc8f68698af500933faee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284162, "uuid": "59164479-cbf9-4eba-a0d3-d6735655bfbc", "value": "T16C372341AEE81BB287CC279714FD1EC81FE00F4190B1FAA7E2EF695C169B24D61472D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284162, "uuid": "53fc62d0-8315-4b25-ac2f-2db8dc2081c8", "value": "49152:LOCOKOQOGOhOHOLOuOWONOkO+tGsopQGONOmOsOYOctGsopQ5ObOTOvOCOVOjODs:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284162, "uuid": "992223e9-2064-4f71-aa68-d6b861c79029", "value": 23164067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284162, "uuid": "7c078299-860d-4ee2-8f26-5fd3392ca057", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284162, "uuid": "479c5496-0029-4d6f-8148-8c83b2f9537f", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513bc6fc-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283769, "uuid": "6f134c2b-9d2a-45e6-8ea9-9d4de08deb89", "comment": "Malware payload", "value": "dcc686b2565ee2599b2b9d4bf809ac80", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283769, "uuid": "305ff0d7-b45e-4c27-a7ee-9a28463ab841", "comment": "Malware payload", "value": "521b943d28bbf7f35b9c71ce36f813a0bc48257968fbd97c7153a58ad992d78b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283769, "uuid": "8ef8d55a-abbf-4c98-9f35-7ad4ff8ddba6", "comment": "Malware payload", "value": "4f82ea8c64d9f7cd2c9a85f21605210ae40ea558", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283769, "uuid": "6de627fc-23e3-4e84-aae7-d15621ce0064", "comment": "Malware payload", "value": "10e0e16a832ba4b9112fda1cf7e5121d2103b571b97f13ac2c540bd7ca531471412baee8b865693ea5f22b6807b43ea1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283769, "uuid": "a1b26f20-b0dc-4c4b-8a37-0f9a352f123e", "value": "T1A53723454F28176E1A7C84AD78CB0C9BADDE8F8D95903ED2318CAC5993C635F215B0EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283769, "uuid": "6c7226b1-84f1-4ee4-9b3d-1af004f18282", "value": "49152:N+YuYzdV0Yb2HhZNouNN2hZuqyqdB1ZdOvHAnthZchZyHpZhZBYrOmtlsYAEI7uG:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283769, "uuid": "c5e49654-b6e8-4dc7-ab7a-f6cc26c2b39e", "value": 23684321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283769, "uuid": "67c4fbac-d30d-42a7-8d39-62912a3ecc2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283769, "uuid": "3d35f796-b7d6-42e2-899f-e93c6f960fe4", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29faf76-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283906, "uuid": "fc04b303-45a4-4e44-8aa7-75bec2201706", "comment": "Malware payload", "value": "10895c2a71027f6da3f68d17d0bd1466", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283906, "uuid": "67e8cde5-90fe-445a-a7da-824e42505213", "comment": "Malware payload", "value": "522b2d61c3d37ad8024e94492a074a6a96cc4e940d84d4678848d26ccbf177ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283906, "uuid": "5e1a87d3-ad48-45db-9927-7b0daa9996ad", "comment": "Malware payload", "value": "62461935a5ddfb94ce4c56b2c4f575b0b09b7445", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283906, "uuid": "5393ace4-e5cd-4df1-8384-2f2e45493af5", "comment": "Malware payload", "value": "748111d4ecae4c35cca8e7f8fdc1d609314c47f61c8ef7818aa5ce35a6a41c96f7ef764ab477c721440ee9cc0fccecd5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283906, "uuid": "10757c55-1419-43ad-b6c6-9a5b63eb60c7", "value": "T1243723179D3BEFAE9D9D031C2558DF0B4BA84F1024118EE893FCAE68B90FE679145139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283906, "uuid": "81c67172-d067-464f-8119-cbdfffc71638", "value": "49152:jMwMmM4MxM1MjMpM/MWMLMVMHYhM4MAM1MBMHYGMSMCMWMFMhM5McMSMVMzMjMXg:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283906, "uuid": "628545fe-e2a8-4741-a80e-a77668ee404b", "value": 23164048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283906, "uuid": "73f111ef-1f00-449d-9e11-6efe99cf62f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283906, "uuid": "ca9d7f1c-3c2c-4a5c-b6d9-f4900d9dd985", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ed23f0-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278917, "uuid": "ed206932-9af3-4547-beca-c0b7efa52baa", "comment": "Malware payload", "value": "2321f0dc0bd3c92c7e651d442fa1be4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278917, "uuid": "315e9248-5b5a-477f-b665-4734ae1c3ea8", "comment": "Malware payload", "value": "525148326c4ee7ff73202b4a4a4a9421e3dd8625f9e9d81511658495aeff8fc8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278917, "uuid": "faa9108c-c0af-4ba4-a722-b55c1bbce422", "comment": "Malware payload", "value": "38fb2f18d5c134bf43885011c63432eefcf2a0e9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278917, "uuid": "a622fd40-408a-4697-b6c4-b0288c41c56f", "comment": "Malware payload", "value": "df4b0b8a4d88b4cbe1d27105d31d5488f92fd554d983052a991161610874448135d2694b45634a47cdeb8d9768b364ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278917, "uuid": "48129ec1-8345-4ca7-b0d6-eec785d77139", "value": "T13737239F5E6DDC3EC3B8648C30B64D4F168A8E808695EDD5F7E42DF2854A706203A3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278917, "uuid": "f8cd743e-6bfa-4ac2-9ca1-bf52f7f5dfb2", "value": "49152:T7rC7rP7rc7r77rL7rF7rY7rT7ry7rW7rJ7rO23j7r47ru7rn7rv7rK23G7rG7rM:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278917, "uuid": "ead81017-a82b-43c5-abd2-0d69742b9761", "value": 23944464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278917, "uuid": "92b8b7f0-21c2-45a9-af5b-4ceb6ab1a16f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278917, "uuid": "960df74e-7d43-4888-a284-a26ee8c41932", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da364299-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285288, "uuid": "0ab8a16a-353a-473d-a8d8-fe370f1748b0", "comment": "Malware payload (Mirai)", "value": "2d1512b89b05c8f60f09b4142fca0d84", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285288, "uuid": "e33d4fd9-8936-4429-bb92-50991202c707", "comment": "Malware payload (Mirai)", "value": "52a4fef9de40fed0cdb3facd388f6a2c551a6b78660982c5aa435c06a4cc2965", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285288, "uuid": "9e99b8c6-db5e-4196-8fb8-b3cddcf24915", "comment": "Malware payload (Mirai)", "value": "0b64853c4275bcc721b103e50bb88ff1aaa3ba0f", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285288, "uuid": "7826f646-872e-4727-970d-910ce6051614", "comment": "Malware payload (Mirai)", "value": "2b816c4ea41576d406c4c66e5d049ce5ffe2288833c99614b56fa7ffb4880dbb7a6567cf18bb28aff576dba00a007aa1", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285288, "uuid": "98622b34-af9d-4c2c-8559-4662b80135e2", "value": "T1B0357C5AF2F374BCD067C030439FDB62A835F46A01222E7B65C4DA352D66DA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285288, "uuid": "6dc9e072-f1a8-4692-acb8-44ab0e6e04d5", "value": "12288:eKwVprVcg70NBZaYd4gja9Vnqi7GYDyz0q3jmysz8ZT8LnL5k:eKwVprVcg70NBZf4g+9Vnq4GaiNBZQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285288, "uuid": "12366d3d-001d-4fbd-8f0b-fcbb9dd54a6a", "value": 1104000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285288, "uuid": "25f96c37-4e2c-4550-84cb-4585fc18478b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285288, "uuid": "dcfe06cf-7c36-4dd7-9b92-cf0db6543445", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8248336-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276748, "uuid": "792803b5-d360-4fa6-abaa-9e73dce2dc26", "comment": "Malware payload", "value": "5b0e9753728563663c2a2b7b2abd3af7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276748, "uuid": "6e5fb217-f400-4df9-ad1f-5ea4e8235df3", "comment": "Malware payload", "value": "5308062f412559005bee3b6eaacc0ccf27092e2f38682e76c898c9c93127f87b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276748, "uuid": "5b4f5128-d07a-4012-8d60-bbecb6a0cf22", "comment": "Malware payload", "value": "7853c22eb8fc36778820cb4c544de825687d3a0d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276748, "uuid": "7d4c6928-e55e-4d18-89a0-4e0dff87d6bb", "comment": "Malware payload", "value": "73573095eec246aceef3877290369fd5597d3813eceee7644b665d866f7b2b01384184c45b7ea9f99370fe5df5817b2b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276748, "uuid": "a1ad2007-38ab-47eb-82a8-0e22f4ebb337", "value": "T1B63723E7C70D9FAF4139158C58BE035DABC18A979421A9847AE23DEE43CDD5E908732C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276748, "uuid": "f728162a-7f5d-45ac-a1db-e7d021d32ba1", "value": "49152:cLkIFILkIF4LkIFLLkIFZLkIFALkIFaLkIF/LkIFgLkIF5LkIFVLkIFOLkIFP7xa:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276748, "uuid": "593a480b-7380-4981-8026-a34c7592cd01", "value": 23164079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276748, "uuid": "d6b4265e-985d-4ac8-b8c5-6ca5a6ee4adf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276748, "uuid": "7e9f3022-f0bd-4b99-b7bb-45fddec8e263", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83d3e36-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323053, "uuid": "dc9038a1-76e8-4d66-a63b-fbe98dc84a01", "comment": "Malware payload (Mirai)", "value": "d22153f7a94f304dcc642e6e256a104a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323053, "uuid": "a6e89266-7abe-4b1e-9086-a3808c14dd41", "comment": "Malware payload (Mirai)", "value": "533d51225017297d972edf5f8062f5d215b7befb81f2911907ba4a301e79e363", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323053, "uuid": "6eaae163-5dc1-4ecd-b382-3ab47a437303", "comment": "Malware payload (Mirai)", "value": "23d1bd1dfd481cca8047862bb24019a117f3a15e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323053, "uuid": "864528af-39cc-4467-9bf5-f3dbfb19d99a", "comment": "Malware payload (Mirai)", "value": "178efa0243bcfdafca51011bf917da9d8ec25a7d6164b652dcabde9261af5f770def75badf2870410a413cba103e7b28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323053, "uuid": "a4bac5ae-e600-41c4-b20a-8ab81d46d1d1", "value": "T1C7933A45FD819612C6D1137BFB2E328E372663A4E2DE3203DE256F22338659B0D7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323053, "uuid": "110c7939-0d6f-4f15-8b0b-5ad016cd9d41", "value": "1536:OLta87G2FrspVaO3wyb8pPRLQ0YeKXffd6bqmv1y:Opa87F4bPipPVQ0+Pk1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323053, "uuid": "c2b522d1-7bb6-4599-b478-372cdf6262bb", "value": 92248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323053, "uuid": "7de37770-20b2-44b7-8257-aa9025a51ecb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323053, "uuid": "3c78cea8-f6b8-4d23-bbb7-208822f22b4a", "value": "vaxstresser.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5f80d2-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276349, "uuid": "2e59b255-3417-47e7-8b81-c044c1d89695", "comment": "Malware payload", "value": "ea6d6a73dd456e6125ac4484b47430e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276349, "uuid": "9ca6f736-cc81-430e-b52f-d14bad2f10f2", "comment": "Malware payload", "value": "533d5455880199c7b105b066bcdddf4ec53090fddbeef4cba8f295a53de17594", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276349, "uuid": "2fbe8dea-3242-4cf6-b83c-181b623816ba", "comment": "Malware payload", "value": "99e94c728cde6baaf350484fc7c62e92e3fad578", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276349, "uuid": "607aa34b-cdf7-46e2-b91a-222dc2202f7a", "comment": "Malware payload", "value": "6397f9e1835bba55a8b7a05df9506bf7a70b3ea8e642fed7ed6c163124ca73d83342cacb28a9f7d5eeed7844098fb07c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276349, "uuid": "e4d1b48d-be78-4cb5-8e85-466a596a038c", "value": "T18537228EEEA34A5F4EFD00B9206B8F8B0D415C6C4DA6BD35D7DBB09F983EE012419654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276349, "uuid": "ca1e3663-a9bf-4aea-92ec-7a61168ae062", "value": "49152:p/R/D/U/L/7/5/L/1/S/9/L/+/g/g/H/L/F/c/o/u/l/p/N/V/+/L/7/T/C/T/nB:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276349, "uuid": "e84a1c26-c648-41e4-82f8-dc4c008ee6a5", "value": 23684328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276349, "uuid": "f8f98710-425a-45af-a4fd-af4009639fa6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276349, "uuid": "7af29642-53d5-45d9-980d-4195503d3999", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab2f3b9-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777265049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265049, "uuid": "809d6152-f775-45e9-8cf4-451202d059a0", "comment": "Malware payload (ValleyRAT)", "value": "e174ad9f181abeb71892deaa70c3d0e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265049, "uuid": "a26eb84b-b0f4-4ee5-9936-9348393b0bab", "comment": "Malware payload (ValleyRAT)", "value": "53418b805cd49091163bcffa2434caacfcb6f2a435ca609969193ad025f17842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265049, "uuid": "08b9aa89-e539-405a-8917-7710e886c8e7", "comment": "Malware payload (ValleyRAT)", "value": "368248e483a52a34d36b54f8bf6f34228d8e2966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265049, "uuid": "28115a2d-e005-44a2-97be-fe0e4f352e87", "comment": "Malware payload (ValleyRAT)", "value": "cfa3f7e977fbd299fc67e2f22afebb64e719529c16bc0a22f969488f8a5080bad899d40efe2b070f7fb3aee5f2be79d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265049, "uuid": "076888db-4728-41cf-87cc-86656f835c53", "value": "T160953387E522EC87D0E9493588F79DB1A3D2E92CB0F21B6747846F2FF538D621062653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265049, "uuid": "10a7dce1-16cf-48b1-9198-9673ca3f1a48", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265049, "uuid": "8a1593a7-8253-4603-8127-d13fd83a2a1f", "value": "49152:+K9fnP/sPe0a9Y63mFeGjkUWQnyjoNu07KFaQ/oX3r:3PsG0aHmjkU5niV0+FaQgnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265049, "uuid": "fffe5b94-0935-4cd8-bcf7-a6ddbd98474b", "value": 2025108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265049, "uuid": "da5cc4f4-52fd-4e25-b5cd-6c21df3b9496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265049, "uuid": "6314c122-4735-4c72-a931-21434a407c13", "value": "E174AD9F181ABEB71892DEAA70C3D0E9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c65290e-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280460, "uuid": "c71577c3-4f42-4bdb-9254-eefe8c3b27cf", "comment": "Malware payload", "value": "4450d931343792938cc23294ba863eb0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280460, "uuid": "044155f1-f19b-471e-802b-60fdf4ec3ae3", "comment": "Malware payload", "value": "5344bc2ee21776a1c94511005f659c0710d3a3590ef17202bd77fc7a5111bc67", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280460, "uuid": "bbbe3e87-7a61-4bdc-aa49-9f8ff2ce8bb1", "comment": "Malware payload", "value": "3edd39abf935c8c1d99f0173d5b94866c0bd5f1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280460, "uuid": "69b6bd6c-fe73-4a6d-9879-4ad753ae23ff", "comment": "Malware payload", "value": "dfb566c2228674defee72951006e81f5f0926a8c110c6bd8fe89dcee3452ac311539dccecfcd6dd04dc630aa686cd600", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280460, "uuid": "a7ba721c-5c52-44b2-a3cd-27c542794fbf", "value": "T14837230D8B5A1D6909D54B3436EF9FCE3228CE05803806AC635EB58EA76FBBC11576DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280460, "uuid": "b4976c8c-e55e-4085-8177-66368ea88333", "value": "49152:VMi6Mi5Mi8Mi0Mi5MiTMiTMi1Mi6MidMibMil6bFu6yMigMinMitMidMit6bFu6Z:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280460, "uuid": "3607bacb-dd9e-4ef2-bdb1-53a804aa4de0", "value": 23424215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280460, "uuid": "45886ee9-e2f5-4abd-858d-212fcdcee555", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280460, "uuid": "83f6a4bf-db27-4cf5-9e30-8c488c23564f", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e84784-4223-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777285408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285408, "uuid": "fde129af-65cb-463a-9c97-1dae5b902767", "comment": "Malware payload (AsyncRAT)", "value": "781cb9c585d3e50fcb924f43d95eccc2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285408, "uuid": "b62e8c06-1701-4878-8c47-a5dff5c4c95d", "comment": "Malware payload (AsyncRAT)", "value": "536e1f8f46ee0f6cced9da56710b7f6996526da9d48e9cb63c0acb53dff14d5b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285408, "uuid": "25ccfbfd-33bc-4bac-a170-904df325cecf", "comment": "Malware payload (AsyncRAT)", "value": "ded62a4ef60b21265652fe95579af96bc3708c72", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285408, "uuid": "085636c1-4ef3-462e-8531-3469d823c9b6", "comment": "Malware payload (AsyncRAT)", "value": "7b9a5f68faf112877dc9725f66c86104a5831603bde989288228b05072c696842780687a2feec3dfbf37740f2bcb081e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285408, "uuid": "cf687e57-750c-461c-b9c6-33cf603412b1", "value": "T148757C3ADB3FC742928B253ECAE565CEDCB4877C03F1A788BD4DB2560959EA405E44C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285408, "uuid": "ba3036d4-f5e6-4506-95bb-fb73c1dd0dae", "value": "24576:wVYMFrhBva5fsmMHlgr8482MPn/rjeMoTPJBa:QxhBvad8e4SMOMojJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285408, "uuid": "23d16ba5-cda7-4d64-8de7-1e08beedee25", "value": 1641861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285408, "uuid": "affcfe5c-fc5f-4044-b692-ab546a858965", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285408, "uuid": "74084491-391e-4f35-9e94-592aaab3499e", "value": "ghhjgr.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba209ef6-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276644, "uuid": "9974dd9a-1f1f-4a25-bfcd-c16259c9f8ec", "comment": "Malware payload", "value": "7102fd3aff0449b15849bdc72fc0a371", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276644, "uuid": "f005cc2e-2f64-4f1d-8ca1-478aea148b14", "comment": "Malware payload", "value": "54f979222d142d48582d182158747b12dcf241987683bf9bfe2fd820e2628aba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276644, "uuid": "672ba8f2-d054-4ea8-80ca-1d479910c255", "comment": "Malware payload", "value": "8d2c9a1e108ac64e59d8b36b3677329a0fd70bd4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276644, "uuid": "b87b422a-5d71-4309-b983-ecb8221202d2", "comment": "Malware payload", "value": "b193aee4e4a92fda27adf3e8a9b3882e7feba3d94b7f245fbfc78a62df8daedd7bc80bf88a628931b7a58c0da4da3a57", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276644, "uuid": "97d80b9d-b82a-47ef-bc1e-e7501dd714cf", "value": "T14837234B072F8E2E43BE23551DB26F7706DDE8081C5C9E76B3E17239515DB0232BA269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276644, "uuid": "19be75b4-62e9-4c3d-a4ac-033389ee4790", "value": "49152:pSoawSoavSoacSoaDSoaPSoaVSoa4SoaYSoaCSoaWSoaySoaioSoaVSoaASoa6Sl:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276644, "uuid": "ca75e146-6238-44f5-8de0-ef0cfd87265c", "value": 23944449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276644, "uuid": "f5ffec89-3ba2-4a6c-9ab1-9d5a81c3b11b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276644, "uuid": "ba9d3a17-edbb-4dfc-b9ab-29c4adbafa1d", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509da207-4294-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777334020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334020, "uuid": "61d1139b-09a5-4b93-9304-2226cc4379d6", "comment": "Malware payload (Mirai)", "value": "ca356392e14e3c76add3d2788a9e00b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334020, "uuid": "94f56ac3-525f-41f7-bc2e-e6f3270879dc", "comment": "Malware payload (Mirai)", "value": "5559ae21f567984a6576103bf81e8cb2af4593026c1eb33391e7c522632456f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334020, "uuid": "3cfba439-ab26-4774-9fe4-e075ebb03457", "comment": "Malware payload (Mirai)", "value": "9538d241ef13b16b1fcdf7d13809008c02d04e74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334020, "uuid": "385265d8-f1c8-4f8f-b7b2-e927c167dd7f", "comment": "Malware payload (Mirai)", "value": "60750c2d184aea590f9fc4de015a6eda61c5c94169fe76009399a36ba5c594420a4484223f5ff8b3f704e4dfc3714c56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334020, "uuid": "42bf7db8-098b-4209-b6e9-c1d2b66f1d5b", "value": "T105534C89F783F0F0DD4A0A71115BB37E96349E125024DE6AEB94BDA2AD32F12611F71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334020, "uuid": "c5bc4f13-f95a-471c-ab0e-fb2b97d5411a", "value": "1536:UxDvHPi7C3TYSYc0Oip3AB1+lC7IROHUV31cUCRczr:EzPzTYSYZQ4CydiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777334020, "uuid": "568f0ea9-8d60-4606-a0b5-8bd288c6bd1c", "value": 62064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777334020, "uuid": "ccc8f239-2b83-4b3c-b73d-4ed92a662af1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334020, "uuid": "ec7671f4-22af-49aa-923b-f9c45870adb5", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c651f8fb-422c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777289549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289549, "uuid": "bde38e82-8f3b-41cc-bad6-eba32ef02059", "comment": "Malware payload (AgentTesla)", "value": "875f2a3ea70058fa8ab3cedecc5c2745", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289549, "uuid": "f1f27f39-b074-4bb2-b16c-06736cda20cf", "comment": "Malware payload (AgentTesla)", "value": "556ab6637af06a95ad9305214045effb5d3fd1bd639d484e8eb6f23e659d6bd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289549, "uuid": "30092395-d4fd-4a34-8952-2a370c0bccce", "comment": "Malware payload (AgentTesla)", "value": "fa991fabeb2debcc287eb59becd5092abe92ce16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289549, "uuid": "037da8dd-7063-4f59-b134-513d1d0eca2d", "comment": "Malware payload (AgentTesla)", "value": "4b2bd4d2813e6f2a36c8ae9b0dd85ad8992fc726351f6e7e3a1164536f07d89fa7b646e0a6ee5c1dcb70fff66e7f4b51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289549, "uuid": "da75e2d8-d65d-48b4-9855-32b87390f3d7", "value": "T17FF423123FE1D033E1566F3B1F73A8BC1586EBE01A91E66F7720627D64A1E87D608349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289549, "uuid": "1458525e-4bf0-4390-94ba-88ace1b1729f", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289549, "uuid": "8fdf1385-4121-4279-8ad6-afafc1189c0c", "value": "12288:j+Z4WD9rr4MsN5UK8SuySOIJ6Ziyc2IuNJO1opFMg5m+ajc4pVGYRw:j+ZrDlrkD8uaTyeH27A+IlpVTRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777289549, "uuid": "a55d8f91-5693-4e9d-9059-81b77b27bf9a", "value": 771181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777289549, "uuid": "67f102e0-7155-4b0f-87e3-7623e8bea518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289549, "uuid": "b0d8b306-a2a7-4721-a95d-b7d61fd65bb1", "value": "0098266354677779182773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae785ca-428f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777331782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331782, "uuid": "e44e5f61-8adc-47a1-9d49-635b0b9de427", "comment": "Malware payload (Mirai)", "value": "cab5a1c80df4a63aaf71d35087e6f896", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331782, "uuid": "990ed018-4dbc-4034-97d9-7be787267be7", "comment": "Malware payload (Mirai)", "value": "55d101ec0e41129151292cece2075b7a79714d25e096d69a8619389cde6980cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331782, "uuid": "ebd42840-8a61-4ec2-bf2d-983b35d952b3", "comment": "Malware payload (Mirai)", "value": "e4c652cc66ebb8ff1c93368ef03743afc8099165", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331782, "uuid": "1e5ec5db-2ea1-40bb-80b9-0237e8e5ef40", "comment": "Malware payload (Mirai)", "value": "6e2ca4ce5c101fe654b2739d1d33114eb53b77bd0bea66ff80097897afa221c8176c4862e7b3f111d998f8181c0f2d0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331782, "uuid": "89f6e570-fcc3-4336-9a2b-1619d57532b9", "value": "T1DB7319C7FC00E9B6F809D77744974A1AB230E3A10A821AB67347352AED7A1951477F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331782, "uuid": "63cf3747-2280-4d27-a7ee-1dff3dfa5c0a", "value": "1536:u15xyml+/K8fvPW3Vgyi66O8m9yA54/sXz7BkffCAOtBtFBJJnCBdglxgI:m5xnw/rPWlgyi66O4AikwfCAOxFBjnF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777331782, "uuid": "e982a457-6f49-4f1e-bc50-b41e2fd8747c", "value": 77880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777331782, "uuid": "146a611c-77a9-418e-a5f2-9b14427b296a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331782, "uuid": "bbc0d89f-317d-45d1-b0b9-9f5413cc277b", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c893345-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284218, "uuid": "791a5e58-890a-488e-bbed-60fc8834c41d", "comment": "Malware payload", "value": "5fc690ff4cc2ec2e1ea5d63e77b035f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284218, "uuid": "28d26657-a917-4950-b921-49f5c335f621", "comment": "Malware payload", "value": "55ef14fae560a2c6a69b25c52019bf8a30313fd0a687b200c6ae3e72dac8b29e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284218, "uuid": "31f23a88-464d-4366-bf83-3dd7b574dc5d", "comment": "Malware payload", "value": "49855ead377a9d8a3dc7c225f2f5c5bb9bf60ae1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284218, "uuid": "6bacb959-bcb7-47ba-9d2a-4f3e66161d69", "comment": "Malware payload", "value": "d3a83d0f37d8a36648a1fa1657237f6ee6f2b09bc1cc471bffa489d84775d660dd6d45fa7f34a52b5897efbbe90fd75c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284218, "uuid": "48e84416-0078-419b-8385-b0350c0d07c7", "value": "T14737230DEB69BD19553C1F1C1A5B6BBB09E65F86A02CD39B0FD8BCA3473564022123F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284218, "uuid": "6f9e2baa-07da-4661-ac81-a622bba4e5c9", "value": "49152:1/S/A/I/P/H/h/m/L/y/o/p/EsdsrK/S/L/J/B/psdsrH/C/Z/8/r/5/h/R/d/8b:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284218, "uuid": "0b3cf134-ba27-42e6-aad4-26d95c8568a3", "value": 23684325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284218, "uuid": "8ea0af68-6eb8-4415-8933-857515f03931", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284218, "uuid": "30a172d1-d06f-4140-a23f-b1ccf1677e73", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b5fe32-420e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777276551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276551, "uuid": "24e3c7c9-18c7-4553-a7d5-d64d4eea9dc3", "comment": "Malware payload (Formbook)", "value": "aeb8ee5d8225dd92c3b2775966d0a34a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276551, "uuid": "bfad458d-ea53-4d85-af10-2b79e9e7941b", "comment": "Malware payload (Formbook)", "value": "560eebed936f112b8892437063f73a9a6a7b28c9514cea157e8b3314c3cebb9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276551, "uuid": "19dd0076-a799-44a1-ae63-258eae3948c9", "comment": "Malware payload (Formbook)", "value": "e935d867c466c1742fed1374094d4e20e9b71394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276551, "uuid": "97e63af8-112d-4628-aae7-ad8296f4aaca", "comment": "Malware payload (Formbook)", "value": "a43be9ce38e6269e55ec81dec8cfb902ae6555ef689cd46b28d8c49c6c1aa2de95b45f96dc67280dea86f0556a253aa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276551, "uuid": "e1066e64-87a3-4c78-afbd-6e081fb8afb5", "value": "T1073512182245DA03D8A92BF90A72F27543F91EED6912D35A9FCDBCFB79A6B101C44343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276551, "uuid": "190f2706-a8ae-4867-a70a-7f67a9982cb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276551, "uuid": "4dc5d55c-f41b-4ced-9dc8-480b9a6be680", "value": "24576:dTO58KlDixzRGE2Vnh5Fe8wVI0J8hutia6r5/6oPgNk1xHGwt:5chiBRGE2Vnh2c0J8hutiafoPgi1Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276551, "uuid": "5d8ac882-70dc-4668-b237-e54ca8babd50", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276551, "uuid": "b429c857-449f-488f-b0d5-ea88869f3247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276551, "uuid": "b0f6ac77-2483-4bf6-95b6-7c2cdd12e278", "value": "Contract Documents, Payment Receipts, and Outstanding Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d40af9-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285203, "uuid": "0908c4db-46c1-4ce3-a0d5-c967ae3efc51", "comment": "Malware payload (Mirai)", "value": "61825304ab3bb7720728ccce94d2d269", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285203, "uuid": "020a6db5-0421-4c79-bdf8-ac42c2d0940e", "comment": "Malware payload (Mirai)", "value": "564375062a147dc6d40ad565aef3b958d505ff98630a6be7610cb52b55492ec8", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285203, "uuid": "d990a264-8896-4700-8b04-9d7f5b7f1acb", "comment": "Malware payload (Mirai)", "value": "630e6ca37b3ba1d474d149df2802ca56dc4495d8", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285203, "uuid": "31a664de-6173-4979-93ff-a810532c864b", "comment": "Malware payload (Mirai)", "value": "9b277e25062be0126e004e0f91bc7f56065712be7705855bd876ef078221cc55b91146c1f3067ddb29eb73368cb54683", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285203, "uuid": "20028f50-027f-408d-abd6-2d032794fd05", "value": "T1C0D43955F8809F61C6C539B6F74D42A873074BB9D3EB72069A145B343BEB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285203, "uuid": "b12fce76-7f15-4b76-8272-259f143f3fc1", "value": "12288:6JATIJ8eqh/GIX7giL5iCTeJEXGRG/8a96DPe128pJlCco:s8eqhj7LoCTe+XeG/5hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285203, "uuid": "9a23ceb4-50b6-4959-9cd7-4901423408a2", "value": 617448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285203, "uuid": "b5a7780d-8f90-4891-88a9-b315605a5579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285203, "uuid": "568d1008-9a54-413a-9f66-a3f8e31ad63a", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94581e57-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283882, "uuid": "d2f5c3c3-9b84-4d43-8cc7-1207db684df0", "comment": "Malware payload", "value": "0ddbf839eb2472e9d2def82b4062561f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283882, "uuid": "64a41384-04e4-4b68-912f-3edfd044ce8c", "comment": "Malware payload", "value": "56891477297b22863ba9c7de4c3c3bad2f1f950b3e7e348deed773ee40b9fe1d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283882, "uuid": "01e2f386-dd1a-4045-95f9-4528dae80b0a", "comment": "Malware payload", "value": "81cbc6aeca96ec0405e2763c20e19ce71c7253e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283882, "uuid": "5935447c-ff11-46cd-8cb0-26bba5271f33", "comment": "Malware payload", "value": "cef9cd9230fb69f08cddd79aea576913bcdae7bbb9fc74c2b658d58a06f03f232a2e2abd5d88953cac7777de05b91854", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283882, "uuid": "9009b971-7180-4ad0-9e66-39eb67cafb3d", "value": "T1AD3723450E948DFF4216E2EC006F6A8B5DA45FCECF25D086CDC8BCAA524DF502D5A2B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283882, "uuid": "c1848dd8-1b65-4625-98ea-179ca42fff40", "value": "49152:ASck7f1S7awdhqwm0RAyhdhXqwm0RZWAI1w02ApemlOeqwm0RUqwm0RNFDEqwm0e:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283882, "uuid": "75a34d28-6d50-4854-9605-0253fc605f91", "value": 22383662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283882, "uuid": "b2b4cca0-69f4-4d36-a255-4e073bdb04e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283882, "uuid": "104d4b97-05e7-41c4-94ac-6f52921bb2d6", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299512e5-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278978, "uuid": "dba3d53f-0cb6-4c69-9efd-262b4454a608", "comment": "Malware payload", "value": "fb59a093d873a076d1fd424ed1cd5f50", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278978, "uuid": "6be39adb-32f5-43a6-9aa6-200065bd027d", "comment": "Malware payload", "value": "56d8863c94114de02ad5f708d0f07ba4ba1f7eaa28b403899bcf18fde788aebb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278978, "uuid": "ce91dc86-300a-4e2b-bfa9-12890972150a", "comment": "Malware payload", "value": "6b7741ddb10c9c483a81272b6ca2b0db7ce39341", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278978, "uuid": "5da679f4-1d24-4987-af28-91cc5d5e1925", "comment": "Malware payload", "value": "de8d50c5e8787c31db9ada16e42f8a3a1c36613d0e68bda15147989998289b610bee0bff9d32ced20d91e2e0bb315642", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278978, "uuid": "041b5eb9-ee0b-492c-886d-28c7651b4041", "value": "T1F13723629F38BF79CDB91A6C21EF120746F9CD2C446395E7F3AC36D6A386E1A1019341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278978, "uuid": "c911508f-62ba-43e4-93c5-981f5b678b36", "value": "49152:mua+K3152UjQxJF1ts4bJSVJXiNorGdTBcC1JoJytRjJBzRBEzzKiGUKwGlXl3ph:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278978, "uuid": "a962574d-6fa2-4196-9d34-c31642c473a2", "value": 23684330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278978, "uuid": "43e58ca2-0ca4-4995-a5a1-ae61995d2d2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278978, "uuid": "2b040100-9114-44b3-b9cb-2999816ac87e", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4c1598-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280518, "uuid": "0cc72f3c-ab0a-4e1e-8502-e8af40c718b4", "comment": "Malware payload", "value": "e98ae787b69244507a3491473151f8f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280518, "uuid": "443a3a33-eb31-40f7-8cf1-183d858c7e21", "comment": "Malware payload", "value": "57f72fde7d8d788a8ce00f78bd32cad2ca9af6d46f2acfab396bbdd42e585993", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280518, "uuid": "7fa03551-04b5-452b-be29-27e61c4c60fd", "comment": "Malware payload", "value": "9712b9b02da10ffed0850d5229563bf392554ed2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280518, "uuid": "8535fa30-c915-4aa1-9151-f353a64b2043", "comment": "Malware payload", "value": "6e3f51d62cfd5dc9fdc5b83016594f70ece5e83d21da39c71fb8410817e828e1a0dcec9e2218a8b78e36a625b04923b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280518, "uuid": "853967c4-0ef7-4d3f-b872-6325eb4ea597", "value": "T1E837121A0F118E3E4D6B212198A113191DA18F67765CBDF37ABABD63E34E41632274CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280518, "uuid": "988c955d-ea60-4f01-9aab-7ef4b1df89a9", "value": "49152:GTLVTLjTLCTLmTL9TLHTLpTL0TLUTL/TL2TLfekZoTL0TLHTLXTLLTL8ekZFTLPc:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280518, "uuid": "0bcb138a-f614-465b-bf05-4ff02c2ef0ae", "value": 23164071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280518, "uuid": "fcf56b49-a493-4662-8510-4cfb0b16d796", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280518, "uuid": "caf2307f-aaff-4ac8-8b2f-4cd546f9ad14", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcccf79-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294504, "uuid": "97644533-4fa4-4656-95bf-3835ad996d6b", "comment": "Malware payload", "value": "76fe71d4f947dbf329803f3696d0c4a5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294504, "uuid": "fa082e07-b171-4509-bc9c-72f7ef872770", "comment": "Malware payload", "value": "58593d6d9e58fb10116e6d243ace0143135370bf2642d0324d333d0c8bc0abc9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294504, "uuid": "f85c1eae-0c57-46a8-bd95-572f9b03b455", "comment": "Malware payload", "value": "7f026d4e8fab80bb4fa9e36e675e25116dada63f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294504, "uuid": "9b92e5c7-6817-4598-8874-fa9891940814", "comment": "Malware payload", "value": "b3edb6fc6b4cc1de08340e707a1a4ab2d879eb0d9b8ed67e33d8835dbadbe3ef52457c362901c759cbb3bd53287882e1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294504, "uuid": "cd252518-434d-4814-a42d-bcb69b8f68b8", "value": "T15F372322DC5E8B5B539633B53DB81E1F53F89B02055098539EFD3D8DC66EE92082273A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294504, "uuid": "81881205-ddbf-4216-beab-89de1b01b9ea", "value": "49152:0ft1Mft18ft1Ift1Oft1Zft1Xft1Cft1tft1+ft1Aft1Xft146MW6ft1xft15ft5:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294504, "uuid": "9031bcc0-f739-4c52-9499-6c33c5878d07", "value": 22383661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294504, "uuid": "36e51a4c-4980-4d82-9f2c-9dbfff0b989f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294504, "uuid": "4f119371-5e90-4df3-a708-17f86f547e64", "value": "invoice-1645080830.pdf (62).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40825250-4227-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777287177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287177, "uuid": "cad1768e-64c0-4d69-aa0e-4013bee9d8a9", "comment": "Malware payload", "value": "b59fde641eea38fcd1aec3f55a1d8e4d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287177, "uuid": "f3602e66-f747-4508-93fe-e1796c8b09be", "comment": "Malware payload", "value": "590a05ad978d5230605aeb7612e7d7fa804bedfcb8843f7e721248a412ae7afa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287177, "uuid": "b91b40f8-2024-451b-b2c3-0d5651771182", "comment": "Malware payload", "value": "628cc57e3414db38f6355ccbae290ed097f43ddf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287177, "uuid": "1d33d8cc-aefa-4b36-9d03-2bb243b93bbc", "comment": "Malware payload", "value": "cedce03c26e20eff100e5d4854a2d54d43cf6b4957c884a14ec55bc20448f9f601d79999843c7cd424d4b68e1739e9a9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287177, "uuid": "8ecf844c-cf84-4e38-a471-53d6634090bd", "value": "T1C946E082F701E86BC0FB5633493A476256435DA98E87EB932D20736C8CB75C45F5AF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287177, "uuid": "753d971f-7d18-49aa-b9a9-dda0dbcba2dc", "value": "98304:v/zmAds/gAD8bkX3ObS0UJ1Ox9iBStm/3mq5dgm439y73oQqGgD2yVb:3XskUJ1Ox9iBStm7H7NnC2yV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777287177, "uuid": "4e9ed83b-119f-4bd9-a402-512d4e80a467", "value": 5805772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777287177, "uuid": "1012ed6b-9cbb-471f-ac98-1379e352b2aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287177, "uuid": "45982ecb-4e96-47f6-81dc-94336de5f6d8", "value": "Barchatoliqvideolar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c448b3aa-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271507, "uuid": "f85bc9c3-5a55-483d-9f77-5f72fbba5ccf", "comment": "Malware payload", "value": "c0929bc230f025a03d5a955c7eb95a43", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271507, "uuid": "bb559c2e-b671-4265-99da-c57ce370393e", "comment": "Malware payload", "value": "59a9af3365acdd837f0637e5b5ee7614f0ae60d55c1cde5b98c5b4e8f1834f92", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271507, "uuid": "0b22f6b0-20c4-41e5-935f-ffbc10df7623", "comment": "Malware payload", "value": "1ba340024011058745d60ab87c5912ba4c2fbc3c", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271507, "uuid": "afb00f1a-aef5-49ba-b9f1-e5affb838f74", "comment": "Malware payload", "value": "cd28dde9147ddc6c59cbed3ef3f6f82bf843663d75433a4c8613ccb2ea3ebd4fe9019cf29d116c8b77c3d3bd6e0f0061", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271507, "uuid": "1411be97-80c0-4626-a6f1-76b4c7567b90", "value": "T19B37238C0E379B7145AC9788045B7D69A4980D83C8B2DDEDF7EA79CB1B2BD079A0F144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271507, "uuid": "8d5293eb-b36c-457b-aaa1-c93267ad01e5", "value": "49152:dCo/CoLCoJCo5Co6CoECoUCo3CojCoKCoJCoGdCoKCoXCo5CoRCo4wCobCoSCo4b:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271507, "uuid": "bdcc787f-b64e-4d0c-ad66-c10e0a322c3e", "value": 23684335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271507, "uuid": "3657e294-2297-43cc-930c-ecc3ba9ef9ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271507, "uuid": "fca3159f-955f-4208-8a2b-7e1dd3db4bce", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8108fe5-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284371, "uuid": "1cbb043e-aedd-441c-9bc1-bb12b97d9064", "comment": "Malware payload", "value": "1ddc4893930dac0856e28dce96c8fd0e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284371, "uuid": "24ce827f-a04a-411f-a0bc-f2162b0faf4d", "comment": "Malware payload", "value": "59b907c91ff1ecf3d371a9d2582061cb1516925f074b4fe85e016bac3b3e29de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284371, "uuid": "54a6926b-2ac5-4e80-81a1-1fe22e1186e4", "comment": "Malware payload", "value": "9f9270e6c26633d2bc4822ee650b8ee11805b387", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284371, "uuid": "2081732f-b0b4-4d5f-9372-7c0d15a1f4e9", "comment": "Malware payload", "value": "c5dd2ca798a5c0bb9ac0f0a2d63cec36dbef40f744befd4abc07beb2e9832dd4925b01af8f6c2cf6f421205995d686a2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284371, "uuid": "81ccf303-9db9-4296-97e9-3c9d39614388", "value": "T1AD3723991B448E5A48F4111848BE0E48BFF04910DE4BFFF8BE9B90F1E25DE2C256679D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284371, "uuid": "b2f35f1f-6bd7-4e27-a7c7-f48d89f17486", "value": "49152:MDzA3DzAuDzAGDzA+DzApDzALDzA5DzA5DzAkDzATDzAfDzAMJpDzACDzAzDzAV9:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284371, "uuid": "2cbbd14a-a521-4296-b801-52599d449585", "value": 23164068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284371, "uuid": "ce21ba65-2b1f-41b9-a02a-e031384476f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284371, "uuid": "70cc7924-23e3-4aa9-a4e4-07310913b791", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cda8b87-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279494, "uuid": "a1de9357-8d30-4031-9518-03fdc304ba04", "comment": "Malware payload", "value": "0c7636fee11cdd2ce6f24b2dbce687ef", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279494, "uuid": "285820d4-36f1-42b9-b48b-59cb26e6e6b3", "comment": "Malware payload", "value": "59b9f31762b941f4b88f22b4d584ced46cf715d7f25168ac118b13d28eb6829c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279494, "uuid": "f9097626-7750-4259-8acb-5db77c0c24b9", "comment": "Malware payload", "value": "4ecca0fb9f2256498a5e9913af82d8b81e3ad6f5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279494, "uuid": "eb56b012-33f2-4ba7-811b-769865a4e186", "comment": "Malware payload", "value": "6bb78ae285940c4ca306ed7a744d97fcb22b051c95719e4db531266f1aade60e4398598805fe6ba0d63749ca70252d9e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279494, "uuid": "13e7d88a-c8e2-40ae-8a73-897efda0b1ab", "value": "T1043723610E3C897B8339636D58D7ABDF62A0875D61C036DE83DD7AC1885FB80369B90D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279494, "uuid": "7a38eb50-ee2a-4bc7-bc3d-47ea99252efe", "value": "49152:QQ8JOQ8J/Q8JrQ8JmQ8JWQ8JAQ8JiQ8JKQ8JdQ8JIQ8JgQ8Ja/WIdsgQ8JLQ8J4M:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279494, "uuid": "1ea6166a-ca6a-4f3f-a1ca-af8b33c06c85", "value": 23164077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279494, "uuid": "84ccf942-506e-4875-8ea4-107e16eab5cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279494, "uuid": "b06b1e74-b2df-4bae-af15-77543c557af9", "value": "invoice-1645080830.pdf (58).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b59bb3-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777302673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302673, "uuid": "6052f0d7-efaf-4c69-bf77-501d59d5aad0", "comment": "Malware payload (AsyncRAT)", "value": "77716a2df86aebcbc378267ab72a8b57", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302673, "uuid": "d4184bae-6304-44a6-b0d9-216f9841eca5", "comment": "Malware payload (AsyncRAT)", "value": "59e68875b733b15fa766af8d4f1d960b961e81a3b9cab37cf161c8ac9057ebd6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302673, "uuid": "f357c4cf-7579-4659-b1fd-b228ad5929fe", "comment": "Malware payload (AsyncRAT)", "value": "f104840dd4d3d1329b8d7b9c3c532913f5ad9533", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302673, "uuid": "60593c95-12b8-4669-b989-0913fa0b60bc", "comment": "Malware payload (AsyncRAT)", "value": "6bbc4b1c90f6d0049d17f7ca73d42356fc418bf2d0309cbcf8f97bca7081209689fa2b2f2e5e282f058d54668ea672b2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302673, "uuid": "25651f4c-7702-43df-93b0-13c70e7433af", "value": "T16134223CED847A39901D21DBB1B46B0D42F61BFF0668C0D7A8B963D7A7D524CA20799C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302673, "uuid": "da76e9e4-8dcf-4c67-977f-e1514703a407", "value": "6144:ZfChIRukuJ1X1JmGcdFUmMHpC90/JfpoimI6yIhUdxg7tc:ZTRukuJ1X1ZWUmMJCopoiEyIakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302673, "uuid": "0fd011d2-e27c-46ee-abd6-59fb1b417a3f", "value": 252407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302673, "uuid": "d18e2b26-31f6-4baf-8268-61198ff2926f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302673, "uuid": "71b7fffe-2a02-4fd1-a1ac-6e6a456489f3", "value": "ps_ltkWkFbKX1qb_1776239582596.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd4fc78-4261-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777312409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777312409, "uuid": "606d769d-e5ee-460d-a47d-2a1c1aecf506", "comment": "Malware payload", "value": "c5231a2b0c46b87a3c6a8d41d7e5494c", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777312409, "uuid": "52c45d6f-e3c4-4bc7-8d80-8a48ccc677ff", "comment": "Malware payload", "value": "5a30867937f1e2f714c8b398436135c63c164267602cc66a5adb5b4c2ed55365", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777312409, "uuid": "fab7377b-1d62-4360-b6c3-e2c83b239050", "comment": "Malware payload", "value": "6ffa006928e188961d6098aed792f19bbcdb516e", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777312409, "uuid": "24fdf998-8696-4fd9-a9d4-565aca46668f", "comment": "Malware payload", "value": "d5725c58099642518867c7cde393a1f380ff349fadeb2a188b790a7c1b6c6f167aa89a9e69f5fadd2671615b5b72a87e", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777312409, "uuid": "5d2600f4-c556-4ff8-914c-f714ba847bed", "value": "T1AC273306DF4115C4816284BE95DCCCADAE78064EF469CC3E6CA5F38499FD8DFAA3C618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777312409, "uuid": "30c32923-9599-4991-b351-4831a05c0ecb", "value": "393216:qF12da05VyJZ7E1mRTXXUt6C2u/t2VG0+6Qktt1L6ME7XLe86hAiWAVRDK:qr1J9E1mhXX9C2YuTftfL6ME7C82WS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777312409, "uuid": "997a2400-331d-4066-9520-660670788e52", "value": 20573677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777312409, "uuid": "c6b0f13d-0e04-48f7-93a9-30684057151f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777312409, "uuid": "b0fcd5b4-8798-46fb-abc2-9a5d8192802a", "value": "io", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf7e5dd-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294392, "uuid": "8ab223a6-6868-4029-ad23-3e595a77b917", "comment": "Malware payload", "value": "f1b598141a1e74908e351b20d818f6de", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294392, "uuid": "a6f4d5ba-b2ca-4864-9f88-9e1ea282ca28", "comment": "Malware payload", "value": "5ac0a2318a7140f6cc4f66d8cbe95e70d0bc17c00caade263eed0a65ec34aa25", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294392, "uuid": "16d802ca-e543-4447-86c5-63e18bc1eaa5", "comment": "Malware payload", "value": "946ced8473dda47046b6cbe198cd71124200956a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294392, "uuid": "dba11680-aa56-434b-b30d-b4e1f7bf28b7", "comment": "Malware payload", "value": "e66b79f4dc3426cb8e3ec39c5895a400b32e1b2ee03faaadfec8e13b27a777d334266dfb0965e330e0e57d936ad8adee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294392, "uuid": "4926b4b8-20b0-4e91-842a-ff23b5c413a6", "value": "T12B3723644BBFAF3F48ACB5843C595EAF017AEA8500087ED577D9603FD8ADEE21587084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294392, "uuid": "e52c811d-0aad-4b0c-b9d1-c857937cbde9", "value": "49152:zPj4bPj4/Pj4JPj4bPj4SPj4wPj4jPj4YPj4rPj4NPj4uPj4WyNPj4mPj4VPj49S:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294392, "uuid": "f0767b2e-05f7-4356-8ac1-dc53bffac25b", "value": 23424211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294392, "uuid": "75e2ee03-b9d1-43a6-b973-f7df8a8438a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294392, "uuid": "bd8fc50c-5374-4c9e-abb1-657f94e62894", "value": "invoice-1645080830.pdf (66).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c9a56b-41f6-11f1-a769-42010a9c0008", "comment": "Malware payload (MimiKatz)", "timestamp": 1777266382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266382, "uuid": "e74ad633-c0b2-4753-a6fd-452024d93dd7", "comment": "Malware payload (MimiKatz)", "value": "33db917d36ad54d82c81015b61ff306a", "object_relation": "md5", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.al", "colour": "#1C631B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266382, "uuid": "9faffb56-19ca-40ac-8673-4f98752c307f", "comment": "Malware payload (MimiKatz)", "value": "5af6b3b7d269d548c6e750424c45c6e9e34495b750a7e889bded7f0842efde12", "object_relation": "sha256", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.al", "colour": "#1C631B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266382, "uuid": "db36bd06-2fb0-466f-87c4-fb60400fad11", "comment": "Malware payload (MimiKatz)", "value": "6c2c3dc9141efb2c9d4c72a1fcf9986a50616592", "object_relation": "sha1", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.al", "colour": "#1C631B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266382, "uuid": "7793eecb-d02d-4eaf-bb45-4b21c2d09b50", "comment": "Malware payload (MimiKatz)", "value": "37c378984e36175b0411cca76bff2ce1933c0234c3c951c97f715f0564575edf94dbc50a89f2c8d17834bcb9d916a873", "object_relation": "sha3-384", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.al", "colour": "#1C631B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777266382, "uuid": "f39eecbe-cd31-4972-b85f-9d29939d9a74", "value": "T1C1183361F0CE8731E6AF91352668EB3991F23CD113B340DB42D4CAE7597EA835236B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777266382, "uuid": "e6f94953-0d3d-4bfd-830b-d1c2c780a724", "value": "1572864:lu2nD/IqC/25jK4vzWXttFBLbLk1lCdiukriyoxXfVO4KnZxnXsgRDVw:llnD/a/Ajx6dtFBLU3CbYiyoThKLXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777266382, "uuid": "7949e4da-f7b8-430e-9aed-bc022c7d6b88", "value": 89160704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777266382, "uuid": "d94fff9e-fa0d-4d9f-ab21-31c45a90f0fc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777266382, "uuid": "cb7fab34-65ff-42e0-af01-cc5beea1bea8", "value": "win32-chromexinwu.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcbd8b8-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323093, "uuid": "750b12c3-9215-49ee-adf1-a2050f7c59a8", "comment": "Malware payload (Mirai)", "value": "fecc003603f10e745c6b4148cf91f989", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323093, "uuid": "7f8c1021-d0c2-4618-a2b1-e42dadbb01fd", "comment": "Malware payload (Mirai)", "value": "5c18dfb57a897f44f454cbee15127567b2fe0a3fc75524c8b0953b9b0204da3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323093, "uuid": "49b4b5ee-583e-4220-81d6-8e7a8afa534b", "comment": "Malware payload (Mirai)", "value": "777333f2190be1bb9441be81dbef3ad04e47074d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323093, "uuid": "b869f9eb-9550-4737-8cec-7bcd2dbf420f", "comment": "Malware payload (Mirai)", "value": "7ba63d62bc6e161e7c764615d1cb67fafd2f49d904ccf2cea70614864c752e0c7dc013ca40f1dd2155afa6681ef18103", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323093, "uuid": "52b71435-670f-4514-adb9-7b44ef921041", "value": "T14413F128D6225A32C66C4E37D46CCAC1615B5BF841B7E4716230A6F4F2E105A7BF8E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323093, "uuid": "3d7342dc-1b1b-49d5-91da-a4e9081bea9d", "value": "768:8/dYr66PqjnzCogWE2+fUckufz0LAq55ekWuMYGh4M9Akcue9q3UEL83:81YnP8zhgP4Kk8NRAkNLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323093, "uuid": "5b5fdf67-cadf-4c4c-8c78-659fa7030ce7", "value": 44772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323093, "uuid": "fccf9ee0-317c-451d-be0a-e19f728fff2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323093, "uuid": "e144d11b-cf6b-462e-aeb2-87ed2c2ed78e", "value": "vaxstresser.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdae596b-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277187, "uuid": "5158f1e5-08e0-4d19-aa22-b04791c4d632", "comment": "Malware payload", "value": "bbc14287f34a477727904ff92f14e7d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277187, "uuid": "2b42ba8d-e1e6-42a5-8fe9-f28aaa497608", "comment": "Malware payload", "value": "5c3afd5b83117b65c63fe90ce9dccc54263bae8af578980f6e83138df180308b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277187, "uuid": "e0f3902c-526a-47cf-bb16-a7a21704226c", "comment": "Malware payload", "value": "4548787c6010a7c9617f04cdeede3c1706803f3d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277187, "uuid": "e203f8bf-72ef-4d8e-9240-b44ab3f4619f", "comment": "Malware payload", "value": "98e46fe004b0be42eabe6eff3490fcebb61a4a93fa59d5c1efc691768d49f39ce0f2cb019e165dc82ac8eda765088482", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277187, "uuid": "cdef3019-5233-45bc-9c24-7748729611d7", "value": "T1483723555E7ABCEFCB3832B526BD16074BA14B1003D8BC595EA7B1DAC70AE01374F298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277187, "uuid": "3035e118-8be2-428d-8520-2af1fb2201a8", "value": "49152:xq2Cq2Iq2+q2nq2Fq2jq2Lq2Fq24q2xq23q2JIBq2Gq2Jq2tq2Vq2eIYq2cq2fqQ:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277187, "uuid": "cd3597dc-03b8-4e37-8dd0-0c51e5b57326", "value": 23164054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277187, "uuid": "53a4e196-3133-41d0-a3aa-d913ef300ed3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277187, "uuid": "faad64a7-14c8-41eb-8ee2-064cd142420c", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67c5bf1-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276718, "uuid": "6d74c0bd-4017-401d-99c4-6ca864683dc5", "comment": "Malware payload", "value": "ad80fba24d5e1239362b4129d61d240f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276718, "uuid": "9e09d477-2fd2-43e1-9ffe-0e5d2007e8ec", "comment": "Malware payload", "value": "5c4cbebcc7b43bcdf809b06976fe63c29f1902e7928e082e35090f93c2dcd9cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276718, "uuid": "e0e31f40-82ab-4048-9e99-a1c4c8b619eb", "comment": "Malware payload", "value": "e9f87c37f16ca446bf0ef0d9a5cb4ea0f99d6085", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276718, "uuid": "6b087d68-f6b8-49c1-872d-e50ee72d74d9", "comment": "Malware payload", "value": "d563b74d1fa1474f46cf3f47f1a8924aadd7bee4ea586b41bf902c3f49e4f6fbb9feab0168ff621bee216bcd5b579186", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276718, "uuid": "67f7eb46-7f1d-40dc-b981-308373f0e716", "value": "T1843723FAE702EE7C2B793B2154DF489C65E53EAD4521B8935ADB218BC4BDE730016438", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276718, "uuid": "4c1bd2e6-574d-46dc-90f0-04c71884f526", "value": "49152:GJKBhvJKBhgJKBhGJKBh7JKBhxJKBhvJKBhxJKBhlJKBhEJKBhTJKBhfJKBhOIJM:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276718, "uuid": "4cdbd80e-2dea-478e-a739-382fbe5b0bcd", "value": 23424215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276718, "uuid": "84ffa4a5-e45a-4075-ae66-def76d8f83a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276718, "uuid": "fe4d3c11-3eb9-46d9-aaa9-79d1c43ac040", "value": "invoice-1645080830.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebc5cf9-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276169, "uuid": "2d100b7d-7245-4ca4-a77f-9d5006b21de3", "comment": "Malware payload", "value": "19fb7c9d7b136fa42132c711c3129b9b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276169, "uuid": "b31c8377-9603-45d0-ac42-9a86a2cd70ba", "comment": "Malware payload", "value": "5c688ad84f031961cf811ab37381d8bf8a467bc50e17e8a4fb393c2fe063cea1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276169, "uuid": "2f4b9cdb-8234-47c2-bdfc-a5f16e7602db", "comment": "Malware payload", "value": "3ff3a6a23d349c224aa4528e43511bd54e8a1566", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276169, "uuid": "515566d9-909e-4055-abaf-13a0b82a0de5", "comment": "Malware payload", "value": "14b9059f0594209fbf13def8a088b705b3fb8bdfa3959fba59ee81a9d990e8e944822b74f667b3ca71b0d96cfafa0f16", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276169, "uuid": "88894d1c-1db7-4bdc-a53a-9b1feb6fd6f7", "value": "T1743723568A4E9ECFC2ACB3A714F50F1FA9490840B552F9D986D63EBF042F586537F280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276169, "uuid": "1103265d-b77c-4c83-925c-64aea4e9ccab", "value": "24576:PL2awL2alL2aiL2awL2afL2aZL2aeL2aUL2aAL2aUL2aWL2atZ4pmilYbJtNL2al:f6l6J6Z6Q6+666O65666Y6M6A6d6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276169, "uuid": "bc19f4a0-e18a-409f-8868-9c55bbcb969b", "value": 23684339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276169, "uuid": "3c907e67-c642-4844-a426-43e251da6007", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276169, "uuid": "17ce4c2e-3256-4aaf-bbf8-9d1279c2ef0b", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e57b6c3-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276383, "uuid": "e77dfe14-93c5-4345-b9cc-a1765a10e444", "comment": "Malware payload", "value": "fe6420892549a6dc7660744298662d48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276383, "uuid": "2b71b514-4e5c-4ff2-ac14-60d07678cb1b", "comment": "Malware payload", "value": "5c87ea954e4b8c1578cee82ad9b5cad534ab666cfbf3856b62653d9ca07b62b7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276383, "uuid": "4d56f9fe-d095-4fd5-ac21-3327f3076603", "comment": "Malware payload", "value": "0cd73dac68084cc78f0d4ed6cc9e1cfa60d42da3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276383, "uuid": "d3c4d920-f0ed-4ce3-8158-9905c7eed9fd", "comment": "Malware payload", "value": "510f0ee355b1ce274aaf0b688c3a0db974932d225d13885e3024907c317e4bf23023f274c8219bf017057ea1f9b9a971", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276383, "uuid": "d22875fd-7a05-43b9-92e1-3220a35f6d6f", "value": "T1BB372322EC52DD7BDB7F8A3D8079074E2DA4C5116E3233C9A6D18C5CAAFEF50129A135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276383, "uuid": "e12af47f-bc94-414c-90dc-36b38e949a7d", "value": "49152:jFVF4F4F2FDFtFPFRFuF5FjFZ0o8aiFqFiFVFpFX0o8afFPFgFwFsF/FIF9F8F9f:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276383, "uuid": "b52a8486-a1ab-4882-ac47-22dc5ad2375d", "value": 23424199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276383, "uuid": "0dd17e49-2970-4558-829e-4bde0fe64c14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276383, "uuid": "b34ece65-d3b4-491d-8982-f55426789156", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58014ec7-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283781, "uuid": "af66e586-9b6c-4eeb-afdb-5ca8d1f31570", "comment": "Malware payload", "value": "a35ce0aee23000f8a0ede3fe6e935ae7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283781, "uuid": "30a6c557-d811-4ff4-bf2b-23bb79dc6f9c", "comment": "Malware payload", "value": "5d440dba7a9ded46fd3694111742494ef075cc4ae8a0b106bcd397b8460fc6b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283781, "uuid": "7f4b2999-0d9e-4e7c-bd23-ec50434c676a", "comment": "Malware payload", "value": "7309e52d8b77c63f8850546e046bba7f85221242", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283781, "uuid": "12bf1f7b-87e1-415c-9c63-b161fdd63982", "comment": "Malware payload", "value": "f2d6d964c0369500b875e3e669b05f4c5a676836e4dec5e0369076e4a8c15f409d0370713d35ccb2b20b4c9ca4139b5e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283781, "uuid": "95fb2a6e-1ee8-456d-9711-43a7170bd4a5", "value": "T1DA3723029F66AC4EC109615E21F2EFDB9DD99C260CD42775AC845826E9CD3AC30EF36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283781, "uuid": "503ebecc-eeac-48f5-abae-4b84058b523b", "value": "49152:mdZd4dIdJdJdHd5dYdydndCdI2sl8dudHdvdPdH2slvdYdUdgdtdFdpd4dIdPdvv:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283781, "uuid": "23e428da-c886-4065-8deb-719d084b4f97", "value": 23684344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283781, "uuid": "bbd54219-eb5c-416c-a30b-b06629faabbd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283781, "uuid": "d89700e1-4482-40f2-8104-3c4d80588db1", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7b6b28-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323119, "uuid": "2a5b69eb-88e6-4340-9199-b3b9fb0e706b", "comment": "Malware payload (Mirai)", "value": "63de41bd752e2dc399151d058dad6e6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323119, "uuid": "a32f108c-0ee6-4ae9-8b95-de624fb305a8", "comment": "Malware payload (Mirai)", "value": "5d5303c0a28fe046de35c40a232ccc2668cdb1100eced24a254950138f4d16fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323119, "uuid": "b56bc230-572b-42dd-bdef-351219ee2e54", "comment": "Malware payload (Mirai)", "value": "dfc7d6f51bba7ea836f6d394eefc24805d6310fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323119, "uuid": "35f7b1f4-ac14-42af-a0d7-9c5b9f7eddd6", "comment": "Malware payload (Mirai)", "value": "0e83a0e3d42e7c29b7960894ffda61c389ec371034facb9f1cc72ed5e560e0da2628f0d354894d955c58dd44610d2417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323119, "uuid": "526a1cf8-093e-414c-a9cd-895293268d77", "value": "T1BB045C46EB818A13C0D71779B69F524633239BA4D3DB33069918AFB43F867DE0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323119, "uuid": "57f7640d-9996-410d-a6d5-618b66270116", "value": "3072:OUsd5o+DImaehF/h9PZpgBmsXCKiHUdzQy3d0fM/9bezpFM:OUrKLaehF/h9RpwJCDH0zQy3dEM/9YM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323119, "uuid": "5e822bbd-4f47-40f3-baf0-172f3de1a1e3", "value": 176507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323119, "uuid": "5095c919-ebdc-4cff-b31e-98b26d271aab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323119, "uuid": "5e7a93bb-0556-43f2-9411-dab897d6c8e1", "value": "vaxstresser.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a4eef8-422b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777289042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289042, "uuid": "519aab53-2fb0-4c45-919f-1aa2b354ad63", "comment": "Malware payload", "value": "7efd8a2e4577a931c02554ab20bc4948", "object_relation": "md5", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289042, "uuid": "293697a2-6f78-4637-969d-67bc264e3f77", "comment": "Malware payload", "value": "5da602a4fadc0cc5036ecf8f9146f7465ee58fc6504978c20f7efff16cc0756d", "object_relation": "sha256", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289042, "uuid": "bae597fa-ac17-4dae-a0d9-5fcbe24045d7", "comment": "Malware payload", "value": "1ada59d5f2d5285ee541d33b46873043c6183ba0", "object_relation": "sha1", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289042, "uuid": "fc8c43ca-4fd2-4515-8caf-6635c914829e", "comment": "Malware payload", "value": "2d80aa668841e2acc409f23d63b99ccbe3c6cd99715250fad5e21e58f8bf961e478848ca19d1461946d28ee3843beb3c", "object_relation": "sha3-384", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289042, "uuid": "94da4b7b-8548-400f-a56d-5c6342227c51", "value": "T1B2F7F853F3508E12D29D523988EF435D2375FE469B33820BA918F3683FBA75C2D68952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289042, "uuid": "a6f01fa0-c2d0-4bcd-ac76-19b36d8be264", "value": "6144:JrZn7y/EGuH/cpizkJIftx/ZgGIuXjB2AssSo:hUDuH/c8zkMRUuXjTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777289042, "uuid": "5d7a1dbd-c144-49ac-af92-dd5b3b0a2b6e", "value": 71303168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777289042, "uuid": "2a65e1e5-746a-48a0-be37-dd62763f7348", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289042, "uuid": "87468dc3-2d1e-4fbe-a1d7-0a001d4747b2", "value": "Documents.vhdx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce1c355-4225-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777286393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777286393, "uuid": "da9b2a61-7830-4ffe-a0cc-75d27afa1489", "comment": "Malware payload (Mirai)", "value": "6a7a32cee9c2dcd46784a93edc339c0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777286393, "uuid": "a7404af6-ac80-4470-b44d-041caadfed70", "comment": "Malware payload (Mirai)", "value": "5e0b0a398ab427aa79b3dea99a9c23944a1ea8533e6d1dc42182d95bd5df075d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777286393, "uuid": "b7639550-3125-4348-8bf1-7606fb087bba", "comment": "Malware payload (Mirai)", "value": "b8e3645931cf1ec6440ebbacc68c92e066ec7951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777286393, "uuid": "fcf1f03c-b5b1-4446-af0e-aeebfcb9b36d", "comment": "Malware payload (Mirai)", "value": "13b14c1ba2bb56ab4175df94c3b5af19b5345f637c03cdc48e66e487f462d329925444195935cb82de0fc851be158740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777286393, "uuid": "38752fd7-7149-4d57-a00a-cc833134d286", "value": "T12A431917F94685FDC089C234177EBA3AE92331FE1229B26A67D4FB263DC6D611E09D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777286393, "uuid": "226e8542-00b6-4dd1-8cf3-87c2b3f9b411", "value": "1536:1XIY73si3qEToSRhINcQ/K6C8u50pfEHwNLT:2Y7H6ETRhIV/Kn5qEHw1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777286393, "uuid": "7c75ec1a-8882-49d1-9deb-b743b1cce959", "value": 58480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777286393, "uuid": "6b207390-327a-43fb-97fd-e9f4b7e289ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777286393, "uuid": "755b4571-4a01-4246-8fb4-20ec204894cb", "value": "RpcSecurity.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e6a8d8-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276145, "uuid": "77a27721-dcb2-4411-ab88-cfba3eae4b02", "comment": "Malware payload", "value": "56ee113cb0ed7e886b1feb8ba8fea8eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276145, "uuid": "9b5773de-a299-4ede-9819-2313b47757e5", "comment": "Malware payload", "value": "5e733bbcb90e045f91f8a79e9885603c91646cec0fce48fafcda7a2d035add0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276145, "uuid": "5ef96b5d-79bf-45b3-bdeb-deb999c555a9", "comment": "Malware payload", "value": "60463150cc021a839259aa93d65dff8ab4156aea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276145, "uuid": "71e24d71-7a9f-4a2a-8e3c-ddec3cb8277d", "comment": "Malware payload", "value": "65ef9fb11aca0565f1130dfa1b7178b4246a6217c36b8f76e92270adc5cc8ae288704c120f3580edcfa7b02d3e4f0bd7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276145, "uuid": "ef8812bb-836b-44cf-a699-f89707dab75a", "value": "T1173723350D99CD6D427AB6F4151E6F6E43E81DE0F81123A962CBECD7179EF0B102829E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276145, "uuid": "737cbf11-961b-42d1-959e-8a841e0eb705", "value": "49152:+ybFybeybZybJybMybqybdybxyb3ybjybbybl+ZS+ybtybuybAybEybR+ZSVybgz:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276145, "uuid": "a64725b4-7935-47d4-8670-72986d9d3f37", "value": 23164056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276145, "uuid": "f6c56a44-d746-4562-a0c4-64ed635d5bb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276145, "uuid": "15ba405e-d53c-403c-9d6b-9b350fe16c6f", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0468b30c-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276769, "uuid": "a661cb78-a1c0-4e17-aa2e-d2e44d67a356", "comment": "Malware payload", "value": "b6a175364d60fa8e8a3c8ff6ff6dbed7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276769, "uuid": "15ee84ba-1532-4a98-9f64-a465d844bc8a", "comment": "Malware payload", "value": "5f4e06e2d8c7bc14d9e602a0f9d10c967db68723a544bcb9715acd49480e6073", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276769, "uuid": "5b9706ed-3967-4709-a420-36e764befe78", "comment": "Malware payload", "value": "5671b6fdd158d59374a64117dd740366ac09217a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276769, "uuid": "091c10a1-5b46-4096-897f-9519e04cd9c2", "comment": "Malware payload", "value": "dfb7e348ee78ab504f1726e193b9bc2745e5873b909a62183198170127f4c65762d274f8dd535cbb83a445d826014d78", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276769, "uuid": "d98d9e29-a282-4a45-90f8-0e01f3679cf5", "value": "T1AF3723225C0DABD6A9FC775910B91B4D05E9CAC441A83AC663E25CA4C793F3F828F1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276769, "uuid": "d5828785-82d9-49f9-9faa-e1ef705181e1", "value": "49152:6HNMHNMHNlHNgHNSHNQHNOHN2HNXHNcHNwHNq2h8HNOHN/HNhHNpHNC2hdHNpHN5:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276769, "uuid": "ad8a82b3-9f9e-4aab-a1dd-2dac5fc683d1", "value": 23424206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276769, "uuid": "3627961f-d0b8-4d86-9899-b876d3a0b7c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276769, "uuid": "bfeed6cd-62b1-4920-b897-202a98cab3ad", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d36a9be-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276837, "uuid": "e259a62b-2ce3-4897-b165-54c2d5e889bf", "comment": "Malware payload", "value": "6a3c29f8bd822f7274796b8110c8fdaf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276837, "uuid": "fcb0fc2c-0cb2-4fdb-9e60-59fa7cf3e890", "comment": "Malware payload", "value": "5f81780654489aa324e298f3d5b1e16b66b654e7aea7ae5dd1686891e22c4528", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276837, "uuid": "9a4dcaf3-1dd0-45d2-a073-1b630bfab0b9", "comment": "Malware payload", "value": "dc00f6cb539798e196d965ece78a66433261f568", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276837, "uuid": "c8bcbe81-2e23-42fc-b8b4-6c978c67efef", "comment": "Malware payload", "value": "47d3005472a85e542f8b8def47c3611a3ed136cde329272bda6fdb88f75a92f136272c043095e3a2236f194b8610f3b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276837, "uuid": "16c4c723-1fa1-4445-bf09-d727b92b8a11", "value": "T1F12723057E5CBA3F907B66D80D2A0B8C6376C1259878A9D1F392CA44E32EF4446375FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276837, "uuid": "84d03a00-82a3-45ac-8459-cc9aff0e0085", "value": "49152:YvYqHdHTigNAVGDZk+v3UGDk/YKOtzL3WLhCh6GDCGDEgoQGDdiklVccbfPzvKVf:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276837, "uuid": "3b9ac6c9-72bc-4d85-8f70-f6c94c058921", "value": 21603289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276837, "uuid": "c7037433-0738-4f03-9ef6-3d7ab2b3170b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276837, "uuid": "fda03d9b-d9f0-4ea3-90f2-cc9af8ca57bd", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8334159-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280560, "uuid": "337eb526-190e-4fb9-97d4-b3df0175276f", "comment": "Malware payload", "value": "f9b4efdc616bdcbb336d21a57f6e1fb5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280560, "uuid": "bd3fdc4e-107d-474e-9885-ca1b462c679f", "comment": "Malware payload", "value": "5fe23b633a21c720710af7da97c6573d06af538530a9967b571e44dbc3188f19", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280560, "uuid": "950ec9a6-2571-462e-8c2a-c28f4860c234", "comment": "Malware payload", "value": "088e7fdda6b8641b75e06e1919cafb2b5ba415ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280560, "uuid": "d08c9af3-8a40-41a6-b2a3-d6df73cccb69", "comment": "Malware payload", "value": "104a867c476c6dd0f8fc5e709b6c5db4d56e84a0bda1d240e4e4593295c82695f849e4994ce710d0387889427727fbe4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280560, "uuid": "d3727f92-986f-4f8f-8efe-3a61860bde61", "value": "T1BC371321383ECA9B13EC406D10789BAFFDE40954C51A89C6E3B5A5E6DFBD708661307B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280560, "uuid": "deb7bcc0-1589-42b2-ab68-1a3eaed5f3e5", "value": "49152:spF5SecfmH1YhVnGXSTNRVVnGGixEZ+FRB4ggEnmVnG2VnGGFvPVnG7rZVwtlCOq:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280560, "uuid": "68e1c077-cd55-4de7-a4e2-a0fa03162582", "value": 24204591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280560, "uuid": "c1b0152a-736d-44b6-a2ce-c027fe27fe73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280560, "uuid": "389ddb23-bf36-402d-ad8d-a59e5a80f57d", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7e030d-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279440, "uuid": "7fd9d7a1-ae5f-4414-ba61-d177053f0054", "comment": "Malware payload", "value": "035cf921326ca8c5855c20b74fb0f48c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279440, "uuid": "bad2dd87-a79c-4f05-abfe-a19bb4baa664", "comment": "Malware payload", "value": "604d3aef9fbec737328c28f73e04e929e84c0c702c4944ac7a93f0db7667d8d6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279440, "uuid": "5979ff52-08bb-4e5e-9645-16ea19e4879e", "comment": "Malware payload", "value": "e184fe3e7678f30de58dac08e6a57b68d824d4c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279440, "uuid": "96fc3881-9f32-4c6b-90bc-49243ff771e0", "comment": "Malware payload", "value": "e3426ea1b9de2adec5ac7324bf17bddf6649bae1572b7fb0bd4b083c540038679e8207046c2609512d18606f365c503d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279440, "uuid": "2a3b9777-2764-4144-af8b-6f3148cab780", "value": "T19727235F8E053F5E023804A2E5368DCEE2C69F94519855F6BBAAB8B6097FF01E0D107D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279440, "uuid": "be982c33-43b9-4e48-bc88-919c9f2f8faa", "value": "49152:QCzeCzZCz4CzbCzFCzPCzRCzeCzqCzvCzgCziqCzLCzyCzeCzaCzDJCz2CzMCzxi:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279440, "uuid": "50106211-675a-4605-b560-5923f5cca2f5", "value": 22123545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279440, "uuid": "b9a33fd3-80a8-4a0b-a84c-985c2e0fdaaa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279440, "uuid": "8000edc0-4662-4433-aa5b-d50e57a2c256", "value": "invoice-1645080830.pdf (52).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdd692f-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321959, "uuid": "cf116058-adc1-4700-b6c1-59de0d599a9f", "comment": "Malware payload", "value": "ed9132965a1290664bf861682805ef07", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321959, "uuid": "cd89c905-b26d-4cf6-b1a7-b84743a7a302", "comment": "Malware payload", "value": "60a5eaf9709a95fbd30e7994e4ce8e567f5c5371fc76ea5f0b0edc7e2f3c9d6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321959, "uuid": "dd51c8d7-0df9-4c37-8fc4-cb6006d1cd38", "comment": "Malware payload", "value": "ff35bd7474cfd59ae9300ce6326e8518d5bae573", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321959, "uuid": "43314845-f96a-4c29-847e-a403c25e46b6", "comment": "Malware payload", "value": "73771db2eb514ab4a2412ff120082911e76a59528f0157606305281ae7e48fc9f4f964c5d9b98625ae11713cc3d3cb83", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321959, "uuid": "7bd8b496-e467-421c-8540-993bb66ea78f", "value": "T168B09259A04DB8398BC76B818AA860A91577E50B025A4892025A65AC88A1B6C64B6222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321959, "uuid": "560f442a-012a-4ddc-8489-ea9a02fcc057", "value": "3:gdQTtQ8wVIEXjKUJKhcsTDNkxLNBkMxhJH0fJH6tM:gdhRIBUcr1gf/jUfJH6tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321959, "uuid": "4d3599b9-f119-4b98-b030-ff49d8bea4e0", "value": 124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321959, "uuid": "8458f391-8ea3-4df6-b981-2e25a8d40098", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321959, "uuid": "4dcd3029-c28d-40c6-9041-b6722e595390", "value": "164.90.195.107_1777321924458655_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6e7e0c-41eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777261533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261533, "uuid": "fccb0e5f-1a2b-48ea-bbd9-a3aef06358a8", "comment": "Malware payload (Mirai)", "value": "f47334b71a94c8a45c8bf69a38385096", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261533, "uuid": "1919ca9a-cf3c-475d-8f6d-99b23eaf8e86", "comment": "Malware payload (Mirai)", "value": "60cb91261ed525930eb34c7791753fda45f4b2f19e1df5425cb00924505ca63a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261533, "uuid": "3885a521-7579-4bdc-915e-aac1c91f9445", "comment": "Malware payload (Mirai)", "value": "f5eeec629c307c0759f3f9870c79fe095dfd8d30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261533, "uuid": "8be38e1b-c4ee-4687-8886-a6f2554356a8", "comment": "Malware payload (Mirai)", "value": "d3f363f254060b33169d09a5427acf05c9b4ebd4c14b3bd168ee75ba2b22f39effb02b4c64d0ac47df5b0144a7a4afb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777261533, "uuid": "6737bb39-8cad-40f6-aacc-b85498fd0304", "value": "T103733A336551C9BEC097A1F02AEBD6A3FC20BD3D1771200563D4BFA26FA58C16D993A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777261533, "uuid": "9b6a5ece-c82a-4b39-aebd-bdf4612f29e8", "value": "1536:WMM6vTZPTYxfdQV4sQnQbglslNQ2jAiABmwSeiWHdRzdb7j3nKZ:WpAZbY1GV4o6iAB2eiWHf5b7bnKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777261533, "uuid": "601ee004-8459-4807-b0dc-e24d176e517e", "value": 79048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777261533, "uuid": "d97491f7-d894-4ae9-b133-83016ad8a5d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777261533, "uuid": "e488c616-53fe-4ad2-b9fb-deca3dfa6dea", "value": "xdf.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ef197e-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279237, "uuid": "780ffa91-ce8b-42b3-8635-796b74d9af56", "comment": "Malware payload", "value": "8f58c2b6aa7d8f830d15a9d60543cd29", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279237, "uuid": "2eab41d2-0a62-4749-9038-e778b302c705", "comment": "Malware payload", "value": "618344c8c0285a21473fd938267cffd514e5faa402a0cba67d4daffb39cbc0e1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279237, "uuid": "0ce410f9-2f2c-4a91-9f9f-d78a917cd50a", "comment": "Malware payload", "value": "4c3b5baa6f4bade5e275557bbd0cd18dcb3c6364", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279237, "uuid": "2a71a74d-2329-4461-90a4-6ea73269f133", "comment": "Malware payload", "value": "28450832daed744162312236b146ba41fba835918760caadc8bf6e4da53f2b7df8fc5ee25e09336d76afd460ae9226db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279237, "uuid": "fd37b136-d5b4-44b5-9a2e-c6266a53cd24", "value": "T16437135D0E6D090E427827FDB9BF0BCBB2C88D44514D7C9267C620DB566BCDA12EF229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279237, "uuid": "ea4a5a8d-bb99-4728-8954-63346076c79b", "value": "49152:xGmSFGmSaGmSuGmSzGmStGmSPGmSEGmSDGmS0GmSiGmSNGmSmfGmSmGmSgGmSFGW:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279237, "uuid": "1bea5bdb-61ff-4fba-b219-aa13c4d72bb2", "value": 23944474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279237, "uuid": "db036b8b-17d8-45e4-b89b-b75e0a25ce23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279237, "uuid": "ee2f45e8-6c0a-4d2a-97bf-44270f3aa9ae", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e04723f-427c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777323654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323654, "uuid": "139b8aec-3633-46d2-99ac-6cc31bf8bcc4", "comment": "Malware payload", "value": "411bf24d3fb22f7c4856580d682e0b97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323654, "uuid": "443fab32-4679-4b4d-b551-6584aba413a0", "comment": "Malware payload", "value": "621b14fbd5f9e7d6eef6c1aea7258c5e16af27e1c7241ca57c152e9446658858", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323654, "uuid": "9a457e74-68e9-4d05-8029-7bf45a0e6356", "comment": "Malware payload", "value": "77ba799c93701699564080bd4b381d23dfe656e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323654, "uuid": "3daa5d8a-fb37-4a44-940f-68de93713630", "comment": "Malware payload", "value": "25d05fc284d44dcd45e518e26d494dff0908426973d61a7395b519856627eecaca8aefb5d19e9e652862a06a020b9af8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323654, "uuid": "81f7185e-49fd-43a9-831b-843ab43977b4", "value": "T14DF1BE8543930996EB214333008EAA94E693516861F5AA7769048FB3313F6C7EACEDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323654, "uuid": "6228a3d1-8087-4fb6-a2f0-1af04f547289", "value": "192:Ry4+FxGAKV7rZg9BIUhTpWOltZZEaBHKEJ1nX:U44UV7r8GUhTp/ftBTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323654, "uuid": "9d01b537-6397-4724-b691-2ce8cf897c4f", "value": 7988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323654, "uuid": "466252b2-877f-423e-8e54-ce353aea10dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323654, "uuid": "9f14f1ed-53de-49ad-81d2-689d48444214", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6488d85f-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294539, "uuid": "bf8e8572-de6f-46e8-a572-1a972e9de053", "comment": "Malware payload", "value": "65061a14b4f6f612d4b8f36af5124325", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294539, "uuid": "5e2fa80f-fe58-4ff0-a4f3-acc6b91a6900", "comment": "Malware payload", "value": "6222f559d9b7013fd641c157a2f116eeec488311814e8acca3d4dfce90c0c79f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294539, "uuid": "89e9fcc1-31d7-45ae-8564-527c41b02a39", "comment": "Malware payload", "value": "09e6f5bf5e1b2f61363e6847fed74333d58755f9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294539, "uuid": "851707eb-1e9f-4ebc-a9ff-c7b9fe4a4d5f", "comment": "Malware payload", "value": "c7efafe1dea9fdf88d187c05471f49bbcedb1feb44597158d789681d0eeacfa3b51d7dd97a7660f89061e16d08c36053", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294539, "uuid": "0c218007-819b-4c33-b5ba-3ee2e3e03d99", "value": "T1393723291965CB0F1D943E5415F92E6E26A08F04E2532FF3B7BD60A7190F71CBA227B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294539, "uuid": "e0b22f9d-9499-4860-b5ae-1b4be1b55eae", "value": "49152:0B3p391B3p39eB3p39kB3p39FB3p39PB3p39FB3p39gB3p39FB3p396B3p39eB3w:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294539, "uuid": "dd9fc699-1808-4d73-898a-28f8eb59205e", "value": 23424200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294539, "uuid": "f07a462a-2d73-43be-83f5-579babdf4dd3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294539, "uuid": "2d29eaf9-851e-4412-9353-a2ba72f78331", "value": "invoice-1645080830.pdf (59).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03f9004-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276252, "uuid": "f140bbdd-d03f-4539-be65-e27c5e82a6a9", "comment": "Malware payload", "value": "7fa8edb5cfc7e943a30ae9f30aa20c14", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276252, "uuid": "5f75c756-c1ae-4002-890d-f38bd99da5b6", "comment": "Malware payload", "value": "62436f92d60f8aabba035367483a88fcb54c587802c51c3b7539fed0a1c15fb3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276252, "uuid": "c590b653-5012-4656-a6c2-078a4a8ca718", "comment": "Malware payload", "value": "f2cd85dd942a798eadc630896b8a2c94847c50cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276252, "uuid": "922dac6a-533f-41ab-bfef-a57b6d385b6c", "comment": "Malware payload", "value": "c695d0d0d4da3412f5f76af354bbde590f7ee7c8dd056d78dda9ff9807505af8482a154fe81df2012c55f87f322add97", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276252, "uuid": "62d6967e-96ec-4f1f-a040-c4da41b7188a", "value": "T1B2372302EFAD5FED86DD151801BA4C1F19A6CF1648B54CE297C1398C91AEF5BA0CB1EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276252, "uuid": "f4a2a5f7-148c-40b7-807b-41fa305ed99a", "value": "49152:iUTUuUNU9UqUEUnUEU7UFUGUz0U1UUUSUSUwxUoU2UDUfUKUpUTUeUTUUUcUWU7w:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276252, "uuid": "4464e93e-7a4d-4349-859d-cf502113b280", "value": 23164063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276252, "uuid": "5d5cab57-371a-487b-b1b0-fabd96c8ee64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276252, "uuid": "3de78d9a-ba38-43b6-9eef-20f1f009d7f7", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80f84e9-428d-11f1-a769-42010a9c0008", "comment": "Malware payload (UmbralStealer)", "timestamp": 1777331240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331240, "uuid": "ac94d1e8-25ee-42f5-81df-bd3b05920a73", "comment": "Malware payload (UmbralStealer)", "value": "57f9ca77ba96a6acea972777c559da67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331240, "uuid": "6bd4eb7c-e959-4974-b24f-097fd211403d", "comment": "Malware payload (UmbralStealer)", "value": "625df39010f6ad218c53983132278973269db5bed1a7d3188d8c27faee25534b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331240, "uuid": "773badb0-16d4-48a3-a25e-fba89e013946", "comment": "Malware payload (UmbralStealer)", "value": "2256c1f4a53b694b3ef04399479541ad1a506054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331240, "uuid": "58c59960-87a5-44ec-a98e-ead46c2f52a7", "comment": "Malware payload (UmbralStealer)", "value": "99103e711131ec249c4a22ce4a044282fa79e476ff011008a7c5b3b900d4abc6ed1c337c7981c0b209a69167d54c0fcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331240, "uuid": "52b4eece-79fc-455a-bf47-d76efb4ff359", "value": "T183346C1437B88F12E15F9BBDDAB0549F8B71F103E91AF78E1C8895E82452B42EC09E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331240, "uuid": "e93d9add-2981-4a5f-ab09-0db10b02083b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331240, "uuid": "57d948c9-01c8-4306-a9ff-4d530e02a8d9", "value": "6144:1loZMrrIkd8g+EtXHkv/iD41tgPGELnsYd42X3Wxmmly8e1mli:XoZcL+EP8HgPGELnsYd42X3W5eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777331240, "uuid": "9de12de3-eabe-4e13-9e91-c546b96f9414", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777331240, "uuid": "22c1de30-11a0-4a03-a96e-99af16a0c1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331240, "uuid": "59c11fae-998a-4390-b581-e0b05dc3bf18", "value": "Windows piska.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763b8360-41fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777269658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269658, "uuid": "c39bb062-8c61-41f5-8608-e22bb42c9e7b", "comment": "Malware payload (Mirai)", "value": "dce6c310169bc374b1c413acb3dfa87d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269658, "uuid": "ff4b7995-e697-4286-a159-26265616f1a1", "comment": "Malware payload (Mirai)", "value": "62b5398fe5aec960ad28de496159dc9a939551ac5008e6e3c76bbe51909490e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269658, "uuid": "3f234cdc-e815-4d8a-ac58-14a85d9804c4", "comment": "Malware payload (Mirai)", "value": "bc0ffd68bc5c69c5f4f3b70b36e308fca2412cea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269658, "uuid": "57e92d38-bff3-47df-a8f9-00e53423ef14", "comment": "Malware payload (Mirai)", "value": "145c8b6a29b7c2aad47e457b5a0cadc6dc9f887b93c2b712dccf018e5a5ca81ca89b0eb29b8a54f731139cc795951b20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777269658, "uuid": "2ef69b12-96d1-4a63-9c78-389702698963", "value": "T167A43A51BD419B26C7D06ABBFFAD828C331317B8D2EE7112DD164B3136DB85A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777269658, "uuid": "919c34aa-8afe-4511-8329-93f259c2361a", "value": "12288:KFRY4tNW3RFOaASG1AiQvixtn/UEqHDPcVPA3SyNrRGNy9pEMJlqTtb78Ed1wBGy:GUxTEDCEIBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777269658, "uuid": "9480a37b-24f4-4e72-b568-93eb7449534d", "value": 467060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777269658, "uuid": "9aa5879e-79ab-4c4c-835d-c6b60b6126cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777269658, "uuid": "ddfdb205-2348-4462-a318-f4d9c1bf3643", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c0ec1c-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283836, "uuid": "690a1a41-3c73-4d45-a79e-e5777267ac02", "comment": "Malware payload", "value": "682c52c45113d56eff3fb88b8943995c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283836, "uuid": "6bca4ff9-51ed-4d3e-95f3-9b52fb400bbb", "comment": "Malware payload", "value": "638f640a57521b36d8c8c52e5f06d3bb4d4c11e4fd5013c28eaed13f1a71c50e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283836, "uuid": "3861aa4c-8d18-4e94-bcf4-3d797639466c", "comment": "Malware payload", "value": "bb1628649fa6006afd308e133f9d2a7ade1f6acc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283836, "uuid": "ce1ea1f2-174a-4b18-a848-224bfdfbe677", "comment": "Malware payload", "value": "1ce974c7cce424326da65be6d53536c491b6067f5041659348ca2e9ff7d2620440009cb5a15500c7120f114de6675a31", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283836, "uuid": "672a8f30-a2d1-45c6-af73-1fce41d6e328", "value": "T1B23723A749EBCCFBC06E750D4DBF2ACE55394D0FC51AA4DB8E9C850E0A0955F286E90C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283836, "uuid": "d40f8921-fe05-4a64-a916-9714560db635", "value": "49152:vaQGaQFaQ+aQEaQLaQpaQ9aQzaQgaQraQdaQTSaQRaQ0aQMaQIaQe9aQQaQZaQ3n:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283836, "uuid": "c64fd3c3-9cef-47ba-9f12-7134fff936d6", "value": 22643815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283836, "uuid": "ddca90fd-be66-4553-b804-813e11f29b3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283836, "uuid": "c1165bc0-5be1-4298-b140-6d86db6bd09b", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c485eb2c-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285251, "uuid": "afc1b2bc-25a9-44d2-99ff-78bc105212f3", "comment": "Malware payload (Mirai)", "value": "8998c27ada28321024599ea33afafe14", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285251, "uuid": "d2cf1ce0-b1d6-46e4-af26-33670c45bc07", "comment": "Malware payload (Mirai)", "value": "6427a80806087899a10e4fc806bdf2438a57e6f3a021c75d729c39ecce7daa1a", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285251, "uuid": "010f5dc9-faaa-43e5-945c-641e595d9dca", "comment": "Malware payload (Mirai)", "value": "7ef77348e61d75f2bdc19ba43d5ab85bd31851f5", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285251, "uuid": "45860b72-99af-4646-9071-4506c9da4143", "comment": "Malware payload (Mirai)", "value": "605067433b69bbcca4ba945c626a62b4681263e50c2c0b98faa41aed53311dead976f2b35203fb00b2ff58526207b06d", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285251, "uuid": "d26b6181-dbfd-475a-8289-1aae7809831d", "value": "T165D43955F8809F61C6C539B6F74D42A873074BB9D3EB72069A145B343BEB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285251, "uuid": "2db71d74-ac7a-42bf-9b57-d3465aedc7cb", "value": "12288:1U3EIOXeLyCk1RwO6kWwjLCuSI8212LDGWb8pJlCcc:u3EIOdv1iLkWeLdSIqOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285251, "uuid": "f6c786d4-9ecf-4534-84aa-d006b5101c83", "value": 617448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285251, "uuid": "8ca6340f-ddca-4bbb-b20d-c6d9ed210703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285251, "uuid": "b207ecf8-a7d9-4d55-9f8e-3979ed390eac", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716561e7-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279528, "uuid": "2ae33054-ccc5-4a69-9481-2a7036924c33", "comment": "Malware payload", "value": "a90da96c705f242ea355c7562eccd5f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279528, "uuid": "21faa936-42fa-4180-870b-11933b29b1e2", "comment": "Malware payload", "value": "64a5f2b671e0e2d4e4f2da654d49d87dd99d01c03d624c71446db3b7bd500cc6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279528, "uuid": "e410857b-eec3-4acc-92ff-a1dd72cde3d4", "comment": "Malware payload", "value": "31bb7528a902c5acc4a7be527b7f8c854a86d53d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279528, "uuid": "69e0f0fa-f11d-4d12-b9d1-34e3a0e0a69c", "comment": "Malware payload", "value": "1ed95f4ecb95a79cfa6c1f48252e2625d994524e22cc841189abfc480dc59a7db1b6b4d5a0379990ce8b7aac0e12f133", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279528, "uuid": "708daabb-7888-4f6c-9934-482f6d6fd003", "value": "T10A3722200A3A1F5D0C541AB830772F6E6EF06E11931B6B934AC67EF58D0DAD52C6E35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279528, "uuid": "8a6179df-3ef2-40f9-923a-7fe030d8dabb", "value": "49152:kbR1bRkbRxbRtbRibRQbRJbRMbRvbRvbR6bRyCXQQAbRHbR8bRQbRIbRpCXQQ5bY:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279528, "uuid": "6eab01c9-f478-4d99-96b6-8aa7e414a9d5", "value": 23424198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279528, "uuid": "e945417d-9af1-434c-985f-6067475e8883", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279528, "uuid": "1153c746-70ae-4927-a555-403942e79e3d", "value": "invoice-1645080830.pdf (62).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f9665a-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279080, "uuid": "56e132ab-ed7a-4d81-b048-63c64a7cabe0", "comment": "Malware payload", "value": "78b63367cda16950ef51bd16c6ed8b80", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279080, "uuid": "ddc430c4-88d6-49ba-869b-824264ed59e2", "comment": "Malware payload", "value": "64ec863881b7d77a911f114f675561beb21f947591accd292c7ec49b8a6560d0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279080, "uuid": "87578acf-a8c6-42d0-a5a3-79397ff91510", "comment": "Malware payload", "value": "f1ec30a87e472d9586df40e5a0dfb5e9571195a6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279080, "uuid": "2aead491-5ff4-4ee0-92e2-39a59774d602", "comment": "Malware payload", "value": "3bc8cb13939d792b1e076c5907388072ba8a7bd6a0342d2ae33c7f1a4db5139ab221ccb6cafa958af3af09185dcacec1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279080, "uuid": "1944c897-6638-4984-b868-290969f74eff", "value": "T10B372318A97E582E408C163D18BF5F0E89F5DF42883435798EFABC5E42CC7E5649D2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279080, "uuid": "aa6c9a9b-031b-4738-a094-29bec2007aab", "value": "49152:bDRnWDRnADRnhDRngDRnyDRnsDRnBDRn0DRnfDRnHDRnWDRnHfkSpDRnhDRnmDRX:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279080, "uuid": "5e25cca0-627b-4c1d-b0e9-c311c07dd666", "value": 23424208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279080, "uuid": "2745970d-794c-470b-a65c-acd754022278", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279080, "uuid": "8d26bd45-a876-4e95-a2f9-0b1f7c481b66", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9381f807-428f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777331984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331984, "uuid": "4ceac9db-cbc5-4a27-8d95-7e0f450877a4", "comment": "Malware payload (AgentTesla)", "value": "37541cda2e1b5f08facd02cfd8a2032e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331984, "uuid": "ac7822fd-ebd7-4fbf-bdd4-21bfea4e0883", "comment": "Malware payload (AgentTesla)", "value": "650a4596fb2ddd666b05b7f3ae7619789781dd773f87172de99b0db8545d41ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331984, "uuid": "9f4a9404-d4aa-4a54-b819-5a03d8828b2e", "comment": "Malware payload (AgentTesla)", "value": "2e7004dde1c15470763faf2873d01432f121ac5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331984, "uuid": "c1fe5de8-df0e-4075-ab8b-4542e4e8615a", "comment": "Malware payload (AgentTesla)", "value": "8ffcb14ec5b0bcc6d78d8e084489c5ff497bacfeee712d3db59a28be9bcc398d03bd8f004d6c2a2ec3574dc62ddd0553", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331984, "uuid": "c3b492d4-f634-4e27-9577-9149dfa5af40", "value": "T12C2523632ECB613D091D633EE1EBDE4A97F66B207051C2DE92811DD6094F63BC5A7C28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331984, "uuid": "5ad3b90c-0f58-4012-9a14-98e6e98e68fd", "value": "24576:kRl7fSRbWRfUQJsD+EFtx4vIVyVqCVNSE:kjXcAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777331984, "uuid": "b29ad326-35a9-4c54-a27e-06751e750e39", "value": 966368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777331984, "uuid": "c3e7dde7-bbf3-45dd-a584-6fc779226af8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331984, "uuid": "5eb99cc8-b1bb-4f7c-832f-34db3f1755e3", "value": "INTXCP0Y.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897f67b0-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285582, "uuid": "0acfafe7-f29d-4d4d-9306-49157f4f97a3", "comment": "Malware payload", "value": "2ce41c504ff468d62293ce71365d5a2a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285582, "uuid": "bb581b43-81c3-4f3d-8505-ad8c45a5d487", "comment": "Malware payload", "value": "65161944e6759bd2910891d2ca19f7590f2cfde7d7938cf0ac957dc5ec7e505e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285582, "uuid": "71a6ea3b-5461-43bc-a8b3-48a2355e9f49", "comment": "Malware payload", "value": "2ee80b948ce19f57df47d806442613d7f787ac4e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285582, "uuid": "268eb3c5-8e60-421c-b21b-d2f1b018e9ed", "comment": "Malware payload", "value": "f956eecf8af3abf1486d8e60d4b7036a0cfafab8cd6d3ebce4f0be08d186bc3d65920ee5ba1e09d22d5c84087ec4e9b7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285582, "uuid": "683d8000-e821-4946-b5b4-308390454abf", "value": "T1783723545A3C5BA98F69768805F74EC76FF2CB9C885B8CF5A1406A87DFC8F64140F20A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285582, "uuid": "61c369c3-c22f-45e0-ae52-b6326fab97c5", "value": "49152:YqgAwhzY3SSpGkRfOkHjlkRwLhgsfNwU/JbVX9kRYkRgSvhkRjm2nI7riuqwe2Ij:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285582, "uuid": "46a58478-22a1-435f-a956-45e90534c327", "value": 22903920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285582, "uuid": "dab79704-3cd4-4e98-aa32-b2b187aaae03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285582, "uuid": "6d235938-e9fb-408d-b832-2ea6ff118045", "value": "invoice-1645080830.pdf (60).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6360390-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276315, "uuid": "2410792b-a590-413c-96c4-afe071bc9ad7", "comment": "Malware payload", "value": "a403122be1bc8c5b050c10c86d80e3ff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276315, "uuid": "61efc6a6-e846-4596-a75d-ce36875672bc", "comment": "Malware payload", "value": "657359b90ff6b4bde81a011ce03cdd45e0f4575b6ec8bc3ecad26f7e0d4a070c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276315, "uuid": "3a809cd5-2185-4ebb-a3b8-3e8b2a154b47", "comment": "Malware payload", "value": "ff03c51ab65811f9fc1edc78127437d0e2a4930e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276315, "uuid": "e0f269bd-0233-416f-8927-7792e3cf8408", "comment": "Malware payload", "value": "50e2ebfa8db9c91ec2102560d07c6b0027520923a3f964d4a412b270f7a958e4b68180de46daf7bb4950678ebac3fc6d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276315, "uuid": "289515fe-155d-4e9c-ad11-65b6c84f42f8", "value": "T1CF3723317C345E0D10F8109058AA1F6E67EAEE11D194C8EF4BF2E621DD9DE297027EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276315, "uuid": "30c3835b-ff3d-4f33-84aa-07cea2c0d9e4", "value": "49152:XpgG9fNmlwYjxmlFU4glabjFeyVETMaAwkAFXzsiPTYcXfqumy+hcJf5wJfrPl0Y:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276315, "uuid": "21052e6e-3f54-47cf-9e8f-fed1ffd23f85", "value": 23164063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276315, "uuid": "abd439e0-8e8a-48e3-8a95-56410a70f910", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276315, "uuid": "66b1e4f0-87f5-4467-a74c-07a15d5b0a6d", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0087a8d3-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276762, "uuid": "781a9575-cadf-4f7e-bb42-1b785f5a7a0b", "comment": "Malware payload", "value": "500b042074b2c9d881ec8187a18e534e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276762, "uuid": "fd0b5669-c223-4a08-a21a-e84536e43a5b", "comment": "Malware payload", "value": "6638a4454fd5ec8ccc9be876eb31b36ac0a3e6aeaf868e52db81e2ab2cd04440", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276762, "uuid": "17214ce9-f1cb-435a-a26b-1b560f3982f8", "comment": "Malware payload", "value": "c90c65a409c6ca2139ed3bc2f3f317433dd7fb03", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276762, "uuid": "8993e2c2-acf3-409f-ad32-77fd7ad86e46", "comment": "Malware payload", "value": "7b6fbf37ff8e79b0eacc02eb751f9b7f285b1e1e6417af498c99e9e1919753a8570823edc38749f74c4993cb41150e21", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276762, "uuid": "5d6145bd-c3cc-4c40-90eb-cb162280e3da", "value": "T1B037230A1E3B4C1F0979662658BB170923F1DE42C05DB87C456277ABCDFFA26298781F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276762, "uuid": "6915d629-7289-43aa-815a-b931302f3266", "value": "24576:CQtQkQVQwQGQ8QnQvQvQhQVQLdlwwmQCQpQBQxQYdlwwjQGQHQYQ9QRQ2QlQTQyI:4rKcfT96ivjxna6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276762, "uuid": "d8cbd44a-0cda-4d4f-a7f2-41ca1d03dfc3", "value": 22643811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276762, "uuid": "339aade4-b488-4344-95f4-f050810e0133", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276762, "uuid": "07be80e8-59c7-46a7-a16a-8d364f0cad2b", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ad0305-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285513, "uuid": "f0e28bb6-a980-4dda-b7be-c8646a4e42b2", "comment": "Malware payload", "value": "3b04a86ce808bc6708c6af3831a7f8a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285513, "uuid": "84dfb59f-641c-41f0-b131-2d97dd101997", "comment": "Malware payload", "value": "66dadceac92ed1b09e85536aba6a69a4d4b3350345e6b6408c66bb67bfa5dd59", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285513, "uuid": "05d38c39-9e7d-47ba-8c0f-19500a9d0f5c", "comment": "Malware payload", "value": "537cf1715c1c0af2433e7907631a36c764267e25", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285513, "uuid": "01f0a810-e08a-40bf-ad71-d3c803ab132c", "comment": "Malware payload", "value": "07a42f46de39397475605d4dd5c188e79b4dccb777845bbfe93a98832ea6d0bc42d5d37b49a7e3624c10d5e4e465a995", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285513, "uuid": "1d72cbf9-15df-46ce-bc6d-2dd689b2beea", "value": "T1AC371306457FBABE842C212876DB0FAF5EDC99448A14E481F2D5ED2DE365CB3968F10C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285513, "uuid": "bfa707a4-0cd1-4f62-ab32-eb9926e5475e", "value": "49152:vVtZVtfVtbVtfVtSVtwVt3VtyVthVtlVt0VthUuVtsVtgVttVtRVtnUdVtaVtDVI:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285513, "uuid": "01b6f3de-2334-4bef-a548-590e368fdb95", "value": 23424202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285513, "uuid": "ccd0f686-7482-4a2c-afcb-91ff06bda85a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285513, "uuid": "86f296fc-ea49-4a74-8178-def691aec9a4", "value": "invoice-1645080830.pdf (62).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5edc69-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777265103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265103, "uuid": "f274c366-ad88-4ea1-a229-b6e85a039485", "comment": "Malware payload", "value": "b9e7d4c40747af9c18821781b72dc85a", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265103, "uuid": "321e7e71-de35-4a21-8804-7a63e4c46306", "comment": "Malware payload", "value": "6758ada3b9bafa1e4458fcd318d2ca30afe9313d42e022821e7af5488914c783", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265103, "uuid": "381d746d-4d68-430f-a201-ef940a2e8968", "comment": "Malware payload", "value": "f9bfa61c342ca40550da09266df6960f0420406b", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265103, "uuid": "2bf884c9-6df4-4f53-a6f5-4182b960dd82", "comment": "Malware payload", "value": "52823d4a553b2964af77b0f9bc6d6df9d811da113070cdcd9962a2bcba72b24b4ba2cc5d0455a44eda069a973ed5bf9c", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265103, "uuid": "ce0b168b-62cc-457c-8075-8befd4cbafa0", "value": "T198C56E05389348ECC55E723289F2299A7B34B80C5B226FD71A4379742D737E27D76B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265103, "uuid": "0cb7e27f-9f59-4ffb-be95-6a040223b911", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265103, "uuid": "511692ea-e241-4dba-8844-985c94d0e442", "value": "49152:77rTCFtL6DJs6ZKsaewCx9ki3kxyFRSw/0gPg3q:77vmRgZUewa9ki3kxyh0gPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265103, "uuid": "58e3d669-0051-4abf-a7c0-79a412125089", "value": 2507992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265103, "uuid": "4c888ed3-9c1b-4069-bcf2-2b24aef6c15b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265103, "uuid": "49289460-ad39-4be4-a39e-6dde54d7a6e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d90424-4227-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777287190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287190, "uuid": "1b15d257-785c-4b5f-94e9-8dd1cb35255a", "comment": "Malware payload", "value": "e84176b5dd3e15fc2dbbbe9a7a04f322", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287190, "uuid": "a4227bf9-0038-43b0-a27a-bae775fbc72d", "comment": "Malware payload", "value": "679ed416aecc8ded866cfeabaa261d2eb4752dffca7fb066deb58df6642ae9d6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287190, "uuid": "5af9138f-9357-476c-a920-abc05560d533", "comment": "Malware payload", "value": "9f0ec325f49d946db332c14f3ccb41d15c054500", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287190, "uuid": "4ddb07a6-e66c-4c73-8386-737eb32ad804", "comment": "Malware payload", "value": "c05f8b6d27f6fa460c4713277b4259b648f31af520ce10b1516b420499e9077a2e31442f081e816e4b8e46d7d35404ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287190, "uuid": "fcc18941-ed7f-45ea-9691-a61ef66a8c6c", "value": "T1CE260283F701E96BD0EB813340764B6252578DA98E87EBA72D20776C4CF35C45F9AE48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287190, "uuid": "d660b0c8-c4b0-4e15-bc31-4a6c4c758034", "value": "98304:s/zmAds/grbWac77kLSDAsE1MDqnpkX3OZD8W0UyUT:gXsCtc77kLSDADgUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777287190, "uuid": "fbe72110-834a-4612-8f8e-52662104ffd3", "value": 4703224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777287190, "uuid": "c739890d-31cb-48e6-95cb-e2cdf1613c6a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287190, "uuid": "cf11e63b-ebcd-4709-9bbf-50034b9d3e7a", "value": "Barchatoliqvideolar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71df646b-4252-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777305729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305729, "uuid": "80f15904-294f-4601-a748-c15bc36de1d5", "comment": "Malware payload", "value": "f8e4ca2148b9822b210f45da5f305d9a", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305729, "uuid": "0ff49983-4704-4ddb-af5c-e10c72c4c0a5", "comment": "Malware payload", "value": "67a67d9e1d3403f3e449645bd5fbb9542e16c13d19ae69c768df1a428a3ac7f4", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305729, "uuid": "3fbc7568-939a-40d7-8f00-ff03b604a73a", "comment": "Malware payload", "value": "4df1e0246d2eb76d04b8a35dc5d244511f13a732", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305729, "uuid": "ddb33fbf-0027-48b2-bfa0-a6e9c77efdad", "comment": "Malware payload", "value": "d4602918415e28c63b58651ca60dc8d35c2f0893e2d0a445e72dcbc32fda59023f3365c2ab79825adaff8c4db217906b", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305729, "uuid": "467a27f8-ce3d-4bed-abdb-5e837e137840", "value": "T13D255C1FE39980EAD46AD17982865321FE70BC524760B9CF16A047213F56EF4AF3EB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305729, "uuid": "3b6c9be9-47a2-460f-8b92-73ed4b15da74", "value": "2e2a333389da667cda144ef1ac124a55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305729, "uuid": "5ee74d74-076b-4024-82f2-4a223cd6eb07", "value": "12288:3Kc91qRFgm3MnNgZgG3WTLoAWmYYopYjaKO32SXFqzwlIKu:3KceKnh3YwGKO32SXYMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777305729, "uuid": "54682b1d-546d-4566-b079-3fcd8e811e3b", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777305729, "uuid": "9de8d805-4c6b-4b35-9ecb-02ccf767532e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305729, "uuid": "08eeba21-ea21-4a6c-87eb-ccc8fa7bb92f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d9ced4-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280264, "uuid": "fd872813-d235-40fb-9c9d-4e040b260629", "comment": "Malware payload", "value": "b5ebdf99bc1a48f023f75a2d196a73f2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280264, "uuid": "153c8b85-68ca-481e-8e0a-1b61e168f87e", "comment": "Malware payload", "value": "6817c674fad6c9920a4fdc2710f1e30f0afe1cd50390d27151d6d8e97ff1cd07", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280264, "uuid": "2c66a7ae-1f26-437a-bef6-79ebb3b7de19", "comment": "Malware payload", "value": "442d277b66da782745676fe430813ac2ee050c37", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280264, "uuid": "1df3800a-7b00-412b-bc70-1ae09276293f", "comment": "Malware payload", "value": "41e47e74dd79e21e1bc046a8adc5d4e4f3ae4a8def11bc83b9ab44950ca2987e6e91dbbff56bf429c22c5d408b882924", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280264, "uuid": "ef00bba1-b20e-4be6-b33c-76a8c76a7543", "value": "T1DA37238DDD599E7E03E9133828EE560C3FA5494C42C46CAE62B5F8C853FDA9C012B5BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280264, "uuid": "1dbf3e89-a221-4b5f-878d-4bc93af5d1de", "value": "49152:mlARElARXlARqlARslARXlARhlARllAR0lAR0lAR7lAR2lARElARylARjlAR/lA2:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280264, "uuid": "241c1c04-43a9-488b-8d4e-9dcf2f46d11c", "value": 23684335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280264, "uuid": "9efa6a98-62d3-4c00-9611-ad2ac48d7c32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280264, "uuid": "856cacdb-93df-449c-9413-3cc0d6e1fda4", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd88aaa-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283869, "uuid": "abadc63b-adc3-4159-ba22-8fecac7d1f1e", "comment": "Malware payload", "value": "e0376d2c5b8eb5d732f38b65975608dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283869, "uuid": "76a1c799-dcf2-4476-b29a-e4f48c7a88c2", "comment": "Malware payload", "value": "682538e18f9393e0db1e15346f4e141dcf1770ae7b10a81b0ae17a833b5b21a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283869, "uuid": "1f37d568-66ec-48aa-bb72-aa117b0251b0", "comment": "Malware payload", "value": "7123304f2e69a8cd9e8ed0210461779758684922", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283869, "uuid": "2fcf04a0-7c3c-40b9-bfc3-6e9d8ef9705d", "comment": "Malware payload", "value": "4e3ece232410628bdf9bd82a7319edb097a08da85785ce00c0da52f3c7578e704249cae14f22c8983271849c5a3ed985", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283869, "uuid": "f4a955b8-300f-4ce7-828d-c3dadf0355b9", "value": "T1123723530B5AAC7E1C4C47BD32B40ACDAB46B8414849A5F1BACD3C9C6BF7B24255D2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283869, "uuid": "7bba259b-8342-4d42-a8bd-72a5f2bc627a", "value": "49152:sp5jp5xp5op5Mp5Zp5Lp5wp5Fp5yp5Sp5bp5GH36t4Sp50p5sp51p5Vp5DH36t4H:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283869, "uuid": "2c896ddb-a1e5-48c3-bb34-add3aefdbe86", "value": 22643807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283869, "uuid": "26ae0fdc-0d52-4000-96d8-da5a87935161", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283869, "uuid": "d6aa2997-7110-4307-9445-547449199839", "value": "invoice-1645080830.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0ac0a8-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276080, "uuid": "7210a97e-0cd4-4b4d-bbec-497a0502e195", "comment": "Malware payload", "value": "8be530bb7b9d5da6ce59e9c6b5eaa59a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276080, "uuid": "3a57f492-b3b0-48d5-8a5d-081b7f7d3d2d", "comment": "Malware payload", "value": "6848ddeb1828084e1b9ce07b4bf414e83d8912a0a809d7059fa6a48bb5b79f1e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276080, "uuid": "d2fc2aff-8955-487e-a4d0-843f9d43c275", "comment": "Malware payload", "value": "3fcea06c704edfd17c035cbfa48dc977ace11b5b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276080, "uuid": "a0965848-cca1-497a-bf7e-2007586b9582", "comment": "Malware payload", "value": "326d23b1b760ff8fdfd09d83efb9b8b8ec1205063abfaed709af2381e29dd4ffccd877630ce6efa89360e0a0a69e70eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276080, "uuid": "4147d341-6c2b-4605-b09a-85cd7eeebfd3", "value": "T18C37234ECDDC9C1F6ECC121F222A8E4F6EF1DA421977D99423D4AC8BA7AD155348E312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276080, "uuid": "0a1e9ceb-022f-4530-b796-253e483a5012", "value": "49152:VKtKfKfKBKoKiKzK+K9K5K4KR11KrKxKUKAKL1EK8KtKZKJKRKAKjKEKJKvKXKQJ:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276080, "uuid": "281a9cb1-c295-4285-bf5d-2de6c7456b62", "value": 23684338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276080, "uuid": "ce166df4-d7e0-4b7f-b8b8-c3e4bee21f20", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276080, "uuid": "fc4eb8ef-6af2-453e-9358-a49ef0d5c484", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61de313-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277094, "uuid": "764af697-f44e-47b0-8123-7e0d7a38e1a7", "comment": "Malware payload", "value": "dfaa63a23d9574b476428984da19b7b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277094, "uuid": "cfd6382e-aff3-428d-be3b-c1fb18e33501", "comment": "Malware payload", "value": "6869bf3d0f621aa3cd853ae0871486559662ffeeb6ce509765ef71b5e2225511", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277094, "uuid": "25059f9c-199d-4285-b63f-57288b57c262", "comment": "Malware payload", "value": "29cd4c7c3e9b8d99612c771a7edc03e35205d37b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277094, "uuid": "f4eeb22f-4d62-420c-9794-a84543cfdf51", "comment": "Malware payload", "value": "8dbde8087df0a220c1502faf49758acd5962d03948b157930c39712f6bc4961da8cbaca192cf8e16112901a1802a4028", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277094, "uuid": "076c483b-0ff5-44a3-888c-ce1c214b858a", "value": "T19C372372CE9ABF1F8BF89F58106D1DDC8B9C8BD01863DA5187F03457E92CB1C12AA654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277094, "uuid": "2a4c1799-fda3-406d-a764-f4ffea435dac", "value": "49152:G9DBTd9DBTP9DBTN9DBTs9DBTM9DBTy9DBTl9DBTb9DBTL9DBT79DBTR9DBTPldj:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277094, "uuid": "7ee7ef7e-0ed2-4abd-b2e4-8bb2266ef6cc", "value": 22383682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277094, "uuid": "b008dc88-7c81-48a2-a87c-fe7388bd8949", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277094, "uuid": "ad785500-09e6-4936-8b1e-50bcf27fac41", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61622651-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777264899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264899, "uuid": "0add05dc-09ff-48a2-952c-7df02dfe8ae7", "comment": "Malware payload (NanoCore)", "value": "e4e7a6ba58c45b3e32d3cc1e383adfdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264899, "uuid": "9dbddb84-439a-429d-80a1-f3740e8ba668", "comment": "Malware payload (NanoCore)", "value": "69d57b0812969e8b61619c22196959e88b64df20f691819d565e91ec6e9d0aba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264899, "uuid": "0acd18b3-a8cf-4dcf-b70a-2cb5c35c4ebd", "comment": "Malware payload (NanoCore)", "value": "649c02fd53a015346df44a83780c3ce48fa90102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264899, "uuid": "bd4a085a-4d55-4a37-bcf7-1c1d04c0d246", "comment": "Malware payload (NanoCore)", "value": "04693d2201910bc9a64023e98b39fafcc861861671f2e16eeaa65b812380947feecb2f6e3ec52cadd9f6bbd3c804f43b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264899, "uuid": "78f5712f-b318-469b-bf50-a7576e2f8cda", "value": "T1FA14CF5677A88A2FE2DE86B9711252128379C2E399C3F3DE58D464F78F227E106071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264899, "uuid": "3a884b22-eeb2-4c52-b0a3-64f0d24d8cf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264899, "uuid": "346f34fa-0a8b-44ee-a2f2-add9cfb42cb8", "value": "6144:sLV6Bta6dtJmakIM5+0cFHkf8wa3PNMGd0j:sLV6BtpmkdrH3wKlMGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777264899, "uuid": "7b92607d-7ba1-49dd-8500-6de339ed5925", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777264899, "uuid": "5a073867-fb5b-480e-9b25-05914d3f0849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264899, "uuid": "61baecb5-24d8-49ad-8764-6c25e912216a", "value": "xxxzzratnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ddeda1-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279140, "uuid": "663aa92b-7091-4617-9d27-864c485f4aaa", "comment": "Malware payload", "value": "92e82eadfef072fd7a9e10be4dd8b172", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279140, "uuid": "b9386c36-c0a2-4af8-a891-918cdafb4e3e", "comment": "Malware payload", "value": "6a63de64537c7be75d97685abf64d05b78fdef6a6403244c5e23ff64cb26926a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279140, "uuid": "a9831fb2-0964-477b-ac32-c3d96dd5abf5", "comment": "Malware payload", "value": "37bcd04b31b7d3e4237cdff988d4697866dec5e3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279140, "uuid": "ff8cceab-1133-4c4a-9161-dad2cce8c0a9", "comment": "Malware payload", "value": "9e3aa5ad7a898b77f3e88151fbd7c92e66e795a0bca1333393cfc2330db7e96ebfdb7a53ffa37b5f15454521a004ea96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279140, "uuid": "274e1a39-e146-4901-a3e0-2f73aa876d20", "value": "T14C3723090F598E7A4A4C526D167E0D0E9DD4CC55618EF2CA39BA2CD39F2CE412CDADF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279140, "uuid": "187e8e18-644d-49bb-84a4-03c38bf8cd47", "value": "49152:lkiDFA6evpwNZRkD3jEYmRk+QpdB0DbHuq4sdkRkhRk6gRTRk3xMV9IYbPTFfegT:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279140, "uuid": "716a053f-b478-4c06-a8b4-0ea48010155b", "value": 23164062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279140, "uuid": "02f261ec-57d9-4da0-b758-e02e6bc172f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279140, "uuid": "1b3f1c6e-2d96-4440-9cbd-7f641604b1f3", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca5dcff-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276111, "uuid": "aa04e3ff-0110-4b7a-afd4-44694eb8c2f5", "comment": "Malware payload", "value": "c58ddd3ce101a52a5b5d0f0960685179", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276111, "uuid": "372db467-4fb3-4342-aeb1-446bfc1ec27f", "comment": "Malware payload", "value": "6adfd71c6502a3b3c50fcd3e141977e227d7df1fa509103282bff8d15b696f39", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276111, "uuid": "652b482f-1101-4a25-8448-cb4d6073fec4", "comment": "Malware payload", "value": "0b78adb33c897d4a7abf4aa3e0da533bb6b60204", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276111, "uuid": "e172644c-df46-4f0d-966c-a4fb28ea22e2", "comment": "Malware payload", "value": "2bc2495d83fc0a64c27d0237455b298f440f24d1f818245b4ddf844676588f17dbd2ea4d86b8924d4016ac53dc2dc0fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276111, "uuid": "aed769bb-97de-43b8-8af5-ed2cd6c4998e", "value": "T1A8372348071FFF5F5E597B98647A0E088FE8490929C91EFA23E0B13F11CEF2A5587259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276111, "uuid": "8e6cf90f-b5a9-4237-a84e-5ccc048e62ac", "value": "49152:ketGHetG/etGaetGSetGtetGPetGdetGxetGwetGPetGvetGFNNiziWetGcetGmN:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276111, "uuid": "18e75d97-9a6f-46ee-bd2a-cb7b32ee4def", "value": 23944455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276111, "uuid": "39cd182c-9a05-4d5c-93aa-2814f6ed25b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276111, "uuid": "edcb113a-7ecc-476b-88cb-a3609f715525", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c94d317-422f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777290714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777290714, "uuid": "8a8d793e-e817-4176-ba57-9aa9acdd0582", "comment": "Malware payload", "value": "dfdef93cd89e0f8977a46e6c82d41d59", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777290714, "uuid": "b71eb5ae-6e5b-454c-8993-5e531eb10660", "comment": "Malware payload", "value": "6ae26a332364a32f05616a06f7ce6eb32fd3f3fc13910b1cc27abffe642a091c", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777290714, "uuid": "abbfcc53-8725-430b-b85b-4b6c08f5af13", "comment": "Malware payload", "value": "acbb542d5610ceed7a4b1afa6d42df2d625a8d54", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777290714, "uuid": "d4ad6ed2-db4c-4173-a7dc-afc6413fa738", "comment": "Malware payload", "value": "9079576ebf6a7cf33c6acd0e947d4e2383f9df579a333f68c47c0d42293817bc90fc817281f65d1e1bf65de4ecf34934", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777290714, "uuid": "40c3b833-1bd6-45a5-9a3c-73550473960c", "value": "T1D6372333B29A643EE46E4B365972D210553BBE10AD178D2FD6F4186CCF252A03E3B617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777290714, "uuid": "5a20dc0d-b8e8-4176-b6aa-44b89473ae59", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777290714, "uuid": "434a06ac-87fc-417f-937f-8c7f94b0e095", "value": "196608:W1ZbkhAjfnPn62s8COd7tQq4OB5U0zKRlBPUwsA/FXeSnUUq:W15kihXdedY5U0zqQYuaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777290714, "uuid": "7739cdff-6a90-4506-89bc-1d107ae47f44", "value": 23469779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777290714, "uuid": "9983c89b-20d8-46fd-8c4d-2618a8754d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777290714, "uuid": "d97fd19d-a6cb-4054-bdd9-59aeb603debe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c7a751-427b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777323422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323422, "uuid": "d9a61ef8-9904-4ad5-b534-de7e06be2674", "comment": "Malware payload", "value": "d21eca746940f8e93959e2039a25216e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323422, "uuid": "7a463c72-936d-457e-87c5-59e10de84bea", "comment": "Malware payload", "value": "6d76104c70c8cc49b1b8c4e6c546e2ab1aaadb767a57d5c3daf2352f77ecc3d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323422, "uuid": "86fe2c97-2664-417b-b5fe-b83684205f53", "comment": "Malware payload", "value": "ea479e27e4b6508cecef4172db922f0e308522fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323422, "uuid": "6b0a8314-e1cb-4232-b34e-b070a3cc5e50", "comment": "Malware payload", "value": "ad421762d5662be3a41548594385df3a2acef99978dbe608b282834bad0db549243673db13789e684a65d963e658e66c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323422, "uuid": "99d13111-ccb0-43cb-b154-5977416184ce", "value": "T115084B212206C52BD56215B0592C9AAF512D6F720F7260CBB3EC3E6F7BB45C21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323422, "uuid": "b20fcbc2-a7af-45a4-b6bd-cfe7f8c81e98", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323422, "uuid": "7a5f39a1-aae5-4355-b184-da707fc673a9", "value": "98304:wr99u4kc8Hao8eRjYBU4UAir2Y5StE1PfC9g:G9upko8Rr6rug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323422, "uuid": "97e9fa16-404b-4640-802e-7f76769a3039", "value": 81800552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323422, "uuid": "63aee893-8bce-43cc-847f-774c3aff1a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323422, "uuid": "cdc0a370-0e1e-4dfc-8f3f-b14d3de1aa5f", "value": "PlagueIncEvolved.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a410ed3-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279167, "uuid": "248ec701-9ac1-4b9c-9041-2a843c7d2750", "comment": "Malware payload", "value": "473e26641c2e23a448b31dc48da4cf5d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279167, "uuid": "f62490b4-3f06-458a-b609-3ba737d59953", "comment": "Malware payload", "value": "6dd2fd36b390921e12b30fdc92085d3a29a57a069455b2a40961ac5d3107e6d6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279167, "uuid": "3812f2eb-6fab-403c-9f2c-5ae7cdd11df2", "comment": "Malware payload", "value": "25bece106a3cd931706ad1ec6a1991873fd1cb39", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279167, "uuid": "e00c632a-78e4-4932-9d9f-494a32e1ea25", "comment": "Malware payload", "value": "4e8392cdeabb5907e32f3f36bf8aefde2edbe00afcfb12a8db8830dbbd03ebf636ea501c558cb4e9a8a1d203d548519e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279167, "uuid": "8df52587-4ad7-4411-bd18-92c2f4cc6434", "value": "T1D23723591A5B5AFE07680F1C60AD0B757E644F00A0278778D653BE4AED9FF9C30AB81C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279167, "uuid": "25de77c7-52a4-4436-b278-1c309d501741", "value": "49152:pYfohYfoPYfoeYfodYfoVYfo3YfofYfoEYfosYfohYfo2YfonyYfonYfotYfoIY3:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279167, "uuid": "4ef12764-f89e-4e79-9778-76a82d8b9c1c", "value": 23424208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279167, "uuid": "7b47fa27-b1ef-4d99-a2b9-a5376f012dda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279167, "uuid": "a56665a1-56e1-4a35-bce5-6b303c81ae6f", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db400703-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279277, "uuid": "923dc915-540a-4596-93c2-3052f5d3a2a2", "comment": "Malware payload", "value": "d89fc278000d5f28d39585f6a9bdc293", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279277, "uuid": "f2321f45-ea1a-406b-9efd-085d99f405f9", "comment": "Malware payload", "value": "70b586575d622a328c0a570b86c79e6763ead42c831cd1f7029815f69480ebe9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279277, "uuid": "ecfc5365-5fca-4013-a78d-71aa56022835", "comment": "Malware payload", "value": "a59cee87dfbfbd222641c45315c3a95f8a3daa0b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279277, "uuid": "56825330-4816-4f49-b6d8-a0303a6822bd", "comment": "Malware payload", "value": "1701fff12fc41a05d6ffcaf0c2bb04dd0bab7cdda409b035817d83570a4c0c882a469e79ca59c491ea69f4411bc9491b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279277, "uuid": "e17f8166-a979-4fd3-a24c-72a225648d01", "value": "T10B11B523D2398D5ADC680FB9A50294D4FDA6249C9838261F8C62913C098729D9BB1693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279277, "uuid": "dba1cfe9-3f8c-464c-ab7d-e2806c3bb924", "value": "24:9PQrwWvixbYxCay2GOhcWBb58EMlTR3xt3QDEMs9gN8MSPTF5mPGAQM+K5mXn:9Lxg59YZR3xlAEMsIUputAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279277, "uuid": "c7db3d68-8920-430c-b641-1bd97d351b8b", "value": 1070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279277, "uuid": "1078b902-44d4-46bc-8180-7eaab6f94e93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279277, "uuid": "72aba2a8-5689-45b3-89c0-6ac71c422db6", "value": "Assessment Letter.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bce321-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302598, "uuid": "6c3164cd-48f2-4a61-8ebf-00cdf81a5e14", "comment": "Malware payload (AgentTesla)", "value": "9b7346e801182d672e7e6c4ce4ba92fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302598, "uuid": "691f943e-bda0-41fe-8a55-8b1b20f89565", "comment": "Malware payload (AgentTesla)", "value": "70c806ce9982d8a6388732348919cd5cb0e74b5f6534966d639c2bd73735e88f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302598, "uuid": "f95b8202-8f79-4c5f-b626-3a3f065e326a", "comment": "Malware payload (AgentTesla)", "value": "5bfa8d3d823f938b8241fcdc3a9a178ec0401284", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302598, "uuid": "dbd35073-3f9c-40da-94d4-125b0f36ced5", "comment": "Malware payload (AgentTesla)", "value": "4fcd961f2141c1f1f1f0765fbf36fecf824f9aa20503f4f0f217facf5b55eba19c3565989897164b6f8dd9f6ccb0c877", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302598, "uuid": "002a404e-4460-4630-9666-6eea837df17b", "value": "T1F0252364AE863FE5436EC62DB99FBD0D3E7A0D29484930E5BB18F0C60F94720E5475AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302598, "uuid": "5da23b64-e6ad-4fef-ba0c-fd0f007c8226", "value": "24576:VHK1a6TGEaqVGJmsXCkYredyc4TZbzzN38dLpr/dGzxdlf0K:U13TMJmm76TdzzqNGF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302598, "uuid": "ca462a4c-444d-48fe-9d4a-5d88c5d59507", "value": 1037172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302598, "uuid": "7ab6e046-be9c-4afd-b604-6687618eca82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302598, "uuid": "5d5be79b-f3f6-4f87-b916-bd4fa7a66fe9", "value": "ps_e73dLpMdV3PU_1776240684920.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e1945c-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283727, "uuid": "3cc5131d-4f6d-4bd8-bb93-6f0712bfe106", "comment": "Malware payload", "value": "f23319438f62c3b1b35068e5e04aa3f2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283727, "uuid": "640599ed-5027-41bd-802c-f55ad95403c0", "comment": "Malware payload", "value": "710cbe824bef927d338b94eeeb4c630e20b66bc28c641f2478f425423e87da8f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283727, "uuid": "381520d7-7800-40ab-9d1a-238fd9076758", "comment": "Malware payload", "value": "97d0eb4fecf7b5b81c1e4180cb54c280485ee89f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283727, "uuid": "3c02610f-4830-4bef-ad66-cc16a80cfa97", "comment": "Malware payload", "value": "9cca0edf3bf02015806e7e73fdbf96fbea6e6d200fb03e2d08825aafc2f315f0a16bf061d8505df9b0a5466e9a3a040a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283727, "uuid": "11b886d4-3e08-4448-a6d4-e27cd5f738a0", "value": "T10837230F08BDA63CE48412D86A3F5E5B1B826EF34766EF3257936C77941F928119B384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283727, "uuid": "ce193b34-7c81-4c76-9c7d-94c0b8772229", "value": "49152:b3P3P3h3I3O3c3t3Q3T3n323q63S3H3l3p3xX3E3E3Q3F343J3r3V3g3y383k3/4:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283727, "uuid": "8bd907c1-23eb-45e6-bf2f-44bacfd76da4", "value": 24204592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283727, "uuid": "6c85ba00-ce6c-43bb-bf70-b6b68160fea0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283727, "uuid": "f7400133-e3dc-48eb-9b5e-3d07e544ab68", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75ee36d-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283941, "uuid": "44511b4f-2ab2-4eb6-b87b-b059818917f4", "comment": "Malware payload", "value": "5127bb47a1c635f14ee9a69ccf12eb1c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283941, "uuid": "557376d8-114c-47bd-a09d-5c1d90fb4a82", "comment": "Malware payload", "value": "71725d5fadf3c08cd01b0b5a6f42ed8984b39e4ed6eb2c1c5ba7e86febf98b05", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283941, "uuid": "b1727793-ded5-4738-90de-0cfc6571059c", "comment": "Malware payload", "value": "bed214f6ee2a1ceafc0fd2dc60e9ff56c7e2c971", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283941, "uuid": "ba9fdd79-4943-4132-9234-d56119747685", "comment": "Malware payload", "value": "77280a2b99f1e7602f245776495aa818fa9a8d8470a04321bf058628ffe2c4f733353813d2c4cc9533f0420f1d37eeaa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283941, "uuid": "5d859970-feec-4e26-8f2c-8990e5a8a410", "value": "T1A23723EBEB6C651788B9221D50EF4E0F75DCCA448C6376E5D390F91D2E9ED00CA9A078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283941, "uuid": "114fb32b-10fa-4ab2-a13f-bddef22dc85e", "value": "49152:0f2af2ff2Hf2Hf26f28f2uf2uf25f20f2kf250of2uf2Lf27f2nf2I0jf2cf24f7:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283941, "uuid": "6950aa2c-2dee-42ae-84de-4ec573aebfb8", "value": 23164088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283941, "uuid": "f31f7163-ec26-46aa-ba22-1186e73054b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283941, "uuid": "0535514a-98b1-48c7-a307-b2ad829d7680", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620c27b0-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279503, "uuid": "ce26f19a-0801-4f62-a614-7791e247e3ff", "comment": "Malware payload", "value": "1d6b1fc04f9af2ded52257a146248727", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279503, "uuid": "4176f440-e20a-4828-8e8c-cd445203c80b", "comment": "Malware payload", "value": "71c1428ead08613205d462f59d893a2bce2dcab4e1b3833519fb97923715f83d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279503, "uuid": "9ebae523-78c8-422d-b936-60dbaa6f4594", "comment": "Malware payload", "value": "b8cb9675ac561d6d921ad01c9d65aed599c6f129", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279503, "uuid": "3314b6ee-16b3-4a29-b298-eafbf7f6cee6", "comment": "Malware payload", "value": "0c7776836810b33236b3b38570caaa1eb8bab7d3373530cdc5b95a04de78474c9d17c03c9de2c43508a219b211a18cfd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279503, "uuid": "f3d35691-66ee-4157-b1d4-fa79c1b4980a", "value": "T10537230E4A6D8E7FEA9A35C810BB175F4C744758C2C5EEF016D2FD2EB4CAE18059D268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279503, "uuid": "38dece90-3bf1-439f-95f1-1b90b1ae3baf", "value": "49152:+JQsJQ0JQ9JQrJQuJQYJQZJQCJQjJQHJQ4JQOzGJQdJQXJQOJQOJQfzfJQMJQ2Jh:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279503, "uuid": "56338c30-1d6a-460d-a445-b8a5c355e329", "value": 22383682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279503, "uuid": "345b9d25-448a-4b12-98d1-5f38c52d4528", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279503, "uuid": "6c163069-09f7-4f21-ad63-fc52a08e6599", "value": "invoice-1645080830.pdf (59).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f330af2-41fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777269646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269646, "uuid": "d904f4c5-8d1b-43d3-bb6f-ba7e2dc18776", "comment": "Malware payload (Mirai)", "value": "3cc68d9a150bed85aba396172209d482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269646, "uuid": "c474379f-3605-434d-8a8c-04e39dd7d5b6", "comment": "Malware payload (Mirai)", "value": "72cced9b9801ac98c0036ba08401769c37614c99698be9fee1b60647cf6e9133", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269646, "uuid": "039235da-b4b7-4266-a3c0-63a4498758e5", "comment": "Malware payload (Mirai)", "value": "7312371a62fa0cc86c760a93b4265abd313975a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777269646, "uuid": "db44df38-bd9d-4bab-acc3-d3311dab0c55", "comment": "Malware payload (Mirai)", "value": "14d8c7d5ab7a4ff0ce24897c37a8b964936603aefe4600da3621f32fd46514504463234a6f69f8fd704c32dcb97be5cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777269646, "uuid": "7a0ecd59-cb12-4ade-8866-6d3f69054aba", "value": "T1D2146D46BF541EDBC05ECE318A6F932313EAD8C65396B73B606C9D5C395B2890DC3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777269646, "uuid": "734f6a1a-b95c-466b-b269-66669adce20b", "value": "6144:RHEdThugXKvRZovNF+NjS0ZWAytJQeFR/GlspRQR:RJqDqspR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777269646, "uuid": "89a4802c-362d-4ef6-974b-938a7f7fc362", "value": 207640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777269646, "uuid": "96860958-7a85-4a63-a2ea-3c35c9bc7329", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777269646, "uuid": "a8b2aa59-0de6-474b-a86f-8739bec68000", "value": "agent_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6daab1-4228-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777287868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287868, "uuid": "2e1b4523-7409-4c47-b11f-78bd619c544b", "comment": "Malware payload", "value": "b531927f303aed4fa98c9e42b9c5eca7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287868, "uuid": "bbff4304-8821-4cba-8b41-0db33f050b53", "comment": "Malware payload", "value": "731c9bfeb6816b6acb79cabf7edfeee3b7177c5f3dc76803c5907d7bf8cee808", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287868, "uuid": "43f3cf32-ecc7-460e-97f6-d3fb2c533460", "comment": "Malware payload", "value": "a176fce8809d0d75f6fb02dfc237e35884881502", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287868, "uuid": "8a80441f-2cd2-4353-815a-4ad59e695d6b", "comment": "Malware payload", "value": "f35780b079290e07ae3837f94705a158b7dc304b767ada0d227361812a5f9dc9c2ffef5c2416329186ccf75c359bfd77", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287868, "uuid": "8811577b-8043-4f52-b622-375b7443215a", "value": "T101953A57BCA148F5C0AE9632896691927A61BC440F3263D73F90F37C2F72BD46AB9704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287868, "uuid": "744d8266-c934-4073-9aee-e897ed77f069", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287868, "uuid": "a94563fd-26c6-4127-83c7-b1b4ca4c3119", "value": "24576:Z4y1hwX1lq45EmNvAGwDkIvgoBzfWgJnQsnnjy+qR7T6zyv:RwX7q45ZNvA5k6oP+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777287868, "uuid": "d59b2afc-fe49-4787-adcb-41af6cb1e285", "value": 1943552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777287868, "uuid": "0c899cac-6d6c-4b08-8eb6-6497a2877a54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287868, "uuid": "a33cb69d-dd66-452a-9e94-1781df96ab74", "value": "da_shell_39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3849d94-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279290, "uuid": "1f58619e-0578-4a01-956e-a8c72123842a", "comment": "Malware payload", "value": "fc761d4aa418fac22f3464bdeaf83947", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279290, "uuid": "a0a13595-88c7-49d0-a52b-67051692c2cd", "comment": "Malware payload", "value": "732eb152332098742f79c672d601d7beecce4448ed655b7c7755c1fccd06c22f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279290, "uuid": "98bbda29-e1cc-442b-a4b3-84aa19e6f713", "comment": "Malware payload", "value": "150149d8e67e1a3c608e0d648ce5431e45a7ad0e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279290, "uuid": "068b8eec-29e9-47de-b279-82361c8430dd", "comment": "Malware payload", "value": "439f732275e544f29e61fd62a5fab4b1405c7f950b2cece0835118d8b9243592c962ecb94e55cc8931a210a6e70b779c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279290, "uuid": "e6673f6d-7e7e-4912-9f7b-b43d12519c23", "value": "T1BE3723468C068D1B51B0535C317E0B6DAD758E5B4835FB8C6796F88CCD2EFDAA18B0AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279290, "uuid": "b96c415c-5104-42a8-bf6a-48ac64fa6937", "value": "49152:H636g616S6g6y6V6f6r6T6B68LAnx6i6i6v6/66LAni6H6c606q696J6Y66656Tf:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279290, "uuid": "fe301043-2743-49b9-bef5-a137919623dc", "value": 22903944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279290, "uuid": "2cf3e69f-f47f-4e08-b54c-cda86c32175f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279290, "uuid": "e7263e1e-768e-479b-82df-010e34d09456", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635a64c6-41d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777250299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250299, "uuid": "43342931-4c74-4696-a65b-df48770135cd", "comment": "Malware payload (Mirai)", "value": "71e0cd414f826507fa3a2e4713c0ba7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250299, "uuid": "effdcb88-2b07-4707-ad8c-0355c9cd094e", "comment": "Malware payload (Mirai)", "value": "7345a2c98e6a1464da3c9dd45d14ad3a599208595161b73b4c98d7ce0440dde5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250299, "uuid": "6d766340-902c-4d0a-8968-d869b1ad985c", "comment": "Malware payload (Mirai)", "value": "f9222512008698b9cbbbb45e76013c7dac056468", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250299, "uuid": "75418b8f-5da8-4dcc-8db7-4d52c342ef23", "comment": "Malware payload (Mirai)", "value": "cda1084443ae2ec0486c7b05b50229e79a40e9e0cef26c2b80b323bc1fd9b35db9307633c5f37b1fbdea717a42a67cbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250299, "uuid": "1f93b0dd-05c4-44e1-bd9a-3fd59d942635", "value": "T1D0E44B56F8809F62C5D1257AFA5F82A8331347B8C3DB720689199B343BD786F4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250299, "uuid": "8b52fb86-b9f4-4ecc-9fd8-da4f7d765c07", "value": "12288:SOVQcYoWPf0cYM1WLTHT/ImwdMoZwDZlgpkItq1/ziPd4lqZ:SOeoWPfNYZHcmcMow96kBzi14lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250299, "uuid": "53dd7276-46be-47e0-9d24-4867db6b9165", "value": 667600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250299, "uuid": "49540d2b-1a8c-41d9-853f-d4f05732f5d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250299, "uuid": "362ffcfa-3392-4f5d-a68c-853c747a58c2", "value": "SecuriteInfo.com.Heur.16414.13103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ea24e5-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280504, "uuid": "f58e02b1-1149-498d-84e3-329ebeda392f", "comment": "Malware payload", "value": "b9ba3336ca936fc4501e38764e3e4b4a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280504, "uuid": "05f5e8b9-cdfb-4f61-a147-2a2a2acb7f25", "comment": "Malware payload", "value": "7395beb41908ac1ac61f1f9971136ac27530b141aaf9212d095e435b321b14a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280504, "uuid": "0ee946ae-b21b-4f4c-afad-89d90203c1bd", "comment": "Malware payload", "value": "3aebf4b503727a986d9fcb76528a044ba6d1a568", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280504, "uuid": "90fd8b73-ea20-4dd7-b6b7-4dbb212aadd1", "comment": "Malware payload", "value": "eb8528fe7a67d4aa4cb77c73d2318f9055c94bf48ef1bcfd52eaba84ef2d313e65b8b7439294fb37e8ee3347a470c6ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280504, "uuid": "d022d100-ddd6-4f40-bf06-e501e16814f1", "value": "T1713723528AFD9D3B08FC775E5092276532A5AE2C8241F4DB43D7645B2D0EB700BEB2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280504, "uuid": "2c32e12b-733e-406f-b5bf-8dceb53b65d5", "value": "49152:v+Z9+ZU+ZO+ZL+Zx+ZP+Zd+Zp+Z0+Z/+ZT+ZsNhrs+Zu+ZQ+ZR+ZN+Z9NhrB+ZDD:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280504, "uuid": "a13b5e27-918d-4f68-b86f-8828cb19ed38", "value": 22383698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280504, "uuid": "f627d181-7727-4c00-bc82-f345dcac0762", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280504, "uuid": "5cf390c4-4bff-4cfc-be92-ff6630932af7", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2a3e3a-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276651, "uuid": "820836bd-f7b8-4f84-8632-6b2740da4bec", "comment": "Malware payload", "value": "ab76554152398e8d66bdf1239df8cf3c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276651, "uuid": "1456574f-028c-4856-9e1f-0b89427edee7", "comment": "Malware payload", "value": "73d4fd2bb3f4832c9403e648e5a390934c4709f4d0805643022ecfa857df326e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276651, "uuid": "1ee579ea-13b4-40fb-8359-d90e0d6780a3", "comment": "Malware payload", "value": "27e55c846f85b6266afc37ed19ae7f3c0403fedf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276651, "uuid": "b89fd21e-63b8-4cc7-8df7-0063ba614398", "comment": "Malware payload", "value": "4b0f11f3aed14666c2586de766363093e107ace5b54ae844db1a35cdef36d8d8a68721340b44547452bb23486b289dfa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276651, "uuid": "c071ad6a-3d74-464a-8556-a5fef4c5c500", "value": "T13037232D1B7BCF5E9548221C34FA0B0F6AB64D4D11293EEFA877E62A5E7EF112007509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276651, "uuid": "1b8f2673-6382-4e49-a932-23819de9837a", "value": "49152:9Z7eNZ7eWZ7eYZ7eWZ7eBZ7eHZ7e7Z7e/Z7eyZ7eBZ7elZ7ePvJ3KYYZ7eqZ7ez3:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276651, "uuid": "906f0312-529a-4f3f-951d-389d2053e1e9", "value": 23164059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276651, "uuid": "73b96083-4fd6-4471-ab2d-48da149198e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276651, "uuid": "a79bf52d-2b4c-4b1c-91ec-220da3c1c90b", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3112f2-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302583, "uuid": "f085770b-c30a-4eab-8525-88add9a6c7ca", "comment": "Malware payload (AgentTesla)", "value": "71a977d5b33f85519654828a104888b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302583, "uuid": "84f430b4-71b7-425e-9ed1-133121d49ce6", "comment": "Malware payload (AgentTesla)", "value": "7459fa57994fec5feaf7b3b2af8d38309777dcace1784bb3b17e23212f00cd9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302583, "uuid": "da81638e-e93e-4a0d-9717-81336ed779c7", "comment": "Malware payload (AgentTesla)", "value": "7502829f486997e2d2003c9ff975ca32a4d67f03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302583, "uuid": "86b3aa86-9677-4917-818b-d95d7807b424", "comment": "Malware payload (AgentTesla)", "value": "fe32d005e1fcc7e1ab9b85b4a0d8733e023c6be49717f41ec0eb002b23e24a52f2dc70cdf413be2c427456a30751a9f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302583, "uuid": "043445a6-9db5-4582-964d-40a6802511b8", "value": "T1232533A27EDD98FAC1B5923D623AFF975B717BB34C96884A125110C02E2DF4503EB1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302583, "uuid": "a7af4a74-0b71-4a43-b622-f523d11c1258", "value": "12288:TrbtuQCSa6EYsPJOr5/9Q8M9r6IN06pL5Ua/7GER69/k/AT9OX71LmWfXP+SHBRa:fd7K0r5Vq/yIVL/ATUXhLx+SjBRcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302583, "uuid": "0f82f087-205e-42c0-bcab-90ba4011b7b4", "value": 1037197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302583, "uuid": "78284501-26e9-4017-a89a-cd04912b505c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302583, "uuid": "1396c372-6f59-47ad-b69f-6fe14ab0d135", "value": "ps_du7kYAULa1bq_1776239905794.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ad4b75-41fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777268797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268797, "uuid": "ada0e1b0-5b00-4544-842c-39f8200875ee", "comment": "Malware payload (Mirai)", "value": "7e77aa2caaca732f6c2ac8be9c9bfafc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268797, "uuid": "e22bf008-5c3f-42a5-be53-dba41a46d131", "comment": "Malware payload (Mirai)", "value": "7486fef819f0896ebfa563d95d1fc10158c1ef204f645101cc39b5b743dc8891", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268797, "uuid": "7820795f-4e09-4b69-b342-6ca1c6062ca4", "comment": "Malware payload (Mirai)", "value": "32929b85381f49d659cfe2bf8cbe0188c5886906", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268797, "uuid": "82a7920f-7c05-447b-b351-fe164871a69a", "comment": "Malware payload (Mirai)", "value": "5c5f0eaf7762209c841d9405448f75c9713b799c6661292b36d47e90897c864d2a4858e48b9cdfc6d3ed9ded0d73534c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268797, "uuid": "1eb01989-d2b7-4a5d-bd30-de8559541bef", "value": "T108A43A65BC419B51D6D06ABEFF6E828933132BB8F3DE7112DD055B3067CB84A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268797, "uuid": "d59665e9-8726-44ee-8f21-cd4a735707f4", "value": "12288:roM6/fFJM8KBPHHZJoiiMGSUix6kD1z6oP5LqpT+UDE33OQaYoe+apV6kEv0UQ90:esN96K5MDCeQ+/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777268797, "uuid": "7c91e9b3-ea7f-41fa-8daf-5ceb8f42c223", "value": 457824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777268797, "uuid": "6c61ca5c-226d-4392-93de-419b1ff572d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268797, "uuid": "0ae04725-56ba-4273-9a1c-48b0141dbad9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb045292-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276216, "uuid": "61b51de3-dc4f-4662-ac15-2e7d60941d7c", "comment": "Malware payload", "value": "29e00cb748de09537abf010da66e2e90", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276216, "uuid": "13c208a4-01da-46db-a45c-a1ba9b8847db", "comment": "Malware payload", "value": "74da128998f9058f6ba83ee2881dac5ea2422ff31169dff3cbafdf1104c7d182", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276216, "uuid": "03787284-63a7-4121-8522-261cfea46148", "comment": "Malware payload", "value": "241c6e2ae882fd060581f7206dfa57f5eee92e44", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276216, "uuid": "dcad6f64-690e-476f-84c2-2d46eaf58ed8", "comment": "Malware payload", "value": "7400c9dd6760af6ee33e00e1619d4d811a7a09a9988a98b8bff28de698a54e59ed0d91bb74ee100b42255024080c5265", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276216, "uuid": "4cac5dfc-1a68-41f6-8518-bc0e6c84915c", "value": "T13D3723604F344D3E42ED3B6C10DE0F9A13C15F780624D3D29AC9E8E9F8ADA53266759E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276216, "uuid": "253fae6d-6347-4d30-8ca8-f9bd7953c2ef", "value": "49152:z3fSyF/LLkJtT9QWnZNI9Zcl45kJYbGiQ9D19G9ZH9+9k4TiCvvgEEIU9kaYa4Wl:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276216, "uuid": "d3e12ba3-a6bd-41f1-b719-c4d50c6f41be", "value": 22643820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276216, "uuid": "274406a1-a336-4950-b917-63d19e4f7d39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276216, "uuid": "27075692-ebd5-4022-803e-cf8d365f2373", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887ae9e9-4237-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777294170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294170, "uuid": "dde5aa0f-e799-4613-a919-b93e525fce1e", "comment": "Malware payload (Mirai)", "value": "e2525b35e835b43c4476e8fb5e7b240e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294170, "uuid": "6fd8cef2-6e00-4b0c-868a-9eb987a41139", "comment": "Malware payload (Mirai)", "value": "74dee1d4e1e16a440ef9eab13b946dcf00f66f8010ba3f3b0c8569db45dfba03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294170, "uuid": "c597ba05-f77f-4f75-a882-45af6b4c8253", "comment": "Malware payload (Mirai)", "value": "92ec4494fd8a6a066145ee9354026cea6e747745", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294170, "uuid": "1577f32b-fa3f-4e59-825f-037da57b9e8b", "comment": "Malware payload (Mirai)", "value": "f8b79e7f3bc2fc421531bcf327a84613553a21731e9403c303488f047853784f9b35285675d6feaa1df451d768faf408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294170, "uuid": "cfb8fcb2-bb49-4549-a630-3a5e87345ec0", "value": "T1B623F12770119722DC7027B5AD6881C7AFB34F26E6CE369014346F94150DCA79BBEBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294170, "uuid": "a92ca7d6-5d1c-4e5a-942e-400d8468abcf", "value": "768:jcqV15gtPl8Hwmja90gQ81/qS8dnokw3rL1WPOfQbGwuaZiuHcgNvyWqlE6u4OXk:QqfOtt/meig9lqpKrrL1WPqQbhAqp365", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294170, "uuid": "a3ba3682-4686-4884-b580-8511f64ae280", "value": 49092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294170, "uuid": "25311d37-621a-456d-b4eb-eb014cdd57dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294170, "uuid": "ce5c3b74-4c1d-402a-a648-86117472dfd4", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb50eb5-4294-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777333963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333963, "uuid": "6cddac59-cc35-4c2e-895b-78b683de4c6a", "comment": "Malware payload (Mirai)", "value": "84f45932a72b06c345019ebe4759a379", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333963, "uuid": "3faba833-8aa2-46ff-af60-598c084175ce", "comment": "Malware payload (Mirai)", "value": "75249e8467f738030d84473d29458b46f8a58f093a8035614e6c14d62238cd5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333963, "uuid": "50e8f6a0-89b3-41bf-b73b-df00599a3bda", "comment": "Malware payload (Mirai)", "value": "10d8337f2f191b2d57eae161d90536d8d47c8995", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333963, "uuid": "fe781140-3395-4e7d-8a6e-d878c5b16a6e", "comment": "Malware payload (Mirai)", "value": "474de4db33c880330d8377665f5cd3be1e34082eed31cb26e59f53834e84bc6c590e7ccb08d677057d6cf8390f1c20f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333963, "uuid": "20ea3992-0611-409f-b156-9545b2dbd0a2", "value": "T1F1159D2EB2B3B0BCE017C03447DBCAB25535B47522212DBB26C5DB353D6ADA11769B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333963, "uuid": "279bfbc4-a1e6-40fc-b1b9-4f3c3fe5f7b6", "value": "24576:uUqaNgGkfWsBsDQHJsPPPPPPPPPPPPPPPPPPPPRP/PPPPPPPPPPPPPPPPPPPPPPW:uLaNgG5sYQpsPPPPPPPPPPPPPPPPPPPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777333963, "uuid": "cdaa2be4-4e74-4ce7-ab5f-31939ba21701", "value": 911624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777333963, "uuid": "fcbb95b8-3b66-4884-b1bc-b3e577f5fcc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333963, "uuid": "efef663b-3a71-41a1-b7d5-df55ba426976", "value": "agent_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92537811-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284308, "uuid": "cfcd93dc-e90a-42d0-81ed-4f74e9b8bff2", "comment": "Malware payload", "value": "3cc7f5a9c093edac3958d507ff1d335a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284308, "uuid": "bbbc36c4-d586-489e-9f05-a9ae43c38c6a", "comment": "Malware payload", "value": "7545ce5cda4913bd5d8b585195ffe8839b10ea9dac89b293d9d169f2ea815878", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284308, "uuid": "f78d4ee1-0ba6-44c7-a6df-648f20c42198", "comment": "Malware payload", "value": "6f710ca50feae0e478fad97b77814938d8594636", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284308, "uuid": "47f46882-7610-492e-bb1b-50a8af65c285", "comment": "Malware payload", "value": "aad8414086f221c8817b9eb45edb4cbab774357d4699f635352d53b53ef37ef9ad58f5ccef37dea324482b4d24328c84", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284308, "uuid": "f7c831f9-3e4a-42f6-ab9e-df391dc5f5fa", "value": "T1FC37236A4DD98FB46B95939E08EF0ECF33B2A9D5405E7EC9D320F046C8DEE6502A5311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284308, "uuid": "3c15d4f4-3b08-4db0-8a3d-f62f58ce50da", "value": "49152:r+Qrm+QrG+Qr3+QrT+Qru+Qrk+Qrv+Qr2+Qrd+Qrd+Qrw+Qrn3dtp+Qrg+Qrb+Q0:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284308, "uuid": "208d0993-1569-4d7b-a8bb-1b2d9e5e3292", "value": 23684340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284308, "uuid": "16782fd0-cb9d-49bc-b002-23ef7801f1d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284308, "uuid": "f3fbcfdc-e56b-4776-8a30-937e7bc1ecc3", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f5d972-41e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777258818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258818, "uuid": "0c90f241-942f-496a-ac9e-182f556efeb1", "comment": "Malware payload (Formbook)", "value": "f9bb8a5477c9f047bccd2158cb4968c3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258818, "uuid": "88547f19-4eaa-4a7d-a016-5180a3e990c5", "comment": "Malware payload (Formbook)", "value": "759066f9c70d498ba50b2716b7a4415fe9a4402405f9a0a95309389af6b8089b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258818, "uuid": "9211e4d7-fe5a-4ff1-a281-dda3bb715747", "comment": "Malware payload (Formbook)", "value": "da78240cb2a17ee41e101cc0c6e3fbc86bbb5be6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258818, "uuid": "4a8a5347-8ebb-4584-ab4f-0cd7d30fd4c6", "comment": "Malware payload (Formbook)", "value": "a2cfb8eb3c8b88d9cd58854859db0ca037ae42ee6dd5018e9115bf8242cc925a488e1c5e8eb2f63dd5082b28303b54e7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258818, "uuid": "54fcf56a-293c-47b6-821a-cc4322498be2", "value": "T1FF1438365BFB8016F2F28A0EA631602A653F7EDB3B5B441D24B90BCD0BB1198D0D5B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258818, "uuid": "80228dfa-dab5-4fff-bb4d-f6bc067c302c", "value": "6144:FyAyXgkiac0XF5WpMcefEfNDOxEsioxbzAcwjgflj:FyAywkxc0XGefEfdOxEsioxbuMfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777258818, "uuid": "67de2e1f-409c-4a3a-9254-9aa68d7e0191", "value": 204788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777258818, "uuid": "539f78bc-499a-4e75-8f2c-d0f567bb0c97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258818, "uuid": "042ec50b-916e-4b5a-9ffe-e6945f949140", "value": "rWhatsAppImage2026-04-27at10_26_45AM.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d4f81e-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285193, "uuid": "3ccfc03b-6879-4bd7-8409-35b54ef4e2d6", "comment": "Malware payload (Mirai)", "value": "084765edfa026688297fe4d7b15fdeb8", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285193, "uuid": "6dbf47d4-3030-4db9-8905-5e537a72065d", "comment": "Malware payload (Mirai)", "value": "75a2e1b81470f16ea7b75ba028eeefcd2db251dc7b16154694979cd801a35210", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285193, "uuid": "b334cafd-96bc-4b7e-8e03-9e748be9db51", "comment": "Malware payload (Mirai)", "value": "bd743e8947c244fa90a0d4e2cf815d20cd8ed292", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285193, "uuid": "8b100a67-9544-44cd-a53f-109ff57f1562", "comment": "Malware payload (Mirai)", "value": "1be115a9d5c81bb69b901582d2991fa45922196457d0238de2854c5b2bfde23bcf7ba76e36d82b51718d8e062dd78f99", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285193, "uuid": "49b1f4ad-0ee0-41d9-90c3-90aab20ebf24", "value": "T125C4BF53F2619ECBC12E4A70003DE230874BE6921723B580FA7AD3552D735AAFE5D7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285193, "uuid": "a669813f-b88b-4342-ab10-f102e5a9c92f", "value": "12288:9VYY2lDscs0UrCnrdSDNntRPMyzjre4rFHlS8pRHQVAx:4JrdIpMyzT7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285193, "uuid": "d614f58a-4409-45f4-9328-613bf103e4d6", "value": 584416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285193, "uuid": "8aa12d94-2000-4671-8288-847517573fae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285193, "uuid": "883c01fc-2795-4e7d-8946-8cdf2c948a24", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d0610f-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277068, "uuid": "f21d14c7-c3d2-4007-aa8c-be4528a773f4", "comment": "Malware payload", "value": "5aa0cc5ad36f85bcf1d617667ebc4a22", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277068, "uuid": "b4f62f15-d2fe-4f6a-a89f-434096c54c29", "comment": "Malware payload", "value": "75f3d3b30c94b1da1b26c5841af9fdfa2cddcd1b65818f17fc9037016523d82b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277068, "uuid": "b9548731-f218-4ee0-b047-705c7ca97093", "comment": "Malware payload", "value": "fb6d6767542f702836cf7725677b92700fb85d00", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277068, "uuid": "4df88350-574e-4040-9857-a4c624f936a8", "comment": "Malware payload", "value": "a37fc563fd5ca76636a9ce0c2f6baa2020e8723283263f2f56a1de8468220e9410c40890f6d387ca9c060ac090b14a29", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277068, "uuid": "de5b2d97-d787-4645-9258-5b5830ca6858", "value": "T1763723439B6EFA3FC7F81514082F4A018FA7AC154E8C88F55BCA99B953FF9151036A1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277068, "uuid": "b989969b-a27a-413e-8546-9e073d17c248", "value": "49152:CKtKyKEKfKrKxK1KJKeKjKXKeFVK0K8K7K/KkF4KKKGKOKBKiKcKBKXKyKEKcK4g:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277068, "uuid": "9abc896e-ee42-4d25-8e30-4d7b7c5d54e2", "value": 23684330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277068, "uuid": "55f86090-e333-45e8-9511-3a7cb816bdd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277068, "uuid": "3adfc509-d501-41db-bb9e-d876bff3e04b", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3090f731-423d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777296600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296600, "uuid": "bd036940-3f2f-4ef0-95ed-6334c2687da1", "comment": "Malware payload (Mirai)", "value": "44714178310744109b82def581d49da3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296600, "uuid": "7d8d1bad-d963-4174-b839-3060ea1de111", "comment": "Malware payload (Mirai)", "value": "76e434c93664e5e1f3e7582742e044ba0f3b2b887763778c7de9360f501c627a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296600, "uuid": "2a37098c-1761-4228-a7c3-3d27f00a7ac5", "comment": "Malware payload (Mirai)", "value": "77009d268a548110e688fc11e7919fd8c44ee37c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296600, "uuid": "e1c97123-fb8d-4abb-83ab-2c91d4872793", "comment": "Malware payload (Mirai)", "value": "21f51f329db9236f42020490cbbee1458022dcb67f21d95c7a4cf25f88fe934ad325fe025a663976f8536878c6c0202d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296600, "uuid": "b920a22c-1608-4d46-9cba-cc03c0b7a11d", "value": "T10C4301CEF2E88C4BDB5C3C7C61161AA44B82705A6BB3670A93234851BD61459F8EFC7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296600, "uuid": "fe657e6a-5133-47bd-8cc7-983e421ae983", "value": "768:I0puVyk1AQXc6xPpkOI41VeRthkG7tmVyjyn1LlHI1PspxtXsEYbxPJA8uWI:IHnJcQUhkqtDmn1RcPsFf6P+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777296600, "uuid": "c557625b-d796-4079-a821-ded52e7eed32", "value": 56556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777296600, "uuid": "b53ae699-6981-4c55-b9ec-be4728f8aa74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296600, "uuid": "cb246173-a8aa-4eae-8bc0-f2bbb6361ea6", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c191ae4-427c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777323758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323758, "uuid": "fe9040e9-bfe8-4b1d-a288-25aa5b6a00a6", "comment": "Malware payload", "value": "924c74a4248311a6cdb8e2cfbfa70258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323758, "uuid": "44495e49-fcf2-4f14-8b61-b910af388d48", "comment": "Malware payload", "value": "773e728489a7e568594107b7697f87fde0b9d9f0b9ef403e8de22df30e4f968b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323758, "uuid": "9fea9c85-33b6-4624-b090-653adeb33f40", "comment": "Malware payload", "value": "359db1a83248053f8433167db2e0df50ce76d1aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323758, "uuid": "10c8c439-5357-47c9-8b98-52295c723bfc", "comment": "Malware payload", "value": "c8f932bfa94e389d366758f73a98ab02eeab693493ae95b39db9c23f4f96227cbfe1c4ea2c36937ac0b46a0a7bec0c25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323758, "uuid": "341582cf-1054-41da-bf72-8b5224936239", "value": "T1E6329782E842455BC7C053FB973F9BCC76D3936AD2EF37379B484A44289668D0E36980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323758, "uuid": "e5eed09d-8dea-42dc-9e80-0f86f6165189", "value": "192:IN0qZaVKLJkVURC8W1sJtoyU4dqK9V2U/dIf/0sm6tA9Z:ImqsKLJ44dqgVNda0sm6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323758, "uuid": "c189c6d7-75e6-464d-a1be-b8eab34a4a0b", "value": 11696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323758, "uuid": "85c5af8c-1fd7-4d36-a65e-196a5a86a72e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323758, "uuid": "e44ba6e5-95d7-4394-8dee-9fd36a6899a8", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789f5e3f-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279541, "uuid": "bcf54232-3845-453e-a815-e1e2d4df858b", "comment": "Malware payload", "value": "648b5d1109d6e9d49ae9460588b5981a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279541, "uuid": "aca2880d-5b61-45d0-a5cd-33a6279acfed", "comment": "Malware payload", "value": "77cfeabee7f719c9edd65422a19188d34b7dcce2eefeaa1a5ed4e689da5e5545", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279541, "uuid": "c840be46-8333-406a-8337-75602405a7a2", "comment": "Malware payload", "value": "22d8baf64884a5040b71c06333b1276ad07a35b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279541, "uuid": "7548de57-4aec-4e6a-997d-da892f3e8778", "comment": "Malware payload", "value": "9d5cbf19bfea048cb2790a799c6574a75caeb1cede3a86e278e51c4f1c259050789a1b8d21d1a84c9684bc7b37c229f6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279541, "uuid": "58636ce1-6e5b-42fa-ad60-4eeb8db84dbc", "value": "T16537236E5E63192E07BCAE0D542F6BDD07954214E21A17A2D3C3E40B43B7B5B0ED93B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279541, "uuid": "c7d03e22-ff09-46fc-84f7-88e1a2e6d255", "value": "49152:QdOeYJHPSYt8Gcr04zz4IAcr01ZzpYPzhmHhj092cr0ccr0xBDwcr0ES9TUB5G6s:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279541, "uuid": "4c279c3e-af89-495c-aa7a-6b26e265f6f8", "value": 22383672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279541, "uuid": "cbff26d3-d737-4560-8363-22d2122f19af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279541, "uuid": "c51319b5-a297-427a-99ad-d528e968181b", "value": "invoice-1645080830.pdf (60).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309a5062-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280279, "uuid": "dbc7488d-9b3f-4ca3-a070-7153013842b8", "comment": "Malware payload", "value": "f36832c715682a4ddda03ba206f768c5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280279, "uuid": "c04f49e5-bc4b-4075-b9e4-e4450544a343", "comment": "Malware payload", "value": "77e788208ee8f74acca53969d168bb93447a8274d575882fb1ea31a1361f26f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280279, "uuid": "1a12a01b-9f13-4660-b2ff-a28e5381bdc9", "comment": "Malware payload", "value": "e475cf4b638b6f7b8faebf4f49fea9b5ab67300a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280279, "uuid": "090543ca-d66f-4dde-aee9-f4194a31d200", "comment": "Malware payload", "value": "16dbc7eba6edf1ec104557342c6807d43963bc78e4ac5696fe40331210063eb42ed422f935266abec329887636cef700", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280279, "uuid": "92d0ff44-ce96-4ae0-b5ef-3f738fcb662a", "value": "T1483723061F254B7747EC92790CDF232FBF7DD553E6A45D9AC8819F8A236AA3482053B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280279, "uuid": "40c57fd9-1df1-4280-bc62-069c2fafda45", "value": "49152:XENY+PENY+TENY+7ENY+YENY+UENY+yENY+lENY+fENY+ZENY+TENY+BENY+TbtK:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280279, "uuid": "94b2f386-f397-4bc6-a3cf-12763a998c8e", "value": 22643809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280279, "uuid": "edf6e460-1a63-4b65-bb27-4e239ccb20ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280279, "uuid": "7861124c-3d59-4cf9-9450-ba6df173784f", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed40b15-41ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777261056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261056, "uuid": "40b10c9a-da8d-41fa-bc76-2662c310a8f0", "comment": "Malware payload", "value": "fb5b1b107ede17bcfb361234bfe986f7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261056, "uuid": "7b17443c-c2a2-4c0c-b47c-8df94d2d3e3c", "comment": "Malware payload", "value": "7851bafd9bef773190f9757a6ea9d22cdfaed6cf0e6a12cb8e76a55f4e371fd7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261056, "uuid": "592ba1ce-2853-4ae0-89c9-6c353b2fa202", "comment": "Malware payload", "value": "2eb2d7034e008072cd252bb4a7fc92d23f1987e6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261056, "uuid": "6ea33bde-ac7c-4f87-8580-4a601965266f", "comment": "Malware payload", "value": "fa89afbf4709dc6aad4b251a23762a4d16113161287bdf6493d095db4e8ea1533fde2b3a9acb9fddb5f69a357f59bfcb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777261056, "uuid": "8be167e1-880f-4825-8ac0-66a513ba171d", "value": "T158629379D5984FE487F934819C7007E897ACD2C183A5E8CFA6D1B561262E3F7C738894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777261056, "uuid": "5927575e-a304-44d3-86e7-d2ca18a1590a", "value": "384:aN8trlD4ODygSs3oZSSRYgdzozgbsp+Y9A:aNorqODyg8UBizep+Y9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777261056, "uuid": "631f17b6-8caa-47cd-90d0-53dcfa20ae96", "value": 14972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777261056, "uuid": "88582dcc-1ba6-4292-bf06-b94dc4f56e30", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777261056, "uuid": "b23605da-bbb0-4dc4-807d-0d678d1df86f", "value": "RECIBOS_ABRIL160415042026000458_000459_BETA_COMERCIO_SUPORTE_TEC_ABR_20261.cmd.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04149552-4210-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277198, "uuid": "337c7cbd-01c6-4cdb-9d82-8d2777c64a42", "comment": "Malware payload", "value": "b67c06ef02dcc0334a34b065903641a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277198, "uuid": "8763ccba-3535-4f0a-a27c-15de3d3a2fa8", "comment": "Malware payload", "value": "796ee6da3aa3fc69e6f1654fbb469e90d9c72fbc3ea1387bf10493b6610b36a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277198, "uuid": "f081d428-986f-40fd-9621-14b3a8b18e98", "comment": "Malware payload", "value": "e64f0fc15461ea3651c9903a2464052fa5b7baaa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277198, "uuid": "0f5c3ec2-2d44-437c-ad50-bcc836c76788", "comment": "Malware payload", "value": "151a244c55f14d68a61d9ac56ec5d56400d60729b669e27cf25999d4615ecb4cd0a28820a3c4bc8138751275456f5dc5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277198, "uuid": "3d06c14e-9267-498c-b688-2fd000d3a6a5", "value": "T1C637221E1CFDCE6F8D1DC269C47C2396BDD44A856D13E86167E330EB89AEF096059B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277198, "uuid": "8392708d-e182-4c74-b5ce-ff3d27cba86d", "value": "49152:5eZPeRneZPeReeZPeRDeZPeRKeZPeR+eZPeR8eZPeR5eZPeRfeZPeRdeZPeRzeZo:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277198, "uuid": "cc218998-3b12-4f67-afb1-4f89781f0f1c", "value": 23944451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277198, "uuid": "c67c0b1b-f2e3-442c-9dd3-93d03c9fd659", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277198, "uuid": "242d5676-01ca-4978-8c09-73845e4ebff7", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff030bd7-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276330, "uuid": "519fa2d9-60c4-4171-b3a2-888cd668541f", "comment": "Malware payload", "value": "b972eb6f07f77c14cf819d75111ca4e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276330, "uuid": "09f36d4d-860c-40be-b1e8-8a80dce7fa6a", "comment": "Malware payload", "value": "7972ed07657429463ba82bf94e352f2bc2e2bffbb9257414b598d3020d78e3bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276330, "uuid": "d319020e-2259-401b-898b-bfecf2922689", "comment": "Malware payload", "value": "18035ae411bdcf62247d7cf79a0380b512fe2ffc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276330, "uuid": "da17e635-3b37-4773-a1a6-266efeced9c3", "comment": "Malware payload", "value": "99249510fc31e62daded2b7cb2f8f3902bda386172d7785e9c22ded7cea91ef8277aa7f9cbd1035ac858cf167ffaac0c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276330, "uuid": "e2e93228-93bc-4c70-bfe2-659d33c28c0f", "value": "T10E37230B874DBADE0EEA376844EB1F5D01768B5B4135ACD598CC388A5F1EF4B291843E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276330, "uuid": "7adb1d8c-6ed5-431f-8a49-1d3d0049cfa0", "value": "49152:vVV5SkVV5SyVV5SIVV5SyVV5SBVV5S7VV5SWVV5SqVV5SKVV5S4VV5S0VV5SjW+9:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276330, "uuid": "1a45d024-42ef-4ad9-b0d1-3a0280dbd380", "value": 23424201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276330, "uuid": "4ee8d409-1370-418a-954a-f40db919fcf7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276330, "uuid": "ebc2c585-56d3-4dbb-8f3d-65a90a675143", "value": "invoice-1645080830.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d35f5f-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323081, "uuid": "53b2d4b3-9817-4396-8c38-17808109a6bb", "comment": "Malware payload (Mirai)", "value": "da0f42992c684381330b8d30852562a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323081, "uuid": "21fb187a-f20b-4110-bfc0-de248cdaad63", "comment": "Malware payload (Mirai)", "value": "79ce46382479608c532492016ce9bf31344c7142e8e3127a7764ec19bf8045a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323081, "uuid": "0aa412be-67de-435e-aac9-0ba867b414e5", "comment": "Malware payload (Mirai)", "value": "2314264b1432034c3385ac33a1c82ae3a625eca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323081, "uuid": "705b0ec0-7c94-45c0-8d6d-0c5d56c788a6", "comment": "Malware payload (Mirai)", "value": "339c0160681441d160757d034eca29a1fb69cb2e1d17a8e792a4ff9962a9f89854ef92b2ff34e474c9eb7fbc795bb3a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323081, "uuid": "abb7a389-0f13-430f-bd81-59715acc5c43", "value": "T123935B22B579093BC5E4943712F35326F2F6438A24A88B1E7E710E8EBF156D0364B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323081, "uuid": "d5efbca1-53b8-4224-8998-3d0e387b02f4", "value": "1536:2l5GrqkdLucbPVizYeBtPaWvStPhYm5roASoAteq5:JngoeNLa5hYOc4q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323081, "uuid": "b9ab4b40-33a9-4ac5-b202-bbed0aeb1c8b", "value": 91976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323081, "uuid": "06b23240-5c13-4e4d-9dd8-ecc78166045f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323081, "uuid": "35408214-6afa-4f9b-a76c-a23554c67c62", "value": "vaxstresser.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452e7a5d-41e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777260127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260127, "uuid": "7eaef904-7df7-4cef-9482-2aec00a6f4dc", "comment": "Malware payload", "value": "c1e064113ef987b35536bda33d91857c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260127, "uuid": "5e391ace-d00e-4217-b5db-e0926ac6af21", "comment": "Malware payload", "value": "79e9d002085d727c9a6f52e0a78f0e53c1743df6828f16bf2959fc62c592bb09", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260127, "uuid": "394d67f8-af2b-4517-bfd4-c0140e0ea361", "comment": "Malware payload", "value": "c20c466dd649fb7a0680113dc4d12a5c19cc49f0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260127, "uuid": "60ecf06d-b3c5-41de-82e9-036e653eedcb", "comment": "Malware payload", "value": "40799bdae5e46f476d44792f78bc3c454c914bf1a8dd3ac2a962738e23f648fbe796cea90e68efc9ba83fc75832c3507", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777260127, "uuid": "99dd54c4-6e54-4a69-8dfe-a63f65e0d02e", "value": "T1EF343B2E4ABA5085A8B3CFD09E9470AE59B3BF22185C148C08C81A4F1D75F94FD56B7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777260127, "uuid": "06b5b6f1-dd01-4389-9ec3-f0d1d63fb24f", "value": "6144:0BZGBodc+UJIek6vOK5uVeYdhDGDmAaS5E97QU8t1fc:0BZYGcnJIek8OXV/dxSimY7QU83fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777260127, "uuid": "4601ee69-a55e-4b0a-a0f0-98de39021475", "value": 232294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777260127, "uuid": "af924bc7-9c06-464e-82a1-1c1ab631dd04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777260127, "uuid": "d6b0a0ea-f62a-425a-bdb0-bdce087035cc", "value": "DOC26426.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b68924-41e3-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777258141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258141, "uuid": "fa22f364-8e9c-4a78-a4a1-97953b2e7253", "comment": "Malware payload (MassLogger)", "value": "01be7704fef9236bc993303bf751c5ab", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258141, "uuid": "5f36d2c8-d76c-46f9-a3a7-fac3d552549d", "comment": "Malware payload (MassLogger)", "value": "7ac07536c76c62c163ceabf2e2e877fe3877b3414d95d36d50d8d5838a548fed", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258141, "uuid": "9168ee9e-4664-491d-9148-fc8f3259d2d8", "comment": "Malware payload (MassLogger)", "value": "8a5507b343eb4114ae00ab08a5bc7ad45d614068", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258141, "uuid": "aee371e7-599a-4cc9-9d0c-324fe9c8964d", "comment": "Malware payload (MassLogger)", "value": "31508fadd5d6140c21a6dcf87416c9bda5c61c7e886165e4cf53052c2dceabd2b6b9d1509d29f0c871e6d41182f89b5b", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258141, "uuid": "c54d37f4-c81a-4499-b6ec-992b5a1a1d75", "value": "T1E59312953223820EAC939351947FD9FB61B11E31646F6C96A69CC10B9FBBFE1011FE09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258141, "uuid": "6bce4922-59e1-4ed2-a6f9-04d97de5bda4", "value": "1536:wgQXpTTkNrPaEA1a7GWIi+U08wVxy+DdDr+mlYGNeXyDweQ80jWI9mlvWyxS2ZQx:wgQXpEJP1rGW69tvDr+mv+yE184p9o/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777258141, "uuid": "db20b0e9-2459-4b99-b9a1-82375b578845", "value": 89724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777258141, "uuid": "5aef48e3-821e-4653-8edc-37388368cce2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258141, "uuid": "caa1dd8b-6c4a-46c6-afc5-9d1e29525f4b", "value": "Congress.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17390ef6-428f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777331776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331776, "uuid": "435d4085-d9cb-45fb-92bd-d2ec87e13f8a", "comment": "Malware payload (Mirai)", "value": "008511114c6fb5d1b0b363ad5b82bc9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331776, "uuid": "dee3fc30-e9a9-48a0-bffa-ca0519efa078", "comment": "Malware payload (Mirai)", "value": "7ad5f20bc404a2e3b810de318b5bbd9ae26a096ad794c1e43a46fc9cd468dd98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331776, "uuid": "abf01688-c257-4304-93d4-401f054edf28", "comment": "Malware payload (Mirai)", "value": "072e635fc21668a1037461dc7eb7b192bbc87eb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331776, "uuid": "f27463bf-600c-4ecf-9ed2-46219b9008ad", "comment": "Malware payload (Mirai)", "value": "fc758724f6d3a836a7ebc0773f6b7bd9c070f5fb55cb587731a8ff9ddd5b5b4da24ea461544eabd095c29de3119d2cd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331776, "uuid": "50dda083-5793-4472-a5fd-06009a5625eb", "value": "T10CF2E1886F4340E6DFAAA4F711F183D10EF60A7891B65E4B3CA2C947DEC90E43096ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331776, "uuid": "048fed16-57f1-4726-9780-77d5e6d69cb6", "value": "768:XDPeyjCrlQ3a0PcQVjf8QCzX45XikM6yw6c/rg7SBk2YgMUrDdJgGlzDpbuR1Jw5:LU4UcD8VX4MkMlc/EdgB3VJuq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777331776, "uuid": "5bd723e8-1b38-4a7f-93e4-1be43dd6302a", "value": 35116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777331776, "uuid": "cd71bfb1-1f5c-4169-8f8f-35be64ed756f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331776, "uuid": "172889ad-2702-4d35-92b3-93672e020b76", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318da7c9-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283716, "uuid": "37fff6ff-2d26-460b-b9d7-3e34ff042b86", "comment": "Malware payload", "value": "9f23155ffe93e3ecf04b4cffdb3ab010", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283716, "uuid": "aabea865-6553-421e-b832-fcda56de0798", "comment": "Malware payload", "value": "7ad656f46d2f7d6e0dea566fe109638b8d6c5ba706e05f4cd947e20a2072d8e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283716, "uuid": "4b2bd278-08da-460b-ba3e-21dc8635d5bc", "comment": "Malware payload", "value": "c1757c5e4392f11f1142311d3617f9777431ad0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283716, "uuid": "5a5a70ba-50e2-4b43-9fa4-ea5041846d5a", "comment": "Malware payload", "value": "186357635a2ab17f76459aef29bcb15a241612a013928c04398eb9e2d96563ff822cdaf9abb7983e22b40641aa1dd5aa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283716, "uuid": "6ffd7a77-32f5-4f43-9337-fbce410817ce", "value": "T11F37230CCB6FDA7FEA51C90430B92D960FE8CE40851D6E93A79A35574B0F31411EBA6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283716, "uuid": "36147d1e-0087-4ed5-9dac-8d7329fa243e", "value": "49152:lQyyhggQyyhghQyyhgNQyyhgJQyyhgkQyyhg6QyyhgNQyyhgwQyyhg7QyyhgjQyt:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283716, "uuid": "dc06e8f0-f569-4be3-bdac-591eb63d0ae9", "value": 24464728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283716, "uuid": "7d3ffc35-1361-4678-a07e-308d8f134b87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283716, "uuid": "d26f7023-b041-45c7-872f-b3455e4aad1f", "value": "invoice-1645080830.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83eb56c-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1777265018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265018, "uuid": "a52d07dd-d7ed-45a6-bc29-0ec2cb18e3ab", "comment": "Malware payload (CobaltStrike)", "value": "e8f3a96727072355ecbbad79ae66a1ea", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265018, "uuid": "d5d08f60-0dc5-462b-abe3-07e9cb810c02", "comment": "Malware payload (CobaltStrike)", "value": "7b2b66166e8fa2fde5ed1464d45882d52303d560d4132e697027d712ad1e05d1", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265018, "uuid": "4878efdd-4274-4ad6-83a0-0cc4fd810866", "comment": "Malware payload (CobaltStrike)", "value": "364d2f31c5aad8b0f20cc59c5c143a067edfa2b0", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265018, "uuid": "984efd4d-27fb-444f-b9cc-a8213f685734", "comment": "Malware payload (CobaltStrike)", "value": "edfcd3a0ffcc0387ca44094e17caa49a7fcbc2cba9a2f693e29487218c5269f9ee721b4255cafbb258be0dd9f254a036", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265018, "uuid": "0cd9ec9c-0a6f-46b0-8e34-7be220582af2", "value": "T118823982B7D55CEBC5254139C2335A2BE9767634131386EF23E48E011EAA6816F3FB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265018, "uuid": "9388a291-1230-4d83-bf34-e9996dd2bb2a", "value": "038e011b4e5fd7e93165f5b1a5c427bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265018, "uuid": "cc974558-46e8-48a5-8c91-7094725941d6", "value": "192:GAbsRFpmCQqA2jXyHBi4/hmU3IasJ3Z7AW2KsbWMsttDB955tf/r:GADPLEX+BiChmU3IZ7AW2KGqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265018, "uuid": "858be8a1-a929-4f02-895a-d9bc2ad5b28f", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265018, "uuid": "56813983-a678-4f4b-97eb-050d2825b516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265018, "uuid": "e8f6e848-c343-4229-90b5-10859deea229", "value": "7b2b66166e8fa2fde5ed1464d45882d52303d560d4132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c79641-4223-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285379, "uuid": "253dd9ee-df75-40a8-a77d-cfcee87da598", "comment": "Malware payload (Mirai)", "value": "6a4f753f2bb1aa4b35c8d0bb44000d44", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285379, "uuid": "d9b0084b-0108-4e4e-8d68-f65609ed5681", "comment": "Malware payload (Mirai)", "value": "7b33f86c38d928d19804c629f021706a5b8169812fbb10b3b7ef56cfc5d1040f", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285379, "uuid": "a590261c-7779-49ee-8b8c-ab61fdf2b256", "comment": "Malware payload (Mirai)", "value": "6a63f9c6359602f0e46967cdbcf08b803ceec517", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285379, "uuid": "da4dce66-3a7d-4000-b023-04f85e5b16b4", "comment": "Malware payload (Mirai)", "value": "d28ae4a7fa56246f6f9534816629bceadf66e7bfcc04de01313e99783a62a7a72e06f1562f70b10eea39d808f7093f4a", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285379, "uuid": "5bb08de0-522b-40b6-a5bd-a9693333abc0", "value": "T138968C03ECA515EAC0DD923189729252BB71BC494B3163D72FA0F7386F76BD46AB9340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285379, "uuid": "6d0a6f15-607c-4b2e-9b99-dc9e348211bc", "value": "98304:HdNaZQ1/sj8HHr1oalYiWaDn1TEBfe8xu2fP3VVnUAtG+EFpwkwvrTQkl:HmURHL1oGnHJA08BXtGXwkwvvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285379, "uuid": "0c21481d-8a9e-437d-844e-fa962abae917", "value": 8862913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285379, "uuid": "c9a5a474-d37a-4eef-b9ef-d4952a4068b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285379, "uuid": "8a43e3cd-7634-4a71-a6e7-2f49e9d7c09f", "value": "scanner_new2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff20a83-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279258, "uuid": "46dfc0f2-2ba2-454b-a321-22f18ffeada8", "comment": "Malware payload", "value": "fa801dd3080d451fe0a52befaf8167ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279258, "uuid": "3cda074b-e671-4855-991a-5e0ca10d2d85", "comment": "Malware payload", "value": "7b87b6224dcba02d9f69e0765f46a6805399e617aff0f94662d478c646685fa2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279258, "uuid": "7ee64f05-4872-48b8-92bb-578c4421a6fb", "comment": "Malware payload", "value": "9922377f3a136962bb90a9894f1163e7a5ec6bae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279258, "uuid": "111091bf-6b1b-443c-992b-7db871d7f6c7", "comment": "Malware payload", "value": "aed3360be231feae58f76790c9932373a481f2165629517ab44ce629ff9cac3979c3a3c289f18916e1d84a755177c4e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279258, "uuid": "ce595d10-0bed-401e-8179-a0c54b8d6947", "value": "T1693722558BBB5E3F5B6D12CCA4F90B1E1BE70F062D863DC345DB64AF429BA420217E09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279258, "uuid": "d1765e41-eedf-49f9-a275-d7fdcf150097", "value": "49152:PdlhU6IC0TgShxOSivJVKxOTR0I2fcuRwpRrObxO9xOzHi6xOeeT2fyiJFRn1VDm:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279258, "uuid": "ca7ff589-30a9-44bd-ae7c-1d68fb572000", "value": 22903948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279258, "uuid": "5a20729d-2362-43f6-aded-66fc1078f34d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279258, "uuid": "13e48aba-300f-4292-9645-1f62936f33bd", "value": "invoice-1645080830.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4224ad88-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279020, "uuid": "c6543987-64ff-4fec-bf2c-c73e1a820588", "comment": "Malware payload", "value": "c6fae939db99727cb57e2f1568fdc8b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279020, "uuid": "7d621c13-6c05-4a5a-b47e-64112f152aa2", "comment": "Malware payload", "value": "7b8b5fd692647e563dfeafc162f94c17dafd419979e0b78e2a45e76c92300d8d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279020, "uuid": "1168c539-b70b-4da8-af2d-5726ee42fb1f", "comment": "Malware payload", "value": "08184b05a112e6beeb3358c4367c5c3d714e7a00", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279020, "uuid": "1ba80f4c-214d-4275-88b1-aa8fd7d608cb", "comment": "Malware payload", "value": "7b96ca71717d3ca01d8e766d8c90ccf73074f3b968a7245e9d3696aac86acb73470c72e92bbbf6a191ae6ad1edb67c31", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279020, "uuid": "1bb76735-22dc-46b2-bfb4-f488331bfca2", "value": "T19A3723271F57DAAE84E5748C35EE0B4B07B164C51045F8D266E62DB97EEFFB3002A224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279020, "uuid": "262b42a1-5ed3-4c82-9501-0c43c5e0b146", "value": "49152:Rj0yj05j0Oj0uj0rj0Hj0ij0dj05j0Nj0rj0hj00j02:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279020, "uuid": "2bb59b22-8fd7-42c6-b698-6369e61ac7b6", "value": 22643792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279020, "uuid": "8d196ac2-1613-4b44-84cf-c25f7cce5f50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279020, "uuid": "20fc5dae-244f-454d-878b-634f8a22c58d", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1fcb87-41d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777250287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250287, "uuid": "09377d6c-6514-4f09-bbff-64d230b5b75d", "comment": "Malware payload (Mirai)", "value": "4f055d26ceee36bfade41272ff143bb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250287, "uuid": "cfbdb05b-cf52-4f4f-9608-48a08f8a601a", "comment": "Malware payload (Mirai)", "value": "7c1f7e1ad2367a08a5edfdba26e6a7b318252072d25096c818864c822fa9214b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250287, "uuid": "ad65e922-5c29-469b-9c3b-3b61e4094d27", "comment": "Malware payload (Mirai)", "value": "0babc6b5cac851e700419c17342b09c19cee66ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250287, "uuid": "525ad565-a2cb-4a9e-905b-9cb417976797", "comment": "Malware payload (Mirai)", "value": "9448d16c0bf989a02503fd17e93de68eb2ddb2de8e8851afa1b954792fd476936cf6284069ba2e0eb9dbefc67d120662", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250287, "uuid": "189446f1-5c1b-483b-bd25-b83666b864e5", "value": "T1F5259E2AB2B2B2BDD007C03447DBCBB15532F07556312DBB22C4DB343E9ADA41769B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250287, "uuid": "9c976d12-1c4a-41be-b19d-39e881178f66", "value": "12288:QNalcmpk0/NgwMidbXfdkHhPYOTSyZC5SDR7oEZKohh0USDfrayE/fRvofHXKAT1:3cmp//Ng2UI3s08n2USDyfRQFTBfze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250287, "uuid": "8fab9248-2c85-4128-be8b-f30696e1bd8e", "value": 987016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250287, "uuid": "0bb6e219-8e3f-4598-9458-f6c29551dd99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250287, "uuid": "3797a8dc-aa2d-4382-8ccf-9754ef86afed", "value": "SecuriteInfo.com.Heur.4967.5024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cc594f-4210-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277219, "uuid": "4cf0a326-c495-4780-a4ae-a3766583d5e9", "comment": "Malware payload", "value": "be8b988560a66d1a0699273beb3266a8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277219, "uuid": "22ef73e5-d006-46cb-a03f-83e3b3152d5c", "comment": "Malware payload", "value": "7cddeb3a91243713d8163b331fe0dca6309d1c493c46de7aea02fc24780f74ee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277219, "uuid": "632d4e14-6134-4927-837b-769719b7d671", "comment": "Malware payload", "value": "40341d2d53638db7c006c6fb4651ffaafd9f2aa3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277219, "uuid": "f6d7a02a-c782-445f-a958-1b5f54a0a37e", "comment": "Malware payload", "value": "70ddf47d1ade5a877ea0d9a91fd7a33feb8cb2ce13befd8c9e216246f7c4354460e41496d6b62ecafc943b899cb43e88", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277219, "uuid": "201ab32c-afc8-4810-af21-6faa79e47810", "value": "T13437230F4F5AFD3E42B9674EC0EF020F4AF88C18160699945DD9AC5DC189BAB129739F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277219, "uuid": "ba4a1880-3e2a-4354-b6aa-e4d200281bff", "value": "49152:Pbjkz7bjkzhbjkzWbjkzVbjkz3bjkz5bjkzEbjkzpbjkzMbjkzqbjkzjbjkzkPwJ:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277219, "uuid": "caef0313-8c0c-4ead-bab5-e8987418cf7c", "value": 23424214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277219, "uuid": "ca15c280-76b8-4c03-8822-af5cc6c6a33b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277219, "uuid": "1cb32050-e2bc-4df3-84e1-ceae48ae4153", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66faad2f-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280370, "uuid": "f3e0e4e5-4c67-41d2-8158-994cfb79cf79", "comment": "Malware payload", "value": "78c467de0ca5d96d82d7ea9c9b470f18", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280370, "uuid": "661da915-47e2-40e5-946d-901303ba1a2e", "comment": "Malware payload", "value": "7e3114d4e7dee6736d4d5909355bee86fd70a47475e61051e76ae33037330ee5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280370, "uuid": "4d9eeee1-a912-4bb2-9c95-272c9dfb7a1d", "comment": "Malware payload", "value": "daf67a60f4982ea81b0a19925d9005d0c871d626", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280370, "uuid": "c62f949d-4219-4825-b352-8d64798271a1", "comment": "Malware payload", "value": "60a56e8371936c49c1212d801f66da57368206ea3217cc6b831c430624acdff63405ca4a5e2885734e19ec510613f563", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280370, "uuid": "683810b3-6a54-4c96-af78-ac6a28942bb5", "value": "T15D3723848C3E169F863852743CCE1FCF0FFC4C1016A63D875AD16A69E78B951A2D72AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280370, "uuid": "18df164b-a6b5-4f4e-81bc-eebc690c4422", "value": "49152:Zfn9Sfn9Cfn9Pfn9+fn9efn9kfn96fn9Jfn95fn9ofn9Hfn98e3fn9Zfn9Sfn9Ym:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280370, "uuid": "2eecb986-0c04-464e-8bdd-10030714847f", "value": 22383668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280370, "uuid": "5dce904c-fa6a-43e1-9c19-103a2f9c25f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280370, "uuid": "1c197de8-b5b8-4f29-8f70-fd784cd74180", "value": "invoice-1645080830.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22fd36c-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271530, "uuid": "f1b9e628-c7eb-4af6-b37a-fe94feb46826", "comment": "Malware payload", "value": "8505b9f6ae7ea09aa0309892afdf5cde", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271530, "uuid": "fcb98212-ab18-4c37-8dba-f2f4e39b7984", "comment": "Malware payload", "value": "7e725aa33f664f1e40b328df112a6b8d24b9147496773655f7d56b1b8a5ddc76", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271530, "uuid": "99f7f80b-caeb-4e37-85a7-c0c6956411a6", "comment": "Malware payload", "value": "fa2bcf28857196dad134a13247e01d6015a0ac81", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271530, "uuid": "adc75cbd-d81d-4986-84a2-c6db66e2c2fe", "comment": "Malware payload", "value": "6455d1d17a56fdd9f27d9b2519d920a8ff3c6487b312de4271b3169ba115c1e01fcea3c34fb063ba94485675d859174c", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271530, "uuid": "b3454e0b-0f05-4242-87b8-40332b018df1", "value": "T16437232A0F2B5F6E679C96DC109E1D5B1EB0CF8144C5F87AA993180E84CE65D387F728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271530, "uuid": "267723a2-dbc3-41a1-842c-fe2ada40c813", "value": "49152:N5dD5db5dr5dd5d85d+5dX5du5dZ5dN5d45d5mKNcn5dG5d45dl5d15dAmKNcO57:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271530, "uuid": "d1e210af-03e3-4e99-ba6a-f8bb832f0712", "value": 22643810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271530, "uuid": "e9d647c8-ef5c-4033-8472-74ec7c90580b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271530, "uuid": "49b41c7e-c21d-4695-9a00-7078898915eb", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b36eed9-428f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777331970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331970, "uuid": "f7e93d8f-133b-49a1-92b2-7b791095459d", "comment": "Malware payload", "value": "598ceb17dfe3f295edab31ea51e9629f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331970, "uuid": "d23fea44-0e05-489b-83b2-772cc6054457", "comment": "Malware payload", "value": "7ef21400d73f4016dcfe1a76e81aa9b30056b0e46086ab20209a95007a4d5bf4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331970, "uuid": "4eb6ea15-cda7-43e5-9d5f-26416504bd41", "comment": "Malware payload", "value": "f9802a0d1b43b4002a680ff99f4fa4296d26f37a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331970, "uuid": "f00390ec-86f6-4fd8-9796-5c64bc22345c", "comment": "Malware payload", "value": "56b7480e2c20e72ea294121d98bafd4826a2f13d42e208ccb53bac7e852ce3c822b8f9c314f93f78afacbd32cae144bc", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331970, "uuid": "8fe2682f-ad7d-48fa-bf2d-164771507616", "value": "T126E26126774466EF90E6E3999B23F93C3E587E7F4A18B6D5F3E27BC74188444E801620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331970, "uuid": "85b6053a-442c-48f8-8d82-b6fe8a35273e", "value": "384:AH8EKL2gkwnDDKQRB3SkXs8edoMFv+MKoz6nqwcKjP33GskJJJA:Q8dLgwxN+dNFDzTKL3QJJJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777331970, "uuid": "ca2c9f2b-8025-4e01-b12f-5c72ceef48d5", "value": 33566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777331970, "uuid": "c3fed2ec-399e-4908-84cd-48746a8d53f0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331970, "uuid": "5523e1ac-e874-456f-9a31-97df612ff545", "value": "Nomina-27-04-2026.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f594f7-4267-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777314565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777314565, "uuid": "a6c53f2a-8e5e-4e7f-af35-39adfdbfbdd1", "comment": "Malware payload", "value": "6783cde9b53a30fd8230ccd6b9a8e491", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777314565, "uuid": "e36ef239-b15d-4723-9f1b-24c74c3e22f3", "comment": "Malware payload", "value": "7f53597d0e1f88f1d1af514d09ecf3ac94ad1325c9063f4764c2f7e4f2c7f9a4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777314565, "uuid": "55f0bd26-d6de-40e3-a88d-149b847b0fc5", "comment": "Malware payload", "value": "af331b4eb5e6ff926fc4cce99abb98f3c4595010", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777314565, "uuid": "e9662d41-6eb1-4a6e-9c7e-d72ce3f2945f", "comment": "Malware payload", "value": "5f0251130d57a36e8d700e6f112fb3c56f401c864fff8913fb263151ec26f9c43d11c683ab5a01b5aaed7f04d0599d59", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777314565, "uuid": "903bc399-4ed1-4933-8020-adb51f74bc62", "value": "T1F2136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777314565, "uuid": "938788de-3150-40f7-8b8d-996018e2946e", "value": "768:bYCXRWNGxVI9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bHlxvco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777314565, "uuid": "0333c017-d51d-4b9c-8697-92a590877bd1", "value": 45424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777314565, "uuid": "86388fa2-255a-48f7-b06b-bad8be043473", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777314565, "uuid": "779fe0e8-86f6-4992-9e83-428b8388e3eb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df634b8-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283737, "uuid": "7f5bb4aa-bca7-4ec7-95f7-536e6bed49ab", "comment": "Malware payload", "value": "59ba3211a22dc557d2263f97ee8dac73", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283737, "uuid": "453968c7-3ba2-4f25-8317-65aafa4691bd", "comment": "Malware payload", "value": "7fd9c237aae93c5d2c4acf7dfe744021a46dcc4a5592ce53ff70ce39fdbc7fd6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283737, "uuid": "a6d93a93-2f10-45b4-aa98-66a58c81ce50", "comment": "Malware payload", "value": "1eab0b4d1cb7fdfe190833ba88700361bf66fa11", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283737, "uuid": "a9b262c2-a445-4078-aae4-8587d20db366", "comment": "Malware payload", "value": "4984fc2a59a16fa5d9aafc2c7e5c1fee0d729c6c87b589afec0d258d0007ccde485cc5283a769d9bc19dccc042a3b6cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283737, "uuid": "893d5a5a-5b04-46ae-a5b5-0b850a23a813", "value": "T14A37223A8E7BDEBECB1C63BE10F81FCF8BE91E40430609D256DD79B7590490A8467568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283737, "uuid": "6710a484-fb3f-4bc7-8f59-1b5582aeb4dc", "value": "49152:bvHvyvdvyvGv4vevsvrv4vuvtiG2wopvUvovTvDv/iG2woAvHv3vOvgvuvuvSvxm:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283737, "uuid": "aae31142-6dbc-432f-805b-75ece74cd677", "value": 23684345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283737, "uuid": "d67273f9-04e5-4817-b9ec-406d59fada73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283737, "uuid": "41928861-411a-4edb-9424-1c522301d725", "value": "invoice-1645080830.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a049ff-4290-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777332364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332364, "uuid": "476132d6-e908-44fa-93be-1e2d57fdfd6d", "comment": "Malware payload (Mirai)", "value": "b1be15def2608556a701718cd2a64dc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332364, "uuid": "88dc17fd-548d-4854-9023-6e77dd45f05c", "comment": "Malware payload (Mirai)", "value": "7fdcef2cebf753fc3860beb0360d1df405d91af69532839f123d54849c656afe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332364, "uuid": "5ebe8c00-6535-4066-8685-fb4d315c093d", "comment": "Malware payload (Mirai)", "value": "eef8bfe20dcd05d648c7780eb0e6b89fbd8ceb76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332364, "uuid": "4da97944-161c-4dc8-bbc3-c0b1ab64b7df", "comment": "Malware payload (Mirai)", "value": "bdd7e7b8e55270716a2c913398e43e2650a460fa7c4596357cd40779ca340d33a95944556e63bcf5755940192b84eea0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332364, "uuid": "048b2a2a-72e8-4ca0-bd7c-afdc5e30fa9b", "value": "T1BF438E13A580D0FDC8DBC1784BAFA229E5B3747A5271B31E27C4EE262E6DE516E0D740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332364, "uuid": "c3698f14-ec7e-47e5-bf3a-8fc8a1fe58b3", "value": "768:rIseKUk5B5OKA4vmpK5zoSjLyw1plFG3Kk7pKr1IxDvIGS/s3qUVG+3RddWZIGuC:9UulCpQoS3plac1I1IG6sPVD3PsZBuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777332364, "uuid": "c3932cd9-4323-4a57-a633-90a4d54e6950", "value": 59688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777332364, "uuid": "6c64a8bf-805d-4a3f-bd24-28a8090309b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332364, "uuid": "0925e0ee-1f7e-4291-9d93-8ab10e0bb184", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8d2443-4249-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777301913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301913, "uuid": "4dc45b74-fbaa-420a-8b49-4a8b4c070677", "comment": "Malware payload (RustyStealer)", "value": "6e1a00c7672eddce19f13ccabf36638f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301913, "uuid": "dcda8e15-17ae-44c6-80fc-400836a7bff1", "comment": "Malware payload (RustyStealer)", "value": "80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301913, "uuid": "cb9d705c-b82b-43bc-899d-29b6d67de081", "comment": "Malware payload (RustyStealer)", "value": "ddb0403e0955935c48fa9222f35e42dee43a4bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301913, "uuid": "90e42f6c-ad0a-4261-8c0c-c1be0ff1a9fc", "comment": "Malware payload (RustyStealer)", "value": "526e2613e83458d17da98912e087129d3d4780692fa11d591c3a865bc16071e7d1730da76b75195577f7d050fa5d41c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301913, "uuid": "5f2172d5-839a-4211-98bf-f87b55323d99", "value": "T1CBB46C03BA9552B8D0AAC079930A9573A933B8850734BAFF03D459323F55FE62B3E715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301913, "uuid": "43f58a09-e4ca-4a3f-b06c-77738ace9600", "value": "237d6baeddc9ed20d33cb035491b3df8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301913, "uuid": "43c578c5-aa7d-4b5f-9e57-c58165d811df", "value": "6144:kBksU2ZkpBcZ6AWxdAdBCVIDqf4T5E/NW7p3uaJNu3wyZVghPJjBV:kqgGBc8AZEyDqf4N0M7p0PiFrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777301913, "uuid": "b268935c-7355-4326-ba57-ed1a3db31694", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777301913, "uuid": "4bb8c96c-c9ad-4aec-a220-fbf73db1bd2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301913, "uuid": "d391c55d-1200-48d1-9ddf-51bb4171e321", "value": "\u6837\u672c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac4d995-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276726, "uuid": "b2ad5dc6-474a-4ad5-81c7-b0b80db43ceb", "comment": "Malware payload", "value": "02017e232274ece0287e2c3bf3f64fc1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276726, "uuid": "fd0ce30a-1fbf-464a-bbf9-c234aa2af5f7", "comment": "Malware payload", "value": "80386f30db8a29ac60f4bc95e05b29041b478fd6d4ff914345ec52c5951b69fe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276726, "uuid": "23fc7669-39c0-4186-8472-e419e70e3c5c", "comment": "Malware payload", "value": "769cd8df8de1222c7a325de3b4d97c28362e9edc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276726, "uuid": "af4c01fa-1072-4c42-9aa0-a506c404da7e", "comment": "Malware payload", "value": "57f2768362e8e88c8568afa4b4e91a8ea0fb7ef9f76b20849f47453622a6a782e29f75a38604df68acc52530da0b1f70", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276726, "uuid": "b9ee23f8-3126-460c-b372-6db128b7300a", "value": "T10B37236A5BA47E5B92540278901B46CB0C88ADBD1140F0EB07DDB84FF6DD74B71BA33A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276726, "uuid": "1748f88f-e561-4f3f-bbc2-ba89e58159e7", "value": "49152:T9Rmu9RmD9Rmo9Rmt9RmV9RmT9RmR9Rmj9RmW9Rm79RmJ9Rmluz/9RmF9Rm79RmG:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276726, "uuid": "5ef84b4f-a064-4e89-b409-3f81c2f9f6b1", "value": 23684330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276726, "uuid": "941ee47f-5a37-4fa0-ab47-a4e45b2f3998", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276726, "uuid": "b0627e01-fd80-4d80-84d4-912722285ab3", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ba844d-41d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777253653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253653, "uuid": "7e53e79d-e55b-4b3e-a83d-bd4e31132b40", "comment": "Malware payload (Mirai)", "value": "b01f751d2c1fa20e88ede881ed7b39e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253653, "uuid": "b6638e45-5376-4973-88e8-1c16c1385b0c", "comment": "Malware payload (Mirai)", "value": "813fd49483ea31a14c324083ff4a89bd06cbd6526a58d5eb9228443ccb1cb07f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253653, "uuid": "d88ad461-5bf3-4303-b3bf-51ed17f35b0e", "comment": "Malware payload (Mirai)", "value": "b244b9431f0fde7a9d6765544e76faab5a6cbe4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253653, "uuid": "940dd6eb-7ab4-4496-b50f-579b9d28745a", "comment": "Malware payload (Mirai)", "value": "27e26e222e037acd4a096d5d2658fcd7ea17bdadf76e46a390ad4c245476b6f33516d1be43da6ad7dcfb16259171a0e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253653, "uuid": "25e954fe-2b41-4914-a86f-bb40d22e4894", "value": "T199158E89EBC7D4F1F65301F10A8FD7B60534A2264003FAF6EB8C997674727526A1722E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253653, "uuid": "4dbb3e3b-04b3-44d4-ab11-beb37dcbe3ac", "value": "24576:TgpB2oXYhfmhzDEp2dUf5jyx9Nl4I60QU17JRmVGZ9zGDJ7J:TgWoIhfmhEkCsx9p605RGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777253653, "uuid": "b5b2e237-12b2-4a27-95e4-dc1f6609afc0", "value": 954632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777253653, "uuid": "39b2f7d4-603e-4118-b73b-746b9aad6e99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253653, "uuid": "02331500-cf4d-467e-8968-cfc8c930b009", "value": "SecuriteInfo.com.ELF.Mirai-BTD.63866674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01c929c-423c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777296438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296438, "uuid": "ffe7677b-0f10-48d0-a12a-9c7f2df1c2d2", "comment": "Malware payload", "value": "0166d2ab4823542e1bbc24a1641964f4", "object_relation": "md5", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-rpscontabil-pro", "colour": "#FF6AD0", "exportable": true, "hide_tag": false }, { "name": "rpscontabil-pro", "colour": "#C2634F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296438, "uuid": "bbaa1891-0361-4c7d-bf44-11366f337817", "comment": "Malware payload", "value": "8180f9ffa62f57912ba37dd713c53e05b4f581d85010be7ebdb24a31cf1fc9ab", "object_relation": "sha256", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-rpscontabil-pro", "colour": "#FF6AD0", "exportable": true, "hide_tag": false }, { "name": "rpscontabil-pro", "colour": "#C2634F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296438, "uuid": "80364a9f-ca51-4f90-abae-fff74ac9e115", "comment": "Malware payload", "value": "3d3b5b76b38574b7461474c77521f0a2f5c55a73", "object_relation": "sha1", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-rpscontabil-pro", "colour": "#FF6AD0", "exportable": true, "hide_tag": false }, { "name": "rpscontabil-pro", "colour": "#C2634F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296438, "uuid": "b40d15fd-1e7d-4525-bcf8-36561885b6f6", "comment": "Malware payload", "value": "fc715d71b080a332818d5b37bf9c54a69f6af090e1e173ae379a9cdad76eda2a7fe29349d58bdf93413cd2b6083748d5", "object_relation": "sha3-384", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-rpscontabil-pro", "colour": "#FF6AD0", "exportable": true, "hide_tag": false }, { "name": "rpscontabil-pro", "colour": "#C2634F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296438, "uuid": "6808c574-243c-49a8-ad43-d725bc9c0910", "value": "T10F71F9175D261C0643B1C10902CF99C66C3D438952935EEE32A7DB7D8A6822AA5F7BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296438, "uuid": "2900615b-5e60-4bea-9ad4-48020ca8d11c", "value": "48:NyNfEJEl8wy3KMipwUCY64OJV+vuTAujV+Q2mXBuzmJ9C6Akf2S+TaXcLKFs7lhG:NyfevKMiEEC4gVC6HfJsLK2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777296438, "uuid": "a7264c95-0457-42b1-9912-ea9a3be4832c", "value": 3764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777296438, "uuid": "9f3443bb-5ed9-401d-9248-82079cf86867", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296438, "uuid": "d3adea15-f866-45b9-ba78-0a5dbf0acb04", "value": "hadnrdac.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0659b6b2-427b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323158, "uuid": "7cc8c069-9be4-42ca-9234-95e42e3228f6", "comment": "Malware payload (Mirai)", "value": "b005dda571b2a04daa8bb0dfc6f29bd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323158, "uuid": "4da9fa21-c3e7-46ae-b93b-451c43db8e56", "comment": "Malware payload (Mirai)", "value": "81e8b067c41f63a5a7f1ba8f07c9a6686903c73e388f18394200be017d2e3341", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323158, "uuid": "b6682979-6a07-468f-b31c-ea497428897d", "comment": "Malware payload (Mirai)", "value": "bdb8365d8b73b510bffb8ab9735cd01676821ef8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323158, "uuid": "42e75c06-6d9c-4561-b3ec-257c5b3347b5", "comment": "Malware payload (Mirai)", "value": "2a8fc604acb1cf620423235965ba8acc0367bbf99bae074a75832a240ba201273dbe3d9b971ba2e90e042d56d587887b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323158, "uuid": "e917b458-b959-4d62-984b-46e028656ccd", "value": "T199A32946FC814A21C5D512BEFA1E318E331357B8E2DE72229E149F3173866EB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323158, "uuid": "a2a95c99-53ae-4e12-8e66-9c4b71ff1105", "value": "1536:wAnky0uiMdiA/5JHa9yiqppEGBEqQxEE3k7uaRrtOXrD0Rilp2x/F0v7Xh5GYWs6:Qxf+ppE9uik7uaRgp2x/F8ThULs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323158, "uuid": "2569d18f-da5d-495a-bae1-33f29d99562b", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323158, "uuid": "63fa0821-1bdf-49d9-8ab0-07a3870dcc5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323158, "uuid": "f08525bc-b239-4d1b-a26a-24c5c60c0d83", "value": "vaxstresser.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45048e33-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283749, "uuid": "9589c8a0-a644-4646-887c-b3bb8dccf5b1", "comment": "Malware payload", "value": "eafd6d739df671563e8f45cb1bcf00c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283749, "uuid": "bd523567-f155-4981-8569-7890be267954", "comment": "Malware payload", "value": "81ff53bf64ae0234b59afcfde54a4dbd55d57fee3cf30fee6b376bcd63069ac2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283749, "uuid": "cf8b7ed1-db3e-40fa-b5e6-6c264854a580", "comment": "Malware payload", "value": "7cd67bb8428cacff642cf0e2e30eb30939f74527", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283749, "uuid": "0540769c-f13b-48a6-854b-e200a5555758", "comment": "Malware payload", "value": "130b4189f4be406fadf2e2df255a7444f8ba066ff679bf5de1f117e2928c8b798c183eb245d7580833877da89b264a55", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283749, "uuid": "ab872aed-d1cb-4cc6-a2eb-2c60b3be228c", "value": "T13D3722415DFB5CA795E8910F1D7F0E21B5909CDA003DEFE953C628E8BE09ABA90CD4E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283749, "uuid": "7d75b92c-f84e-4051-b435-1e822287f5a5", "value": "49152:mM/iM/WM/RM/sM/aM/QM/VM/3M/7M/nM/lM/uCE6x00XjM/kM/bM/zM/XM/ACE6Z:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283749, "uuid": "f791ad00-0fc4-4de6-ab6b-91d9d12dce79", "value": 22903936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283749, "uuid": "5be06c9f-ea46-425f-872b-2432107e3008", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283749, "uuid": "cdd36c72-5375-4671-885a-c87adb11d072", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3ac0ae-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285159, "uuid": "71f83683-2db9-4560-a3d5-195fb6e23a4d", "comment": "Malware payload (Mirai)", "value": "42f4270c5181f159aca6532649723713", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285159, "uuid": "3c40d2dc-a155-4377-b74b-67971384e2dd", "comment": "Malware payload (Mirai)", "value": "8243124f1e17c0269dd475a483b0758dc012e5c682712a381bf82b90e6b6de28", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285159, "uuid": "451e0b17-eb8f-4c5f-a75a-1b1c46080691", "comment": "Malware payload (Mirai)", "value": "776956b88e8e2fb91d4ddd029a8b505ca606d62c", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285159, "uuid": "6616ca28-9cd7-48df-8da0-d25bb9cb6df9", "comment": "Malware payload (Mirai)", "value": "43f27560c6578e22a27f044a682639a24f44127424b4fd849cb603836003471ae278d30b749b7bde58299c71bb8bf273", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285159, "uuid": "02f83fba-af0d-4a23-aced-2016c22f0467", "value": "T154E43A55F8809F61C6C529B6F74D42A873074BB9D3EB72069A245B3437EB86F0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285159, "uuid": "748aecc2-f472-4ae0-b2d0-1ce5b3151997", "value": "12288:T0x+MwUKXSd3NzWjQzfp7k74Z9l+tyzIV3iM5618pQcCjjHS:lMwUQKNSifhk76X+YzeCXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285159, "uuid": "816e77cb-4048-4198-9ac1-d8417a3e8190", "value": 662544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285159, "uuid": "162384d7-75f0-4fcb-bba3-bd384be596ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285159, "uuid": "ceee879a-29d1-4367-b03f-2b2875e4b30a", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbd9894-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283821, "uuid": "3686e697-ec5f-4f78-b34e-1af4c61a5502", "comment": "Malware payload", "value": "f3a1ee12375c9b0dfe82f31374abeffb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283821, "uuid": "b5db620a-38ff-4477-980b-0d3480d2f185", "comment": "Malware payload", "value": "828541a8cf0049e53ec7b5ae631982db63deb8b5340832244afe7d1c6be06c91", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283821, "uuid": "5ebda871-bfe9-4218-b27d-83de334e0fc6", "comment": "Malware payload", "value": "5a6b519f26b95de69355e9c8532c582d7d498006", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283821, "uuid": "4463bf89-4751-4642-980e-20a6563c5ce2", "comment": "Malware payload", "value": "63d56ae3b59011b0f7e99404d17ec84b8aaadbeac2b9b8c1f453cfb32385a116c0ddd9e44a38faaeaec64d8ff2adc62e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283821, "uuid": "c5f624e8-dde5-49a2-bbe5-1677bf959d30", "value": "T1C637231A5F3CCFFF0B7C8A7048AF5E5A9AB7C9C482506AD97BF9ACD9235B94640C4050", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283821, "uuid": "73f6d10c-ada3-443e-9323-8e0fe894bb96", "value": "49152:Q+6Co+6CV+6Cp+6C5+6C0+6Ce+6CP+6CV+6Cv+6C9+6CD+6CMgI9H+6Cl+6C2+6G:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283821, "uuid": "fd001ed9-bce9-4639-b052-13e2fc019b4d", "value": 23164073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283821, "uuid": "97b87269-ced9-4e03-abbd-a6555a6cef22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283821, "uuid": "0a57da86-21d6-461a-a288-8b0aa8bdc2be", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431671aa-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280739, "uuid": "4d8b82e9-e669-48d9-8bf1-054e68b1753c", "comment": "Malware payload", "value": "a083de76b239f2ef101d7b16cf3dc0c1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280739, "uuid": "a65b3cc0-0634-432a-8d64-bafa81771596", "comment": "Malware payload", "value": "8317ce5190df42238c4727d37176ccf5e01c505fd2a5a100a2148b11bb5c378d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280739, "uuid": "523fff80-be32-4157-8570-ba80a0b7fe97", "comment": "Malware payload", "value": "986e9b4f061637d8bd33ee56c1316c6925711ee5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280739, "uuid": "013bd058-b55f-4eb7-81b7-76206d14d172", "comment": "Malware payload", "value": "c7ad37e416e5f5ac79b98609348327d0722c6a0c648f95a80e5240c8b7201a906313b3e30acb3c55997551924ae230d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280739, "uuid": "8f366324-20a3-4319-971a-ec6c1fb9bf0d", "value": "T1D53723A26D2DDC2F0B79238958FB090F24F6CE9C5867BEADA59D34C113AFB0D106E154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280739, "uuid": "1c88bdca-4602-47d5-ab4a-29a4b9b13850", "value": "49152:K5pl5pH5pU5pI5px5pr5pN5pX5pi5pf5pZ5pli5pA5p25pt5px5pft5pB5pm5p+9:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280739, "uuid": "a687e8f1-1d01-4691-a9c0-daf4020ad3eb", "value": 23164076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280739, "uuid": "7b2ff541-e52f-4904-9253-4a67477affec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280739, "uuid": "4912b7b4-5c00-486e-a66e-0917edc885da", "value": "invoice-1645080830.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13577a7-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279313, "uuid": "0d8c6a52-3074-4e06-92d7-00515b49a0af", "comment": "Malware payload", "value": "afbf2828d731fe7cffc64982964e3c3b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279313, "uuid": "cf37cf9b-ab65-4fa5-8b4c-e447ad727eb3", "comment": "Malware payload", "value": "841dda4b900a1fa665029fa896e27e919fc710e4452a55f307f1e4188d8f6c6a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279313, "uuid": "a6b315d0-6114-42b0-8387-9bb12ab23d9e", "comment": "Malware payload", "value": "a16eb11bd0e72c11c140436809952d12d85e7d0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279313, "uuid": "78da2001-fba4-484d-b7c2-69e07c2925a5", "comment": "Malware payload", "value": "698c49dd968ad4b25227f40bd28cc8bb1c2f5d9daa17a5835c32ee66da816ed1cf03ad243d17fd05535a6b5674241777", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279313, "uuid": "1d06244c-813d-4892-b09f-33875a318ded", "value": "T1D23723168D3AC5E74BE001C821FD7C8A9EC4C95800757DAB4E352E9A38DEF7BA642375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279313, "uuid": "8dd242c0-d316-4122-8ca3-7cd99263631b", "value": "49152:jkkkhkWkKkxkfkOk2kUkEkQkLOPwk/kwk8k0ktOPFkJkRkRkKkokvk5kVkIkik8/:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279313, "uuid": "0ba7c683-0844-4ac7-91af-02a861245a07", "value": 24204595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279313, "uuid": "4caeae3d-a435-48a4-aaf0-370ae8ec128a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279313, "uuid": "269cad61-6626-4f6e-8f12-54e7b170e25b", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eedd5d52-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276303, "uuid": "f1e2a64d-1336-4b57-bb38-95cc19033d00", "comment": "Malware payload", "value": "651fe207e7f4e48173f11516d088560b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276303, "uuid": "24b7b193-af79-4c41-b79f-7036f9017bf1", "comment": "Malware payload", "value": "845a60ab5ac001c812ea056f4a244b7b4a9f36340653e4cf2c222c64bc8ae97f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276303, "uuid": "135e256d-8390-4175-a808-cb0dd12d1e4e", "comment": "Malware payload", "value": "434c34f9833c2feff2b45c8aec07ac81f9297b13", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276303, "uuid": "0688cb1c-c20c-43f0-aa96-79bb9b2db958", "comment": "Malware payload", "value": "37cfedce6afabbb68ae80b597f3af17628108c0f0b323ad4a23c733589f81c55b7659b432bfaed4692acf7dbe95ea1f0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276303, "uuid": "7fd4a004-e98c-4db4-b923-57b8f30da075", "value": "T1293723265CF8DEFB569D01DA243FAE1F1DC6CDA4082570B6AABA39749C8F518304F634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276303, "uuid": "2146d5fa-5ff1-4349-802c-968cbd4944d5", "value": "24576:WQxqQxbQxNQxwQx+QxsQxDQxkQxXQxdQxKQxneDZYWHyvQxoQxhQxHQxbQx5eDZs:cxWgkXnUQfHdVk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276303, "uuid": "66100d65-29cc-4b8e-b380-7f8b96455e38", "value": 23944457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276303, "uuid": "c1b2f42e-463e-4c04-8732-526e79bc418c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276303, "uuid": "d5d3aab0-f50d-4c0f-bd47-df7e55bb71cb", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aca2e97-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302710, "uuid": "fe1ae925-043a-4745-978f-cc55d455b170", "comment": "Malware payload (AgentTesla)", "value": "f6357ab2ce16295d93b44fbc7d73e183", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302710, "uuid": "29c00dc5-1264-4bfb-aff8-324dd961ddc7", "comment": "Malware payload (AgentTesla)", "value": "848bc608eee8fcaa25cf74745364761bb15f37c833e143a4c4c1e944c278a86e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302710, "uuid": "e42116fe-68cf-413a-8ac6-4e2cb83c1096", "comment": "Malware payload (AgentTesla)", "value": "160f944ac5765f4da6cd17d7a1603dde7705fc1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302710, "uuid": "011a859b-0902-4adb-a79c-1130b4e2d5ee", "comment": "Malware payload (AgentTesla)", "value": "182665879832bc8e93cfc5874df0a811a1456c04890de7bb7ac63692a4c41da5dc29d3166e5f54f46235d4ea6bad2f28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302710, "uuid": "26e41c3d-60e0-4446-9c55-37fdd861b24a", "value": "T18C2533E46F993D7506F59B5D20FEDB0862731736915C538E8B93808B0CEB78A2A77C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302710, "uuid": "c01dad7d-e84c-45e2-ac97-51394e89dc86", "value": "12288:q7g8dn5AAKcNPppU5PUP6qpqy40U3wSzYRCmpTj3KstZcmC/Q98QoQ+mrSVaO1Zd:GgGn5RKYppQAch3HzxmpBtC0oRmWL1ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302710, "uuid": "aacfaf1d-24c9-44cb-bc8f-9ac30fb46e23", "value": 1035937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302710, "uuid": "34937794-e746-4311-9f7a-a68a5cae910c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302710, "uuid": "4bab0ce4-a477-47ae-9018-b1ac9c7f5465", "value": "ps_pal5rj5H4bCo_1776177017870.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097c2328-4210-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277207, "uuid": "57535e36-2652-4b9e-bf4c-6c1c59eb6ca9", "comment": "Malware payload", "value": "03aed1cf24741ddbae52e3b8b8fc5ea4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277207, "uuid": "e40950c0-50ae-407a-b848-bcc8fff101af", "comment": "Malware payload", "value": "84c1652cb32bd35238e624dec41453265aefa06f41012a92caca854cc1a8258b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277207, "uuid": "d367fd1e-14af-4030-8ef3-ce2552a0fccb", "comment": "Malware payload", "value": "5122e0700b54e8d2c4a807b73fea8d3a36998281", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277207, "uuid": "536d3f35-ce80-481d-9a3b-f9b999e6f4fd", "comment": "Malware payload", "value": "9ecc59cdbe8136f67c4afcf34f5858374cca9fc9dd64430d97ad657c9833fe0db9ff4a78f324699f6b4a066cde1c1467", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277207, "uuid": "e7ad6c61-aa61-4c02-92b9-af8df615ba62", "value": "T1853723136E016D7A923C15041AFE178DF39D4E21A8152732D391698D83A4FB5E88EFBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277207, "uuid": "135bda33-71e7-45f8-847d-f7f53e813792", "value": "49152:7c0plICLs3x6J1CvSsYd5C1CvpZ2+sf/vRyNlCha1Cv51CvpTBj1Cv2h3BeRJscT:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277207, "uuid": "7b876a5d-8a42-432a-ad5f-a6552caac03c", "value": 23684334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277207, "uuid": "86225724-4487-43f0-af64-59b161a03802", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277207, "uuid": "18487071-2de8-465f-a66c-d43059b9546a", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86ffcf6-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284023, "uuid": "8d9b3157-ec1d-40c4-95db-0ccac8120615", "comment": "Malware payload", "value": "74e53270d958a25036f819ac253b71ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284023, "uuid": "1d5e3d2c-83a6-41b8-a001-2c31efd90461", "comment": "Malware payload", "value": "85cc791856af9db5f27a72231cd974efedad01c5fecda4bdc68b99dccdafa1a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284023, "uuid": "e60b2006-80a4-4bc5-a9e7-897d723529f0", "comment": "Malware payload", "value": "6806244702e615419cbe7038b41b5ca4f16cfeed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284023, "uuid": "65d3da68-6bc0-428d-842e-4ee301ae976a", "comment": "Malware payload", "value": "8ea766f9809189c31b9da85c4784e949560dbdef10e2dc2ed871f50fe143fb49fe58e59a3f80a5a51cd1dbd760f4e469", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284023, "uuid": "de6e1e24-05df-40e8-bdd6-fbd052df9043", "value": "T1F93723334EABCDFD8A1F3B4419AE8F946B548F10D019E59D13F76D07105EEB6808B2A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284023, "uuid": "3d155e23-216f-41a3-b61d-6a466bb57d08", "value": "49152:bxIZOq0BeHXsNaQB3P4v0u6F99JC/TjOvI3PuZ3eFCuAxJO++++Vcrdr9OrdrGUb:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284023, "uuid": "87ec15f4-fc56-484c-b87c-bf60be06d3c5", "value": 22643803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284023, "uuid": "8531ecfc-82df-44a0-b9ff-ada86b7308c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284023, "uuid": "aa2ecc85-2a0b-484f-8d2b-ec66c830d6c8", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545dece6-423d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777296660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296660, "uuid": "b15409fa-bd2d-4ece-a4ec-97770e7f448c", "comment": "Malware payload (Mirai)", "value": "69aba2e95822e7af262e7ea9d76d0f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296660, "uuid": "852435c5-47f0-498e-a6f1-273b15e28d0b", "comment": "Malware payload (Mirai)", "value": "85e8c28536f6c8e7135ff25d97045e834c9bc4e163bd7ec5f81bc56037b4b58a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296660, "uuid": "f61b493b-2763-406d-906a-6d7060475c58", "comment": "Malware payload (Mirai)", "value": "4e40c865983d36dcb0bf7d4ec0b4299fa8022036", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296660, "uuid": "9e2e0252-c1a5-4f05-8489-c22fffd9aeea", "comment": "Malware payload (Mirai)", "value": "f50bfa04f71a4d3178d8cca09badaf1702c1d93cf994b5d4bb890102a7e986abfc3921fa292a61f9f2acd7dedb61194c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296660, "uuid": "6719bd21-9b1c-49db-a6a0-0f930f7904e1", "value": "T1AB33F2658278E436D13CD6F25C2E0CC3FA32B8996553370E07F722AD5D179705E51E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296660, "uuid": "54214ef0-51eb-4e68-89f9-9f233d9f2cf2", "value": "768:RYIAK9Eb9OpoO7/Fi1GpUyP2Qffb3Pv/9/v9SqkgMcKaSKyKe8I92piNR06++Ne/:RYIAnKLtiaj2Yfzv/xjkNylDp5tnvlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777296660, "uuid": "d5d96ca9-7a5d-4a95-8907-db0357718ba0", "value": 53836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777296660, "uuid": "17bacf79-733f-4d82-80e9-c49de3e20145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296660, "uuid": "eb81531c-7d4b-4e84-a113-f5dbf84857b4", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062fba4e-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276342, "uuid": "01ac9acd-6571-4f3e-bfc3-cd67aaeb98ec", "comment": "Malware payload", "value": "721b97e41f85f263ce8fe37a3c9935b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276342, "uuid": "4a14756b-4897-4157-b4a3-b0d75f99a8e8", "comment": "Malware payload", "value": "85e966ea004387a69562f622d3655031f26f02af5bc9890d1aa3610580da441c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276342, "uuid": "25b7d857-62cc-41cd-b135-812bb997a196", "comment": "Malware payload", "value": "972f5e018d8e72248c8bc5d8dec17bf6d57697a0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276342, "uuid": "81ec3077-dce8-4a70-b5b6-2888846daebb", "comment": "Malware payload", "value": "9e14f114e2a0f88a8355aec951fb4267cc683127a339fd6cf68ea2c84e9c3db0bb6d02184edbf055cce5fd3e40b13a3c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276342, "uuid": "6a59cfa6-a9f2-4bf4-aeaf-703a4e0be2ee", "value": "T1E9372312AE089F5C9BBD6E2810F59F3C54D20D85C59A8EF077A9ECAF67CD61270B3064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276342, "uuid": "fb594cd4-5ccf-4c38-ab8f-32ef7620dd81", "value": "49152:GtqbOtqbutqbstqbYtqbntqbJtqbntqbstqbqtqbZtqbqtqbC6Cij3tqbltqbqtg:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276342, "uuid": "9c2ddaff-fef9-4dc0-af00-e7cd3687c4d9", "value": 23944470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276342, "uuid": "a23fe2d6-57c5-45be-8cc7-76695f724305", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276342, "uuid": "c382d954-7032-475f-9465-00743f71b32e", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588ff1d7-4246-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777300532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777300532, "uuid": "9f8b56c6-87df-4161-ac17-fb54445430a3", "comment": "Malware payload", "value": "396bcf1d5d021453aad5aa4b62341f64", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777300532, "uuid": "a51b8966-107c-4d82-ba78-85c9a709cd35", "comment": "Malware payload", "value": "860d5d42d8fe1e1e4da37b4373a40826b6164d0ae092b6a81cdac85f46b0f878", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777300532, "uuid": "63bd2c55-a2e6-4610-9a54-8c142d7c39d5", "comment": "Malware payload", "value": "f663278153eff0f83e303167287615b3ce03d64d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777300532, "uuid": "2db25d6f-8a00-47d3-83f8-43be41f7a981", "comment": "Malware payload", "value": "508aa626b9ec24bdf996ff7be386224783416398eab8c170e2a2f16775c19de828c02dd2e6c1905ec75ec05b0569f161", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777300532, "uuid": "2824ec52-d784-47a9-b622-5181b9fff471", "value": "T17B25E036F94589CFC427C2B17A12DC900B0EAE527758ABD2342E7B66B773E5DDA83041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777300532, "uuid": "c78f34c1-d103-42bb-9f02-e10ec94e5b24", "value": "12288:zh8UzslKthcraEbBXK97Be0NK3odl+KzslKthcraEbBXK97Be0NK3odlkcIhjb2M:k9rVcBeAK3odlu9rVcBeAK3odlk3P53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777300532, "uuid": "8f13edd2-03cd-4aa2-8a73-070322992233", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777300532, "uuid": "3f6b56ee-4654-4884-8b32-28b374147bba", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777300532, "uuid": "04ee0d06-b65f-4b2e-a274-31bafb6c4735", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.30118.11742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0238832f-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283637, "uuid": "938f916c-bcc1-443f-993b-1df1220f780a", "comment": "Malware payload", "value": "84ba5a26d6c61c78883a384eb50fa8f0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283637, "uuid": "f67cde64-d1ea-4b2b-8bcf-4829178bd118", "comment": "Malware payload", "value": "8610470c9152baa063b98267eb5f21c1480f9af70cc49fe50aafd2d6e985ea45", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283637, "uuid": "225e4180-8ce0-4c6f-9948-1179a2fcb8a3", "comment": "Malware payload", "value": "053c2327ffd7814499a9b48ffd9156c7c5c64ad0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283637, "uuid": "3e9bb0a9-9b6f-4ed7-a0a3-b13ceb71e266", "comment": "Malware payload", "value": "36de0a2f81a6b7337ef71bbe71ad52767a70512613ea4d597d5f881a190044daf772c837f56b9888443072500a82ada7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283637, "uuid": "2cd8eb85-65a5-4df4-98a8-e6ef10a52cf5", "value": "T105F19F61B875F0B6E14263753F6E146C1EEA8131D4A6551EE23E26A223C348DEE931D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283637, "uuid": "4a71ae93-88bb-4693-a359-e031219fda3c", "value": "192:6nIO7uZGOu+5d8QI8IQI7I6LggmWCzUYGgb50X:6L7UPhI8+7lEgaUYGa+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283637, "uuid": "58de8deb-3bc1-4e58-b955-96d4d3dc40cf", "value": 7477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283637, "uuid": "ac820e78-3011-41b9-bce1-ecba620d6364", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283637, "uuid": "8f8a1dad-811a-49b1-b513-df7055817808", "value": "photo-123621198.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94aa7a9b-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1777264985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264985, "uuid": "1561838d-a5bc-47fe-95da-1e48d932d5ea", "comment": "Malware payload (Loda)", "value": "f0fe6033d44c7f72869174ef5dd2a3c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264985, "uuid": "15f0f214-f1b7-4993-92d1-74b73a22dc6f", "comment": "Malware payload (Loda)", "value": "8658945149b1a430f631b774a6e8451b969193bc3ed6ac78b4c4842599d1e5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264985, "uuid": "9160a50f-cc9d-4a5e-be49-47385bd0f09f", "comment": "Malware payload (Loda)", "value": "6391a7396296391960424c9f611f98245964dd72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264985, "uuid": "bb6072bb-a2ee-4b22-950b-02c5c5a98fd9", "comment": "Malware payload (Loda)", "value": "c7dada72481d14d12ac427bf3d596de2999ad379bf233bb37523cdfb7c64c4cd6965c3f63ce118e7c0e655aa0b4dd1ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264985, "uuid": "d33c3a25-d93b-4e3c-9793-6916a603e447", "value": "T1DE0523299E580CBBFA2E023493E3CA2717ADF643445B8BD4EE15CB6F0144A166D61CE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264985, "uuid": "fe25a8e5-ceda-4890-b607-79b9e0c37600", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264985, "uuid": "e96b5821-9fc5-463c-bb48-7d666bfdc87e", "value": "24576:FhloDX0XOf4cLrtthkRXGNZzEi29113g/1w/:FhloJfHft3xEiS11QC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777264985, "uuid": "62a83789-5b79-4bb5-9c59-462ae603bdd4", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777264985, "uuid": "9ad40105-c7b8-41ad-8fb4-2eee6d2f53e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264985, "uuid": "711e4c24-c80a-456f-83a2-171f21b0b8b3", "value": "8658945149b1a430f631b774a6e8451b969193bc3ed6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69cc878-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285631, "uuid": "bb57d524-e78a-42f9-831e-4e84ba38d875", "comment": "Malware payload", "value": "e4cbf110307c1342cae620cdf6e57f33", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285631, "uuid": "8261bea7-7b56-43f6-8e43-a039c88cfa18", "comment": "Malware payload", "value": "86ef1149a6c0b898e52895787ec52d2969a2ebe05b1015040bcc9f2943d2002b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285631, "uuid": "366b7c26-ad66-42bb-b21e-daf5e8f6a488", "comment": "Malware payload", "value": "d369d1301b0dc4f5419e2795ae9a10736801cab8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285631, "uuid": "04ca5aa5-5cb8-4241-b772-d9f94e7e2e97", "comment": "Malware payload", "value": "02353afb0f73ec1d968a995711f845ba31a3f6e5dd2d268a1e248a17120b69f029aaf56cd03ccbfa4f1e11636d8b5417", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285631, "uuid": "e69d075b-be9a-48ef-8164-6b0df7145bd6", "value": "T19B3722070E6796BF9EF9B75404CE0F9F9FF988540898E15A6BF86C1E710D628349326C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285631, "uuid": "656e7504-cad0-4246-b229-b9d6303ee635", "value": "49152:NxU0XDp+PSEBUh2T+E5AaCIh2T+9vwTEelw7yYi9DMh2T+nh2T+Nwwkh2T+gMsFA:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285631, "uuid": "528c0362-b01b-478e-995f-4acd5633262b", "value": 23164074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285631, "uuid": "a6eb5fa2-6100-4f79-892e-94fb62a5e9f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285631, "uuid": "37530a03-822f-4ff1-8e82-96662e808782", "value": "invoice-1645080830.pdf (57).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637ec57c-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302698, "uuid": "4a38390f-a269-488f-8a4f-e64c66d8c507", "comment": "Malware payload (AgentTesla)", "value": "974c385a45e41dfd0b37810e9188d53f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302698, "uuid": "acc204b7-d546-45e2-af50-17b29d920fc6", "comment": "Malware payload (AgentTesla)", "value": "87da4b4b603182ee73c2061467f75ef991a75c0b6d8d3cf733d5f824c5e8ab16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302698, "uuid": "e729f8eb-c35a-4a8b-b02f-ce4ccc79391a", "comment": "Malware payload (AgentTesla)", "value": "1ed05c5b1c57f13f9766ce81b975d3451b8e1ecf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302698, "uuid": "e1302d2a-8fc0-40b9-9cb5-4cdc409cc735", "comment": "Malware payload (AgentTesla)", "value": "5fa26af06d1ddd3c20f49bf718dbd402f45a52f15a117b04e691fa5ca0e4b790ca13896b61caf6e67a5266d4f8ac4d00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302698, "uuid": "ca91e162-e105-4484-8a23-9e9359a4c9bc", "value": "T191253350E92A67718754E2B9817BBD893BE092490C42F6EB7ADC76C02F53363CF79844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302698, "uuid": "5dc13f4b-5222-41be-8752-9de3efcd31ba", "value": "24576:NrH1Xcclqt9/PrtVQCKDBmaZBDIeDBZfUt9W6b:NXVTmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302698, "uuid": "64246606-82bc-4806-b726-3eda6a7b621b", "value": 1028431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302698, "uuid": "66778e7b-aa6a-4caa-bb79-6a66ea512945", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302698, "uuid": "9e475761-02c2-459d-85e9-23be00a59224", "value": "ps_or9CmH6BXZ41_1776261029864.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c414369-4293-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777333556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333556, "uuid": "1586f416-346c-4563-b5d1-ca73bda3d112", "comment": "Malware payload (Mirai)", "value": "efd03af3db524f473e7e5c976607444c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333556, "uuid": "659e6f1b-ade7-492e-b38f-8e07b6326067", "comment": "Malware payload (Mirai)", "value": "88a96ca06f669acda88f60b30fed09c4aaf6abdf760c2d98bb38f9211956c182", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333556, "uuid": "8e1b30db-b0f4-4276-bec2-257df92d1df8", "comment": "Malware payload (Mirai)", "value": "ade6e0c70b772fcbfc2ec23bd626092021aaca97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333556, "uuid": "585423e6-6438-48cd-bf28-acedd60a2de5", "comment": "Malware payload (Mirai)", "value": "1385c6af948ace5ad61663c8704f77bfdea5c775735aa52afb230bdce18adeb10497e77f6d187c5551aabe3199de6fe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333556, "uuid": "e567c8dd-8e99-40da-abca-7ee29c4eb55a", "value": "T1DFC44955F880DF62C6C12976FA5D86AC33174B79C3EB720689254B343BE786B0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333556, "uuid": "4ec95d09-78c5-41fd-9659-c05f6a73b945", "value": "12288:kNGQnhhbnkjGWYymcz/bSCCextULs9mZ28FgpketGd7:kQQfnkjG/ymcv3tSsc2hwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777333556, "uuid": "17f278af-9a17-48da-b9dc-a1d0e3c514e9", "value": 574756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777333556, "uuid": "d856df84-c447-41f9-b72f-8b1401a9f3be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333556, "uuid": "bbb16b3a-0626-4c50-8b47-6ed691e1c837", "value": "agent_armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfaff144-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285673, "uuid": "b8eb2a0e-118a-4575-a909-b97b3ed261f3", "comment": "Malware payload", "value": "ae0a5563e447bece49da3ed3438c0697", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285673, "uuid": "a378b26b-9ef0-48cc-8404-340db504c7f6", "comment": "Malware payload", "value": "8938422cb6c54f68af7be537201d39f1c86d1f6302ea1a14401bb51027eaf919", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285673, "uuid": "3631325d-011c-426f-b415-ee57d1405709", "comment": "Malware payload", "value": "fece6fd85f09f620f8e205dcb86a1fd03298c5d3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285673, "uuid": "78135fce-b505-4da8-ab81-4dcd1a13d64e", "comment": "Malware payload", "value": "fa60b45b7aa78b3a7d89488e2a2a85a8bacee906e86eb4065d7db829c9fb829b1567a9ef2e07bf3fff18030a4d933ced", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285673, "uuid": "06638267-5ebb-44a6-a6a3-73496089df0a", "value": "T1173723084D3B2A7F473C121245BF0A9F45A1664A075A5CC333ABFC27A9CEB25A1EF157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285673, "uuid": "4668da59-e395-45d4-b970-82d49c149cc4", "value": "49152:RyjkLqnYMyjkLqnYOyjkLqnYQyjkLqnY8yjkLqnYByjkLqnYnyjkLqnYayjkLqnS:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285673, "uuid": "13441680-7128-4428-a221-dcec17ff872b", "value": 22383673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285673, "uuid": "e4a27cbd-f2bf-46ab-b363-0cdbfb7dd0c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285673, "uuid": "d086c6f1-38ab-4da0-9a0b-f515f7617f4f", "value": "invoice-1645080830.pdf (55).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ec5ca2-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276805, "uuid": "97d255b2-bd15-4bab-8a95-fc7b2939e904", "comment": "Malware payload", "value": "0dd2c158b444317f81c3acb8b432d7d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276805, "uuid": "641470b5-68ed-4184-8239-4b48e71dd908", "comment": "Malware payload", "value": "893b92e28c01e229aa964e1ce5d3a1112ecd7a3a2245e47afb7806f988e2e772", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276805, "uuid": "9763c92c-d1c7-4950-93e6-8f3a23d55f1d", "comment": "Malware payload", "value": "9a378a3c9e7185dbb67ffe57d6de9f5b8df82cac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276805, "uuid": "689121f5-d0b2-45dd-b4a3-d7dee656f8e8", "comment": "Malware payload", "value": "f9dce9ce19728936e35530070eb01308fe089f988b7e5700c12650882703e6921532fad0e2494ded9b68c6cb83192eb2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276805, "uuid": "136c2d83-33ee-4915-b7bc-c2d10ebe5a37", "value": "T1DC37232A8375CFF786FD255E6122AF1D00B8C81D403BA89995A97CCEC75F93A326171C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276805, "uuid": "5c49523e-f31e-4377-a3d1-92e615cca20d", "value": "49152:Krl2/D14/w61GIQ5UkALIPyHfPv3TYbRbUJyI1ITVScI00RIVmmfr73b9NeKeOcF:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276805, "uuid": "7b882918-06f1-47e0-b7ad-1f83d2113f2f", "value": 22903943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276805, "uuid": "ff286d8d-e42d-4ea3-8a1a-5194a415e21e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276805, "uuid": "96cc1681-20b3-441f-a878-7ff12276322a", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d0a07b-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279321, "uuid": "d187c2e8-fa2e-4d65-b1bf-34dac75ad002", "comment": "Malware payload", "value": "c7d30c87f6f5ed3cb685b05e984a85d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279321, "uuid": "44f6cb5f-f34a-476b-8165-c2789e8e6bf9", "comment": "Malware payload", "value": "89b6cdafdf20bcd861e79e3d5b7ee45b70f77bd3765b75cebaf11db5f980f456", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279321, "uuid": "2db7ba95-2f8d-4764-b6bb-c03d8b48a7d0", "comment": "Malware payload", "value": "73ae9f3dc880eb29cdf456b992b2ff4d5ba3d68d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279321, "uuid": "f9581d79-ac9e-466c-abaf-52922ac68d38", "comment": "Malware payload", "value": "396f5d34674e131f12458ac813a5dca29f3835134f5f459d3ada343bc3f593c1d19d5cdd4819e42a49063df7d8541f3d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279321, "uuid": "e3ca78a5-b2a1-4cc3-b8d9-e8ee6167e368", "value": "T19B372306EE7D7A2A8EEC255C60ED870F02FA4F2A9086F2C967D02EFDA30DE50555F505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279321, "uuid": "a7eac1ab-8501-413a-837f-02298514029a", "value": "49152:dkaYpqkaYpxkaYpMkaYpykaYphkaYpvkaYpZkaYpPkaYp+kaYpPkaYpFkaYpjtkG:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279321, "uuid": "afebb7ed-316b-4a24-94d3-6d0992f20cc9", "value": 23684323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279321, "uuid": "c30a6a2c-0fa4-4a60-809b-b2f602c5acee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279321, "uuid": "0a43094e-b65c-4c31-b8dc-fd61d49d40d0", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ca7653-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323054, "uuid": "3632dc3c-70af-450f-b445-e2ab08fffb53", "comment": "Malware payload (Mirai)", "value": "d580550cd2cfdb48efb75e3abfd4ac73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323054, "uuid": "294d3320-876c-4bec-9a3c-39b847d0a84d", "comment": "Malware payload (Mirai)", "value": "89feeda2b849ec075be7115067fc6a8a661179571b73dca0bf766e4eaebed640", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323054, "uuid": "9ad8ca45-1c14-4da9-b398-71f38a391761", "comment": "Malware payload (Mirai)", "value": "872ef8e00028fe6ce4b260a81127572bde4567ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323054, "uuid": "b567a848-8464-420e-95f4-2d97098c9fc4", "comment": "Malware payload (Mirai)", "value": "8707d92b89fb1344d26a5efb2ce62022630164abb3e4ff0b37ac55d19346b27429792bca8954a34034130b3443f775a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323054, "uuid": "b7ac5213-c380-4cc9-a1aa-22aa85b815e6", "value": "T17F63021002A5D9B6CA61C1377DF449DAB2062EFDB76EE65B12BCE41761F0E53B07B802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323054, "uuid": "1675f4bf-1740-487b-91ea-7cfc6fc96bf7", "value": "1536:qwa/7W2gZdt+WBa1u3IXl+OmzIHt570LaB9GMpi:qwE7nIdIWBR3awOxd0LYgMpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323054, "uuid": "aa6f135d-b98b-45b8-8a90-cd190de2804c", "value": 67392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323054, "uuid": "26c2d90f-8bf1-4a3f-a0b0-c0e6c75c7fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323054, "uuid": "c32bfbd6-a0a9-4f60-82bd-ff28699b008d", "value": "vaxstresser.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4dc71c-4274-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777320481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777320481, "uuid": "aaf2db5f-ac34-40e8-98ad-37fb2ad76035", "comment": "Malware payload", "value": "befa11819994d5879c44608b16ab03c6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "maconecli-gitlab-io", "colour": "#DEE4C2", "exportable": true, "hide_tag": false }, { "name": "mendalik-com", "colour": "#11D539", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "SHubStealer", "colour": "#C8ACD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777320481, "uuid": "6a35b7bb-dcda-42df-a44a-baf02b997374", "comment": "Malware payload", "value": "8a0aa2c9d912e045f70fe90f5c2da97154990c1058908e6480b3a89275df3a3d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "maconecli-gitlab-io", "colour": "#DEE4C2", "exportable": true, "hide_tag": false }, { "name": "mendalik-com", "colour": "#11D539", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "SHubStealer", "colour": "#C8ACD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777320481, "uuid": "1c3cbf79-7b14-47fb-bd1c-c7351b7a8311", "comment": "Malware payload", "value": "17f009c8b471a4ca7c174caf5ef0033e6284a9b4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "maconecli-gitlab-io", "colour": "#DEE4C2", "exportable": true, "hide_tag": false }, { "name": "mendalik-com", "colour": "#11D539", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "SHubStealer", "colour": "#C8ACD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777320481, "uuid": "a005da9f-c8a9-487d-8a80-3c3b0f548ce2", "comment": "Malware payload", "value": "a6ae916b13da5fbbea61f46a0f508b0d83afb0b0a6ce09a731bfbca765e58c02e95989d653ae46c10c29e55cd401721f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "maconecli-gitlab-io", "colour": "#DEE4C2", "exportable": true, "hide_tag": false }, { "name": "mendalik-com", "colour": "#11D539", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "SHubStealer", "colour": "#C8ACD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777320481, "uuid": "b9124e0d-4d39-4d86-b9bd-3e809207d308", "value": "T10D42C07405E5BE67CC0F8F92076520CF85B08242D5D3162D1F136B5AB0EEDECD1A66CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777320481, "uuid": "2c6cc5c6-0c50-42ae-b873-e6abf6bb2e99", "value": "384:sF60JhLAW98rZtF4C2M8cr6Q+eMD4cDWO5Komc3nV/S:sg0F8rZv8c+JeMD4sWaKomMV/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777320481, "uuid": "72ca5514-5316-4e43-91fb-e061389d5d7b", "value": 12567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777320481, "uuid": "98484217-78e7-4408-8b4d-151aa65648b6", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777320481, "uuid": "e9c73d7e-5841-448c-af26-c409f386e173", "value": "payload.applescript.sh.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9e667c-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323032, "uuid": "7363c08c-faed-4485-9671-2bef9dedeb68", "comment": "Malware payload (Mirai)", "value": "7d3328f46b51a88e54be397fecc44ffb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323032, "uuid": "7f5a0b93-5266-4002-bb67-3e120f25da4d", "comment": "Malware payload (Mirai)", "value": "8a21b2a34d07ed8cfbfd2a0c621f0152628de493884177395ae16259a5a70479", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323032, "uuid": "9d27feba-db1c-42f4-9151-5dbcda67f9fd", "comment": "Malware payload (Mirai)", "value": "5c3598e868ad3b37b75fd271d891190cd67dfd67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323032, "uuid": "32e3b5f0-6618-4f00-bfe3-3dd067357bc0", "comment": "Malware payload (Mirai)", "value": "a5c27521134e3ebe82e6b56ea4f4c6243fee8ff325aa542998337f2a18a2e4e68e125362b62da0a231fc90fdc14a6670", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323032, "uuid": "2109b5b1-ca35-465e-9aba-d72931c7eca7", "value": "T1FCB2D1192849C150C5343D79F95DD6D302430AECA1FF2C3A320D8C7A678ED6676AA7B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323032, "uuid": "f01f4f62-53d4-4a45-977c-e4b6a459a659", "value": "384:hE2biV2BlW7PUOtmnUYLvqOrBJpFCcvqtJTFCl+hhPsgzOL2fhymdGUop5hu9V:hEb8BULtmnU4v7jQNwctsoOLSs3UozMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323032, "uuid": "165047bf-6a9e-4acc-bb3a-d6c824e1631a", "value": 25128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323032, "uuid": "fdce8ef7-af23-4255-b3e9-6eebb7de8079", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323032, "uuid": "f0b0f275-2e95-489b-97f8-0422ee12ede6", "value": "vaxstresser.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b38c69-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276128, "uuid": "8c5254db-58a2-4bbf-819f-26920add22dc", "comment": "Malware payload", "value": "3766047a2cfe54d8724c0f181a066afd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276128, "uuid": "d5f27fb8-ef82-47c9-b7d1-de2a43eaa615", "comment": "Malware payload", "value": "8b0c98957f13b5a2a9b69199c16f0903757e91e8a0e0556ffc9ea08be3cf623c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276128, "uuid": "427dd716-9122-45e6-a702-e38f6ac91e9d", "comment": "Malware payload", "value": "f1e2f03f1c936328a86eeb9b67e4e8d4fcb4538c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276128, "uuid": "ddf28772-361e-4659-a105-e3259bf74090", "comment": "Malware payload", "value": "58e539eec6c665d3c52e41d3b939acf50218a2e96418ae43bbb50746d1a3e5641788d13c8f0f2b30a183d7a0cf5d2848", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276128, "uuid": "fa4b02d0-78e9-4aed-8bfd-af446fbbbe76", "value": "T1872723100C1EFDAD5A7931DE26DA1B4B2BA517986080CC83B6D9703F6E9FEAE1075077", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276128, "uuid": "9f1547a7-4566-4faa-9510-dde69a3083f6", "value": "49152:iGgEGgXGgRGgnGgwGg6GgUGg6Gg7GgaGgEGgqKsGgHGg4GgGGg+GgEKjGgzGgpGA:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276128, "uuid": "0ee9d3a4-1da6-457d-99d8-22265b985be1", "value": 22123543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276128, "uuid": "5c7fea16-25ca-4170-8489-a6d3b6286a3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276128, "uuid": "cbd5a4d7-a296-43e3-bdb4-41be6286225a", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28f0d03-4259-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777308924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777308924, "uuid": "231df7d0-c775-4fe3-93bc-6a724baadd6f", "comment": "Malware payload", "value": "76e08cc007e4000ea080873f5026357b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777308924, "uuid": "2f28d57b-72eb-46cd-8da1-83127af1cd88", "comment": "Malware payload", "value": "8b3ff516d65e2166e965d38b1ab4e53f8835713bd7886b0a884d7065709508a5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777308924, "uuid": "07ee3550-e5bc-43be-a137-c45ef8e6e037", "comment": "Malware payload", "value": "644c678812e0a04f2dabdb50b73c7eea8e6bc051", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777308924, "uuid": "7b01ae2e-ff9e-4d33-a2bc-881a1a259bb4", "comment": "Malware payload", "value": "c9d7b0051bd36f5c27c4c7eed4ed22917dd706f08a8e67d9b3e23ef5bec453e031bde4a581ba9510735ba01a0d708bfd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777308924, "uuid": "7439e7cd-09c4-4548-8b8b-336d1366a495", "value": "T1F8B2E0F1F8ECA436369D453ABB9CA805A9CF7C2F4DAB7D2014575938411CB1EA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777308924, "uuid": "9ecfb5ee-1f78-4c9e-bfde-b2964b24cb52", "value": "384:MVc3s1oisjsKG6qkSgjkjV/A4UAcGE3JNRhQuW5Q:3shUMkSgjkjVdUAcd3JN3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777308924, "uuid": "3aae9867-f0a3-460b-b8a5-0c6a4b83eab6", "value": 24176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777308924, "uuid": "19a337b0-d096-4adf-a83a-ed18c17f5731", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777308924, "uuid": "e979edcf-7eca-48bb-bdd9-f34f907655e3", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad554e55-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283924, "uuid": "4b1fd289-bee5-40e2-bd8e-6ce6c1d1229a", "comment": "Malware payload", "value": "35de252d70c137c73aaa0d93e59f300e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283924, "uuid": "65c7367b-d343-40be-98f4-0f3d2af725d5", "comment": "Malware payload", "value": "8ba44e92f253ebb87ec4beea571e983ac81010a43a3f30532d64c021a3f540d6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283924, "uuid": "4147eccd-febc-4c1e-88ec-f52ff385cf14", "comment": "Malware payload", "value": "e46e6590bf798fc8a252fa3b6ebbffaf2b1de379", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283924, "uuid": "8b869a6f-497f-4d4e-afac-4f5f50d10635", "comment": "Malware payload", "value": "930338366cae5e2035b16c377ed416f6a908b275ba2f79d74398af2af5007195fab31907772da17667e52399b357f6b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283924, "uuid": "ce2e0ba5-af02-4293-a952-d14607149d96", "value": "T17A37231B4D13EEDE03E810AD91B74DCECCF43F9A82785288B999395E85CFE265C1507A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283924, "uuid": "495a74da-b2d6-400c-ba0e-c6664bbebe93", "value": "49152:XVUsnTVUsnKVUsnfVUsnAVUsnqVUsncVUsnhVUsn9VUsnJVUsnTVUsn/VUsnPakC:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283924, "uuid": "32cf1d87-8579-41e1-aa56-568863a73c2e", "value": 22903940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283924, "uuid": "b9f42167-4c6a-4ad7-9cac-dd611eb74e32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283924, "uuid": "a189cb42-f2e8-4744-95ae-c76709744f27", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd009fb-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279306, "uuid": "c43ff3d2-704c-47a3-9f19-0cc34b4e50f6", "comment": "Malware payload", "value": "fa4f6f46bb10b0756f2992bd076f7bb6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279306, "uuid": "04c79590-c1e9-4379-bb94-1eaa477dc57d", "comment": "Malware payload", "value": "8ba62567c7f71ce534465140b7fee1b19be17a80fe2a05403c8ee2599dae9cab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279306, "uuid": "fc60e11a-ab12-4ee2-a86f-1a02432f4013", "comment": "Malware payload", "value": "1d31799b1f9a93005eebdf225b5af7e87e2d38e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279306, "uuid": "bbf4a52c-dd71-4f32-afe9-d17ed05aa8b0", "comment": "Malware payload", "value": "b19ef907f38232151e9bfd895db352c4916ab8df2742fafcc61912763c15723832e221fc7d6c38242239df6f38c1d68c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279306, "uuid": "cce845c4-344a-4ff3-bfd0-65b0cf31308b", "value": "T1EE3723531F755DBA43E8C16EA0AF4F0F023B5FA980512FC4F6A7281F664BA4509DB1AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279306, "uuid": "43cd6dfa-9593-4407-abbf-191d5240f771", "value": "49152:tOa4OaVOaeOaxOahOajOaAOabOa8OaeOaVOamOaCOaPOa1OaFOaEOaNOaVOawOa/:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279306, "uuid": "a760b817-3fc8-4d5d-8e5e-bc49cc6438ab", "value": 23684335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279306, "uuid": "8ab08310-230f-43cd-b9e2-7e581f2f9f8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279306, "uuid": "e37a6818-1f82-47b5-9a5d-9c069723f692", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a9fdbd-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777275997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275997, "uuid": "d14829ba-3f65-4c91-abc2-2a93a43a4432", "comment": "Malware payload", "value": "6e3f137ba270943f3a12ae1008f79468", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275997, "uuid": "a5e87225-6515-411a-8ee6-ce57570d6d34", "comment": "Malware payload", "value": "8c162fe2c5d5eaeb4299378fd55ca3c2207ab42ac89ea1dfaffd1443781e314e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275997, "uuid": "3304f627-4ad5-48cc-83a4-64a0ca991698", "comment": "Malware payload", "value": "dd337e7858ba7fc232ffbb37338032102955f78b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275997, "uuid": "82ee8ba6-2199-4a7c-8e37-28cf36961cb3", "comment": "Malware payload", "value": "a4e9973cd8b0d33d073911b2093cf18b5b53f22b0a5ba71d88c18157c302ba794ee1701df9433f6b7b1605fa12add6e9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275997, "uuid": "d8dbb784-5244-4ce4-8836-8e969e941bc3", "value": "T1763723072BBF5C2694ED716CA9BE1A0390F20B410C4AED99D3DA61DA427DF0725C7BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275997, "uuid": "6e50efcc-b638-449e-b842-c0e28261c107", "value": "49152:1DhafPJRscvuCS2XTiuiSh6fltXQxy9NdgmcSWSB/LASyYrrONVk4AsImoiwiwAH:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777275997, "uuid": "01b762df-7458-43aa-b3ad-2e162aa179a7", "value": 24204586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777275997, "uuid": "6faa225f-bb96-453d-add7-fd129a1dc119", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275997, "uuid": "d94b4b14-533c-4095-8931-5df070622a7f", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceef1a2b-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285698, "uuid": "712b606b-8c72-4119-ba14-4a3a2484eff2", "comment": "Malware payload", "value": "d09c8ce3bfdd8cdff550c4e9d4e1de81", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285698, "uuid": "a6c92e59-0379-4c93-bc79-29a5a87e6f69", "comment": "Malware payload", "value": "8c631e207bfc4c7208b3936bd7d6f0237447ec6723165782819b1f4d1c3db06b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285698, "uuid": "313e6221-fbc8-43d0-9992-0f9ce836198a", "comment": "Malware payload", "value": "045783f122f4d2f8abdaafa53489babb7d4451b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285698, "uuid": "1ef2fbb7-1d10-4ea1-bb64-0a54d014e824", "comment": "Malware payload", "value": "f1be69988cfb1d0d1e321446921d2d68ab8a1919b03a4aa40a858dfb349e5479ad1332b78709a25b3ff27cd4b9ca883c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285698, "uuid": "91702656-0960-4633-bf87-6a86f479ebae", "value": "T1BE3723178BAA2C3B0F3C77B832BF4A049BE65D84104DE495E2FF5D1D858EC4A5B5342A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285698, "uuid": "a7cbacf2-406a-4456-bfa2-8557b507261d", "value": "49152:qwuwhw+wKwtw/w5wvwYwvw5wR4pwqw5w/w6w6wv4pwTwKwww3wZwUwjwSwDw2we5:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285698, "uuid": "b0dcfaef-14e5-41e7-ad61-236b5b894aa2", "value": 23164071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285698, "uuid": "b23bbbe5-93d8-4f5f-8d49-1936009098b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285698, "uuid": "fbf59478-3538-4ec9-ac3b-4281a8e373d2", "value": "invoice-1645080830.pdf (54).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3833387f-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279003, "uuid": "ed661739-5ca5-4ac6-a221-cae6adba3523", "comment": "Malware payload", "value": "b3ebe0e555176048c12af4fc3b60da4e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279003, "uuid": "381cde0a-c199-4be3-b6f2-5c27ccc11eea", "comment": "Malware payload", "value": "8c8fb54fe586cb8b157912427df59b52f202f8689e6fbd864cf4a13d3f1668c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279003, "uuid": "9e89c35a-90ee-4df7-a2ff-553a714dfb4a", "comment": "Malware payload", "value": "71fee565791b60846c69a98f24b7751f65e3c397", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279003, "uuid": "c8592469-c76e-47cb-a443-5e72e7abc750", "comment": "Malware payload", "value": "64f81dcadb97fc26a4d31c7576d1dd5a2e431050ea1173a5a45ed2b586cc18e1e1ae384a8855fee1fed8c0e870fb9794", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279003, "uuid": "dd108ef1-ad7e-4435-9e28-6f13cfe409b4", "value": "T1093723374F599E67B7B6229C202F5E0E17A1DC1C4809ACF125A3F5F8834CD687AA395C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279003, "uuid": "12f2ba9a-70db-45e7-b1d1-66cecc1ce3b8", "value": "49152:KzHmH4zHmH6zHmHdzHmH7zHmH6zHmHQzHmHtzHmHhzHmHXzHmH/zHmH7zHmHIruL:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279003, "uuid": "3fc0cdb4-1f3d-4818-bf54-6e892be0f264", "value": 23424194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279003, "uuid": "b4ad84cb-e020-4dcb-9ded-8b3c1eaf248a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279003, "uuid": "5cc8b1c2-5469-4f82-9022-72fe226051eb", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40409556-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777302639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302639, "uuid": "d1fbe577-d2d4-4bff-b29a-aeea3ccd52ef", "comment": "Malware payload (AsyncRAT)", "value": "b8660b994e264671f61f1b23507d954b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302639, "uuid": "5df2033c-5f7f-47c9-bc87-113c822ee13e", "comment": "Malware payload (AsyncRAT)", "value": "8d0ffcb69cefff7f66be5248e7714549bdaccab163842a86f8baebf7a341ea5d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302639, "uuid": "b33a17fb-7831-4e23-a580-bf77218670a0", "comment": "Malware payload (AsyncRAT)", "value": "8364d8c19e33c580f6b4acf005015a4c6f2594d6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302639, "uuid": "080906b4-d3b1-4be7-97b6-a14e5362bb6e", "comment": "Malware payload (AsyncRAT)", "value": "7b5d0f225cecaad931142c9279b4bc0819f71adc6e141a93b603b5e83232d620b28599d8d2ad729e3ab432d4f818bb6b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302639, "uuid": "7f0822d9-3b68-4b98-bd98-18d3c281801c", "value": "T11A4423306B2D5FB80648A3A941E6F55917F0381FCD89B6AD6AC25EC28C37DE86F1580C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302639, "uuid": "62080b1c-b64d-4c2f-866b-923f5154adcd", "value": "6144:ek9WwTjncCsWK0QTD+LgeX/bajbUgnLHtatvuAWWXO8h:t+CM0Q/4gevejb3Lc1uADXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302639, "uuid": "2eb8b11d-7f40-427a-99bf-eaf2887b0328", "value": 273357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302639, "uuid": "76222c04-fee2-491b-94f2-ea9c7ef1ea09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302639, "uuid": "b2184deb-5ff0-40c3-a450-c6dd02574a60", "value": "ps_iY3D5NwRZMLv_1776240671633.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7029143-421e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283564, "uuid": "513e74e9-66c6-42a1-b213-1f227d6e6a60", "comment": "Malware payload", "value": "c3e62f1211a6c7fcc9e2a43508864613", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283564, "uuid": "4a2e5021-3945-4fdc-ad67-690290befbc4", "comment": "Malware payload", "value": "8f1480cc93214b190636f5fdaccc1b44f5a995cda257a3f40e6f59ec8ebb6d2a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283564, "uuid": "c840501f-2009-41bc-92c9-b0d3b0b869a5", "comment": "Malware payload", "value": "cb7bd9b98c0865ab36882f4676d69fc4b3fd1739", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283564, "uuid": "ba22c8f6-758d-449c-bd33-23c38da23af5", "comment": "Malware payload", "value": "08dad6fc04d05a88494e83bbf1fb34957a43d348431a311907fd2840ec8c0e3c79e09698127f6c973114494acc53d5dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283564, "uuid": "bca2a4d8-892f-4a09-8592-bf507c11bd3c", "value": "T1243723038577AE3FC97C791C11865E0F1F601B90A014BE76219A1CCF699FF3AEA87646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283564, "uuid": "98a58b4d-6fa6-4918-beeb-5921012d9d65", "value": "49152:vulculhuliuleul/ul5ul8ulEulIulSulOulgLul+uljulLulzulZguluuleul0P:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283564, "uuid": "ba75eece-f7ac-4a8a-b8b0-ee6cf7d0a487", "value": 23944458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283564, "uuid": "2bf51512-8396-4bd7-93bb-2da6018684f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283564, "uuid": "680056d3-ec70-442d-990c-326d6d98408e", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330248c6-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321944, "uuid": "e093a843-f31e-4cb3-bcfc-0bffb012f34b", "comment": "Malware payload", "value": "1ae58626f3800ccce06df30978066cfe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321944, "uuid": "26243f31-f50d-4396-91c4-94eb6b67f034", "comment": "Malware payload", "value": "90d2ac3fba0a34f0b1c5c5da547b2ceae1ee979f95a8559b231b9bf7a34cd0f3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321944, "uuid": "4ee3ab0e-f922-448b-a6bf-878e5cf86a51", "comment": "Malware payload", "value": "caee4ae9a2bd59152e11ebfdbe899ba9db7629bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321944, "uuid": "fffa8bea-c6bb-481d-a552-ed34e6227a6d", "comment": "Malware payload", "value": "48ca8a4a76a2b26503a38061d92f42773da1609cc1faf7c79e04f15ca458d5f8d01faa6bc755aa8828e1a541a79229c1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321944, "uuid": "17d2b0eb-3175-43d7-8777-3921a455be91", "value": "T1CEC02B14A0497CB8034B17CA856414A10112CC0B120C4C93020000FCC4E054C39B1413", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321944, "uuid": "a9189c15-e158-46f1-81d6-1bcf57a9261d", "value": "3:gdQTtQ8wTdt+g9rmfLLK0nsTDNkxLNBkMxhJH0fJH6tM:gdhXH9rULu1gf/jUfJH6tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321944, "uuid": "20e35419-874f-4ad2-b765-e27310abc337", "value": 132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321944, "uuid": "38a4ff8e-5c1c-4aa4-b004-2a64e90d402e", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321944, "uuid": "15975743-6282-42e3-a941-c3df0ec3eead", "value": "164.90.195.107_1777321921125483_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d47f3ec-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285481, "uuid": "c930d46d-4371-4d26-a759-35cadb7a6ab9", "comment": "Malware payload", "value": "15cd8ce2ccbd61998075ba5af1bec39c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285481, "uuid": "866c4766-f9e9-4abc-b3b6-57bc20e50e7e", "comment": "Malware payload", "value": "918df39f728f05d18c1d5db1228e2416af7464d77faed996d1d1822ad98da11e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285481, "uuid": "d8dcb520-7d3f-4ce8-b486-d9754308a710", "comment": "Malware payload", "value": "7adf2f1d42070a8d649660fea8e51ac5177c56a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285481, "uuid": "83499545-0f8c-43ba-b715-27a4f3d10782", "comment": "Malware payload", "value": "60756bace9de73cc889335c97ae2a00491b12fd7f2242358ea8a6a1dd4d14894d0faba83b835f1c840a7dfe9c6e3ca97", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285481, "uuid": "a953b670-5391-497d-af70-d87052b61bdc", "value": "T17237230867A99FDB8FC4665550FEEF28CBC56C41C839662243723C6ACF57379226F488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285481, "uuid": "001ef6c0-d777-44fd-b115-430747a7f42a", "value": "49152:ZeVSZeVSzeVSaeVSueVSxeVSjeVSGeVSveVSgeVSkeVSJeVSMageVSleVSPeVSOy:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285481, "uuid": "308bf09e-6c74-49f9-a2c6-3ce4e8a3dc49", "value": 22643794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285481, "uuid": "a094f4a8-8d03-4481-9710-ccd978d01a20", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285481, "uuid": "05cd32bc-fbcf-4d75-8ed6-59e721be8221", "value": "invoice-1645080830.pdf (66).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6d1bfb-428f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777331788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331788, "uuid": "8aef405c-3309-4fd9-b7b6-a7b3ab90863c", "comment": "Malware payload (Mirai)", "value": "a01138bbc121079e3c529e6fe2bd3218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331788, "uuid": "9595992e-d653-47ac-94d3-a94679a2d49a", "comment": "Malware payload (Mirai)", "value": "91a48451d767181ce03a62977eedbb448c491759d310ff094fb4befdf495966c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331788, "uuid": "06ce3078-915d-4c6f-a445-c3b86e552a2e", "comment": "Malware payload (Mirai)", "value": "c39a5063946d5dc5ea7ef77cfd67b0f247f0c62d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331788, "uuid": "82746497-ce6e-49b2-9fb6-8056eff093cc", "comment": "Malware payload (Mirai)", "value": "5bee2d5ccffaa495fcb70953db1bf9cdb719962a72ace82679acdd391f4bf1ecc50a74323125431f9a8fe105c8115bd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331788, "uuid": "eff20b9a-f351-49f3-b30b-b41cbfc2dd76", "value": "T1A35302D3E1A26972CAB4553F9B569D4C975C28FEC0770E638A4126536FE60013EB8393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331788, "uuid": "9eedd0b1-3946-47c9-87a7-a47a5bbce97f", "value": "1536:8lo3LvSp/A3SSqmmqq+o0+TaXMm0bEA+TX2/L3u31WVxiw:7S57Sqdqqc++cm+xLZVxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777331788, "uuid": "b79d7988-2696-4514-bef6-2523d90595d2", "value": 60932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777331788, "uuid": "ed6d6e5b-dcbe-469c-aa85-809474f31290", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331788, "uuid": "009c0dbe-3740-4635-853c-212d99c4fbf8", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565e7a15-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777264880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264880, "uuid": "00995800-404d-498b-a49f-5bdd5cd5f5c9", "comment": "Malware payload (NanoCore)", "value": "bf81a80ce54ab333401a4125aafd2e4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264880, "uuid": "0415a5bb-d88d-43ad-9179-b4858ec2966e", "comment": "Malware payload (NanoCore)", "value": "91bd29fbcd1fa40462378d834ff35939be6d97c6c53b9b6a2bd2facb67e12024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264880, "uuid": "063e965b-e3a4-49b7-b3af-a79616057c12", "comment": "Malware payload (NanoCore)", "value": "b5e80d3299abf19957ed86f372dd3f86259b998d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264880, "uuid": "ad0545f8-1513-4b67-bf18-15734fd237fa", "comment": "Malware payload (NanoCore)", "value": "9ff04e48b8f1eb2da4482772debca1ff0891b4bc401aed6d4dfc6a71a513121967fb861ca993125300cc9a38eaf8569a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264880, "uuid": "af5ff8a1-0b83-40cc-8f3c-ed8cb568d8b7", "value": "T14114C02677A94A2FE2DE86B9701212039779C2E2A8C3F3DF58D454B74F167E4060B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264880, "uuid": "2af4d456-5327-41c6-8875-283bb12f5cb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264880, "uuid": "c1fcfebc-426d-4fc3-a5d8-91cec7afa354", "value": "6144:sLV6Bta6dtJmakIM5aitzMM3/mpjxE7pzpTVtv:sLV6BtpmkJitoxizpZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777264880, "uuid": "3da46f18-31c8-41a6-9af6-b4743d7ff44e", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777264880, "uuid": "ccb9021d-ad23-4025-ba4e-0175328c39e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264880, "uuid": "0bd43a97-cc17-44d5-b229-f920a0c35169", "value": "xvratnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d9efa0-422c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777289604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289604, "uuid": "8434ea3e-322b-42e5-9c25-bcfa319da929", "comment": "Malware payload (Mirai)", "value": "aad8b33f75aa2d96a98d8ef026651037", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289604, "uuid": "0ff424fe-9de5-4383-9b0a-49b700e7e509", "comment": "Malware payload (Mirai)", "value": "9200f2224e6a7decd25a018f33bb522d4f0cb71e2c177eb007077aef043d10d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289604, "uuid": "2649d80f-312a-482b-b492-3a570a8929a3", "comment": "Malware payload (Mirai)", "value": "094a8b11b70e6ed17e4b47b80a5281697cde579c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777289604, "uuid": "68120bc1-2ffb-4a64-a76a-cadfdd2def5a", "comment": "Malware payload (Mirai)", "value": "be77a40a167a7f61f65293d0c196a151b199c75012cd483c85aa85316d4f7b2992af0a3ab1d81183fd166d04ce8d8275", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289604, "uuid": "356135b8-d9d4-422c-b5a0-d27a8d3214d2", "value": "T14CB2D0A2EF858577D4E1563E716F5BEBF9381EB00B2BE206E07181406CDF1D3E25452A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289604, "uuid": "326dc535-d97d-49f8-aa98-3660740764cc", "value": "384:MlWwXtXNhqZzAqkYNA3ImuHH3vkgiLWJE4ujlLQWuAyNghLi4vTv1RAQc:QWueZUqkYyILMxLKujlkRghxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777289604, "uuid": "ac4af941-d34e-4d90-b58c-49354f0c26ae", "value": 23736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777289604, "uuid": "02c52a41-0879-4ac3-9bb3-860e08c54ff1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777289604, "uuid": "f4cc996c-219d-4e9f-b01d-18fefd07dc95", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49ebe2e-4228-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777287829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287829, "uuid": "a3161f2e-6b1d-4abb-81d1-ccf37fcd4fe6", "comment": "Malware payload", "value": "0b43d183fa64803608385806501750a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287829, "uuid": "50e3a13d-4d90-4593-9824-c4418727e008", "comment": "Malware payload", "value": "921376cf81f2a5eca3d9b44cdb6ff2df0a1a685bf47518d5f86e45576c997b60", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287829, "uuid": "bd92125a-c6b7-4e42-a633-44740a0ca896", "comment": "Malware payload", "value": "6c280d0312ce01fecfc0447bc6b1073a5473ce65", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287829, "uuid": "97a1a967-c47b-4f80-829a-510f83e123f6", "comment": "Malware payload", "value": "dea95714b332fdd2ccf779c31b73edc3fe1f9cf0b86ba1fe4bc042edbf551f3880e118ac7e5f62822387e350e2e09e0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287829, "uuid": "dd1e85dd-7e37-442c-9ecb-9f9b4021f552", "value": "T15D953A57BCA148F9C4AE963289669152BA61BC440F3223D73F90F7BC2F72BD05A79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287829, "uuid": "718411f1-3e55-48da-a45f-d8e9b20b661a", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287829, "uuid": "de0dbfd2-d243-4f9b-aafc-ef33f313ee09", "value": "24576:tCDumtopAKI+ehiGG/dv8YdzfTjJnQsn9jywoHS2A:3mWpAd+ehDG/bqNHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777287829, "uuid": "e46604dc-d9e8-42c7-ae93-24f3f975bfa4", "value": 1945088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777287829, "uuid": "e85fb7f3-3d13-4219-bede-fc0637324661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287829, "uuid": "fe5f306f-0320-482d-a036-830c9c6453e4", "value": "arc39_new.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2c0564-426c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777316963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316963, "uuid": "746641eb-0f69-4d55-9447-964e5a0ec57b", "comment": "Malware payload (Mirai)", "value": "8827a4e0c494606a12e1ba75e54c84d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316963, "uuid": "520073bb-d4cf-4013-8558-ef3b6f5d9005", "comment": "Malware payload (Mirai)", "value": "921578ec0f0054d54db0928e11fed1e414c15e36d5dd8d5aa5a24638216c36a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316963, "uuid": "62effa91-0e88-4580-a85d-499d36f7ca14", "comment": "Malware payload (Mirai)", "value": "e4b56784faaf7c0ba7bcb8a05c687d58faf93a9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316963, "uuid": "62dc23d8-f347-4250-9538-6a81868571ea", "comment": "Malware payload (Mirai)", "value": "898445697fda63d0a09044f0e2a35e84cf249ac12bf43602925a0627de6921abe575c454ce9d755e4332cf294187af79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316963, "uuid": "f7572aa9-6f02-427f-a7b1-3222ff731e5d", "value": "T184F2D1EEF6BCEC46DD9C5CBEC19902AA69803140A2CD73BD7346CC817929F4778A5474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316963, "uuid": "ecefa981-4db8-4949-a794-6b876a268c65", "value": "768:HpIgd492Yq0WbO03MVv94lykTCRFdV4GtwqQ4C/dWn:OGdYrWbO+yk+7dum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777316963, "uuid": "0a32607e-7051-49aa-9bc1-149fa3a79e64", "value": 35424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777316963, "uuid": "ea1bef69-1d2f-4a5d-8746-2a855757fbd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316963, "uuid": "9a2f7b1f-6c69-4ef2-9454-76c4f85f28ea", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7754a6f-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284048, "uuid": "10c43b91-021b-4dff-a26e-3a04fe13dcee", "comment": "Malware payload", "value": "ee6f484cf68a9e1442b6bab58e0b496f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284048, "uuid": "47d52e6e-527d-4d36-b173-d14f471377f1", "comment": "Malware payload", "value": "9481f34f33a229281eb852cc9ced087f0f36dd03dbff185b9471918703717bca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284048, "uuid": "fada7a68-b5b4-4c65-994e-669fb6ccb80d", "comment": "Malware payload", "value": "ecd3bdf23bf40e549a0b82c023a37ac22fd5472d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284048, "uuid": "2ffb9d1e-bb01-4591-a4fe-72f0cd387c23", "comment": "Malware payload", "value": "47d2925c34eff1d41b4c0dd158cf3562b021c07ddcad150e9642696d06c9847dbfc4e091d2257b2eaa76220e35df7509", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284048, "uuid": "9b5c2b57-cd53-4bca-ba8f-749eb5ad9435", "value": "T10B37235A6A2505B70ABC03F8F4A50B6FFA800F41D1A1E95FD3F35C509E9C76E28AD487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284048, "uuid": "43d0d195-b248-4a4a-b87a-d8fb7d39a3dd", "value": "49152:wrdy1Jrdy1nrdy1Qrdy18rdy1Lrdy1trdy1Ardy1krdy1Crdy1qrdy1qrdy1u9qA:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284048, "uuid": "fe184323-bff3-41eb-86a9-c9abd2a5031f", "value": 23164082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284048, "uuid": "8bab20e9-1cd5-4929-b6bc-1215b0e48f65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284048, "uuid": "44121f93-b427-48d2-b5fe-3a94f508f6a9", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedf4df4-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1777265029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265029, "uuid": "e0ba6a35-50ce-4451-9861-521b96ef1565", "comment": "Malware payload (CobaltStrike)", "value": "26cf02e777c1238b301c4c94f19ae6ce", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265029, "uuid": "5e10f7ad-f786-49cf-9633-52e3d456d562", "comment": "Malware payload (CobaltStrike)", "value": "94ac8014079db7511da409b5fccebfb01846e29e2b5c551522e865f438120601", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265029, "uuid": "82137ab5-949b-4778-a019-918311d5b3b9", "comment": "Malware payload (CobaltStrike)", "value": "1b65147f3bd68f49161e768574cc3356f542caff", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265029, "uuid": "0219bc79-945c-4194-88bf-ea5b49581956", "comment": "Malware payload (CobaltStrike)", "value": "b128f665d9ddb5a672b89399758a9bd2358b99cdeb788a0d41862fddfa186e63b41fe43d2d6ccced71a223a031c0c8a9", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265029, "uuid": "573eaba6-ae60-4e4f-81c2-76f9d82680c6", "value": "T146523A46EA901ADAEA3181F9C4630E1BF27AB41017B253DF4770A56D0DA3B417A2EF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265029, "uuid": "80aaa18a-c9f1-495c-8d4e-e2bb000ffa8b", "value": "fdf82832b805ce097afa454a1d3faff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265029, "uuid": "aadedafc-5459-4211-be29-4d394cd2bfdd", "value": "192:KojzNswXSouL39w2HQH0Lq1A6aAiwtuCo1W51tGrMHX:KojZswXJ0f68wtu/0Htr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265029, "uuid": "cd885c2b-8840-4ab5-a584-7511aba7cb55", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265029, "uuid": "03f95518-867b-464d-91f1-6a9e922380ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265029, "uuid": "a79e986b-41a1-482e-aca8-42b6b9ec81ae", "value": "94ac8014079db7511da409b5fccebfb01846e29e2b5c5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcf2df6-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277076, "uuid": "776a422b-47b6-4cdb-ae02-34fa5f82400b", "comment": "Malware payload", "value": "0ec9431e8d8bacc822327ade93f93817", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277076, "uuid": "11aa849e-4ce7-4da0-9294-1d422f665aa1", "comment": "Malware payload", "value": "95fb2af6ccdc493e65eede027eef05e00758e5d93a1bdf644280c4b99a3307c0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277076, "uuid": "0513fc6b-a7a8-4bbc-9d24-5a1925b89fc2", "comment": "Malware payload", "value": "00afe9f45ab53991c31d069064adf01425425c66", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277076, "uuid": "a1a2fd67-f54f-4e2d-b9ce-04b15e992785", "comment": "Malware payload", "value": "edc9dcf9e2ce43ee8ad4fca2e34a80b9d7e7567acdc8dc68add55e198b48023c9819f80006750edcf4c5518135407645", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277076, "uuid": "7f150681-e98f-43fb-b827-1d3764600e18", "value": "T1C33723D7AE339E3BD2BD57103EAF0F8C8694C80A224021ED455F3889CF96E69256DD74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277076, "uuid": "3637a01a-6912-4da3-9f58-0cc2a68b8c39", "value": "49152:b828w8b8J8o8a808E818K8S85XXv8f8/8M8k8MXXu8G8A8J8r8K8v8D8d8o8E82m:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277076, "uuid": "ea05381c-20f6-4292-9baa-62b6583bb8eb", "value": 22383682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277076, "uuid": "2a252738-e257-4371-9063-fdffc9f187c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277076, "uuid": "7adc98e9-218b-4dbb-803b-52406a33370f", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dad04fd-41f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777265295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265295, "uuid": "6e2d1342-237a-4321-ac0f-793585e9ac8c", "comment": "Malware payload", "value": "948bb3ca165d386c7040e0acdbcc29d2", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265295, "uuid": "657e926a-4e81-4642-8cd6-9f716e9ae0cf", "comment": "Malware payload", "value": "96e56d8e1746abf15ff605225bf57ec835ecfdafb63ad7d7a057222e65a2014c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265295, "uuid": "787fbb4e-e029-4507-a263-e1d49d7fc39b", "comment": "Malware payload", "value": "3bb69214fe0674cfe5b383b2f3eb9ae3a70b1dbc", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265295, "uuid": "5cf48e10-f254-4b01-ac35-ac300492f3be", "comment": "Malware payload", "value": "a77edb63732a1536da50115c9062bced139a98f85b1d94a0a1277b4468312885da07a6a13eeb1a7306959fca7ed89151", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265295, "uuid": "17c918fd-e5b6-4900-9df4-d1ac617d9695", "value": "T10BB46B55E3A802FCD0A7D23C89A79906E63678490761A7DF13A4C6711F237E1AF3E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265295, "uuid": "dce317ca-9cb4-4f0d-819a-fd79dc1429ca", "value": "0e3fbdf96b8d2bd27ce62d9ce8a607c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265295, "uuid": "9eab3ada-9609-409a-8e90-67bac024ec70", "value": "6144:ROXXHCxB/3stUPR6E7ZWhO5+lqaH1XktbneMieIvpKYjpz9X8jJ7Kagah:xxBPJ7E2cHuSMZIxK4Fh8VKagC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265295, "uuid": "fb8de3c1-28d5-4e7c-a2f2-e2a6cb7b7451", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265295, "uuid": "987f17eb-3a4f-4c9d-ba3d-bebb6a8a03b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265295, "uuid": "6d14deb2-6797-468a-8476-ddc768098ef1", "value": "96e56d8e1746abf15ff605225bf57ec835ecfdafb63ad7d7a057222e65a2014c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3a89c0-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285264, "uuid": "df5a1d8b-fe74-44fa-bcd8-85bbccc8722e", "comment": "Malware payload (Mirai)", "value": "190673f593abc180745334e9c725f890", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285264, "uuid": "7fdda8a6-a831-43e9-bf7f-30d9320595fa", "comment": "Malware payload (Mirai)", "value": "9717a7078379256efccaf78050f590465293390fe68fd79a6f425ed1345df9bb", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285264, "uuid": "fb0df296-b346-455f-bbf8-84fd6b62010d", "comment": "Malware payload (Mirai)", "value": "257af6ff5b99e5dcf6f115a396ced066fc0b3928", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285264, "uuid": "adae2b2e-1a21-4a48-b211-6de174b4cc1d", "comment": "Malware payload (Mirai)", "value": "1c6f5eff16132881d445eaa4929628c73fa4613037dc6ebf1696444510abe3e17617d4f6c5332e0c7ce130ce0cebbfb9", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285264, "uuid": "4aea228f-0d53-408c-abac-0e00938339dc", "value": "T183C4CF8773053E3AF4B3993E44C20B12BA38E79555C357272028B669AD376B82F356C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285264, "uuid": "994bc04d-9c60-4ae0-9218-50bb4f117d51", "value": "12288:M+YmHoRCrc5QoMutyQoMSnA5W3fa270MNdhpLhVzl5nr:M+YvCrcGQWAofplVp5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285264, "uuid": "68e3f1d2-4bd7-4747-b00c-95fc02b8d863", "value": 576828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285264, "uuid": "00fffd45-c2e4-487a-ab70-63a9c6197caf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285264, "uuid": "497f3d07-827b-4353-a994-498d2dadf596", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d94f24f-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276086, "uuid": "809755f9-e378-4261-b736-d276feed783c", "comment": "Malware payload", "value": "994d37c7ff75f463eaf9d836f5bb46f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276086, "uuid": "d4d48bd6-2fb4-4a00-844c-ef7847e03fe5", "comment": "Malware payload", "value": "975e460d205af4016743a0260731ba3b8fe80006220ea46f76df3964b4dda550", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276086, "uuid": "aacd68ea-df3d-4f12-af30-28ef2eb0ef62", "comment": "Malware payload", "value": "96e66054251ee69426561764bdddcb2da01c01a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276086, "uuid": "c0d8b99f-488d-4bf7-81be-077f12f81129", "comment": "Malware payload", "value": "ff1721ccc8c3e8125fd290f05fdc6ff505ebb4e3ff4ce529c2e26d783b525a22417808669b83371f029a98284e1554d2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276086, "uuid": "8675b246-d562-4d46-958b-7601431beb71", "value": "T1AD272389D67C5F6E822A148431EB0F5A4AF0CB9041A5A88B37FE38EC575FF1911971CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276086, "uuid": "0c77909a-d4ad-4c30-a31c-0d1be9976906", "value": "49152:4HxJhq9HxJhqGHxJhqZHxJhqkHxJhqIHxJhq+HxJhqRHxJhq6HxJhqLHxJhqLHxA:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276086, "uuid": "8f4923d7-5111-4ccf-8491-fb89ee5c8095", "value": 21863435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276086, "uuid": "ea4580db-6a26-430e-9f5c-fcb6672b962e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276086, "uuid": "ee982a06-bf48-4e93-9bba-dd120459a91b", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4908b161-4228-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777287621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287621, "uuid": "7d73de74-d7f9-47df-8358-6c3f3bdd0a71", "comment": "Malware payload (AgentTesla)", "value": "166e92bc800ed45fd0a9a6eccfed5dfa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287621, "uuid": "60af150b-11ed-4378-8ba6-079c1fc537a2", "comment": "Malware payload (AgentTesla)", "value": "97ae3e5222fff7243604ce7a829bbcaa15686ec366798b6526a61ffb9e5fa36b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287621, "uuid": "7911ce7d-9263-4659-a519-67e19c24b93c", "comment": "Malware payload (AgentTesla)", "value": "361d5002fafb1f221a15d02062956da28a9bde1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287621, "uuid": "b2d415f0-a64f-4474-b407-21184080971d", "comment": "Malware payload (AgentTesla)", "value": "fe199a5ebca31a652d2c8cc02aebe247472938aabbdf3724e9555f03e980fea6e1047a5c48758c9d72a009b0f1313d63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287621, "uuid": "9c63e5e7-fd30-4d46-b9c5-97f8f4cff46b", "value": "T1D982E82A8946AFF4052D7291AA5F2C177A4103239674384DBC8FD46F37BE720DFE1998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287621, "uuid": "44e3e08f-8cd5-4f24-bff3-c8b0754f1242", "value": "384:KEF4Vus6rK5FEo+th8T3EiYJ0EhbWy6+2ow6OIrNLzihi37g+827:Kao/oigFFlNShi8f+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777287621, "uuid": "11ed0a3a-52ea-4cc7-8cf8-765147673c3d", "value": 18091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777287621, "uuid": "83aefdfe-9719-430f-ba5d-433a7ec05054", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287621, "uuid": "689c5c25-183e-4461-80ac-715fa79b79dd", "value": "rdocx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575778c2-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279485, "uuid": "30822cf6-d58e-44e9-8a56-5679e89345cf", "comment": "Malware payload", "value": "f5f84377fb35c14b6c0f8de17a72d17b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279485, "uuid": "5a77cd60-ffa3-4779-b120-d56a66fbd486", "comment": "Malware payload", "value": "9991868ce687b906084390955581160e816c548c5f01e96a108409742f6f56e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279485, "uuid": "47ff10ae-7e22-4ecb-85cb-6b6063b6bb9f", "comment": "Malware payload", "value": "053a02182c950a0276ba2868e9a8d1fda97260f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279485, "uuid": "b99e74f0-4e99-4d3d-bade-eb81b11af993", "comment": "Malware payload", "value": "690ea7a1fd0bdd8ef23edd0389934f11e7a8334a94026a73828e73119bb5e0a106f84afc4c9a8e99380313170a81e35f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279485, "uuid": "25e8f16e-c9db-4ae0-8833-65ceb2140e2f", "value": "T1CE3712290FA5C92DC63C171B603F6BF99FB4490943ED5E3A71871E5F260ABB8113992C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279485, "uuid": "1f21f7cc-aa03-47e5-b638-a4e3b8523599", "value": "49152:8uVO09/fS85wfhvw1PnohGdAGM6gscZoo/y+hshmd0qhTd5cXCKl1lV1vlTkT4/S:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279485, "uuid": "160a745c-74f9-46ea-9ad0-58d3b60c2530", "value": 24204594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279485, "uuid": "631cd025-afcb-4c51-904b-c4cb1baccd1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279485, "uuid": "8d07017f-be7b-4cb6-982c-bfb6fb1df666", "value": "invoice-1645080830.pdf (57).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85b5918-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323027, "uuid": "10166b2e-078e-4d0f-ad5f-a18e08f9b28b", "comment": "Malware payload (Mirai)", "value": "71374b861af97673e289c77b0f231051", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323027, "uuid": "46b50708-c1b0-4b08-b7b6-c07e789de88c", "comment": "Malware payload (Mirai)", "value": "99b5bfbec6ba9771f68935052512c3e6a7a1c67657cb2ab2cfbc3e49c1a2a360", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323027, "uuid": "d5bc7049-37da-41de-bac5-4a054cfa7428", "comment": "Malware payload (Mirai)", "value": "5d1faa9180e32ee7d9e3dbdb7ef1660ff071b72f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323027, "uuid": "a5c446cf-0040-4114-9188-9d41998146fa", "comment": "Malware payload (Mirai)", "value": "c268b65e38368ea40d5c9aa490a8a4f6e7b5e7fbe66647343a29b8ea781692854773eedc0a65b9e75f1248209866edb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323027, "uuid": "e9d15539-15fe-4d20-9ca6-a1e4e75c703c", "value": "T13713F1B71B13E7B5C0B7A7B192D48582DE70591B869B03DB2EB4BD3C2C6A0649D04ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323027, "uuid": "9a633661-e3be-43de-a57b-44ce050a84a9", "value": "768:x201GjDlPCGZnkrZpdaz8syl6wA53VuCeU5L/MgFPUulcBx05V:x20wjDlaanGZ8yl6w2lurgFPFlEAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323027, "uuid": "aa7d8d3f-9ee0-4e8a-b2ed-324092775186", "value": 41988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323027, "uuid": "61921ce7-16c0-43ec-b068-5c981c63ad8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323027, "uuid": "78896db8-c305-43a9-9d88-76fadab9af58", "value": "vaxstresser.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e699df41-427a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777323104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323104, "uuid": "a12fded8-1209-4c92-928c-56af7e65064e", "comment": "Malware payload", "value": "a4e39e6492b8f51cb9d1da4a275f7eb7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323104, "uuid": "f4e3f858-6e04-4b9e-b976-ba8e77947e4e", "comment": "Malware payload", "value": "99b90eb991342097eed26458ceabae185c87416b8e5bb807c4e598a395cc2c3c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323104, "uuid": "3837fb81-41de-47d0-a67a-b571cf538477", "comment": "Malware payload", "value": "1a8491ee51343b70dd0d3e7a2016cc7d3709bfe4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323104, "uuid": "2edeb2a2-b7dc-42a7-90a2-21975286db1b", "comment": "Malware payload", "value": "e2db68fc869883eb72c4ec579d5fb35ad45574f0aec8ea53b7cf30385560138d0ce1b969633ae78f147743290905706e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323104, "uuid": "5fba8775-1102-43fb-8a59-88d08f5fc7c7", "value": "T14EF0A08AC4AD1D360A7D8A13A320EB6830151462ABF27BF8D585D7218B5B038B341F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323104, "uuid": "b65100e7-0532-4dcc-8112-7d14efa1baf4", "value": "12:ZCk47Tyyy0yowq9Ov0GyVpoQGy76ULnI+yLd+JM+0RwbFUO:ZCk47Tyyy0ytq9Ov0GyVpoQ976ULI+cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323104, "uuid": "aa672132-baed-42cb-911f-185f813aaa4c", "value": 452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323104, "uuid": "4f919be5-58e9-4a11-a294-ff7885d5cb0f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323104, "uuid": "338e86fa-848f-4564-b35e-277c34c41ffe", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc20c90b-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276755, "uuid": "775d9424-bf62-43a6-8fbd-6bae767b2e9c", "comment": "Malware payload", "value": "bb5116a72b48ecfd35caea4b9705f44f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276755, "uuid": "bc420460-ac01-4c46-8779-033eafe20300", "comment": "Malware payload", "value": "9a10cb94e6f04ac4200fd702231928153ac4e121ad5cd49e4570bb59acc0b412", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276755, "uuid": "1822ca2e-65fb-4c18-8643-d30e47b4fa28", "comment": "Malware payload", "value": "b35916f16cbc686c368840e57af291fb3697bedf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276755, "uuid": "79d2bb89-48ef-4c70-88b9-fc487567f3f7", "comment": "Malware payload", "value": "b6dfbadaec5d560a2f334cfba82ea5a5b09298f0a00c00a742f7a13dae6c5067bc87962d959f932b84f43c008f8a377f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276755, "uuid": "362c5367-348f-4947-9326-4f415561afc9", "value": "T127271214977F59BFC734266528FE1F0B4CA486484212E0FA6FE5D80A7A7EF0C3B4A456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276755, "uuid": "ce3f22cb-12d4-433f-91ae-202cef490e09", "value": "49152:kZwywqZwywQZwywOZwywkZwywTZwywZZwywtZwywjZwywIZwywbZwywtZwywzKIk:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276755, "uuid": "671a0b6b-79e9-47ed-8798-96c8f37f78a1", "value": 22123544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276755, "uuid": "52729f5f-a7b9-480f-b7c6-bce46377646e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276755, "uuid": "9b2a4f91-1490-455a-ba60-598a1ba0583d", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4a2bb1-423d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777296755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296755, "uuid": "2b43a3a9-cef5-4fc1-82ea-325682a3843b", "comment": "Malware payload", "value": "0bf547e4592f9c449f20b0d08ed39bb5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296755, "uuid": "14e7822c-682c-4c89-a6d9-f228e00bf9e4", "comment": "Malware payload", "value": "9aabbd8fdf34c28f7350afcbda9587cda4c4d73b8e2c2043349ac1803e66eea5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296755, "uuid": "49406c45-2f7c-4072-8ad6-1bcbc11bc94c", "comment": "Malware payload", "value": "d26a5ba802653e3d7f97932e0538caefc5483e4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296755, "uuid": "ae3839c6-38e2-4e40-b037-c2da2022bc16", "comment": "Malware payload", "value": "0dc774a22b25ee3d0d8080347c1e1466089ed12a0af35c0682ef2a59dfa171c624fc5becb6ffb918f6ce36aac718a069", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296755, "uuid": "d52e3798-13c8-4c66-8c59-aee2e3e9eb75", "value": "T11832D77435F14C333A616940B3772BA2ABB7D95345A3218C39DE2E265F87B12B4BF811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296755, "uuid": "75c37cf5-3dda-4281-b504-e87cc9a68366", "value": "96:cLuKB63uxu+SEgI45+fIBVIB7IBMIB8IBrO9F7S+vevGvNSJCqArXyBsR:cLuu6Yvk0ewPziE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777296755, "uuid": "669fcba5-a354-4645-a820-c8057e2d73ea", "value": 11674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777296755, "uuid": "8d3222b8-10e3-4c57-997e-a41a98aefd17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296755, "uuid": "83ec922f-605e-4561-a0d3-99d7191a5e68", "value": "9aabbd8fdf34c28f7350afcbda9587cda4c4d73b8e2c2043349ac1803e66eea5.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1a4378-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279229, "uuid": "8507ab08-5d4f-4c3e-8227-b5cdaa2445b6", "comment": "Malware payload", "value": "548367367f58ef56c2984995e015c5d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279229, "uuid": "42acd7f6-a5e9-4a10-8f84-981c2cb7f0d0", "comment": "Malware payload", "value": "9ac584996710e8a12e63584ab9b6e5c6201f0d9f52d20cff917c27ecdaed9805", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279229, "uuid": "a0dc970e-9282-471d-aa2d-de4a191b3fc1", "comment": "Malware payload", "value": "0177ee7702a0b94263dbc4b1040dbe8b1bd3a830", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279229, "uuid": "c35bbc20-ed6a-4087-85f8-9d04f6fb08cb", "comment": "Malware payload", "value": "9e7515222e84deb8d011baad90587679982d83234009afeed1c9d0f53097fdccab28d038580aef55dcf122ae6773cfd4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279229, "uuid": "33722253-7661-415e-90a7-0476bebcb95f", "value": "T14D3723887A6A56334B62789C50FF0D1EA69D4F0415106F80EDEE287E7B9DF29209F5CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279229, "uuid": "7727429f-fcc4-4bf4-9c65-fb2156d06074", "value": "49152:0pptXopptXopptXmpptXmpptXhpptXjpptXKpptXRpptXspptX4pptX3pptX5wyW:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279229, "uuid": "22b1f005-8fdd-4429-ac57-3945445a50fe", "value": 23944463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279229, "uuid": "2375dc85-37ff-4209-8ea9-638f4746b5b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279229, "uuid": "ea79d230-2929-4929-963c-162c3a88bc11", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ab73cb-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285755, "uuid": "daed947b-a218-474b-8923-122ba90938b1", "comment": "Malware payload", "value": "57e9233b6ec46a571aaa379923d0c219", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285755, "uuid": "a11fba98-3c3f-47cf-af7b-9cc11d51eab4", "comment": "Malware payload", "value": "9aeed3d95976b0637a019cab4f766f523264ac6247ba8a4a305ae48628fa544b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285755, "uuid": "f1049b6d-f706-43af-b7e5-e9ba24e3a708", "comment": "Malware payload", "value": "04ccf5d555fddb904aeb74355cad98247ce87952", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285755, "uuid": "ac9c048b-40aa-49db-8121-6dfbde7d931d", "comment": "Malware payload", "value": "b47093ed7d507406cde05921502525c71e91ca5f99797d63a1f3a9c01276f518c18fff27b72d708b91390ddd94e866a3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285755, "uuid": "272178a1-3bf7-431e-94cf-fd113655ac45", "value": "T1F927230ADEE44F6F8E3C25B421790F6E17D40D084C2E516388E9B6CEBB5BE47538E196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285755, "uuid": "62eb8cfe-eb6e-4b2c-8c76-945e5d8ad6b4", "value": "49152:TgpXLm8fqNdkJhaQGlgIBMwEihaQGlg/YsPv4aSonecdgbhaQGlg5haQGlgfhY9z:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285755, "uuid": "67cfc2ae-86e7-4e1f-8778-02beef8701fd", "value": 21343154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285755, "uuid": "2e48b1d5-c132-4261-a9c4-3bcb9a1a7c2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285755, "uuid": "689bdb1a-6cab-4a53-bbae-faeed3fb8238", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e827422a-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280587, "uuid": "9c33c0d1-e278-451c-b57c-15954ccac615", "comment": "Malware payload", "value": "2283f7062be6a5a7106494c9df4919a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280587, "uuid": "99fa72e4-0eed-4076-8d57-ab2546b70f31", "comment": "Malware payload", "value": "9b6aae35b7b9073f302f2fdc2aad82e737ac4dc29cee30b64260cbac3bd35d00", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280587, "uuid": "a2e7d26b-4855-4a1f-9a66-13b8da7d3b74", "comment": "Malware payload", "value": "f310d14ff7ccfd99c0c3aa2be0b1bb3109f3e1ea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280587, "uuid": "c42589c4-c1df-49bb-9e4b-ebbdae2322d0", "comment": "Malware payload", "value": "6d9ac7ac0c2752bc5da5238287cce602a7f69a2178f19492313c040d601758d34bcdaf26674c151acf9302b49070ba2a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280587, "uuid": "c2e90846-44f0-490b-bd8b-d2b05818be27", "value": "T15B37234EDDAF4C6E00149566B47F460D377B4904503AB64ABF33AA6E3D6CD89A388CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280587, "uuid": "92a89486-a287-4f4e-8879-a48ace44a1d9", "value": "49152:z7o07ow7ob7or7oo7oO7og7on7o57o67o57of7o+7oP7oB7oF7oz7oP7oj7oY7oa:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280587, "uuid": "fc7e78dd-6869-4ab9-8ca5-2f012f89db98", "value": 23684326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280587, "uuid": "b17c1531-9837-4b7f-9dce-f46c2568617e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280587, "uuid": "bbb14492-9b7d-438c-9df6-e5b1cf6e4718", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b1f3f4-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283691, "uuid": "07f72921-08af-4235-a1ef-629e57dde89e", "comment": "Malware payload", "value": "5dbe2879ef379aba5d54756bbab2a670", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283691, "uuid": "ec13a398-909e-46de-82b6-ab7f5f34dd5d", "comment": "Malware payload", "value": "9c16a3b8ca2cc392682bdb95136c4ec63d5e3a2937675463f771fc2d005bb16a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283691, "uuid": "ebbe1619-bb18-4fdd-a218-b2b87ef9bc27", "comment": "Malware payload", "value": "d66eba68a0c34b7abd862fec65754010c582c283", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283691, "uuid": "765fa9be-7cd8-43d2-a8ce-2ad19d00e052", "comment": "Malware payload", "value": "433142b31e6aa2435a77a25e8a0e5146751677eb6d8df666dd8914033c1b71836f036a01855e3e0e935a750fd3436807", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283691, "uuid": "28693f11-24e5-41e6-a0b5-68ca5c8f11f6", "value": "T1DD3723110D16976E25BB26441DFE03A60EE6DFA400F5FB82D2AA1C1BD98DF3615BE31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283691, "uuid": "329033c0-6852-4a38-b78c-057935996fb0", "value": "49152:LvPRuvPR8vPRYvPRdvPRvvPRtvPRzvPRHvPR6vPRpvPRBvPRMf+vPRXvPRqvPRAh:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283691, "uuid": "d2b58d49-654e-4e80-83c7-ef459463d39b", "value": 23164082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283691, "uuid": "ce6b7715-d021-46a2-86bf-ff09d1f41021", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283691, "uuid": "1e137c24-53ce-4964-8312-039bb1bc5760", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b16b3b9-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280726, "uuid": "3108f9bf-9f61-42ba-8efb-0bb6ce56ec8d", "comment": "Malware payload", "value": "84d3e02eaac0423a353340020cffc156", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280726, "uuid": "af87d9d5-3a76-4c58-9901-e8954a1b9ccf", "comment": "Malware payload", "value": "9c5f8759a4b8df738183abe53d80d19eccfcbb2064bfa47238d1587fb4c68f40", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280726, "uuid": "418d51b8-fb11-49c7-b3b2-bf5492a96358", "comment": "Malware payload", "value": "f93ca6d83bf20f201238a83d912efda46e3aae77", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280726, "uuid": "ee8c3feb-d83c-4e44-b7b3-37e599098f41", "comment": "Malware payload", "value": "6d15871739596887757cc3eed1c26a79dee8e17eaffda078abd152737f7d1cea52c6a1637d6670fb6b3d660122abe00a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280726, "uuid": "35999aa4-8fbd-46a9-ab42-4c69095e0acd", "value": "T1513722AB593E8E3F079823346C3E0A46B6BC088510355DDBFBC5396BC68967C3712A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280726, "uuid": "4501d1d7-cebe-4d8f-81f1-3ae97c52727f", "value": "49152:NcRZfcRZMcRZJcRZucRZmcRZYcRZtcRZ0cRZbcRZncRZOcRZYwjyrcRZQcRZScRJ:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280726, "uuid": "0e75a6ff-6b3e-4776-886b-b51d41df8970", "value": 22903935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280726, "uuid": "31251407-00cb-4868-8024-299d4af38d1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280726, "uuid": "2f25c487-9ae2-4038-b682-6138aec8fe2c", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f43dd7-4235-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777293283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777293283, "uuid": "e0e28924-e13b-4bfd-aecb-570842117fc5", "comment": "Malware payload (AgentTesla)", "value": "242070a447ac423016e7df8a66c5ca5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777293283, "uuid": "71a805dd-f599-4ba3-97da-795bffc415e9", "comment": "Malware payload (AgentTesla)", "value": "9d17387bf010e9c307fcb2e6a37037da25fcb87d4a146585fea2084ae6ff4bad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777293283, "uuid": "517bf75b-2029-4b24-9a45-632adad6db88", "comment": "Malware payload (AgentTesla)", "value": "efe08c1775df67b4581b4f62a5458998c2b00f16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777293283, "uuid": "e07b579a-4606-4a23-81ec-d43264175b72", "comment": "Malware payload (AgentTesla)", "value": "7d7f9abbc8f8ef74aa1c52419f350e62e1792cdd3ee3c7c1001ad20ba6f5c3d4aed60f63df6248f5db49a95f52ebb8d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777293283, "uuid": "fac0296d-79a9-4403-81d8-631f7b00758d", "value": "T1E0550114D9C43EF48F9E5B2960BE2149E3E10ACF2405658BEF22FD85BFF7601924A578", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777293283, "uuid": "8684279e-88fd-4c0b-a707-fcbfb3146099", "value": "24576:k1vJiwSePY+2PgJoe2X9UaxPuABnGpYLz6GfBePdFWRfTt5k1:UswCe2N/PnEuzlTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777293283, "uuid": "41e7ad3f-f776-44db-9c67-79d52b42fadb", "value": 1390222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777293283, "uuid": "b60aec64-7961-4902-9997-e337eff40d04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777293283, "uuid": "3e9c748f-36da-4e14-a5a5-196237eac147", "value": "PURCHASE ORDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62fe3c6e-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284229, "uuid": "7c6963c8-27ce-4e6b-b66d-9b1000521a8f", "comment": "Malware payload", "value": "220f5f58f71814dad85c443564450af7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284229, "uuid": "58fc27ff-457b-44a4-a000-54e573ecf6a3", "comment": "Malware payload", "value": "9d5d00e56ab4d914f69a73bcebf674ad52afc8b97aeb8b3530c79201cac1b135", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284229, "uuid": "a93e904d-cbd4-414e-a8e7-4975b8416419", "comment": "Malware payload", "value": "975bdac34193239ef7207bdc0084e568f6784bab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284229, "uuid": "d875b483-5dc4-4de8-a4b5-32c273f91382", "comment": "Malware payload", "value": "4feed3252782a6bfc36e4b073b9e1df65fbb03ef50b6dfac47b49b0d3c578109ba4c0903e7ef911e9f4efd6083ffa358", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284229, "uuid": "b50e1716-3d71-43d8-85dc-c0c17184aba0", "value": "T19D3723604A768DFF06B4334F00AA1E1B26EAC57111299CE7D1F6FC9D214F37066EA68D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284229, "uuid": "4ec99560-7503-464a-9df3-09b51888e4c2", "value": "49152:ce5ereCele5eDeTe0eIe1eGeGUuWneMetezejeCUuWmeNePeCeceueieleie7ecz:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284229, "uuid": "5e6c3c13-6346-4e18-bcc3-cdc8ef19a6a8", "value": 22903943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284229, "uuid": "e5dab28f-da3b-498b-8ea7-7960e8d1614e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284229, "uuid": "4fc2d5d1-941e-4655-978c-b515e1c7ece6", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9118b3-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777291600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291600, "uuid": "9cb1eb03-26e3-41be-9108-823fe394925d", "comment": "Malware payload (Mirai)", "value": "0cf41a25c9676e6a6551d73cf69731db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291600, "uuid": "1804f49b-7d98-445f-9446-0ae7380289bd", "comment": "Malware payload (Mirai)", "value": "9e10f2aace0584c5001e81848a513e0fdb7f94b629873f2de405fadce29ac50c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291600, "uuid": "333dd9ea-908a-4237-bbce-a9915f9ecdad", "comment": "Malware payload (Mirai)", "value": "456ac0cfca8dcf98a0adc3f4c06730fce7da5984", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291600, "uuid": "51e185ab-6674-42e5-9b84-dd807cb275a5", "comment": "Malware payload (Mirai)", "value": "430049715028fb3825b45dfa175bbe080d7792f3ddbdedaa833eaa4e032fd5b39c7d5e5a4f1c40398f1e34fd500160e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291600, "uuid": "1ee2051e-eac3-433d-8591-9498f96f5486", "value": "T1A033F183619624B9863054BB8A782F14E9CFC5FC94E0726F74C81FB933C9C5693A61CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291600, "uuid": "039f534e-cde6-4ee4-97d6-d6c7bdbb3623", "value": "1536:KFoay9tILVqxpcKLZ9q+WVCNnt2q3DIOiebezy:6oCVqxpLdA+WVCPD2eie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291600, "uuid": "746f7673-71da-4c85-a770-9c5c15ff2328", "value": 50648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291600, "uuid": "d2ad7858-5081-45da-a79f-e422c4dc47d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291600, "uuid": "1baee7d4-dd79-4359-8cbf-1c1a9a4a1b08", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc190a0-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271499, "uuid": "b4a67fff-19ce-409b-bcdc-65c6d0785e1e", "comment": "Malware payload", "value": "9eff05047c51ab3f1ca564ed76aaec42", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271499, "uuid": "44929fd3-a816-45f3-ac9d-a7c63843e83a", "comment": "Malware payload", "value": "9ed199869829e081b381d36e4504aeef097d3042d749d6f22726a439c400bc46", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271499, "uuid": "0cd07d10-0ee5-400c-869c-7fd9f34f765d", "comment": "Malware payload", "value": "5ff0a9f4343918e19c17c29b2470c90d571da462", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271499, "uuid": "1e1313ed-989e-4e27-b916-0f64faa68f61", "comment": "Malware payload", "value": "8d38f55d5b0192899f679a66345a532f6ce81b0edd0b01de23d0e425f0c58fbe73bccaa5d776c50ffdfbd372ad07f7da", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271499, "uuid": "05e9deba-ca34-47a3-8367-f6790ed02fb0", "value": "T186372302CF391FAF90E9627D25E5094E0BA54150991CEA33EAF7BC2D826EF7910D3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271499, "uuid": "f9909048-cacb-4b9d-8429-3f34bc45caa9", "value": "49152:MptkOptkiptkHptkoptkAptkSptk+ptkEptklptkIptkaptkQF0aJptkQptkHpto:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271499, "uuid": "ade4020d-dee6-40d6-919a-9e0936714bcd", "value": 24464725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271499, "uuid": "392cb9c1-bcd1-4b3f-b563-332cb89352de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271499, "uuid": "6e59b6af-ab72-4f7e-a89d-14a801a7303a", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6060e8b-4209-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777274570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777274570, "uuid": "4f63f603-9257-4072-a499-8920cea7ddf6", "comment": "Malware payload", "value": "b3bf26bfbf7aec43379523bd18b1ec16", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777274570, "uuid": "82e0ccd1-503b-4e79-8306-e425a55f299a", "comment": "Malware payload", "value": "a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777274570, "uuid": "67a677ae-e241-41ba-8e8c-7520f12612f2", "comment": "Malware payload", "value": "687cee4e972323e6991acfa59f608a7d1a6e170b", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777274570, "uuid": "71e564dc-601e-4c46-8b21-aa63d70aa06d", "comment": "Malware payload", "value": "1ac45a277e5c833b24bb872ed51790380b0c3af7af3201d9048806ec4b1e3cb3456f3b7ee60c25846e3c5fde79d5fa81", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777274570, "uuid": "ca211fed-ff54-4ad9-ba79-6dddf295350f", "value": "T1857633574DF2CEDEFF6AAB3836A2F015A1AE4308E6CB6527B6E53CA4810793417544CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777274570, "uuid": "c9d31bab-1e50-4d1f-8bbe-48ade9c9e253", "value": "196608:qpLr1+t6XYMqZepbJHzJhcp3ikU4yGxcCZcR:Mf1+t6XsZepbJdutihGxcCZcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777274570, "uuid": "72837deb-99d4-40ca-b539-9076881e42de", "value": 7512874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777274570, "uuid": "08a72533-cea3-4d3a-8f2a-e86de6f30ce2", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777274570, "uuid": "1b3af9a0-b1f2-4d88-81b8-1b07b32b7ce5", "value": "Word Document - CV - Vu PLPC KT nam 2026.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beee0f11-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323038, "uuid": "34e8578f-671c-49eb-9ae1-37dba0f4ed22", "comment": "Malware payload (Mirai)", "value": "6737931339d3a38ab67fb2aba198bbdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323038, "uuid": "53a74737-5076-4f96-bc6c-7cfa495ca24a", "comment": "Malware payload (Mirai)", "value": "a22f6eda1ca12a99e36053dc09e866d8bef715331049a24139f041167f764a1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323038, "uuid": "6406c3e2-7de5-470d-9b20-91ceb7c68383", "comment": "Malware payload (Mirai)", "value": "0cfc9ee62d018e21e92771186e9e1e47b6702ee3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323038, "uuid": "4079ae0d-3afb-43c0-b4ee-25e0b3a81f72", "comment": "Malware payload (Mirai)", "value": "297abc90a1d613c387f918d6bdc921f3a51ffe12af3f3f6ef4fbce9dc6544f7ef91a22da3660cc091d0d2f18632dfc48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323038, "uuid": "6e29d169-3c7c-4cd5-a4b2-bd926e3b20ff", "value": "T12903F104C58AA469F0177336417B7ACB4C16DB5EC1F88BC61EE4FC767685F642E242CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323038, "uuid": "74ec55cb-2457-4137-8dd8-e4418e5dcd1b", "value": "768:qXyZ9boRkEz8+RYgMAKusWxnqpCRivcD66WAEIhX3ChOmrAR++43woN39eCk+9KU:qYmkC8+WrfW8pEivrVhEXShXrAR++43T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323038, "uuid": "b05d3f22-733f-465e-b846-be5c90d1d551", "value": 39692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323038, "uuid": "1ae83e97-8906-41b1-b307-1ad01778241c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323038, "uuid": "6024c835-1661-4227-83c7-c0715df2d89a", "value": "vaxstresser.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c2363b-4228-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777287891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287891, "uuid": "c806394a-67c0-495d-9e38-2879533d35ac", "comment": "Malware payload", "value": "4d9e61fe5d105e4d6d26ac67f7228742", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287891, "uuid": "0746292e-bb84-46dc-ade0-868adcf38fcc", "comment": "Malware payload", "value": "a2363e2f464694cb4bb8f487d33ea378764790a1c742bce98a03db5f52f4cd06", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287891, "uuid": "f9da8758-6616-498d-9445-79c42177a039", "comment": "Malware payload", "value": "56b91302fb68794db6bbebf320373fbbaa4cab2e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287891, "uuid": "43b457d9-59ce-4647-b98b-5f2bbe3671f1", "comment": "Malware payload", "value": "328e5aa52c69a6aecc84c517479fd87966f8695f9a1421cfbdb3c8920d5f5c8a2eff9b2bf61ba91defee28319f94e417", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287891, "uuid": "0d3b57a8-3595-498e-a49f-294dd717955b", "value": "T13413E61B7B9350ECC02BC070D6B75331EA72F42016231B3B1962C6342E6DDA92F7AD99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287891, "uuid": "0aa9e47b-6ed8-4bfe-94d2-2a3748ad6bfb", "value": "87e458cd3b55cfb98a1e37abce3c322f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287891, "uuid": "4237f942-b948-4504-9fc0-33fba5ff4377", "value": "768:XsPQndcDOVoG9QrwipO9pC7olEHZZpy2:XUQwEoG91CO9pqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777287891, "uuid": "44d84310-c7d4-4c63-9f5f-211e49eb243a", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777287891, "uuid": "b25b920a-6192-478b-9303-6e9869ac3710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287891, "uuid": "d2e8dc81-4b09-4669-b174-83a2b19be344", "value": "svcload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822145af-425d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777310480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777310480, "uuid": "294a3791-5e22-4e3a-9d3c-a105ed5d3c1a", "comment": "Malware payload", "value": "65ef3e8de00d077704804b4b2a2d7eaa", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "sec-ailos-com", "colour": "#8F6E8C", "exportable": true, "hide_tag": false }, { "name": "webhook-sec-ailos-com", "colour": "#25F878", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777310480, "uuid": "5d132c38-2e0a-4662-99fa-42c23b9eb1ab", "comment": "Malware payload", "value": "a24e6bd8ccda593a96d7c040b6ddb1647f0b2d4c4f2d257b764c774353de3191", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "sec-ailos-com", "colour": "#8F6E8C", "exportable": true, "hide_tag": false }, { "name": "webhook-sec-ailos-com", "colour": "#25F878", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777310480, "uuid": "d2b22076-4e7e-40be-907b-8d1391522b69", "comment": "Malware payload", "value": "1847126b9515804325f95f546b5580d920f695ea", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "sec-ailos-com", "colour": "#8F6E8C", "exportable": true, "hide_tag": false }, { "name": "webhook-sec-ailos-com", "colour": "#25F878", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777310480, "uuid": "d12ebf16-45ca-47c0-ae6b-5b48381fc2cb", "comment": "Malware payload", "value": "857a32ef41d7e48c9ae486b782d4c98b22f20fd0179c7c64d8caa2e8a862c61ef4fe50f5e027b72c2ed374af440243da", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "sec-ailos-com", "colour": "#8F6E8C", "exportable": true, "hide_tag": false }, { "name": "webhook-sec-ailos-com", "colour": "#25F878", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777310480, "uuid": "8758804f-4014-4f90-a188-a6095910b8f4", "value": "T1B7865A43ECA515E8C1AED1358AA39663BB717C491B3123D32B50FB283F76BD069B9350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777310480, "uuid": "6d67cce9-d4a9-4808-aa3a-d3e6dcc35b59", "value": "49152:TCD2DqO5w+82xdNcFdjrJ+xiOON6ylUXBL8DV3GIbqNMGSmk2FdLgApEW/VIdDgv:TqBOmUfqdIv0AyQP7EK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777310480, "uuid": "8e8e25e1-bf6a-4c54-aec4-975cd59c6d72", "value": 8487074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777310480, "uuid": "e522feb2-f557-4c53-a3b2-415e0a67a48f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777310480, "uuid": "80d01393-b39a-48ff-ac10-f6df09d04280", "value": "ll-x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663980db-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283805, "uuid": "87d05064-d34e-4031-87f3-efe42ef6333f", "comment": "Malware payload", "value": "f94f48179966f9f2aba3da9009719b37", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283805, "uuid": "85f5f682-9ecd-4f05-a4e8-d5fce7d2a866", "comment": "Malware payload", "value": "a2fb8dfaa59353a9fa4b42e5e128297f3d0c8a19aa7fee7e63fa46742a24362f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283805, "uuid": "9ed9625a-e185-422d-a8a2-e58e63e163dd", "comment": "Malware payload", "value": "89237bd01c06d97a85c200d3aa22f9c76fd85a96", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283805, "uuid": "941f63b0-5237-4a9f-9fb4-6658f9f44338", "comment": "Malware payload", "value": "ecba4de02ef56933e9b5cb5e4a921a57e87a385f757f1862e8138b8d7205456afe014c94db959ae0d94c764f348db5c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283805, "uuid": "64ce72e7-68e8-40a6-a665-5c33000dd108", "value": "T13E3723958683BEFE07EE92B87979285D32C94C15B5117CE4FA90B4E2D34EF0305B9878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283805, "uuid": "61292e33-0020-4641-b1ce-20be3a48e056", "value": "49152:cupuHu4uuunu9uFuZuGuPuXu7oIam4uPuHuAuYuzoIamluNusuRuMuKuEuZuxugD:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283805, "uuid": "0b2cde13-072d-434f-a22b-e77f73b21bda", "value": 22643809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283805, "uuid": "c3520a03-8b4b-451a-a282-dde22d8d2dfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283805, "uuid": "2da9e166-f2c4-4c2a-bccb-33412b2b1e3b", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4468ba60-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321973, "uuid": "1dc40d99-557f-4881-bba3-24f11327cd0d", "comment": "Malware payload", "value": "9c3416d9e20993d0dba745b6f61c5c96", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321973, "uuid": "9762e53a-96ea-4320-b9ef-f2979d5aac25", "comment": "Malware payload", "value": "a334fe4623acd9fb572f416b9974293ef3ea2061873d80cdf34433bbcf28859a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321973, "uuid": "f1c483db-0b97-4375-a8a1-c443e7033086", "comment": "Malware payload", "value": "e717f4e5950157237fc109f0bca89678d7c00663", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321973, "uuid": "87f7cccc-f919-4792-9136-aab16c18fa0c", "comment": "Malware payload", "value": "967e377991e7d9b69d89c634445276e5af5b74b61590fb8378940d76afdcaf7b8d631ee3b5ea0ae4f04e9c4fbae85df2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321973, "uuid": "49658611-6db4-4fa3-8ce6-cfa34a46ee12", "value": "T13C5119A8C7421632EFAB182FFAA1205847C6AC03EB65504D5EFB5CCE01A0946A66CF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321973, "uuid": "3d15e3ba-41c1-4682-8d7b-afbb00c7a646", "value": "48:7+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:7katIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321973, "uuid": "05556bf5-b9c3-4aee-984a-2d4e7303a6ec", "value": 2494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321973, "uuid": "156a5868-a674-4b24-a3d6-37a80e2ea9fb", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321973, "uuid": "69d5631e-b870-4a39-b664-3bd0e765b2c8", "value": "164.90.195.107_1777321928892238_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a371fa3b-4223-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777285625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285625, "uuid": "397e9730-87c5-458b-919e-45ccbef0ae83", "comment": "Malware payload (Vidar)", "value": "588c1a0dab3e16a2b459e20609131459", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285625, "uuid": "16f43253-a4da-449c-a819-4a012b58cb16", "comment": "Malware payload (Vidar)", "value": "a3357377a15308ee54ea18d92d17e44abf6bfb6811248cd9f1e248b79bc29d62", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285625, "uuid": "b0237e99-c641-4411-a989-31adc753ea8c", "comment": "Malware payload (Vidar)", "value": "805b1219984ef7497a4cc6ff738a344bbab9ff59", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285625, "uuid": "3953e7c9-45bf-452f-ba87-4d6a8ffd06ce", "comment": "Malware payload (Vidar)", "value": "3b1076c94ac7d2e983779a9f30efb83528189d1d205e5150cce4bf7dc85f9ad5105a590fcf2aa35d05eb066e41ce4959", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285625, "uuid": "b3c550ea-8c21-410c-bbe6-fd7835d87523", "value": "T16FC57B017CD015EDC4EE763249F6B985BB34B8590B3A23C31A41AAB83E777D11C76B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285625, "uuid": "c320b5e1-ef6a-4769-b3f8-db755b7ba161", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285625, "uuid": "62ceed98-cc83-476c-b75b-2c88f92d11fd", "value": "49152:Dnuq9T+OHY1V/A176TV/iCO5xKU7w+ik3D:DnP9JbDrvK+wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285625, "uuid": "db55ac99-1ed9-46bc-8d64-26419611082f", "value": 2648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285625, "uuid": "69e3485d-cc79-4fc5-9b24-998b57151407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285625, "uuid": "743c1c26-51f1-4ce4-899c-6e49672e0642", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212f6e64-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276817, "uuid": "5a638d73-df10-42bf-a99f-ad3c3ed0a9b6", "comment": "Malware payload", "value": "a5448a8d36fbaeda82467d13e018a01c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276817, "uuid": "a0348c10-8894-4cdd-83b0-f27407b78046", "comment": "Malware payload", "value": "a3949cea8cb6f4dc44d8fa430b8860b1328653d42d02171c2a47ed1211e632e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276817, "uuid": "39432784-f05a-4931-90bd-376c393ffb44", "comment": "Malware payload", "value": "a4bd937727e40729562a429a244030c50cdbf2c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276817, "uuid": "077c9b0d-b372-46ac-882d-c616a4eaff31", "comment": "Malware payload", "value": "e1256829a87e34d6d6de72441caef18b44c31f96ffebdb154bfece42072d154271d1a73cd876f9c272f506d18f0d2c3a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276817, "uuid": "4d14c233-c16d-42f8-a95e-e7f27e5709e8", "value": "T19037230B4F6DA94E4ABC77D8BCDF4B0438225E8144A060F652954CB61FBAF2854EF778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276817, "uuid": "23ca5ac2-6ff1-4bde-9e1e-bd580f4aabe7", "value": "49152:BpqbVpqbqpqbnpqbepqbopqbypqbkpqbCpqb1pqbOpqbspqbLRkNpqbSpqbspqbS:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276817, "uuid": "0ebaf77e-7a23-4e41-bbc8-318e30dbbe61", "value": 23164076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276817, "uuid": "979472d7-39a8-4623-a66a-a114c6983cea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276817, "uuid": "ed196496-9eb2-4f52-99d5-68fffba4ff33", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41c6bf5-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323127, "uuid": "276763a7-2296-473b-9a1c-a924423143fe", "comment": "Malware payload (Mirai)", "value": "31b296f88c4350019a41714e0d345225", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323127, "uuid": "83d54042-4f3e-470c-80ed-121c56ae2dc6", "comment": "Malware payload (Mirai)", "value": "a3bd04ded327f48798299b6a27cbc3e4c8318a1836cb2fc8dcab8ada9a36f670", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323127, "uuid": "86bd739c-08c1-46d7-b600-c27218109c51", "comment": "Malware payload (Mirai)", "value": "b4151a15c471530bf45de94a6e4313764fcf9944", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323127, "uuid": "7df58f87-b2c7-4caf-8881-b146f0a98cfc", "comment": "Malware payload (Mirai)", "value": "590558a11ef967d399c5fec01fcee5aa12b10d61ebf6416a55a5307fa473154a03a4ab4acd78134cddaca15a8bcf63eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323127, "uuid": "91ba6cc6-80af-4bf8-ba79-76bf257128b5", "value": "T17D8329C1FA8BC0F1D91B89304067F73FCB31E9695061975DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323127, "uuid": "26acdc3e-c537-48fa-89bc-69d8ee8a884a", "value": "1536:HInlZzkj+0cO4xoPEw6HMAyvleEMWximKjfTsv4gz9F7EY:HIlySh9is7HMAQjwmKjfTc4DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323127, "uuid": "cd3da0f5-5e43-4fb5-a057-b88db3a5f683", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323127, "uuid": "6ad4dcdb-89a5-4f88-bba6-d5e8844d3a49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323127, "uuid": "0ddb4727-f7e4-4132-8d78-9b4523939b83", "value": "vaxstresser.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6dc309f-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277175, "uuid": "b96970b7-39e4-4281-a0df-4c9a435d87c2", "comment": "Malware payload", "value": "da7e3b123bc566ffd36e60ac5e46a53a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277175, "uuid": "e43924b2-e310-4b17-97ba-4f889460e70f", "comment": "Malware payload", "value": "a3eeb8a071de7dbb277348fbe2f98beb726b7881852eba819b13c89f640773b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277175, "uuid": "ef8ce8a5-7559-495a-a785-6d9a94b16cc2", "comment": "Malware payload", "value": "3f085d02743cf7d461577c847ba3bbd6bb42a955", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277175, "uuid": "a3bf8d0c-d939-4c8a-89df-a4f1e24d9f32", "comment": "Malware payload", "value": "08a7d46ce4bcb30879e00a8957c8ad0c9c97513ffd2ba389656d47e51c3abd6a44e255efb8933d50db7db4a4d193d4f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277175, "uuid": "37156f3b-1470-4cae-a068-032a3a69cc9c", "value": "T1293722884E1F4F29A62C0D6DA62F4F5FA1E24C4590000493BBB16CDEA3C77BD7A572D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277175, "uuid": "62b60b80-fd66-4799-a963-2b9e2f35aad0", "value": "49152:IEmKSyHEmKSyJEmKSyOEmKSyGEmKSynEmKSyVEmKSyYEmKSyUEmKSygEmKSyCEmE:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277175, "uuid": "f69196c7-ad62-4f15-bd2f-b0c34dd6b8cc", "value": 23424220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277175, "uuid": "0c950cd3-e291-460d-b4f0-a24b2f8739a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277175, "uuid": "11645930-f956-4ce1-9cd8-a287307fd3d5", "value": "invoice-1645080830.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c7b9f2-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276310, "uuid": "77f45573-70f9-4c85-bfed-3ad021f1a3d6", "comment": "Malware payload", "value": "34f50a46151d72e1d42acc818024778b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276310, "uuid": "f29e9a33-c95d-4f9b-b662-5e0c6d5c4dd1", "comment": "Malware payload", "value": "a4256bb710db7881e90c4f9f9f013e31a8819deb30f75f397dfbcdddb6dbf94b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276310, "uuid": "eb6081b5-dd6c-4976-a7ad-6662e521d0ac", "comment": "Malware payload", "value": "6a0327f86b0d13ffdfa42d4fb86405442b85cd57", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276310, "uuid": "7af5a6d5-985f-4a49-aa1c-33394ceacca8", "comment": "Malware payload", "value": "4eeeb9c2c51799bcbb46149a6988b0caf4caf88f2308a0d9e97642e1d3badcfefdbdcb2193617aaedb240b97a847b2e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276310, "uuid": "cfee85a6-3aa7-476e-9379-804304dff8e4", "value": "T10D3723366B79256F1338275C14FA0F3CAC629D895C40FC2DD3A11CADDB89B92815F39A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276310, "uuid": "44abfa72-44e8-42e5-bef7-5596abdb27f8", "value": "49152:5xY6zxY6AxY6SxY6ixY6RxY6jxY6ExY6exY6YxY6ixY6ExY6w6wrxY60xY6TxY65:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276310, "uuid": "420826ef-de79-4403-9ffd-33f8390c6540", "value": 23424184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276310, "uuid": "d087c6b9-327c-4775-a34d-bdb12ff97f2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276310, "uuid": "36e84384-8f26-4d48-8bd9-30d2e96c1fb7", "value": "invoice-1645080830.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e740d01-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1777264974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264974, "uuid": "02dd0666-881a-4b74-8797-2a88221c40b5", "comment": "Malware payload (Loda)", "value": "77bea7bc874e664690dbc1ecc00c87c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264974, "uuid": "9a6d48e1-c835-432e-b948-3b6d4b0d6765", "comment": "Malware payload (Loda)", "value": "a427fc9bc7a54e7ce1e2cfb94d80c2857f40df94b3bdb2afd72e60abf50fa632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264974, "uuid": "212f54a2-bd27-4489-b4cf-53bd9aff626c", "comment": "Malware payload (Loda)", "value": "252ef49c8dc89bf5fa8a9db18cf9795e47585f46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264974, "uuid": "82ce7f9a-3464-4a6f-bf01-dd50deec6123", "comment": "Malware payload (Loda)", "value": "561837a8e2634064cac77a6976c570d7a0a636ab59990825c6b5e714d53f9ce79eb70b74a6251944ae14bc6ed6da8857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264974, "uuid": "f4555f39-0085-4129-9bf9-66c0ea0831b0", "value": "T127232C003BE98126E2FE5F789DF2214586BBB6632502D55E3CCC42D74B137C6CA52AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264974, "uuid": "cf225aba-5db4-43ab-8d67-fc43b15431dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264974, "uuid": "641e4fb7-e48e-4bf7-8967-a541be00c809", "value": "768:aqN9HbXQUap/xuRCrCmHWW0bHa9K3hrWxHBDdTyMQYI6OCx2tYcFmVc6K:adpJZ+uW5bHX3VeHV8MA6OUKmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777264974, "uuid": "35316266-08d7-48b5-87e4-80fe82513364", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777264974, "uuid": "40e84fdd-8240-4eb2-8eb8-4d488bbb1b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264974, "uuid": "73d7686b-63f4-46be-aac5-af7c19959a00", "value": "a427fc9bc7a54e7ce1e2cfb94d80c2857f40df94b3bdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846f4b41-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283855, "uuid": "28e6278e-235e-4de6-88cc-3d2adf5aac3e", "comment": "Malware payload", "value": "05acfb09b842001d2381ae83fc58d1fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283855, "uuid": "d8609d90-80e5-4d4f-9019-9ce628437fea", "comment": "Malware payload", "value": "a52521b804baa56ec22acc17a7059b2849920d518b5e969de9fb08ab2e4a789a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283855, "uuid": "53051681-dca4-4d44-bb03-e06d4c108be0", "comment": "Malware payload", "value": "c760c9fbcf5e8c95d787766e44d963377d324144", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283855, "uuid": "98ab6e12-206f-4c73-b884-497c47001a29", "comment": "Malware payload", "value": "9bab2da19fd106a9fc850f3cd4bbae7e9d3aea17fc69df961d0d27c96ae775adc89cdfe5c470b9a07865c367cea2eb93", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283855, "uuid": "c315d412-a5ee-4239-ad6c-1250aab5b5a3", "value": "T1173723058DA32A3A417897ACFD4E0B7BA2D04708F865985933E09F539C07756B1EF6B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283855, "uuid": "9eeb8551-94df-4ef5-86c5-37f3730bc84a", "value": "24576:SJqUQVd77JqUQVd7lJqUQVd7iJqUQVd7XJqUQVd7tJqUQVd77JqUQVd7AJqUQVdx:Xy9yIy7yTygyoy8yVywy9y2yuy3yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283855, "uuid": "e763ea87-2bb1-478b-b4a5-8fcf42db495c", "value": 23944466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283855, "uuid": "aa979a20-2866-4064-a378-e1996b16298b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283855, "uuid": "85067f4b-f42b-43ea-b559-a6136e81870f", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9a8776-424a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302525, "uuid": "e32ae252-9ca4-450d-b102-151549fc1583", "comment": "Malware payload (AgentTesla)", "value": "b9d42dd22694c594f7fbdd6d4b32bb0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302525, "uuid": "f503f1d2-2051-4c3c-909e-41f420be898d", "comment": "Malware payload (AgentTesla)", "value": "a53a30135e49a1c849e65147412e9e35e3297bbe3419d701b4c938c1f23ff35d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302525, "uuid": "f70d9a7d-be50-4847-beda-8d546f7b735f", "comment": "Malware payload (AgentTesla)", "value": "b050b1e9c598a320d656d85c2b7c57f2868437b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302525, "uuid": "f2fd3d75-2cfd-43bb-9ba8-bd62bfd7feb0", "comment": "Malware payload (AgentTesla)", "value": "bfcae687e523e1db5cdfee20c957bc229cf00e550f39126a1c6675b3a6195f2a3199e709f54143a076685881ecde8927", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302525, "uuid": "af801b2b-55f8-4fe3-9a74-1402e69184d5", "value": "T10D252329EE25FDE20520421C0ABF6F551FF01B474427A14AEBB0D6979EB1AD35242FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302525, "uuid": "71a9e441-34f8-42b2-b79b-27955d3f5453", "value": "24576:cngOoIbfHJkntsTRgHGUMPe35VJxFqmwXGj+:sJnFUMmJXaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302525, "uuid": "d318c162-079d-4c09-b3cf-f26f63cc203e", "value": 973082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302525, "uuid": "5c43c368-19be-4afb-9839-40a9e8ca4b61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302525, "uuid": "cc2597b9-5ab3-43b6-8f30-554f448451c6", "value": "ps_8EpgjgqkoQ2d_1775722692800.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f37186a-426c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777316945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316945, "uuid": "fa580b49-8d58-40af-a8cd-2aa58f793dd4", "comment": "Malware payload (Mirai)", "value": "4c9eb9b099f9d0c742af586c1c48d0ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316945, "uuid": "bbc3a075-b136-404c-a47e-8b843f8d53f3", "comment": "Malware payload (Mirai)", "value": "a5be77aca418ec4acefefd0addb30ba1d5f9ea21c6baf5af7744b65fe56992be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316945, "uuid": "bef2add9-4f3d-4db2-990a-c6e7671a1477", "comment": "Malware payload (Mirai)", "value": "5cf0f28ebed960a0c37d6c4f7e98608b929b94f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316945, "uuid": "f2f33789-bb8c-4916-867a-91b54cdac39b", "comment": "Malware payload (Mirai)", "value": "3247abcdfe37f474fbd0776d82f50e7112522a0e4edfe23b955aa782a53c52af11756df1936b211143403be8609b137c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316945, "uuid": "209900cd-9ef5-45cc-a8ce-9142e50eaeae", "value": "T115633C22FA71082BC5C4A57961F30735F2F7839A24BC8A173E610D8CBF65A5036677E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316945, "uuid": "fd53ed43-ee22-4d75-a277-e50ed12829ab", "value": "768:iV8/cMw/g6xOmO+Nk5Vfik4YTMk2IEZ/0kVxVtMrsEVPa2t3dYAI03:7/c/FNk5+7IEd0KVt12t3mA73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777316945, "uuid": "1eec886a-170b-4ce5-8127-d1cfe3fd09ae", "value": 68164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777316945, "uuid": "637cc226-1c5c-4365-bfb4-e49bd5b754fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316945, "uuid": "9968f96b-a0eb-4d44-b34c-8f87c9e0706a", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccbae79-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294473, "uuid": "d4e0b382-7a3c-4b37-8076-b7cf85317eab", "comment": "Malware payload", "value": "7c4f55078b49ee650ef049aaa6235771", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294473, "uuid": "3b0867b8-31b1-428b-a6d0-48471bb49ba5", "comment": "Malware payload", "value": "a76ed8012530691a3bfbd4cab25391269029fa688b7e02a93935601e74c661cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294473, "uuid": "5e476a8d-1916-4b41-8e31-0c72fcd38da8", "comment": "Malware payload", "value": "5d9b1476356578fa572d0ad02237967702f7822f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294473, "uuid": "15bebb8b-662a-4c4a-a978-7472edad7066", "comment": "Malware payload", "value": "763afd10a7df4595cd2a5dcc2265c8ff3c9edca1c02c508518002c2d436df15b0a6854ed2ba73f3d05b0549a850fcaff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294473, "uuid": "7d5e2b19-9777-4bd1-81c2-845a83a964d5", "value": "T1BF3723501FE98F3EC93C287614BE0E469FD6980440091DE40AF9D8FEAB4FE56761A1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294473, "uuid": "1ce38ee6-5cf8-444f-9a0c-dbe08187b6a0", "value": "49152:3bmbhbjbxbobGbsb/bxbGbpbxfDb+bebZb1bQfubDbVbYbgbQb0bqb8bBbmbcb/d:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294473, "uuid": "afb07798-ac1d-4c9d-baa6-7b4cf7703b50", "value": 22903945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294473, "uuid": "5f016c66-e374-4b1e-a370-d7a5424ec11c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294473, "uuid": "688b191d-8289-4f8b-9bdd-c01a03cd0d4f", "value": "invoice-1645080830.pdf (65).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293c78fc-41d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777253638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253638, "uuid": "ec99d5b9-3c7c-4485-be3f-1ca3de86c909", "comment": "Malware payload (Mirai)", "value": "64ce19ce1086699c28d4e71db6308fd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253638, "uuid": "dc76c1de-5c4a-4664-80fe-7791c1adfd18", "comment": "Malware payload (Mirai)", "value": "a77fe98cf3580bf3f4ab9685b499496fa9131be496c581066bdea654a52d7268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253638, "uuid": "c63bd8fc-1d2f-4ba1-ba6c-cf7af6f074fa", "comment": "Malware payload (Mirai)", "value": "28122b181e7515a01ce4114808dcb610b1e4b474", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253638, "uuid": "2d353807-c39a-4fa4-8abd-0bc6248cea87", "comment": "Malware payload (Mirai)", "value": "df1876fbff45ac86481bc6a1d58e600a49ea2e08667ed66c6fd5ef6c07d602075089d66b7d357a031c4a1ffbbab68959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253638, "uuid": "f7e6c181-67fc-4a43-a3cb-f5473beba1dc", "value": "T166E43A56F880DF62C5D1257AF65F8268331347B8C3EB720699189B383BD786B4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253638, "uuid": "084c0cd5-7922-4ba5-abfe-94b4f26db6e1", "value": "12288:gpbp4z0rBnNneV5TZAAHbJn/MTxv/64aeiLPzJgpket3GZmRck9vUji2q4yqp:Gp4zsneV59AA1avi4iLUlG+UjiH4yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777253638, "uuid": "cc18c039-bcce-49c4-913c-24ff92ef282e", "value": 681340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777253638, "uuid": "8453b243-2dfe-4120-9132-181de1d78b54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253638, "uuid": "e8f1a02e-2ee5-448b-8024-8ba7c2aaf9de", "value": "SecuriteInfo.com.ELF.Mirai-BTE.62959278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1eae774-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323043, "uuid": "9b7e3a31-3d99-422a-a169-ad719a8fbf8b", "comment": "Malware payload (Mirai)", "value": "beab40aaa85b3dab337d57becb85bd9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323043, "uuid": "2eca6380-52c8-4c94-8de5-197460b161cf", "comment": "Malware payload (Mirai)", "value": "a785ef6311e1fd6516b46a85499069cd0cf6fc70ae98855f514bf6d89e7fb5ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323043, "uuid": "a0e707ec-ac0a-461d-ad8e-f3d02c88960e", "comment": "Malware payload (Mirai)", "value": "b0661f3aea8ae00c1977acc94f2b43f1ae9a4485", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323043, "uuid": "d65a777c-4259-4d6e-af85-c06bc27246f8", "comment": "Malware payload (Mirai)", "value": "6b69a5271db6b52dc63b06fdf37bb07a2c83a4a2367b471bb1583a5edbf986da03fb260d89924b10eafe28f8d833ab60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323043, "uuid": "92985e8b-84cc-4192-89d5-692fe8e85a85", "value": "T15D13F1CE605000F9CE6E567EA8AD0F757580A18032ED0B199275DC66FBFAAC674CC0D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323043, "uuid": "8241efae-e6da-4f79-9ec4-b24581c22d66", "value": "768:4jdBuP37LSHyomZgvE5FRahT2GYADAf+wV88rgbHsXWH+:4jdBo2y/Zhy6GYADAf+wmmHc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323043, "uuid": "977808c3-4c04-466a-b434-6ae1d0138c5c", "value": 44556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323043, "uuid": "7c0f0c09-f160-440c-aa37-4ecabd13561a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323043, "uuid": "3dae7be6-a8f1-4b99-a5f4-545af843d39e", "value": "vaxstresser.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa1b464-4252-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1777305663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305663, "uuid": "c8292df1-032b-4a83-9929-8dee74ce67f2", "comment": "Malware payload (njrat)", "value": "693b75f8eec690690601115ea53fd679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305663, "uuid": "fdc354b4-6995-4090-ab7b-3cb89354838a", "comment": "Malware payload (njrat)", "value": "a8286fe34b7e54d3d0a7cf22de6be71cd525d1bfce394f4582306444957ebe4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305663, "uuid": "c40e2b55-7f86-4f74-bf75-acf66c925a3e", "comment": "Malware payload (njrat)", "value": "139f040191fcf621f3e3aa8a2d23285dca05c65c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305663, "uuid": "03204477-9e31-4da1-b306-498d2cb6a095", "comment": "Malware payload (njrat)", "value": "6ea0527f024700eccc114bec127d3cc70124478f284e3229ec8b4efaeede6eaa7c6ff1633a666ea62d6f4453bc4d3b72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305663, "uuid": "ca761656-0a2a-4ca8-9376-d0073edfd964", "value": "T195834A8726D87D92C07C8BB1BB7327C1C724CE483953DA1D24D4696C8A7E78B39927C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305663, "uuid": "9596328a-7c41-4531-af15-6dc6969feaf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305663, "uuid": "b0c7751c-ba06-4a26-a6e3-bd8ead7060c1", "value": "1536:+2LuqKADg8DIig0HrK1tBPxp41DK/bSKJMh72ZtvMYYiCbaU:+2yqUn0K1tQD6bVJMSiiCbaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777305663, "uuid": "611ccea7-6c2d-4763-9823-cb5c015fa29f", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777305663, "uuid": "39eb9e2c-d234-4a6e-932d-510260a560c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305663, "uuid": "bdff356a-e697-4b47-95f8-e10040ff286e", "value": "rat1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221cdd3e-41e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777260068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260068, "uuid": "1dbaebce-3b97-483a-b04a-4bf973401754", "comment": "Malware payload", "value": "c35454b4fd35860a17838a41710f0e4d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260068, "uuid": "1accf658-47e7-454d-a66f-22c2a5625505", "comment": "Malware payload", "value": "a98f90eeb6d613ce307448412aba1800c2dd17f23a0331298028f2b3bb2b0172", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260068, "uuid": "cf738c77-2ddd-40a2-a540-fecd077306a5", "comment": "Malware payload", "value": "613983a276f2d8726c8e7c4111b206f5d5e52919", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260068, "uuid": "1d735195-66b9-4765-b26d-ba0569133d6c", "comment": "Malware payload", "value": "9931097a8a15370fab3a07cb31b7a054174ff9930ec173cd44c7e38162633c69643b1706861a145c0bdf2723f12ac100", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777260068, "uuid": "551a03f7-56ae-4592-9e4e-aa3cb8d5c1fc", "value": "T1D2C31266A3801BE16335E9571A08805E05B97F71F1931B3708B68AF7B8F6BE7C007CA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777260068, "uuid": "c9b4fca7-8a28-4f12-835a-0e2a14b6ec36", "value": "3072:j1vOPlj4OR1tAVmwGWaTaZR7kFe43Z2Q6R9:FOPGOR1tAVo5sGe43/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777260068, "uuid": "9b9b7b79-83ec-4fc1-b4b5-c4801101e69e", "value": 129769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777260068, "uuid": "3ba33a22-7be2-40a3-b837-1b2065126927", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777260068, "uuid": "b6500c73-6853-48fd-acf7-bcddbe113256", "value": "DOC26426.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ce0d83-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280712, "uuid": "9107481e-91a0-4f38-9b72-deb6e4a7904e", "comment": "Malware payload", "value": "eaa3248375922ed5be04d5fc86b8c644", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280712, "uuid": "2b50c5e7-a4e3-4c52-9759-898376529ca4", "comment": "Malware payload", "value": "a9ddc0e64411baaa15e80464e86edd235a9f8addeaf7c69dd4ad443911d43a3f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280712, "uuid": "a535a6d8-b32f-478a-ada2-afac172a6165", "comment": "Malware payload", "value": "4c7e3f4f987407750893071c4454f6dd80028a67", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280712, "uuid": "fca62d77-dadf-4505-afbd-8ac436825907", "comment": "Malware payload", "value": "3273bf606a0493f9c5726c3264b391cad1348b9ec3f82c65df9e86cbcc82175ca6231b101686a618c930ec40da6b0d39", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280712, "uuid": "da74a7ab-0956-447b-bad5-da732ce0ee25", "value": "T14237229BCD19EEEB99F450D9357C0F4B69D8CE8054819FD13AF3A51B2A4BE40847EB08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280712, "uuid": "1e7a84d9-ce6b-436e-8b20-49949ce44a30", "value": "49152:cM54mzM54m6M54mfM54muM54mEM54myM54mNM54mDM54mZM54mvM54m9M54mwr8i:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280712, "uuid": "00838da9-b158-4ffd-a954-01087264c650", "value": 22383667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280712, "uuid": "2c1fb571-5e32-42c9-a3b1-f20fe0d85005", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280712, "uuid": "32041266-cc79-48aa-9194-9ea9c1ec0fcb", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f24409-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321942, "uuid": "d0d92a72-50b3-4b57-bac5-963adb6ebd08", "comment": "Malware payload", "value": "034c7bed52f1624761f8040fd0a73888", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321942, "uuid": "69eb8e57-b3b7-4efc-a026-6fc5ee0966cc", "comment": "Malware payload", "value": "a9e8cfc5391b6b6e06f28f2ad94d786cbf1173e14e87b00e7b20cd327ddc69ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321942, "uuid": "35d06da8-9811-45d5-82bc-412247bc9f33", "comment": "Malware payload", "value": "6a9a1c45ca7065fe0bf5cdef0675e5a2a9d85576", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321942, "uuid": "238f230d-fdab-42bb-9a9e-20b1fe77ac6f", "comment": "Malware payload", "value": "8444a1c4bc6d7d9676131420c161759233d412126af8c9daddeb595ae3436f20f752cec168888121eab8d8c70fc31787", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321942, "uuid": "492d1735-9b08-4553-b774-9cd8ba8347b2", "value": "T16AC02B155049BC74034FD7C9451018B10113C80B010D48934240019CC5F0D882DF5053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321942, "uuid": "772a9f87-db0f-4ea5-b38d-37473635fce3", "value": "3:gdQTtQ8wTKHm+g9rmecsTDNkxLNBkMxhJH0fJH6tM:gdhXKH69rL1gf/jUfJH6tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321942, "uuid": "078161df-6913-4c0a-929f-8cee415601d8", "value": 138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321942, "uuid": "52fa756a-4a7d-4fd3-9204-3439fb2cacec", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321942, "uuid": "a5734b8a-159e-4a46-8df3-55ec6721d7fd", "value": "164.90.195.107_1777321920564793_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7658dc-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323060, "uuid": "cdb76059-cb39-4125-b1cb-95ff91bc5c6d", "comment": "Malware payload (Mirai)", "value": "7110de73c4c6e431a708e51642b316de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323060, "uuid": "1d4fbc72-8f0c-4460-b563-4d5624fdda8f", "comment": "Malware payload (Mirai)", "value": "aa1f63d4581631b161db6d109d5272d5596bb034a5fc4f2a2c9f214e83802857", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323060, "uuid": "e44fa214-ba57-4229-9101-c738cb9323c5", "comment": "Malware payload (Mirai)", "value": "4c8ec923e990592073552aaa29d7a69b3b713729", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323060, "uuid": "470fe08b-86b2-4cf5-a017-5aa4422fbfe2", "comment": "Malware payload (Mirai)", "value": "ba8c40ac56bb6f1e2e7c4c49ffd99fb683205ed105d55e3e43812b7d1d0e1d6c1a8e3c3997a76e2ebc127088c961c878", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323060, "uuid": "7da03cf5-bea4-4d7f-a168-96363af2e5e1", "value": "T18F03F14991D68B05F22B803A16EE31E76840EA8EB315C56B3F8560793DFDF0E74246E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323060, "uuid": "504d0e88-8c44-4862-a9df-ea78b8197fa4", "value": "768:7I6Iak2KV6lFoUiSRfH9oUXTtxoMpv0AN5ZZZ2ET5lKRpJanbcuyD7UHQRjZ:s9akHcvZz/9oUXTP0anZ15lKRpJanoug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323060, "uuid": "0c22d767-a112-4923-a45b-09e4db68a5d4", "value": 41304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323060, "uuid": "eda80733-ef7f-4a1e-b247-9ee27bfb8147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323060, "uuid": "93a1a71d-edb7-4f12-b589-42b6e572c4e3", "value": "vaxstresser.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c07bf08-4253-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777306014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777306014, "uuid": "b7c9d599-e72d-4a02-9e06-88b8eb689137", "comment": "Malware payload", "value": "0f9e500d8377e42802648aa7bfdbeb99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777306014, "uuid": "b5211b73-7460-4aac-abe3-fa5baff196ad", "comment": "Malware payload", "value": "aa6460af3db085202cac4fc9da0c6b09be4bd00eb6b61d6da2e4b2dd96db5d82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777306014, "uuid": "b9979c04-2327-4f93-b55f-869e9d39c087", "comment": "Malware payload", "value": "1bd685726756692babd0c17014867ef668db51ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777306014, "uuid": "a28ad2b0-b07d-4671-8d03-0e84893872e7", "comment": "Malware payload", "value": "2d1feb7d514117c20e4d99cf1a3196195d810c700323aa4fc2ddb9b23730c86da680434dec1bd21a52ec8b11b97cccd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777306014, "uuid": "e03ec878-3b6f-470f-8349-976451ef35c3", "value": "T1D6D75B21724AC52FD96201B0192CDABB512CAF760B7254CBB3DC2E6F3BB55C21636E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777306014, "uuid": "f0489ef1-5667-4b1d-aebf-6c986114e29e", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777306014, "uuid": "efc10408-cca5-4662-8849-7b20f9dbdc69", "value": "98304:9r99u4kc8Hao8eRjYBU4UAir2Y5aBh1yWn:v9upko8Rr6reXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777306014, "uuid": "609e7472-8e3a-4cb1-9fc3-631b57a6d2ac", "value": 61877608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777306014, "uuid": "6d7a40c4-cff0-4762-8d0f-e93b0b4afb5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777306014, "uuid": "7d5285c2-4ff5-4594-bd24-3cafd3f43477", "value": "CurseOfAsmodeus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0bd1bb-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280674, "uuid": "3df703ac-b77c-4ff1-99c4-2446463a3476", "comment": "Malware payload", "value": "d17350f3453f66d514cebbbcd892dd28", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280674, "uuid": "9bd4bca5-d86d-40aa-993d-0c8d8a7d8e14", "comment": "Malware payload", "value": "aa900c8a22a00c32778aa3e690cbf441356f8b751a2cf4c50e46b30252f32d48", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280674, "uuid": "5889c21a-8e46-438e-bf16-29d5955ebfc1", "comment": "Malware payload", "value": "835c847be3abe75c785b93b94927723722087622", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280674, "uuid": "f1fc0085-54f9-48d1-9c8f-cb2005a87be8", "comment": "Malware payload", "value": "28b517c14c4856db75a676c609214c120c6b245db4aa341138da09148d71e4843e26831aff5be094630d779c47936058", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280674, "uuid": "2a9465e0-4ca2-48f4-b432-cf3190102aa3", "value": "T1643723142EAE1F69C1BC514A54BF2F1E3A48CB78C0C978AD47CC780D9E1A95B287673D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280674, "uuid": "6a2f82d0-ac95-48c9-9eee-f4d99c52336b", "value": "49152:K/qu/qG/qG/qr/qL/qh/qE/q1/qk/qa/qL/qsuDv/4n/qg/qt/qN/qJ/qkuDv/4a:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280674, "uuid": "96111333-f696-4a35-b4d9-1f786b1872ea", "value": 22903957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280674, "uuid": "21e91881-c5d8-450c-9e1e-dee703785ac3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280674, "uuid": "2ed63b9f-fde7-4ec0-b8d6-91f6a6c0dd92", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41daf360-4217-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777280308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280308, "uuid": "a3e04c2e-a3c7-4f2c-979a-52ab7bf8b3ec", "comment": "Malware payload (XWorm)", "value": "57056db786ab5035ea4340ccf0bc292d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280308, "uuid": "ba30b243-ea0e-412b-bb1a-2544af10840c", "comment": "Malware payload (XWorm)", "value": "aaeb85c0cb65e4da3ee3dac33621aaf99fb310f7f43d999d0c45ed5195d1aaa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280308, "uuid": "80986925-e223-41e6-83d5-232d85385af9", "comment": "Malware payload (XWorm)", "value": "5d85383da6ec8d3fef59d80653edac864abe51dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280308, "uuid": "65f535fb-238d-4fa1-be01-2ab90f05153b", "comment": "Malware payload (XWorm)", "value": "76c8916d5d5e89bd04e1569541676404131c189bc3fa00ff385157c3c3f7bd667aced0764670b8f6a331eafca52d6bf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280308, "uuid": "612e9245-5fdf-41ef-bebe-311ec485105c", "value": "T198F412B59F0BD442D98203B14EB2E3B11361DF5CA223C307DBED9CEBB81877661A1291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280308, "uuid": "32a47f93-3538-4c09-909c-52d9265c0366", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280308, "uuid": "65a0ce12-7a8a-431a-960c-1afa9f79dd36", "value": "12288:139SlMP7k/9MXF3fp5LT59MsrENE4e/sLDHzKu0k0SONBPa93m4:1tbQMFrTEa+9ONk93m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280308, "uuid": "3f3af880-37ea-4780-a332-4cecf374ef26", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280308, "uuid": "f37d9bb9-be65-442e-aa03-05c6d53b2c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280308, "uuid": "d91a2b4f-5b35-4489-8434-da7fa6133791", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c708be-4222-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285337, "uuid": "a3868495-ef3f-4660-bcf7-735ab9a2718a", "comment": "Malware payload", "value": "625a0eefcffc4ec8b6c87496c8cdfc00", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285337, "uuid": "f741595e-da5a-4b0e-8ea8-5a971effffec", "comment": "Malware payload", "value": "ab213d042f7bab26249144ffb829a8af70cef273585c3be6681c78097ba54fdf", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285337, "uuid": "cec2fa63-f37e-430a-a423-083daa7f5b21", "comment": "Malware payload", "value": "70b5c4c5e495f2961f35e5fd17e08a4cf6710f9f", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285337, "uuid": "ec318beb-0db6-4447-9bb5-a2619201622d", "comment": "Malware payload", "value": "0584e1c15efc6d3dba21b52140adb0c2d3eea5cfb0e32a7119072c66f40c06f15422210b3ee4a2e3784932a738fc0ce4", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285337, "uuid": "f196d388-674f-4deb-ac54-de28316b23f8", "value": "T1EC11BDF220A5AC33F75B44B69E9EF01D2A12382D24B12F6D70CEA8608F6D7003311A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285337, "uuid": "76e7a328-6835-4fe0-acdf-c6f8b6738e4b", "value": "24:bXQOGyMzMnMqmMUwFbcMODtGGRdMTIm12uP12DKO012uePr:kOBGwyocPGGRdeIm1R1M701C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285337, "uuid": "b4c7f97b-2b0c-4e78-984b-dbeb69a27dcc", "value": 933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285337, "uuid": "e37389ab-4478-4546-a93c-c0943363bf67", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285337, "uuid": "49eeb729-0ee4-4ef8-8998-bcf4bdf1c190", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb365e9a-421b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777282256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777282256, "uuid": "d60375da-7dcf-4b43-b78f-7a5b90dcb14c", "comment": "Malware payload", "value": "72ac04d58eebce62c27259487023e105", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777282256, "uuid": "215082ff-ca61-4979-bc67-2ce9ea456708", "comment": "Malware payload", "value": "ab31ea17ea415efd30a19fdb7a68b92146692b76584007cbbb94f55b9761b8dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777282256, "uuid": "57acbd5f-b702-4c0e-8456-01a0e4da32bb", "comment": "Malware payload", "value": "7c1f27af4f2642daa406fcfc8387c0586827259a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777282256, "uuid": "323d3a46-96e7-41b0-b9f9-a1cc3db34f10", "comment": "Malware payload", "value": "e4afd95996a50d8060305b879d429957f67cdd3404a159219b15f1c8a81c5d6905d96cbc1c392a5f3ea74ad4693ab330", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777282256, "uuid": "da5e3016-dcb2-433b-9825-ca8d0c754a67", "value": "T1BD65F757E89590F4C0EFE134C726A213B9A13499473437E76FA18AF11B26FE866BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777282256, "uuid": "6049aab9-f901-49cb-8777-0c0b4f1dfbb3", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7FOQzjFyaWPli9+cleR8d8:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777282256, "uuid": "a8d13136-28db-4811-abc7-e0fdbde824d4", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777282256, "uuid": "2642a496-8197-43a8-b716-db1611a9abac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777282256, "uuid": "ab51eafe-1c4a-4f5c-8765-e6b7812efaf0", "value": "ab31ea17ea415efd30a19fdb7a68b92146692b76584007cbbb94f55b9761b8dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bcc424-421e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283596, "uuid": "495217f1-b826-4b40-9878-50ff59a8f878", "comment": "Malware payload", "value": "b82d9f38615fb472e0d4d6676f261c3d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283596, "uuid": "7bf8a98a-4e38-49c8-a563-f33bbd055f3b", "comment": "Malware payload", "value": "abcfbc68ec202619dca894ce1afb90ae31a376eeeac5c0018b83dc96c06eb3ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283596, "uuid": "63890237-7d4c-4a91-bb6f-585d71b36542", "comment": "Malware payload", "value": "3a602d21b842170453ee61a86b65473cb10c2c1d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283596, "uuid": "ed32375b-8e4c-407b-b10c-a652ae83f14c", "comment": "Malware payload", "value": "d798f8c6c0cdab1e7d2e7e0cf98bc05a6d0358cb962486f56c2a9f5f5facd525d49c3f3e3d9e9360a657029e32cf19b1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283596, "uuid": "487bf0cc-e79f-486e-ba72-dcf5c7025616", "value": "T143272307083D4B2F483661092C5D2EC3AA93CD98E4A2957E9E5111DEBB6FE33127B45F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283596, "uuid": "04b55f63-8599-45b5-b406-73c3a6fcad7b", "value": "49152:kMfyLwMfyLqMfyLjMfyLrMfyL4MfyLmMfyLZMfyLvMfyLtMfyL7MfyLxMfyLfjOu:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283596, "uuid": "60be0e78-44cc-4585-a620-364277ddb547", "value": 22123529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283596, "uuid": "2c7d389c-405d-494d-b4b2-bb000ed5f984", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283596, "uuid": "f731a340-80df-4124-a0ca-b86694960d4c", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148b435d-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276796, "uuid": "12d369cb-008e-4bb8-ac93-9cf9ae3c113f", "comment": "Malware payload", "value": "df7574acecc380294032b90d1a4f40a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276796, "uuid": "ada04c0b-c893-4435-a863-91d70336db8d", "comment": "Malware payload", "value": "ac045ecb4652d22a273a96c380b69aa01e154ba3bfa9fc403c2b946464b5c62e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276796, "uuid": "f7bfea39-efd3-4a22-868f-5a170bbe2b7b", "comment": "Malware payload", "value": "772f61fa0e92876fed2002929a3b62e50584b97d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276796, "uuid": "ef9fdce8-97e3-454e-8480-4fc9a2ed5a84", "comment": "Malware payload", "value": "2b9fe09f10f8de692acbe2fe48149d0aacd86596bc9f741119b1289e66b707af7128010819a2f3b34cdc9a8322240e98", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276796, "uuid": "5438b4d7-1189-4c3b-b2f4-4fa9c9fe50de", "value": "T18A37238F62A8FA3D16EC339D547E0E5D13E90A4590B4EC99CBC2B86F571F71321CA894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276796, "uuid": "74be4e13-d74c-419b-91d9-71f443339122", "value": "49152:O9rK9rq9rJ9ry9rx9re9rV9rI9rG9rL9rE9rU9rt9rZ:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276796, "uuid": "032e13a5-f3bb-43e3-a6d7-a46bcdd0c66c", "value": 23684328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276796, "uuid": "e69c083f-6b89-41e1-b551-8239a9f936c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276796, "uuid": "cbbc86d0-bf05-4ad1-bbe7-29588b9f2212", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15eadb6b-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276368, "uuid": "c3271352-0754-4525-a565-4766843af627", "comment": "Malware payload", "value": "f9d8f058318c6b02e5d64eb102f122a6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276368, "uuid": "59a225a8-d5eb-4418-97b2-1b5a26e552f7", "comment": "Malware payload", "value": "ac463d21f2277ca7525dc047f4792c24515d53f05a96a7554197742254aa1502", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276368, "uuid": "4bb3c7f9-22d3-48d3-af1e-c24706a10d02", "comment": "Malware payload", "value": "1ab95bb0af3f187b058c192583be114e660f4ec5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276368, "uuid": "117a6ec2-557d-43c2-b4a1-275c7eb8e953", "comment": "Malware payload", "value": "8f6677c1f23d9bcd6b8e224029df0f670415c2f5ee6fcb83f1c8b5b36cdda9c90eff78bad3e772e4a63f406bc54b3d6a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276368, "uuid": "c14c6605-fb18-4205-b24a-3b2395e4d364", "value": "T1E437234D4EBD19AD5328F1556ACA1CCDB7CDDD7C90A69CB3B3D5C8AE028AF906107223", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276368, "uuid": "b22f98c1-8b75-4295-99fd-d419c65fe1eb", "value": "49152:0rM57PkrM57PtrM57PkrM57PtrM57PdrM57PXrM57P5rM57PprM57PGrM57PnrMF:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276368, "uuid": "0c92379a-222f-4be5-b5cc-177840d327ea", "value": 23684319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276368, "uuid": "bb739cdc-88b7-4e4b-a46f-eaa91aaf4481", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276368, "uuid": "ef044cc8-75ee-498f-b6a8-4e51f4b5afe3", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c961358e-41d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777253477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253477, "uuid": "178d4822-6611-44e4-8510-f3fba0fe023b", "comment": "Malware payload", "value": "974f1ff2fe153b06736bd5e2a79c14c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253477, "uuid": "1f4d5629-3ca7-40e7-9f72-677552156615", "comment": "Malware payload", "value": "acbd88b86cb53c186551183a1d83faf7447930250a1ea91f20263f3f20dc436b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253477, "uuid": "57277b0c-7783-4e18-b38d-09a09712d788", "comment": "Malware payload", "value": "60ba898e90c03f8776b50d5a3988c99d5d79e0b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253477, "uuid": "ddf72903-b545-481f-8dca-acd02b9628a1", "comment": "Malware payload", "value": "3aa92c8016e325655d10e3b4b0064be2d91f26403b1c70a43da74f6da32489e3432f124c6cafa096b7dd8ee4d7bf6ce8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253477, "uuid": "61875be8-d858-4b0c-996d-215fa6a419ea", "value": "T1C7B67C73945334D8E5A88DB4D11416526DBC388B5738A3CBBAC471F667BABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253477, "uuid": "fb0b7cfc-5a02-48d8-8769-8b84c9949fcb", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQL:cqYUQuVDt0TZE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777253477, "uuid": "0f938ff3-df39-4eaa-a244-5bd9ff788e48", "value": 11108352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777253477, "uuid": "927855bd-ca59-49d0-aec8-431dc95660a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253477, "uuid": "bc4f2fa5-625f-461c-bd05-1d8274c9c7be", "value": "acbd88b86cb53c186551183a1d83faf7447930250a1ea91f20263f3f20dc436b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cb5ccb-41cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777248641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777248641, "uuid": "0c0bbb27-9af1-471b-9631-eef1d558a6b7", "comment": "Malware payload (Mirai)", "value": "dbb6cf85eb21573e5624f1ec858f05f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777248641, "uuid": "89afa8dc-0351-4e53-8410-8e31121a52ac", "comment": "Malware payload (Mirai)", "value": "ad358a598bc9c8b45b0009e78f4f535614227c617f3aef8b0b7c5bcec5d5229a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777248641, "uuid": "414498ff-1ed8-40a6-9b2d-a6b96181dcde", "comment": "Malware payload (Mirai)", "value": "f1fdf5c1762999e16078b70ae6b8cc024d58e764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777248641, "uuid": "73efcff8-80c6-4f06-92d8-da60d7714458", "comment": "Malware payload (Mirai)", "value": "53d5ce5f7ab7bd76fdbd2112228aa544a4ddec1a73d77eea7364f1121f7af8906151ab84ae67d1d5552289a74bf04095", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777248641, "uuid": "f3636dd8-bd66-402c-a051-21b937b089ea", "value": "T18332C517A7BBAE1BC4D0377B0193072162E95F916024472FBD0D1C8E6E9A3412D3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777248641, "uuid": "0df6619e-4cc2-4cd0-8a47-e4e06997ba2c", "value": "192:xvrOR1CQOsz1NxfAz+OH9iG0GhWaDpU/O7Q89AGSybQqeif:xvrbCzfap2GwIU/kwGSHUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777248641, "uuid": "1cf7704b-e525-440c-b7a6-31689663c767", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777248641, "uuid": "e4df7038-5ef6-4102-9aff-6f5fb496d899", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777248641, "uuid": "310b5b14-4681-42c6-846c-43f1915f2048", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb19cc7-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276783, "uuid": "a919359e-4de7-4910-b278-e564dea06dba", "comment": "Malware payload", "value": "bbf45c09320a484cae943a754e346323", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276783, "uuid": "d2a2b295-8e8d-474c-bcf5-dd9041d2d0ea", "comment": "Malware payload", "value": "ad9a266b6f01d630b3eb09cc1a055beaf320672fd48797591ffea7fb5b993bb8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276783, "uuid": "32deeab9-e8f9-4906-8db6-1fc808f67d09", "comment": "Malware payload", "value": "7240b51879559177992ed5fde7ad9f2f6fbb0f62", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276783, "uuid": "817ecc17-8493-4eb7-9fe2-e569a114346f", "comment": "Malware payload", "value": "c2ac77f34c9df1579f038d1d878b5b494bcc4d45ee7792e44509218ed97f8f373ac3b7fb8b8828439b4e63452f563e0e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276783, "uuid": "ee74bbba-e116-4fbc-8949-a23b290bd19a", "value": "T110372371DE758FAF45F8583E22ED1E4638A50DD84661CC74B3A06B2890DFF4530EB9A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276783, "uuid": "aa2df184-3b08-41d6-815a-429f3e9a1ea3", "value": "49152:cdyXSpWDdyXSpWudyXSpWwdyXSpWBdyXSpWfdyXSpWNdyXSpWkdyXSpW+dyXSpWW:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276783, "uuid": "c9b9486b-8977-443b-927f-5011e3ed9295", "value": 22383686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276783, "uuid": "48fc1b1a-ce4f-4384-bc76-c6b27bf6aa8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276783, "uuid": "ee6bba9a-ac7f-4655-87f6-a2458419f75c", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60df850a-4229-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777288091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288091, "uuid": "30c24ee0-b3d7-42de-894a-f22ce562324d", "comment": "Malware payload (RustyStealer)", "value": "53a5679e2d385ae37c5073ed79f462ec", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288091, "uuid": "56deafa9-3b26-4c39-8746-814f37143a19", "comment": "Malware payload (RustyStealer)", "value": "adb6c2381a814919f489ad238be4811bddd260a176f2de0ada7baa9d8f487f90", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288091, "uuid": "fb9d2c49-2f14-4591-92db-50e76a03494a", "comment": "Malware payload (RustyStealer)", "value": "6de44425e66185559aa97eb5f41bd4793fe47dc6", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288091, "uuid": "f487a211-9336-48e9-9b2d-178e00d69e88", "comment": "Malware payload (RustyStealer)", "value": "13b6f52fe0d10ab40702428089b6091bb6debc3f1896a1d9c9a1543526b227b19981941994f60ef71f9e426f7532271b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288091, "uuid": "cebf0162-3c52-410d-8043-af3c6d7231ae", "value": "T11F05F03DB65449F9E127C47487486662FA73B88707216AFF03D582353E9AAF02E3DB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288091, "uuid": "0fe239ed-e77d-498c-aee0-df414b3fa30f", "value": "87a783942c56d41f0e2a1b348deaeb26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288091, "uuid": "ace1798a-0f1f-47e9-b9b5-8b233c052761", "value": "24576:sCM27hYvEzvJh2cx0hAELqphDb1QZ/I69:sCM27GvGJhLx0QphDRQZIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777288091, "uuid": "973d9d8a-f3d0-4402-8cb7-344f8891ddb6", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777288091, "uuid": "9bb33d1e-802d-4cf5-83c7-49622ef0028e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288091, "uuid": "eade37c0-ef7b-4af4-ae74-1b90bac9543f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ce0278-4222-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285228, "uuid": "54abccf4-7cc1-4f26-911d-09b80a4adef3", "comment": "Malware payload (Mirai)", "value": "65bf49c16b39364e089edb12acf43278", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285228, "uuid": "93a9114d-6196-45e6-b7a4-ab4d159a9ff7", "comment": "Malware payload (Mirai)", "value": "adc30d320b8e4221475aa72dec76672c6843029a80957ce8d4347ee93172e2bc", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285228, "uuid": "cd2b94c0-9bab-435d-9dbf-4df156226d94", "comment": "Malware payload (Mirai)", "value": "3f4731342225ac8edeaff0056ce0a1b84fb5c471", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285228, "uuid": "3dbdeecd-d4bc-4cf0-880b-b5f7e94d0cf4", "comment": "Malware payload (Mirai)", "value": "56e9afe74bc5cf937c47cf04b9520beec8e4554416d8fcf7c2b8beb4d53d08f5ac8cadc283af931d1df15a0531726c80", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285228, "uuid": "305ae991-2e7d-4384-a741-839335204bf4", "value": "T149055B02BF405FEBC4AFCD30493EC75716DDA9D352C5A63A71FC4A8CBA5925A0AD3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285228, "uuid": "7ace5709-2b20-45c1-9229-bbee742cf5c5", "value": "12288:mgOfhsksEP3wzO1Ttb05xdFdpBB/wZ8Wf0ErCmjIzRpr/svr2OYA68wpOImr6PEb:2vrBh34bKk6rrcNWQJUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285228, "uuid": "94db4839-4701-45fc-8cb7-bfff15997d8a", "value": 833084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285228, "uuid": "2db7935e-ee00-4194-8912-0e6da52ea015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285228, "uuid": "c86b27bc-6787-40cc-ac18-41126ba4f2d6", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03013b8-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280573, "uuid": "292b6190-466f-4f06-8a22-7c799cc0e2fa", "comment": "Malware payload", "value": "110a8dfa6a0f9561121687f1dc77de8f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280573, "uuid": "bdb60a4b-88e7-402d-ad94-daa544e2887b", "comment": "Malware payload", "value": "ae2c9303e685661d6e06fdf15bb89d3a50c544e613aae030d351d608d0683c39", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280573, "uuid": "165e6171-6858-4bf8-aa72-6b89170f5310", "comment": "Malware payload", "value": "33a60eb8f4d2dc97789ce9793ddfae7bf2e596df", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280573, "uuid": "30f873f9-b8fe-4c79-93cd-20650d872b0a", "comment": "Malware payload", "value": "0119532cdbb862868d02ba7097a2bfbbca8b7afa58b781846429201caed215fb96d58b75873b79378643ba3aeffd67f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280573, "uuid": "b6d92fa8-82d3-415c-89eb-fe610b593b05", "value": "T1F437232E0D3C9DBAC3F7D549107E6B4829D5A7814460ED6349E27913EBCFAEA316342C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280573, "uuid": "b6f4f02b-2d6e-4528-82d9-f61f383316f6", "value": "49152:UWyKJh39bc7pwdH+XYIwHdHnHjN20yn+rG+eICdHhdHDV0zdHCvx48VlOS2UiTpv:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280573, "uuid": "22ac8735-913d-4986-9a01-e1f393b2060d", "value": 23424198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280573, "uuid": "d647a67d-d7a4-410e-902d-0ed8e1b8b6a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280573, "uuid": "456ac25f-8668-4546-a4d8-9c4b8252d007", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3830b280-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280291, "uuid": "6c2c9b69-7978-4162-ae01-d56b45a5ae48", "comment": "Malware payload", "value": "bf139a2f50fa2263f5047bd392fc6f35", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280291, "uuid": "cd3f0a1e-556d-4af1-b23d-af976f4b8009", "comment": "Malware payload", "value": "ae6dc6d01a8909245deea877f29f2c78acbb8c72c9afe7bfd1fa2af8ebd6b06c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280291, "uuid": "65ec84f1-7f82-45bc-a471-289011d18d38", "comment": "Malware payload", "value": "b6800f93159deedd96d5ff3da5ab1e8ad77161be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280291, "uuid": "b1b6dee9-b6ab-4366-a6e2-e6aa4017c7c9", "comment": "Malware payload", "value": "c70a353f7abb6f5262625836454e31eee33b9ca87cd56cdd3c3edd57dc10eb31b207a9ce3c208dd0c3fe72b282ee9920", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280291, "uuid": "f7c6fa41-11e9-4fe9-941d-c781a3f99595", "value": "T1CB37231B4FF6E52F88B8AFA48CD5070F85F04728485EAA24CAAD65BF154EFF52327105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280291, "uuid": "1d93bcb0-2d53-4e60-b59d-0e2e0ed76ad7", "value": "49152:mi04i0zi08i06i0Ri0Di04i0ti0ii0Wi0Ti04Fl7i0Wi0yi0Di0zi0NFlki01i05:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280291, "uuid": "160f3d50-95f6-46be-994c-065a5dca5a41", "value": 23424198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280291, "uuid": "5985d85f-eaf7-4a06-a478-2c3c86b634a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280291, "uuid": "0ffca777-facc-4d1f-94a2-1aa2ee997c57", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed00636-420e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777276544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276544, "uuid": "6fa94d07-5fa1-4924-82f3-28663651d857", "comment": "Malware payload (Formbook)", "value": "8b24c37ceb3274e2b5e833769a50449c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276544, "uuid": "d66c2b25-60a8-497a-a55c-ae3c08e68457", "comment": "Malware payload (Formbook)", "value": "ae7859250a08f3a5b0480800349da8c9fb44a0501958d1009d06a6994ac1f17b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276544, "uuid": "10c54104-fe51-44d8-9c40-7ca80c9c85ba", "comment": "Malware payload (Formbook)", "value": "521227bcead28ae9594a9ec6232461d843b89c9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276544, "uuid": "251ebc3e-7518-4ea7-9a1c-b3e29cff6cdd", "comment": "Malware payload (Formbook)", "value": "bcd865e0bfa47641d4fe5632ae6e02377ba53e5499851bffedd5633a5b2618523b8ec388d161fb167ff643b1b28503f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276544, "uuid": "40e52ffe-ac52-4b0c-9605-cff40e1bec90", "value": "T128062901EB9002F2C6BADBB5C1830932C5B1F5E5E711534E04BAC61D3EA6B651B6EF36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276544, "uuid": "c79fa2cd-bebf-4c86-a2ac-d1bdb888ed23", "value": "97cc49084729ee1e1ef6f6fd1deb6e0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276544, "uuid": "3bc9b779-4a5a-450e-9030-3b7bfa5b2407", "value": "49152:C8anV3ppppCCCU28nGLG3n63broA+Vb7bZHD5bZbd3gJ8arxIU+Aq8fbdDXbthry:4SO6rU0IU+Aq8fbdDXbthr7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276544, "uuid": "6792dce0-4036-4c56-9be6-4b878cfe3562", "value": 3773952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276544, "uuid": "cce33a45-5722-4db3-8efb-18e222620cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276544, "uuid": "e55e5443-08cd-4249-ada8-07ec44c0bb94", "value": "base.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8139cf10-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276119, "uuid": "db7608a5-3cd9-4d32-a1fa-f9d107ef7650", "comment": "Malware payload", "value": "50be334fa27575e0bb462964a5863dea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276119, "uuid": "610d046e-189b-4f84-b19d-a136c7347662", "comment": "Malware payload", "value": "ae83d0b1eb7fd7596bf75f77c65338f5eeb184ea784b6655ca456da23835ecfd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276119, "uuid": "72dd5f62-da4c-4f60-b8b4-247c3d51f317", "comment": "Malware payload", "value": "2fe9b2840c4ef120de565d66bb2702c26b501a11", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276119, "uuid": "c7ec318d-56be-40ce-a018-ddd9de9d9492", "comment": "Malware payload", "value": "9006041835b939c94feab0e0071a0fd25fcc5fcbdabf6f44d37ec69da55328ffd8c53e14b8e19de3e51fad17544bc637", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276119, "uuid": "82e7a2d2-c921-4fdd-9fb1-82c99c0be38a", "value": "T19037238FCEA33D8F945CF84C182B485D6ED0095AE93697D55AFB2CCFC28B804D65B429", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276119, "uuid": "c64cf601-1029-4250-84cf-d4c848ee843a", "value": "49152:aXrXHVXXXZX4X2X3XHXFXtXhXelYXZXmXiXSXtlRXNXZXnXuVXeXDXoVXMXpXwXZ:kDzwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276119, "uuid": "093ba8b0-a4a2-43eb-b6b6-fe2b02c1e73f", "value": 24464713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276119, "uuid": "4f3e319f-2c84-453e-af97-93de13ba7fcd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276119, "uuid": "745f54f6-0562-46f6-93e3-4aeee91f596f", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa37fcdf-4251-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777305394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305394, "uuid": "7c48934d-46b3-4c39-96e9-2248a9eca816", "comment": "Malware payload (NanoCore)", "value": "1ff4053b9087024a494f773791300504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305394, "uuid": "365dc8d2-a454-436b-85cf-a9c65b525660", "comment": "Malware payload (NanoCore)", "value": "aeb53bfd9ebe9a1a39cc513bec19f42782b69653f1d282ce5e6778e833fddb67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305394, "uuid": "defd124b-0f7a-4e11-9ec5-f3e90e5995a2", "comment": "Malware payload (NanoCore)", "value": "60f69f19fc1fb0c1520cfc67d5b7755480227440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305394, "uuid": "500a6546-b01f-44af-9b86-56d3010cfe3c", "comment": "Malware payload (NanoCore)", "value": "53eb3fbb3b7c8195a76aa146c7944896f954fb3bb497b7d045b55ff16782dac75317176731a73e619dd1cfcacc24dca3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305394, "uuid": "99301004-2c16-469d-b7bd-d3a62a461a66", "value": "T18164AE1537A4752ED29E45786311A172437889E2ACC3F3DA28CC72EB7A7EAE005371D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305394, "uuid": "7871161b-8157-4ab4-9040-b971f995f9cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305394, "uuid": "36162cbb-d0d3-435f-95dd-e7af03c2952e", "value": "6144:WLV6Bta6dtJmakIM59MjaSdHlHMLHLpnN5h:WLV6BtpmkZ3FmHLpnN5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777305394, "uuid": "788fd3ba-bac0-449b-be0e-3ebf6b20f179", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777305394, "uuid": "d8ab05e7-81a3-4f1a-b831-c7b5517279c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305394, "uuid": "d0b9cbd9-50b4-4c2a-a01c-1aa45b41d5fb", "value": "dfwf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98bd886-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271516, "uuid": "6dd1aab6-49b3-4f0d-a038-9afd24bc4a22", "comment": "Malware payload", "value": "868182be9f78e80b86625ea56613537d", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271516, "uuid": "2b171926-0e73-4d50-8300-57c8eeb497a5", "comment": "Malware payload", "value": "aeffd30924a0233896a8626354ef8decc67b0b5c4eba880f6c1447b29bb07192", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271516, "uuid": "bee69684-43fd-413c-9b09-74aebddeb540", "comment": "Malware payload", "value": "13beacb194b2f1819e96edf32bdccad0e2c19da2", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271516, "uuid": "fe02b030-d184-480b-9d23-7a18ade258cb", "comment": "Malware payload", "value": "aa20defd8284001a4f9c0cf0c2ee584b0070c5655eec20218704605dace9bdb952d9092ff81ab78817eae4a585d84ee2", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271516, "uuid": "bb57533d-795a-4221-b883-3d8065cc6a10", "value": "T1AF372307A87E8FBDC3DD221997EF47EE36890DDD0160D495DAE49EDA432EF431822894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271516, "uuid": "0c0e5e1a-6da6-46f8-801a-1ee32ed29516", "value": "49152:EGatOiGatOyGatOAGatO+GatO9GatOLGatOmGatOeGatO+GatOMGatO0GatOd3Uh:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271516, "uuid": "6be44915-7139-4eb6-805e-0125befa987f", "value": 23684322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271516, "uuid": "480ac634-48c8-428c-ac8e-bc8e4e80f5be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271516, "uuid": "6e6d791a-7aa5-49cd-bf7c-07ca651addc9", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c87cd36-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302686, "uuid": "b14fe2c4-5551-4e35-bb96-1d3deb4a37a2", "comment": "Malware payload (AgentTesla)", "value": "723154251af897cf3bf6249b2c8d2e37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302686, "uuid": "ae67a02d-807c-4794-89b0-869a36bff5b1", "comment": "Malware payload (AgentTesla)", "value": "af7e768f3e6723876a77a09a8c523e4d1a5af0fd3f4d520bfeeec3d4f135791a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302686, "uuid": "855f2798-7779-43b6-957e-3e7e8086b63c", "comment": "Malware payload (AgentTesla)", "value": "3179c35d9b10b6c2791feda5d26e7af54fa15323", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302686, "uuid": "07e9622a-d8c7-4743-a596-4285c41e5d55", "comment": "Malware payload (AgentTesla)", "value": "1be53cf8fb4d6395cd08bdb9cc7a26ac9e32ca9712c05addfa0b5275c5ba75494f07b472907e681c17ed1ed236ba505c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302686, "uuid": "0219e67e-e502-43c0-a7a1-a5234cd974a9", "value": "T13D2533D11F50BEADB84F460CB153FA1C46F29CEC4A46B11BB6D43893943F74E864A87A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302686, "uuid": "d6dd128a-5e24-4138-b24c-72aa3051c8b3", "value": "24576:JEW/oLzB5bDJrORr85TERTmCB7COcHBYaiWh39IqxGKkqoRF:0tKVXAyaNaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302686, "uuid": "46288562-e7b4-48eb-bd41-c690ce40617a", "value": 1037197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302686, "uuid": "86ed7ad1-834d-42b0-a60c-2c34d8f2aac6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302686, "uuid": "d103c98d-1407-49ea-96b9-03246e598595", "value": "ps_O7bSByHl4yvy_1776087127147.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a25df2-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276281, "uuid": "3ec4f941-2a94-4177-9084-36324cb481c1", "comment": "Malware payload", "value": "632176a953cbea19826bfd738ae82acb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276281, "uuid": "e89a4290-ff8f-4657-88c0-9dd73031b198", "comment": "Malware payload", "value": "b02ebc335766e10cc1197351cbb720cfdc33126a9276057ccd55eabf88a64870", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276281, "uuid": "b9033ba1-e61e-4cfb-a403-51cb039a6dbe", "comment": "Malware payload", "value": "8ddf200cf1ce98b520268fc46c0b9bb29e23a637", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276281, "uuid": "276ed57d-c577-45a5-98e9-7638d707adeb", "comment": "Malware payload", "value": "83467d5d9a78a3ec80d41bd77c32fde557174452ea7c1143e4d0d86e676624960775ae71f44c150c61068a829366ef3e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276281, "uuid": "da6610f9-89fd-4204-b5f4-4a212da1a7aa", "value": "T14E372311470D8D3A02BCDB7524BF4E8EDF99DF244436A651CBD728CC91CE62272BE16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276281, "uuid": "89cbc63e-9898-4833-aaa4-241440e6bc35", "value": "49152:PZu2HZu2UZu26Zu2cZu2bZu2NZu2WZu2jZu2QZu2EZu2xZu2hZu2zZu2jZu2yZuT:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276281, "uuid": "bfc23a4c-8a74-4d6d-b719-c6dcfe4ea492", "value": 23684334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276281, "uuid": "3bde1652-edcd-4728-b2db-4bb36d51c1c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276281, "uuid": "2a5840dd-03b8-48c0-8caa-e6a7914f3deb", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789db54b-424b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777302733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302733, "uuid": "dd50feac-cc04-4b78-b42f-da698b660aa0", "comment": "Malware payload", "value": "b6306a36fd3e78d553965451a3d85ff0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302733, "uuid": "9fe85dd7-e194-4778-96e0-7817dcd42e9a", "comment": "Malware payload", "value": "b072be1a837427495108107374b387d03d681bd781256b319c9d265e5b5d5e22", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302733, "uuid": "87a82566-4a4c-41b9-b4a3-816d5a6900ba", "comment": "Malware payload", "value": "b48c947824c8620190b2fa5514261048ada24397", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302733, "uuid": "c9482f96-e62d-4897-8d82-974dab4edd3b", "comment": "Malware payload", "value": "8d435ec14c7c2d871afe39debecc6f61d6ac2587ea610b0c89d8ca7b04cbe982e42af4795f5f10b01883106d9e158a81", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302733, "uuid": "3682790e-06fe-485f-a053-f7fa182067c1", "value": "T1642110857AE6A72285328F184E56D294C51F123620A7250077EC8341FF7869FC669BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302733, "uuid": "d98bab79-7696-42d0-99eb-85d39886f655", "value": "24:2XTody/GELm8hLNnLak88WFiOIRIbj23OA5WQxoUWTV/0wC3:2jodKGYm8FNLVWSinNKWSW/C3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302733, "uuid": "e74a9a37-1025-4abc-81f2-9fdda7b15bf8", "value": 1374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302733, "uuid": "a8e30972-5b61-442b-9fd1-739e243d449f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302733, "uuid": "7ad1728f-3ec6-4c98-b0f0-7a8fa68741f8", "value": "ufjm50lqodh.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84721b58-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279131, "uuid": "305c6b0b-b07b-47a5-aae0-da2950325a0a", "comment": "Malware payload", "value": "826aad9ebe3d042c272736a54410be3c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279131, "uuid": "66df62c6-8c76-42f9-85f7-446b82a8dcc3", "comment": "Malware payload", "value": "b18952d68bdf2310e1e6a1bdb0b0fe2244d26dfe28bc5ab6ef0513454c89ab4c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279131, "uuid": "4efa6943-ed48-4910-be98-4bc423fe721c", "comment": "Malware payload", "value": "aed8e7c3bf9c0a6e10f9ed4aba82469e9f07bea9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279131, "uuid": "2d99a76f-ae03-4bd8-be2e-27bf65c2b017", "comment": "Malware payload", "value": "3804b5de4aa6ca24988a3701de99b2f00c1708ee45f1c9f0897bc59b5d4bb41478c5a2f015c7ad4d12fc96e52f211b7c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279131, "uuid": "79fbad26-570e-4090-b4b3-176282cd75ea", "value": "T1DB37230E891FA21E01FCBA3758690F0F5CB15D1811D179E0A3E874849FDFEB162ABB56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279131, "uuid": "8008f708-5365-47ee-ae0c-b9c90aafdd8a", "value": "49152:bvvvvvMv5vXvhvmvuvKvcvovOhv3vQvsvUvPwvqvqvRvvvov6vJvZvEvivMvivMn:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279131, "uuid": "4954dba3-c920-44e4-b8f3-0c83dce51c0f", "value": 23684326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279131, "uuid": "8744cccf-11ef-4a93-82d5-3112f5798b90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279131, "uuid": "348b7355-23ff-469b-bc1b-07ec2751006f", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af93702-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283759, "uuid": "0bb5042c-6fcf-42d7-b552-003a991b7535", "comment": "Malware payload", "value": "6bd55bda69b0698113164fec97963829", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283759, "uuid": "611e469d-3499-4af7-b1df-f8eac6368cd7", "comment": "Malware payload", "value": "b1bbb4a3a0af8a4dc517fbb4db348f7c442f911fae556a667b2b648f24761c0a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283759, "uuid": "c3c1ad46-8ac0-48a0-99c4-3b7c88de84c4", "comment": "Malware payload", "value": "8bc9fd6dd862edaad9a3588613c9310d8e1d29fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283759, "uuid": "a034f4ca-0ea8-4c63-893c-5afda9e4b82f", "comment": "Malware payload", "value": "ddf8cbe140cb8de32d1560a8b4220481e253484a440e078c5f4a91eea0745286036e8ba7cd8faefe8d1ea4411366d300", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283759, "uuid": "f66fa041-ccd8-4393-9a84-474eba42832f", "value": "T18F37231B2FAEE47DC91D142820FF1F0B5853EA56A1E161C317E63971CF9D7E2200A66E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283759, "uuid": "db56cbc6-4555-48f1-acd2-0fd8b062466b", "value": "49152:AdB5dBhdBEdBXdBzdB5dBjdBNdBKdBNdB7dBv2mKdWdBodB4dBXdB3dBM2mKdbdq:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283759, "uuid": "d652bbd0-9e68-465a-9dbb-c08d9a0c77e7", "value": 22643812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283759, "uuid": "959f8f03-948e-40a6-98b9-52c5c0bf836c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283759, "uuid": "d62100ef-ae32-42a9-a48c-9c5141722569", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca33549-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276943, "uuid": "ad49cd3a-1ce1-49ac-b9c5-5244858ed843", "comment": "Malware payload", "value": "0f31a6be207438c89f78a023a8091968", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276943, "uuid": "2cf8d971-87fa-4993-9555-2c422ccaf3cc", "comment": "Malware payload", "value": "b1c287a90ddeeec2747d4ba0fed9002ec7b8483afccefb61b011052cf6b5187e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276943, "uuid": "62f6dd21-4670-4bfa-8b98-0157f150ae27", "comment": "Malware payload", "value": "79466cedefa6e81997a9556a68db6d7ff4b7fada", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276943, "uuid": "89585aa2-f602-4795-a960-da6181dda14c", "comment": "Malware payload", "value": "1cff1bbd1c960e6fbd19cb19c290f9db81b2f268829eec470c7996e6fcd4a23fff1e15529733d0f23663439f0cf1bd12", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276943, "uuid": "9c9fee44-a6c5-4d6b-912d-318b0b3a09f8", "value": "T123372315074FCF8F86B8615A1CF70B3F884C8FB6A8D5A9AE1713B8EB190EB45544690B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276943, "uuid": "9628a75e-f8c1-4e7e-b5ed-db382b4bd0e4", "value": "49152:e+O8wdaey+O8wdaeC+O8wdaep+O8wdaep+O8wdae4+O8wdaeK+O8wdaeO+O8wdaQ:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276943, "uuid": "a65fd30d-5f12-4937-b737-87a5c3b41ae2", "value": 22903939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276943, "uuid": "6728c0e5-3586-47af-b365-090fb6380b7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276943, "uuid": "f5e0e69a-3b0e-49a2-8a00-f2c4bd26dfa3", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da25fae-41e7-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777259685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777259685, "uuid": "2da41859-5e95-4d7a-bb29-a7c0578b68c2", "comment": "Malware payload (AgentTesla)", "value": "1c9522dda69188a2d7b911a7855f1776", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777259685, "uuid": "809ebb4c-a921-44f5-b45a-ed0d8c0c2ffe", "comment": "Malware payload (AgentTesla)", "value": "b220fc0d454d709488e2cd1ee7d07f0a3315772407169b28de1317e5e8ba57b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777259685, "uuid": "f8a0efd3-9ea3-4bce-b59b-bd6a85aaf87e", "comment": "Malware payload (AgentTesla)", "value": "ca7ab8b62f32f7686c9df216421e555b9aca359d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777259685, "uuid": "4c9688d5-fb96-4493-be71-22a534ddf6da", "comment": "Malware payload (AgentTesla)", "value": "c6979cdf2e67ebe6e16a770034195d6beae5f72b00080747f795ceb5533da3bb2733b98168c8343bec3ca168f671e93b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777259685, "uuid": "44dfe616-1c39-45e9-a861-f796acf67c63", "value": "T114F423023BD06133D12A5F7A1E3368FC8A49EFE41D66DA2FB72016AE7571A474D0C64A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777259685, "uuid": "7a3edc36-9208-4f5c-8b12-98984187af71", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777259685, "uuid": "9a92e665-1450-4d5c-9244-067b65d4aaa4", "value": "12288:j+ZUj1hM5Gg+NOgLcvNSis6Ziyc2IuNJO1opFMg5m+ajc4pVGYRB:j+ZQkcokcvN+TyeH27A+IlpVTRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777259685, "uuid": "c3d5ee21-c2da-4aa7-b38a-1237f811f8c6", "value": 773968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777259685, "uuid": "0e6f35d2-b896-48fe-9878-5fe58a589f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777259685, "uuid": "e49e6461-2e95-46aa-a8a6-2e83b8f2ad8b", "value": "NewOrder009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2d7a99-424a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302501, "uuid": "849e16a2-3178-486c-b5e3-f88ed920f096", "comment": "Malware payload (AgentTesla)", "value": "e5de7c0718fcf395727530e22d710126", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302501, "uuid": "840a6dd6-7dc9-4379-aa14-419d8d94592b", "comment": "Malware payload (AgentTesla)", "value": "b278bb125662da48d48681451d978424f75586fecd35dc3914bb9314ce629400", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302501, "uuid": "80fc3bb0-863e-4649-862f-c8095091c4c1", "comment": "Malware payload (AgentTesla)", "value": "b18ee1b43b3c2db69858fd25a18b16e357f95d8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302501, "uuid": "ec27ffd7-fd11-49fb-b070-26da23219682", "comment": "Malware payload (AgentTesla)", "value": "d1737d04ababdcf263cfb81c04febf436cc8cae1eccbf7ba570a85c1a3b2af85c12e0da0d998c164ac930129b887083c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302501, "uuid": "06e68344-78e1-4f95-bfd7-b26ccfe61807", "value": "T13F253371AEC07D955328D69DF4FB64B0E2B5426B846F10DB3BC8A9C3111C289BC97D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302501, "uuid": "d7227169-5c7a-4dfd-b580-7155cd1e3a2c", "value": "24576:DQjTpoXmb50QRD2YEml16pnxRVrmSmjEAW+N1:YOGLRqYwxymAZN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302501, "uuid": "032f0502-7ca4-4745-84f4-d01092fcf8b1", "value": 1055502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302501, "uuid": "77513e57-10e9-4446-88cb-76b75126d415", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302501, "uuid": "f642b25b-c869-48e1-aa76-d7ca28e007eb", "value": "ps_6QvsqRCK0Q1h_1776143753705.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cc2e8b-41d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777250280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250280, "uuid": "34bc8d44-dbc4-4c26-aff7-1b22f50fd8cb", "comment": "Malware payload", "value": "7747755af79fe80e2035f60de9296a81", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250280, "uuid": "d00cf483-3213-4646-b734-617194c690f3", "comment": "Malware payload", "value": "b2d8a3457212dfc142e848f3853a1c47f328d74b278337c80794ab20ceed96ad", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250280, "uuid": "fc7ffce4-ead5-4dd9-a54f-c6df49408ece", "comment": "Malware payload", "value": "1e930bb1f20df0d6ac8a4364e566cb8a0e4574c8", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250280, "uuid": "8669ff58-bdff-4076-9990-7137c1aedc96", "comment": "Malware payload", "value": "029b770599c41dbd6f755022898c16f5a1f6fb233e19bbda26f12b4eea07f4e17c1150c7df51c4ed1f07c94c2c452b42", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250280, "uuid": "0009eae2-3ee1-4503-a8d6-752c82f009f4", "value": "T1DAE026103CA5C6B8CA63C837629AABB0CAA3DD7C330D1101736A4A4FF600A29886D55C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250280, "uuid": "d4d63464-e24c-46c3-aa5e-5d99c3a83e57", "value": "6:htdL82cTn+R9e2jInytGQO0cZAuBn2nKMdZXKZX5d8ZX5EXTBArtH2cG:hoTn89jjInGHpc+e2FdZaZz8ZqXTBytC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250280, "uuid": "dfefe8f3-049b-4bb5-b6af-bd3fa6a13edc", "value": 323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250280, "uuid": "36de3d1b-dd42-432d-bffb-aea9f630210d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250280, "uuid": "6f3befdd-f571-40a9-9219-2274e74da407", "value": "yaiio.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3243dda9-4291-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777332680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332680, "uuid": "f78b511e-05ca-4284-956d-d6b37037ac90", "comment": "Malware payload", "value": "7d84b68c5635e9b25ae8545877890b0d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332680, "uuid": "4b17eb8f-9f16-49bc-98fc-092b2f1de557", "comment": "Malware payload", "value": "b2e5d7b435341d3ec449b2990cf3858e0392b450e8d203c455f06e170b01a510", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332680, "uuid": "5db3edb9-47eb-4bb3-bcfe-20297e6752f3", "comment": "Malware payload", "value": "879272da65cca5d61e975d2a11f4a629ef9fde81", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332680, "uuid": "2469a479-f6b3-42e2-a9b2-ce7d0c9bf08a", "comment": "Malware payload", "value": "e55aece26b65981c2544f926a7a2b480b4ec894cd609636828fa48ae127676693026a80d79b0e96c02e93431ccab0582", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332680, "uuid": "f793c4a9-d4ff-4f7e-a60d-832a7884ef56", "value": "T10E6533220F086AFD5DAC572C217B196C0BF01F939C0DA7F77BAA57E64E913C5849B848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332680, "uuid": "58289a52-6880-49fc-a49c-5f15b93e9cc6", "value": "24576:AOKKUMpVIQpACqCmvUdpypdHdP55rhvjzbt1AS2Ujtx5Zgu8R0:gwzaCG8W9P5Zb1Nv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777332680, "uuid": "198fb271-3c26-4a5b-8b26-005a11940f3c", "value": 1429626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777332680, "uuid": "cfe8cdec-e585-4821-a4cc-b9f31a622b11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332680, "uuid": "c63c556f-c319-4237-bec8-1dec190b8c7b", "value": "ps_HkXqUUPwDulw_1777325873115.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b3aa75-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284173, "uuid": "c722a2ce-1bd9-4741-baea-75d2bc27db89", "comment": "Malware payload", "value": "48448e01be056202fc2e7a9b11350acd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284173, "uuid": "1b882bab-f2e6-4995-9fe0-0610b2ffb00d", "comment": "Malware payload", "value": "b3547e861e19e44ec7e0785d8ff72076ac978d1c32599d61b0a49f3827dfa2a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284173, "uuid": "21b1d211-7f77-4c2f-80be-f939b92b37f5", "comment": "Malware payload", "value": "8a62c7c13f535cb1ac5a4e1c9fb12322f17e66ba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284173, "uuid": "35d013ea-0659-407a-a149-5e9465cf026d", "comment": "Malware payload", "value": "8f7977095c86efa87164239c2fe329eab14e74bcc9be09d2bf812de0e472b6d14e7845e5a2780cecfe609c8876dd7f9d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284173, "uuid": "c0f8846a-4806-487f-be64-7ebaff7f0ff8", "value": "T1F637231D4516AC3FCFEDB07A64FE1ECE2A2E4FE94800F4ED54D4758BF21A11A424B6A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284173, "uuid": "b1cd1467-626f-4967-99de-0b5ff570ce92", "value": "49152:nh5E1h5EAh5EYh5EAh5EXh5Edh5E8h5Esh5ECh5Euh5Emh5E9eXYb+Nh5Eqh5EbO:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284173, "uuid": "8568ffdf-73c3-4237-8d7e-81f68b9de4cf", "value": 23424196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284173, "uuid": "e14832b7-2300-4a22-a2f8-d79e424a6872", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284173, "uuid": "e32b3861-8551-4ea4-9f85-a102feae9da3", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a4bc63-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777291726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291726, "uuid": "45c32ef4-881d-400e-9978-b0e4ff7fc8c1", "comment": "Malware payload (Mirai)", "value": "623931779b75535c645c81fddc6e636f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291726, "uuid": "e837ff91-bb5e-4f01-a899-ca2c02bb9e39", "comment": "Malware payload (Mirai)", "value": "b4908b86898f390e5337f7d9823da47b8606c396e11a89baf410371f811877be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291726, "uuid": "b3563532-855c-4767-91b8-a2054e027c08", "comment": "Malware payload (Mirai)", "value": "319509b39c77fbc0b12bfb00f952c9d81cc81bfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291726, "uuid": "a09a9a63-f4ed-4c87-b903-372cb42606a7", "comment": "Malware payload (Mirai)", "value": "a805102b52c9fd983a36836fbdb88ea8b542d484c712a9f25dd6b3fbec042fee1b5b3c59db88159e3dbe9d236e9f66af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291726, "uuid": "1197f428-a339-4ba3-b3d9-470b10bc5bd3", "value": "T12704A61E6E228F7EF6A8873447B78E24975833D617E1D645D1ACD2106E2038E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291726, "uuid": "a501ecf4-e419-4b65-8ec9-eb115349a5ce", "value": "3072:GuANexaNDPIHXY7CQY3Esb9KmbCHG0AJL:GuANexaNDPT7CEJ0Cm06L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291726, "uuid": "d91cead5-d06c-4701-99b3-e57b78f9189f", "value": 189932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291726, "uuid": "9c3f227c-7160-4ff8-a493-68a7bf72895a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291726, "uuid": "399dd74a-832e-416d-86d6-5918bf21b1e8", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85dc9fcf-426c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777316929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316929, "uuid": "9aec2d27-c480-47f5-81d4-67b525c5dd9c", "comment": "Malware payload", "value": "548a15bfed04336d2be3bbfc3c9f67a0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316929, "uuid": "09d08f61-9790-4e24-9209-e136179f386f", "comment": "Malware payload", "value": "b4d75fc2d01f2f616ceb8f41ab1b2d23addcf42933c49a3e5578ff181ff7ad5f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316929, "uuid": "e4547209-d428-4a75-8295-cb0af0b9b9ff", "comment": "Malware payload", "value": "2102e6c2dad8534a6edb79482744c5b010f56b67", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777316929, "uuid": "dc1deafa-2151-4d4f-8c54-c0259153f470", "comment": "Malware payload", "value": "368b5dcb6985bad22e5190053e78966eb49772f84cc21aac8edefdcd7b4b7e0ed67de075779dc838c530846ca47abd60", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316929, "uuid": "3f723ef7-0c82-44de-8512-542732fb576e", "value": "T11671B5DC016177B7E938AA6F7B50CF24AA8481D12E90CB7D7D59DE200F947A73B4B680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316929, "uuid": "ce4e6740-e202-4440-86b3-3595f42289c0", "value": "96:LgGtodlrEwVmv920J0oIoNq1qKVhgbuYrF0AU6iuXU:s9EQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777316929, "uuid": "ea22b0ac-5e45-4248-8269-c3bf1f1ad621", "value": 3629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777316929, "uuid": "dfd3b381-a29b-4fd8-9cac-0a3f3b2e660a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777316929, "uuid": "fef42ca4-76cd-4690-9cdf-dc39817a53b5", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40254de4-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276010, "uuid": "39df6419-62de-4772-8aa2-5ecf732e2d5f", "comment": "Malware payload", "value": "afdb1371743682ffe266b3e1f5705c59", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276010, "uuid": "26e87ee7-441f-412d-a167-626bdfdefbac", "comment": "Malware payload", "value": "b4eb219415659a3ccc3e82634f2dd4824d7264fa2dc2765ca19be7e080be817a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276010, "uuid": "93f08635-f348-4166-a292-22bd5f27e71c", "comment": "Malware payload", "value": "79649e58bc5d3b6a4f4d7fbfe8b29ef4b6de5a7a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276010, "uuid": "7badfa40-2f95-4611-90e7-bc3349d4a9f0", "comment": "Malware payload", "value": "caf9db37ab61fae7773695902ceb6562c81ae8c10881280f172239d1ddb17ca175f4dbdc4724b98ad16716fc2b529fd2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276010, "uuid": "54dcce29-5e18-4209-bb45-0d47374a4ce9", "value": "T1A42723416759EE6EC2FC669C346F084F1EB0CA5A509D86EF92D96E7FCE4E85002B31C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276010, "uuid": "b0c1fbca-68ae-4188-8cd9-998834dfbfe9", "value": "49152:gYrzCYrzOYrzfYrzaYrzuYrzoYrzlYrz9YrzxYrzHYrz3Yrz2A65rYrzlYrzHYrk:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276010, "uuid": "c98f4cc5-25bf-496d-b8c6-f1779d078ed8", "value": 21603281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276010, "uuid": "4a3ef51a-1d59-4fa5-8b24-fbc9b6ed6244", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276010, "uuid": "3af9b066-eb4c-45f7-b15b-baa1c34b525c", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec0c754-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271471, "uuid": "49712aeb-7405-4a43-8dae-8e41e8a7ddc7", "comment": "Malware payload", "value": "246e2eaf56d8b2476c1b84c4dbec2071", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271471, "uuid": "543956de-04ca-4324-8e3a-19ba93e74fe4", "comment": "Malware payload", "value": "b4fb71c46a3ab96ce9e3267a7179e83fc1493e31bbc11f7177a732d398ba0bff", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271471, "uuid": "a98e3b57-2168-419e-9b2b-6298e85bcb5f", "comment": "Malware payload", "value": "c5f322ea67a3d83179733882039d65302fc3f4c6", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271471, "uuid": "671bce8d-bb0d-4a06-a9bf-dc9688822ac7", "comment": "Malware payload", "value": "1977c3faf422ced657088b66c1b675a07bd3cec9af21b9365de7f15514aaa7aaeca3fc745ac29c865549fb556ac7ebb4", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271471, "uuid": "52fc041c-6da8-4195-8344-64dc11d3947b", "value": "T1853723020FA945BD8E9DA57E8036498DA7ECCD4934A1FE422FCBB029B54FF253D57206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271471, "uuid": "39fe7928-2d65-40cf-a117-f94871466332", "value": "49152:xbe1AEWBEbe1AEWBMbe1AEWB6be1AEWBgbe1AEWBNbe1AEWBjbe1AEWB4be1AEWD:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271471, "uuid": "8efdeae7-c06a-426d-b041-80c008174d27", "value": 22643806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271471, "uuid": "72732617-c4d0-43ac-aee4-8f256dbd4775", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271471, "uuid": "b5124c1f-b3ed-48f8-8aed-452835092146", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143fb7d2-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280661, "uuid": "cb7dff77-7440-4827-a047-1149c4070134", "comment": "Malware payload", "value": "6822648320085265e3f0c9424c190a16", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280661, "uuid": "80768c9b-048f-401e-a3f3-9dee0a251120", "comment": "Malware payload", "value": "b586308d10cd7b293c002de6fbdc7929696e4d015547ffaf33fce7054f1b9fd5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280661, "uuid": "d816dbff-9ca0-4bba-bc3c-724f8f5613f6", "comment": "Malware payload", "value": "59f7f9d5c7a5f7fed6feed30854cf53a14bf7a69", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280661, "uuid": "1aabc160-6299-46a6-8a6f-739a6a25360c", "comment": "Malware payload", "value": "b8673b071f0f683ec604ee1d2fda87b24adf0a16a00b4ff388b34d6bb0f60f9013912de5edd0d3122df38bdeed745551", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280661, "uuid": "a91c1603-bf04-460e-aa98-92db7ef2f1b0", "value": "T10F3723AACEFE2B7FA21C10C824660D09E115CE4AD01671E469E375BF382B7AC54F761D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280661, "uuid": "344a728b-8e88-427c-9d10-87336bc51fbe", "value": "49152:iflrflgfl8flhfljflNflwflLflifluflZflaFNYfleflDflVfl9flbFNNfl8flQ:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280661, "uuid": "d8a60b6e-e3bf-4715-8bf6-5a32fd711c1b", "value": 23164064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280661, "uuid": "9dcbcc08-e97d-46fc-91fc-35b645095f3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280661, "uuid": "1766d616-8da6-406d-a0a9-e3d375638932", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3718701-41e4-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777258621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258621, "uuid": "83d3250c-4778-43a6-ada8-0a5c5e22061f", "comment": "Malware payload (PhantomStealer)", "value": "65178d855cb8088ce27a1433068ed896", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258621, "uuid": "370a373d-079f-4887-9118-c22c5676f237", "comment": "Malware payload (PhantomStealer)", "value": "b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258621, "uuid": "b59d69f2-ff38-4f76-a80a-1619570f934b", "comment": "Malware payload (PhantomStealer)", "value": "2a5d13d90f6a537ddd0370ef2725cb09f13ec71b", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777258621, "uuid": "c789688b-bbc7-45e0-9dd3-17e6cf84657d", "comment": "Malware payload (PhantomStealer)", "value": "9f2fba80b318d7dec38952c1ee19127ffa23215cc55b461965d49aa89e855d27f2aea053e32e0bb8a4fb1cedf32508aa", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258621, "uuid": "a341a898-182f-4685-bd32-74714f95c3a7", "value": "T1990523802EC53BEE00AC8731717F7E975EC65E64102B6DDF95F0822796CEBA9007B256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258621, "uuid": "5f82f140-f4d7-4067-923f-342ae8e85dc4", "value": "12288:br/QYAykFc3k7EsDS1vGgDlGdZUPKDdp/OwqENiW7wi8UTux2/dupQ:bjQEkx75DS1TlGd2w//7qd0wbno/EpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777258621, "uuid": "f35df5ac-c988-4b43-9ee6-460ba2d821a8", "value": 840473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777258621, "uuid": "68968899-32be-4ec1-92ac-9036b9c68900", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777258621, "uuid": "542f619c-28cb-42fa-9217-e9c75b0dc926", "value": "package.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea68bbab-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277154, "uuid": "357a39f6-07e9-402e-9643-41d7394157b5", "comment": "Malware payload", "value": "72706cfe22dbfd1a101c091278df090a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277154, "uuid": "3535242c-1962-4f1d-b73a-f15953d5dad3", "comment": "Malware payload", "value": "b5b4affa23d4ba01fb8819b1b16748dc2e07aa70674b0b4b4c5badd0829a077a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277154, "uuid": "01b45bda-d064-4e61-8ce3-7ea16e6633f6", "comment": "Malware payload", "value": "8ba20ac4566d5b7b309994f81b2af978f1bf659f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277154, "uuid": "5842422f-7e63-4f9f-b84f-98d244721f0c", "comment": "Malware payload", "value": "2ddcfb0744d5af6fca3fdd49dc58292358f2e7e550ef39321390d01d5f89238002f0d9c7a254a4de665048fb458dc129", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277154, "uuid": "26c42678-0d2d-482d-9c84-aaf2914c9b68", "value": "T1143723128A0E6939972C39686CE60DBFACE4CE5A1057FCF5FBFCB7C15619A162074C18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277154, "uuid": "d85dcb16-0dd9-41f8-b6e5-bcfbb30475cf", "value": "49152:A3lY3lA3lk3lQ3ll3l73l63lN3li3l43lP3l6KjM3la3l+3lj3lf3lTKjb3lR3ly:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277154, "uuid": "95a43712-fc07-4685-ac9d-8684c12248b7", "value": 23424203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277154, "uuid": "11025454-df09-4c26-b947-c9661c0fd902", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277154, "uuid": "2e4562f6-25fa-4848-9355-4fe4ebd59c1b", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53ba7e7-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (LodaRAT)", "timestamp": 1777265013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265013, "uuid": "79e2cdea-dddf-4fa2-80ca-31155647cb4c", "comment": "Malware payload (LodaRAT)", "value": "94ac0a8351a135c43d6a8e5b7e7bfa94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265013, "uuid": "717a23b1-263d-449c-8961-1ef3f2d6606f", "comment": "Malware payload (LodaRAT)", "value": "b655cbf1e46485d2cef122da16a92f782a9b4afebd1dac12dc5a545d8ef0537a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265013, "uuid": "cda9bf82-5bf6-49b8-abbc-aa8bc1e9497c", "comment": "Malware payload (LodaRAT)", "value": "d0ae6e3779204bbb4125e24eb8e98c4fab90e6be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265013, "uuid": "9601c6b6-5633-4e94-96ae-869b54ce7425", "comment": "Malware payload (LodaRAT)", "value": "eb4e1271d3a0d78aa5d7891026a7d8b3211bab4f845d13655e591370db48f1a2ad2bebe0fc1c55f295980b02ab4e58bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265013, "uuid": "ed27d8d2-c85b-45dd-ae58-6bea6dfb80aa", "value": "T19555D01373DD83A5C3B25133BA56B702AEBF7C2506A5F49B2FD5093DE920121522EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265013, "uuid": "e3c921af-aa7d-4e19-8059-a2ac25e23232", "value": "f2da2e4c1b5a39d16c40d60cec2608d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265013, "uuid": "69645809-3b7b-4cea-b217-4aaa4e7e3ca6", "value": "24576:34lavt0LkLL9IMixoEFNY8LrP+thkRXGNZzEi29113g/1wW1q9MmCS:Skwkn9IMSNY8fP+3xEiS11QCGaPCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265013, "uuid": "e7e3149d-d376-4392-b885-16c687e94ddb", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265013, "uuid": "b98ee226-c523-4323-93c9-05df587db59e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265013, "uuid": "171cb4a2-f925-4900-aacf-b6e1fbb587fb", "value": "8658945149b1a430f631b774a6e8451b969193bc3ed6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec01e9e-4289-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777329560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777329560, "uuid": "df21089c-a110-4a46-84fa-9c14f129dc13", "comment": "Malware payload (Smoke Loader)", "value": "47a4d5edb393c9df0550fbaead5823a2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777329560, "uuid": "f449aa8b-18d1-4d70-a709-d6a4cbbe9952", "comment": "Malware payload (Smoke Loader)", "value": "b66657df206db8db1a9068b544e20f8046fcecfe596c5c76479d2fe2fcca5a18", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777329560, "uuid": "df394f1d-8321-4750-836c-6ba50059104a", "comment": "Malware payload (Smoke Loader)", "value": "d1efdf9381dabacb80536ee932cc3a216ee2988f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777329560, "uuid": "51f3441a-dd05-4fb0-a290-40ad8415c69d", "comment": "Malware payload (Smoke Loader)", "value": "7e80f721749d86cc53f1292484cd47bef75dfe8391335e821a8f45a7cd027c4474c68c54362b85d70cd615ef3b2c6c69", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777329560, "uuid": "2776c681-35f8-43ed-ae5b-e2847f9fa1f0", "value": "T1F5A5494178D004FDC4ADB63289F276967B34B8480B3227D31E956A783E77BE15C76B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777329560, "uuid": "1d9eba1d-6ddf-4424-8582-e4e1aab1ccf8", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777329560, "uuid": "b291c44a-4776-4fc1-b36a-c40fc5f90330", "value": "49152:gxonAwkdEHyhwrm6aoQ/d8bG9dodnzJN/1Wc3M:gxEN8ermR+bGjM3Ix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777329560, "uuid": "e4734f52-c2f0-4b9f-91a4-ef6dae96843b", "value": 2205368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777329560, "uuid": "db031261-56c9-40af-a9fb-a5d35466ac83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777329560, "uuid": "ba572951-819f-42e1-bd1c-7b8ea92902ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31971f95-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276415, "uuid": "2f790982-f556-4e30-8562-35bf6ef8ef07", "comment": "Malware payload", "value": "eb09596134d1908682acc6f381769752", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276415, "uuid": "191181ff-0524-4ed8-b715-ad92860edaf1", "comment": "Malware payload", "value": "b67c6ef4eadb35f9178a41ac4e41508824a745e885394d6fe6462c8042d06d13", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276415, "uuid": "9b7ca1d6-b405-4175-a1b4-ee93eec3e2ae", "comment": "Malware payload", "value": "e678103912d684fd7d18c3395b49a62adfcecc62", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276415, "uuid": "a4c74bdc-6001-4382-b053-15bccb9209ef", "comment": "Malware payload", "value": "092146495ef3e5391b337eba118bde1e92720a6e5a23f8550a11b48737a4ad492165c2d4e04bcd1dad85ab419b715446", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276415, "uuid": "679df29f-8c33-49e3-b7b2-7474e05a36ac", "value": "T1F03723424F277DDBD6AC3C3D299F2B8B0CD75B44C8A645E4F7ABBDA762436844639020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276415, "uuid": "a5663aed-5c97-4b67-8bb3-4e32b6ebed71", "value": "49152:/2CGUy2CGUK2CGUN2CGUt2CGUg2CGU22CGUf2CGUb2CGUH2CGU52CGUh2CGUQnSL:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276415, "uuid": "b19dc9ca-e616-43cb-b0a3-08c850d2b7f5", "value": 23164075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276415, "uuid": "6fd0ef45-dc09-4fcd-9706-1ba34240742b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276415, "uuid": "1ea879ef-62a4-4d90-bd08-c44b573627b7", "value": "invoice-1645080830.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf879c0-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276057, "uuid": "bf743dbe-0de4-4473-a5f1-66073b04a96e", "comment": "Malware payload", "value": "368358511e56647882bf49784c960590", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276057, "uuid": "bc97ff06-8a84-4ce1-9f42-855b97af7364", "comment": "Malware payload", "value": "b71e6cb1b14f9f79e1234a17dacf7021a672d7540d14a71a7222a96a1cf1c749", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276057, "uuid": "74de9e44-44b3-4b22-96b9-738f8657e24e", "comment": "Malware payload", "value": "81fe927eda5ce50e71fcc4f606b03df02c9f1249", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276057, "uuid": "4bc76ef1-6407-4dca-8b49-e40d29911832", "comment": "Malware payload", "value": "402e184395d3865a4c260618c9041fe136f945bd2008cde9f164b38c2b376715d80b7ba7b039bb0a7e5775f285780528", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276057, "uuid": "54095bab-4a6b-4034-9783-f242294a0b1a", "value": "T1632723AADFE80C398AE836E9106C1F8D15700E848D1AE1FF59F0BC9BDC4EB55851B46D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276057, "uuid": "3022a839-a811-473a-accf-2ab7a1d9b43e", "value": "49152:KbJb5bLbxb+bAb9bLb5brb5bwqbjbybWbOb2xbabObxbHbHbeb+bhbGbpbTb/b85:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276057, "uuid": "4ca926c9-6df5-4c33-8b31-2aa83fa4b8e5", "value": 21863435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276057, "uuid": "aeca4477-3e8e-4779-a73b-4d3a57b6249b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276057, "uuid": "fc45855d-fc11-4fdc-a069-04e955da06b4", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783fac3f-41fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777268803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268803, "uuid": "5aadcb18-4c88-4f95-bb98-00fe66edfaa2", "comment": "Malware payload (Mirai)", "value": "4f290c5f53932f433c551284fb0f8160", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268803, "uuid": "be3ad90d-5abb-4337-977f-fd3d5b70698b", "comment": "Malware payload (Mirai)", "value": "b77de95014e5dbbbaf515c02a0967afb14a423de030a8429296f3efe68297825", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268803, "uuid": "0040691a-c270-42cc-a5d8-370edceb7ab5", "comment": "Malware payload (Mirai)", "value": "610e346a3680d02b906855264474db656aa84e33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268803, "uuid": "91c71eb7-52fc-4825-9a95-ac51886ea088", "comment": "Malware payload (Mirai)", "value": "883c87896f26734e3ae6ac4e1c6d4ab84aa7d130ccb66535d3d3bf4160fd1b4dc33852fae636b8ba8feafefa3adb42d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268803, "uuid": "b2a11f3a-aa22-45f5-9e78-c69dfb9ec9af", "value": "T17E145C537BA09F62C225C63209F3C76267F5318217D2D14A622DDB1C391278A6E5BFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268803, "uuid": "f87effc1-b5f9-41af-9daf-88f024c064e7", "value": "3072:AVl7SEfJsl7e1bJ2nV5J7D7UqKl4yMHsTEgTZJjmDLubnd6cjR7UZG:6/sl7mboVf4qKltKsAgXUtc1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777268803, "uuid": "a25e7eaf-1439-4560-bc69-d603ac006edd", "value": 207628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777268803, "uuid": "901b8130-2ebe-4126-a582-3b452569603b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268803, "uuid": "23b275b4-f35f-47e9-8ea3-727aa9483336", "value": "agent_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7d454d-41d8-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777253214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253214, "uuid": "a3c9d847-86d7-4556-a472-8f5392d590fc", "comment": "Malware payload (CoinMiner)", "value": "6b636a30bca03c84f89c83712e2e1475", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253214, "uuid": "99538610-e4cc-45b5-b478-57b2761a3158", "comment": "Malware payload (CoinMiner)", "value": "b80016aa911026ba0e71f2818f600b7499eddf87ebfc317c6c9cc7ed53a91c27", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253214, "uuid": "0ac57296-01ee-43da-bdc1-ab5b5c175ff9", "comment": "Malware payload (CoinMiner)", "value": "3274a2d2d5722ffa9071ff07bfcc044946dbfba1", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253214, "uuid": "e5280072-7dc9-40d7-993e-0800c868d1ac", "comment": "Malware payload (CoinMiner)", "value": "14b9a3113fc4e9b6cdf3f092e9d7833cbc67f849794b5f38fde9ee4f4f74671e565974a9c5c5a21ea307ceab65f15389", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253214, "uuid": "68bff9df-052d-46f3-91f5-8885f8f9d37a", "value": "T1D9255C1FE39980EAD46AD17982865321FE70BC524760B9CF16A047213F56EF4AF3EB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253214, "uuid": "b541c865-df9d-47ef-978b-115bca499e12", "value": "2e2a333389da667cda144ef1ac124a55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253214, "uuid": "1d1562de-5dd6-405e-9de7-667336a7af4f", "value": "12288:lKcEqRFgm3MnNgZgG3WTLoAWmYYopYjaKO32SXFqzwlIKu:lKcXKnh3YwGKO32SXYMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777253214, "uuid": "bc1af8b6-403c-4e18-9bfd-0c42a9ad2d6b", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777253214, "uuid": "85cc1fb3-fc97-49f6-8233-7166de76881c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253214, "uuid": "fae92b7c-92c9-424d-85a9-cac59087c234", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f79155-41d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777250330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250330, "uuid": "3d081ed4-53d0-44e6-87f9-47ef764d260a", "comment": "Malware payload", "value": "6d97db3585385fed47da1f25d3065dba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250330, "uuid": "8696fed7-7f21-4482-a624-bc9225b91be5", "comment": "Malware payload", "value": "b81a491d0e90c1e650de75b1efd80dd1678067f2238a1f41297d1ab2b3ffd2d8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250330, "uuid": "3446f3c4-d200-47e9-b345-7523393bf3a0", "comment": "Malware payload", "value": "907726029b2ac6526e602756c114d06621daf72c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250330, "uuid": "454c7167-7001-454e-b4f8-2dfbfe3414f0", "comment": "Malware payload", "value": "b965bf0366c1c6ba108f397e5c930f367a9d354185807cf4a21f473b8cba54f4877f1bd05934d0654bbc895e5a7d2752", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250330, "uuid": "8a359dae-16f5-4b75-a462-11567bb8f14e", "value": "T125136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250330, "uuid": "ba158edf-4bc3-40ff-ad71-3907489a694d", "value": "768:bJs9NyXsZztCc9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:b+HusZgco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250330, "uuid": "622b9969-f4c5-4987-946f-24e5eb4aee7e", "value": 45436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250330, "uuid": "3d1562cc-1eb0-4b1b-bebb-c07f858d0299", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250330, "uuid": "7b493d34-8071-4414-a1c8-263e2e0eb750", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303263cc-428f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777331818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331818, "uuid": "ba9927ec-cf77-49f5-a8ea-1c1c22d5064d", "comment": "Malware payload (Mirai)", "value": "f55d6f9e958f49980891bc0207b7dbf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331818, "uuid": "d6d13fbe-fb50-4848-8b88-4edf5f403fd2", "comment": "Malware payload (Mirai)", "value": "b85051fded5bf6ea2ae573d0325b3afd3ff833f8b22233e128dec17816c51681", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331818, "uuid": "ca98269d-042f-4f97-a253-13f43ae2f9b6", "comment": "Malware payload (Mirai)", "value": "9f8c9425cc537d9e555b3527f669e332ecb6b5b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331818, "uuid": "3d5716f3-d1d0-403e-a6a5-5c033f14608b", "comment": "Malware payload (Mirai)", "value": "52c85754695d17799840be5c2464dea561586d7593c58a7f8371a9aab279ffc3a1e01ab42e2dea40ca77ecebd2feac97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331818, "uuid": "90794b48-b087-4b19-a574-a28b81db110c", "value": "T1A683D95A6F219FBDF568873047B74B21E7A923D633F1C685E29CC5041E6038E581FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331818, "uuid": "a6be5faa-4578-4672-83a3-9d24e2de04c4", "value": "1536:CBq4bc3pA3NMDlu21ebpltGV6rgd83VlclS7:CBq4I3mdwlu2MGcgd83cS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777331818, "uuid": "4e78ee76-6a1e-4305-b1df-17ae5126cb47", "value": 80984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777331818, "uuid": "57d855fb-9407-4815-8b53-5152195d50a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331818, "uuid": "051c1c87-3a95-4b95-9a02-fe24b9238a3e", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3997d01f-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321955, "uuid": "968f51c5-30a0-48c1-b255-9c573e976d7a", "comment": "Malware payload", "value": "d8c58dd88afb2628317b59efaafa749e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321955, "uuid": "84aef5cf-2841-4371-85a8-e599a886f47d", "comment": "Malware payload", "value": "b913d86c8221640da893afc356faa51e28b5adc2548a093d2faf64c923f6fa4b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321955, "uuid": "c1bb31f4-333c-4827-b3ee-ed5ae4ee99cc", "comment": "Malware payload", "value": "3238fe7941fed859b506b84681c1d23262d38970", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321955, "uuid": "f9656e46-91e1-4f36-bc58-22bfc562ceaf", "comment": "Malware payload", "value": "7616bf18618230f7c9114721a7071328fce69dc361a31e4a5e1ae6015ce69693e3802024fb66223966d7c5d457de4319", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321955, "uuid": "d53a86b7-d3d4-4150-9f3f-4ed16b7d59d5", "value": "T1BEB01219B04FBC3D83876BC18A94B0B12127C41F02694CD7035591DCC8E1E0835F7112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321955, "uuid": "935735d2-fd97-4e75-8379-3053cbc79d01", "value": "3:gdQTtQ8wVNDKhqHMTDNkxLNBkMxhJH0fJH6tM:gdhRpcqs1gf/jUfJH6tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321955, "uuid": "9356d28f-1fdd-4bea-b1ae-4ad1601c8947", "value": 111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321955, "uuid": "89070dcf-e656-45e4-9b5c-3c583d436633", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321955, "uuid": "248c5f96-2562-49f6-b46c-437692d7ab6a", "value": "164.90.195.107_1777321923300669_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6315f0-4223-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777285369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285369, "uuid": "e46388c1-1911-4491-a563-bda8aadcd9d9", "comment": "Malware payload (Mirai)", "value": "0c15ea6a6b8310488a44eda040e58fc0", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285369, "uuid": "7229469c-2026-4882-a3ab-f8f1c6d3b436", "comment": "Malware payload (Mirai)", "value": "b9740ad67a27b9868ee9a9dc67d63ced3a94dc94533c1f8b4dd7672ca78b79b7", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285369, "uuid": "279bea9f-a91a-40da-b817-c68c997a744b", "comment": "Malware payload (Mirai)", "value": "7a5ac821c3a841f18a6ebbb63e7fc33cb841144f", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285369, "uuid": "a934c806-35dd-4f77-b916-3a98571d1165", "comment": "Malware payload (Mirai)", "value": "3a3dab9edf0d8458a9d353316294060c322049ac108fc07cd59278ebf75aae9686ea2f8bfd37647dd2ec9e23b493d00b", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285369, "uuid": "1711dc28-6b3a-43d5-982e-fedf2b359c7b", "value": "T185968D43ECA515E9C0DDA23189629252BB71BC494B3163D72F90F7386F77BD4AAB8340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285369, "uuid": "17189b20-ebea-4dad-9c27-4ec30d317982", "value": "98304:KYF7J+j9/WcB5tVmkwp3faJn9vEWrVv2rutlwyTZBHV8Z5uBk:K3B7VmthiPsWrVvYuasH5Bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285369, "uuid": "c236c569-87aa-4c89-8e53-6bfb7ad3a1b8", "value": 8853346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285369, "uuid": "4fb06c23-25a8-4adb-8c82-22652444087c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285369, "uuid": "a9095d90-8487-4023-843c-a53e179de6da", "value": "scanner_new", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e244016-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294529, "uuid": "83d2e7e0-ecc9-42cb-a072-046971620c75", "comment": "Malware payload", "value": "a58991a0d77691b34e60a2b9e806319c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294529, "uuid": "8c701698-1c28-4e38-b561-aebdf6ace936", "comment": "Malware payload", "value": "b984d0393bfacd93a199b5b15364a6684cbac6a5ac970bb10ebd7c013bd68ba9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294529, "uuid": "cbe1aa11-4236-444a-b59e-b478a9b67508", "comment": "Malware payload", "value": "f375f08fa93f8672de0fbc065c2617a8f1d89bf9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294529, "uuid": "bb5294c6-b467-4469-b6ae-ec9a11948722", "comment": "Malware payload", "value": "38ac8c6faa0b05c4ebf3b4215c58d6693078d0be4438b47ebb56259b53d4cb38c9867bc29c6b38b995adcca5d1a9dfd1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294529, "uuid": "d90c3b1c-0bb1-4c31-b8b1-7d63e2d29055", "value": "T12B372387AF584D7A86BC739D0CDE1789A6CA8F0A9040D677E3DEBE44906F71B6013712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294529, "uuid": "535133f8-af8b-4738-a40e-95d78512bd90", "value": "49152:x8K8m8x8X8m8g89848L8/8i8I24Pk888K8/878o24Ph8j8h8y8E8Z8f8n838S873:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294529, "uuid": "b1f47cac-812c-4075-a17f-33c523b72656", "value": 22643816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294529, "uuid": "41f8d0e5-a73d-44b6-b1fa-f86bfaabc29d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294529, "uuid": "b4cfe182-058d-44b6-b25c-b78eeb8a40fe", "value": "invoice-1645080830.pdf (61).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6269dbc1-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276926, "uuid": "efbf6c75-31ac-4967-8c64-5cdc5aacc132", "comment": "Malware payload", "value": "0346a26669646b8bd70c54911ae540a3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276926, "uuid": "0ed2d73c-4af6-4e2c-b9fa-7d01ba18d6df", "comment": "Malware payload", "value": "b9bf56085a104490a24dac5dca7656badbcbbe2c97d0df69b500cea82aaf41b7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276926, "uuid": "8304437a-4d78-41a0-b127-1669c1a4055e", "comment": "Malware payload", "value": "c36bf2f73b2dbd9a398b617933471554302fee9d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276926, "uuid": "b98a7619-c3b8-4319-b1b3-0d49a0195e6f", "comment": "Malware payload", "value": "94c818040ba07fc7578bdf0bfff24f173719334c020727541a42062dfe02e9aa35d8a84fd5dbbc4730af4df32e605119", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276926, "uuid": "a7a76f3b-f4bd-470b-ae12-cd6a208345b3", "value": "T16111675EB3C91D24E3DA76F525E6258E60E0872C437CDA13414B1EFEFD58E4428817D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276926, "uuid": "075602b8-1c4b-419d-bd41-6bb4e5adf099", "value": "12:5j9gRY41Ktd1uN/1TjUglUHEQ1csWXvh+VSbWtAzRTqGJO8EUCeBqAsUuahX:9yRdKtd1uxRfOEbfh+VSStAzROGAYty4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276926, "uuid": "e97bf4e5-c4ad-47a9-943f-83fe2f250f16", "value": 946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276926, "uuid": "5ab11c0a-6ccf-4dbe-8647-71ba43837df1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276926, "uuid": "9cd7dd29-05e3-4881-9b52-c5aee744ca2d", "value": "11111.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e26bce-423d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777296640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296640, "uuid": "4fe315e1-31fd-4cb9-9d65-cbdd6d08c55c", "comment": "Malware payload", "value": "774d4d41aa3cc8ad06915a4694b893ce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296640, "uuid": "ed1f6b32-ad65-4c5a-909d-55c1f6d13fdb", "comment": "Malware payload", "value": "b9eabc3e656e6ca82cd9665e5fa395685bc8672c36e77fc6fe0f8a68187b7649", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296640, "uuid": "032e7779-fd2d-4fb8-b064-63ffdf510ea9", "comment": "Malware payload", "value": "de0e8ffe57b06c097fdec8239f198c55c5739d2b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296640, "uuid": "e042bff0-7332-4976-aa4c-9329bea274ce", "comment": "Malware payload", "value": "4fc28d2c638efe31ab06ef3d7abe38ecd843b55e12c04cca7f89cda4dfb06a83ce8e8f23e95ff4616fa849cfc951b497", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296640, "uuid": "96e58e65-b42c-494e-acdf-25569343e45b", "value": "T10D137D6956857C24AE99883B1C7E2F0CB9A9C3E1310451EDBFCB3CF58C19A9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296640, "uuid": "c26680c6-1a5b-48e4-afb3-910894c85de0", "value": "768:bH+79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bH+Mco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777296640, "uuid": "0410bd62-9215-4e23-b8a0-fc4e01521692", "value": 45432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777296640, "uuid": "5541ced4-26e2-4d51-81a6-4a89b6315b2d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296640, "uuid": "1aa8916e-1e41-4b93-8db7-316cf8eca18c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e957a8-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285685, "uuid": "349f6c0b-7410-406c-a272-f4a96db5a6f3", "comment": "Malware payload", "value": "5ef76d86c0ebdc8d8b407a6f3150714f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285685, "uuid": "e9687720-207b-4f86-9bb5-3ea334294d96", "comment": "Malware payload", "value": "ba3b03ec6e2a8a7c7139c7512eba3de265e03ce80102014f53a0133e1bbfa1fd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285685, "uuid": "e6d08376-368a-4e41-8f32-085b9ac72223", "comment": "Malware payload", "value": "30b988d22ddeb31c51973db74108ed7a839ac71b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285685, "uuid": "0fdb9cfa-315e-4352-aea0-cf69c9918c8a", "comment": "Malware payload", "value": "bb0297d2861c9e8c33ceb5fe30319724b5631880e4b3ec7bdf35b8f438e498cc7e559324493f8bd6e840ccdbe53c4789", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285685, "uuid": "a7fd136c-ff0d-4d65-80d0-c5b016eaf88a", "value": "T165372317CB114B2B4558303144AF1F49BDC58588C881EB9DFBB22DAA545BF3F9ACF09A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285685, "uuid": "d39ead98-8bbb-469f-8b05-74edafcd7228", "value": "49152:1xC4xCqxCRxC3xC+xCgxCixCJxC7xC4xCfxCNBNpQg/TxCIxC0xCzxCnxCUBNpQF:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285685, "uuid": "4876e938-49ff-4061-a8b1-afa2ba355177", "value": 23684322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285685, "uuid": "a1f62a27-7a4d-4569-a7a8-97fef12c4589", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285685, "uuid": "d1a03cc2-28e8-452b-965e-6823aec0ffcb", "value": "invoice-1645080830.pdf (53).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccd0a9b-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321960, "uuid": "0d171e80-b306-48d3-80b7-75e39b31ac11", "comment": "Malware payload", "value": "8664bb075274c9ea0e1c76b142b8bc30", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321960, "uuid": "7864fdc3-c384-48fa-b983-2d94b198a38b", "comment": "Malware payload", "value": "bb94a8944431d219ada019a31f059528d76b7686cb60bf7c6142caaa108e7bd0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321960, "uuid": "b0e4852a-8de6-4a91-b763-ddf67f639bcf", "comment": "Malware payload", "value": "2d3402ef6f1e00e781dcf2b8f387ed974a5665b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321960, "uuid": "910a4a6b-2b88-4551-b08d-633d15c4307b", "comment": "Malware payload", "value": "df9fa8fb4bafa4e00c768beed1b87cbac7d03dc097e19d6c44915c4cb84d1b6c97607a89baeff790fee436b7ffdad1c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321960, "uuid": "00c5128d-5389-4555-89ed-040775b02f78", "value": "T15C51F9A8C7421632FFA6182FFAA1645847C6AC03DB61144D5EFB5CCE01E0A06A67DB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321960, "uuid": "7dcc5dd6-3ed2-4977-b14c-e58ef1571927", "value": "48:w+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:wkatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321960, "uuid": "50936473-8b81-4bfc-99ca-ee68896c26cd", "value": 2486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321960, "uuid": "bfaac34f-d359-4cb7-9602-e8f06ecb6f52", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321960, "uuid": "7b9ee447-67d5-468c-aba1-10c939f7ad3d", "value": "164.90.195.107_1777321924891560_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35789d1-426c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777317005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317005, "uuid": "07a37228-f680-404a-b893-2d131b70a231", "comment": "Malware payload (Mirai)", "value": "8e1f0de43e6e1fce5cacad7f8b145a9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317005, "uuid": "1cf9a63c-10ce-4b92-94e0-75c8d41be119", "comment": "Malware payload (Mirai)", "value": "bc4005a24d14ad0f3b68de7d0efd158e28233e630e252ddb98be466f0e41ea2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317005, "uuid": "2ceea8ee-3208-46b2-b4f8-b6a6d8e3ef2a", "comment": "Malware payload (Mirai)", "value": "901d1c1e60ed408c69015e83f8dacdb1e980fd7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317005, "uuid": "3c7560df-cec6-4413-aa93-ef1f944b0013", "comment": "Malware payload (Mirai)", "value": "412385ced7b715de5bc629b892e4c98d382ac8e5f3e274f3c6afc781c19f4efd9b886d66fcfccd5914aa5ef76cb86dc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777317005, "uuid": "126af69e-a033-4142-a708-e50e6900f5f7", "value": "T1A5338D63CE651E18C16599F0B0B2EF755733A46080875FFA66A6C7B98083D8CF5863BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777317005, "uuid": "f50e31b1-e6ee-4a96-86ad-93f05adb88fc", "value": "768:ffldVv5l5Gfnn7K/wBJarNolK5ONOSh2u06difNobOtAHqu+7Kx3dCpdI8IG:nlplof7K/wBkGl3NEusoxHX+7GCpW8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777317005, "uuid": "fe0f3764-6fa0-4436-bc30-5b8d3f4bf187", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777317005, "uuid": "48159a7e-db9e-4291-b567-d8cf55e48517", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777317005, "uuid": "1598344c-3ea6-453e-b5f1-b69c38b1bac8", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f120258-4221-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284678, "uuid": "e7f7b3ed-6cf8-4391-bbd5-c1d39e3e8f53", "comment": "Malware payload", "value": "3b348dd517c5de3539126c75384f27e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284678, "uuid": "e68eeb9d-7797-4306-b236-062dbf3bc63b", "comment": "Malware payload", "value": "bcf3bae5fe2cd8365be29b9de110cb1e860d2974eaf809bbb12deb632e6dad16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284678, "uuid": "4566335c-6f31-4c8a-98da-8d56a237592d", "comment": "Malware payload", "value": "b25dc473054d0c4efd0c7ac1b164815b0a091124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284678, "uuid": "a7a4cdb3-a4ba-476c-8a89-6a86d0f3d7b8", "comment": "Malware payload", "value": "03fd562768a627e01f71cb3785fd80900e6b67debbb8e5f0afa06783b76bc76d23c12e1d4cc80f69e9f5de86a570e6c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284678, "uuid": "236dc372-f8a9-4b78-8bbe-49485db748d9", "value": "T123647D25A7B92579E177C13DC9938D4ADBF27C4607A0D6CF03A0469A2F237D0963EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284678, "uuid": "daa42cfc-94a9-4c47-9101-94278e78b975", "value": "d2ddc298e70fdbfa13b4822673911627", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284678, "uuid": "cf04b5c9-68ac-4846-b982-9736218261cc", "value": "3072:qEiNAodrfeCOa23T4NUUIOKWV4EIJtk9tqhnIhV0onJYHl8oHUzfINECPL2iJL+M:T/IOWKOKWV43Jt6q0eHlaWPL2izrCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284678, "uuid": "6582c4e5-f248-4da1-a073-5a8aa7d08f23", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284678, "uuid": "74a03bd2-370d-4a84-8619-7e0d9730b9f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284678, "uuid": "1356f703-abe6-465f-ac32-c82944f681c9", "value": "78-33-3E-51-C1-72_x64_dump_945953.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a6c88f-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271456, "uuid": "6abc3ca9-db8d-4fdf-82a8-78b6bb86ef4b", "comment": "Malware payload", "value": "9c1dd5c017dea77a04b6110bf7685655", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271456, "uuid": "f267ca56-36a0-415e-b2a8-6db2d1545562", "comment": "Malware payload", "value": "bd11658c5bc93140f473a19244621c9fd7f76292d651b86e400296752486f0a1", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271456, "uuid": "7e3d3749-7ee4-42bc-a471-44d85ce27e4f", "comment": "Malware payload", "value": "bf02ba9de61870c9b326a75580d1b51df2d164ca", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271456, "uuid": "6bbfa110-c22f-4bee-a107-cc49f628d416", "comment": "Malware payload", "value": "a428556a517af97026679c60ca08b0efbedae9a8797a0f674522a3f5117410068c79d79409a278b5b5a90d7b94646341", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271456, "uuid": "56cd5cff-462e-4781-a91d-1b23f0b7a22d", "value": "T17302866A1E53D89202B1D646E804414BDE73136F128D1E71F97C80419FE8E2EF69C9BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271456, "uuid": "45d14cc4-8d0a-41ed-8a33-3f26622de4a0", "value": "192:/BYwS9bAz07c6MfcN7m/K+lSF+I/ZxqRxrwHR:/qwSNAx1w7mS+lSFF8aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271456, "uuid": "f7ff50cc-ffd8-436b-baa8-ad3af008c337", "value": 8405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271456, "uuid": "bd6bf147-c8c8-42dc-9414-7d715611dfbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271456, "uuid": "7f0fef27-d69c-431c-a26d-de4f0c4adbe6", "value": "dudu.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87676c7-4228-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777287889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287889, "uuid": "014d1bc4-c5d0-46eb-b598-4926e00dd6ea", "comment": "Malware payload", "value": "bd1eaea733425cd21a51a652c429951d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287889, "uuid": "c43b2eb8-58d9-4b3e-9aa9-237911c083b8", "comment": "Malware payload", "value": "bd61c2880920bbfb86c12df439dd1ca0258a10e532433698fd029aef2a5b33f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287889, "uuid": "5dfe0393-552e-421a-8b2e-90d66f515d68", "comment": "Malware payload", "value": "60285f6776cc3ff20872feeee7f2fd0b3b04410d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287889, "uuid": "3fe6543d-fed9-4acc-9d99-b151ff499830", "comment": "Malware payload", "value": "f18b4626d8b10d6a468d0c6dd7183eaed0f5350fda7e3bfee3785febb5231ea5acca4cc786b0a443a561452909cf4598", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287889, "uuid": "8614b41c-905d-4d7b-b586-6c91001908ba", "value": "T1A2871987F8E21EA4C4AAC571D125815BFA727C2C0B3C23DB16A0F7641F3ABD06A76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287889, "uuid": "c6aae572-fba0-46b6-8238-1dd21bc533fa", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287889, "uuid": "722c87fe-a924-4df1-8899-820e10fb2640", "value": "196608:+JrX4l/0ZqdTNsI2zCwP3pT1XjUKzuBmmpkBlnz85TCN3KDSq:+pX4Z0wTNsnCrm33cTW3K3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777287889, "uuid": "c549cea8-6508-4f32-9a26-293c3d0a7ab2", "value": 37110784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777287889, "uuid": "b276569b-92d2-479b-8b39-ad6b5f71209c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287889, "uuid": "093f80c6-3e14-4f6d-b052-8817a6777327", "value": "svchost_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491d3365-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284185, "uuid": "23af9218-ca03-44ca-83f8-8f9533037412", "comment": "Malware payload", "value": "ecf6c93f0c6552325efe78a9df432c30", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284185, "uuid": "36167ece-6d5e-462b-9489-6a27414abba1", "comment": "Malware payload", "value": "bd9cbac8dbc78f045279b7db25e6a33a469ec08d80a659031e3889a2a958bf37", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284185, "uuid": "08e25059-34c2-48b7-8293-c1e68c30115c", "comment": "Malware payload", "value": "43a43e1b046fbfe494953133322c16d719516fc0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284185, "uuid": "ac526780-25af-4775-943a-77fa7044b3c4", "comment": "Malware payload", "value": "f73ffddefc0d3885396f1e551a3d76bb8f6fa9f4c4d78707f4cc357bdb1235ed7a39614850b190b98e4e2b7c275db60a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284185, "uuid": "05b1cc26-f396-4ac5-9a81-64323234f655", "value": "T12A3723078E7EA99751EC5A98E4AD0F2C59C64F0388CDEC8157DFBFBA8A0DE783045116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284185, "uuid": "d36d29ad-6c2c-4f5d-98ed-86aef5ce29db", "value": "49152:dsD0sDJsDRsDNsD2sDEsD5sDxsDnsDnsDLsDyuT6JQsDlsDMsDKsDqsDhuT6JRs2:tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284185, "uuid": "55d185a4-2a85-4795-92a9-315874e6af40", "value": 22643811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284185, "uuid": "92cc3d72-8abf-41d7-8e2b-11f724d89341", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284185, "uuid": "75ee47a9-1a32-4405-b0bd-0b488a6b6c38", "value": "invoice-1645080830.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0940c2c-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284332, "uuid": "41bb522f-2eb5-4fc7-863e-176302a37785", "comment": "Malware payload", "value": "bbbeb96cbef975481467e077a8da7631", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284332, "uuid": "14d572f8-4829-4765-a055-4ab38eef9f59", "comment": "Malware payload", "value": "be7150896f1906deb630bd8eb5eb2023b032ece5e6a9954610225a7e8c6a1af3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284332, "uuid": "16d7fcc1-836c-4fa6-8983-336a7942a5f5", "comment": "Malware payload", "value": "07c218fd83f2b2404793efd52a76cb56cc41b1ac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284332, "uuid": "e737343d-3159-474b-a846-32b7dfbda361", "comment": "Malware payload", "value": "f1943667fc7da9b50d71317b7eece6c31010f0feea490d670456ddd30264241e4719d95e0dfc6adfc2a0345970c920fe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284332, "uuid": "a201843c-4f7b-4248-820f-e3b1723b7f6e", "value": "T1113723525E369DCE0F7982AC09AE4B0FA3F84E9D120762B476B7206EBD1FF492151C1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284332, "uuid": "44ec78e0-79dd-4cb6-800a-6b433856d7a9", "value": "49152:412LZv12LZp12LZQ12LZZ12LZZ12LZz12LZg12LZD12LZK12LZy12LZl12LZSx1H:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284332, "uuid": "e937cbbe-c271-4fff-894a-ad7469b882bc", "value": 22903941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284332, "uuid": "4d3e9a8b-3181-4326-a8e5-71dcfba0d8f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284332, "uuid": "0e92526d-44d5-4c4a-a5a2-bb86f5a32dfb", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f08a00-41f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777266458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266458, "uuid": "7adcafcd-6265-48b3-9d06-400e7da9adf8", "comment": "Malware payload", "value": "390cef3f2c122b4ee9d70c213cc1d173", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.al", "colour": "#1C631B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266458, "uuid": "ae3513e9-afcd-4e75-8701-d5fdf29e4a04", "comment": "Malware payload", "value": "bf35bfdb2f4fce37e932d42eee556b89c1799c86d2f1f9ebaeedbea18c38237b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.al", "colour": "#1C631B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266458, "uuid": "09431990-2ea9-4b76-bf5f-663d48c9da9a", "comment": "Malware payload", "value": "86978f47750499ce31a0bb26b5b8e495b551a165", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.al", "colour": "#1C631B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777266458, "uuid": "629cf660-b225-48b5-9854-b2030cc16e43", "comment": "Malware payload", "value": "31f32d63785d9b48fcd4a5692f962a88fd76900be0e42f347804c3368cc940b54b8c4092d49fc4243e05721185754778", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.al", "colour": "#1C631B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777266458, "uuid": "b31ade8d-479e-4769-a04c-8980247d873b", "value": "T156D73351F0CE8731E6AF80346579DB3991F23DD113B280DB93E4C9A65E7EAC24236B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777266458, "uuid": "6dc097c8-7989-41d8-b541-8c19ec026d7d", "value": "1572864:QumnD/IqC/25jK4vzWXttFBLbLk1lCdiukrYd0fWymjP:QZnD/a/Ajx6dtFBLU3CbuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777266458, "uuid": "e2dccf64-53ae-4a64-a622-cdf5a275a82a", "value": 63576064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777266458, "uuid": "e2ed3776-4c94-4f2a-a104-f68aff69d613", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777266458, "uuid": "bde5549a-d458-4192-ad1c-92763bec7ace", "value": "win32-googeljie.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a50273-421e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777283351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283351, "uuid": "7451cc0b-0dd9-45c4-968d-f608f6fff811", "comment": "Malware payload (AsyncRAT)", "value": "880a67fc25beaef96410fac57c92d4d4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283351, "uuid": "106fc720-e4ef-40a7-9ad0-ef16c43456aa", "comment": "Malware payload (AsyncRAT)", "value": "c03958f4bab9297fdaca6848c6b940002321fde305c3c3d61e0d1714fcdb1cd7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283351, "uuid": "aeff9da8-ed72-42d2-a3a2-9f2f53b5d934", "comment": "Malware payload (AsyncRAT)", "value": "f6af14af1b7a4413320a4c1eb272bd12f5dde254", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283351, "uuid": "91cfd144-60fe-41b0-b479-cd6a950bc362", "comment": "Malware payload (AsyncRAT)", "value": "3b218773b3a544d63b42c407c758453b496ea04c3a20783649a239f75dd158f59a343a6c7c889e6d16c368b7e244d973", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283351, "uuid": "62d4891a-9b76-4f55-ab5e-f57adee2f9a8", "value": "T1ADF412755B48E557C8660BB50D70E3B253A29D8EF460C347C6EEECFF78192A038982D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283351, "uuid": "8882d927-cfb4-4e92-9a0a-90bccadcf065", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283351, "uuid": "3cbca739-2eb4-486d-af6f-d0687cff482d", "value": "12288:0b9SlMPiCWxHt7OBfVYjrQ73tLD8Zi+VGQR1P0SXP3kyRcHAj8NmeddpUg7tLuQH:wCLxHVOtVYjr+38GgPkEceuFddp57Bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283351, "uuid": "93be488b-9ba8-497d-9de7-37913bc5a555", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283351, "uuid": "087f7b20-5ac0-46a5-a940-930f4d7e1ebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283351, "uuid": "423c6a2c-3e2e-471a-9150-400cda8d87c6", "value": "swift_copy_7483.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fe171a-423d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777296582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296582, "uuid": "88575e57-3051-49cb-b717-c0069f16a5e1", "comment": "Malware payload (Mirai)", "value": "b382c1e6169b67109184d87f5147d517", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296582, "uuid": "2c093563-de9f-4894-9758-65733819bf0b", "comment": "Malware payload (Mirai)", "value": "c09f04d11bcbe02a3216a6efe620cd5484fdbcbff5866645d3d6ce461339fd9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296582, "uuid": "5a3fbcd7-2cd0-4248-9644-dbca9c32f962", "comment": "Malware payload (Mirai)", "value": "1d48929ef4b73f5d623a739dd5af95e3c99439d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296582, "uuid": "7b4f7f09-5e84-42eb-a9ca-c80d7b217d82", "comment": "Malware payload (Mirai)", "value": "91c1779e067040cf9353707b2b4b63c61fcf32598df55eb8dead1ff1e630e267d18f5eee65348b86e0d049dc846cc5ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296582, "uuid": "d3e63508-3ef7-460d-aded-a77cf72fc3bb", "value": "T13223F13DA0600E99FF9DEAD57D66E5D33BE14B04A627C30029E99F15323B839FA814C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296582, "uuid": "e67d24eb-171b-4dbd-9074-ba9f41edfb75", "value": "1536:nVOuJSrXwMEUlWPauHNEBZnGV6cba4u+qgw09R:nnJSrXwMEUG2fGFba4u+qgwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777296582, "uuid": "ddf6ee94-1c55-4213-9699-5ee87e27ac08", "value": 49944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777296582, "uuid": "e1e50d1b-0329-4d26-9732-e72cb7836adf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296582, "uuid": "4b8f5b3c-ec54-4e81-9e6a-9078bb299de8", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4e490e-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777265001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265001, "uuid": "1dc0bc66-5cd1-4032-8721-1536c3400e34", "comment": "Malware payload (DCRat)", "value": "62aad6988a430a3deb48ee64f7ca2a71", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265001, "uuid": "3b608b71-3a04-4e28-b531-6eb2d3fac1e0", "comment": "Malware payload (DCRat)", "value": "c1307b6552f49149edaeba50fc282fee96bce85985847fc8280c3f92206968e3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265001, "uuid": "f2a7ca9a-0c09-4aee-b5e2-822d7dd7dbb8", "comment": "Malware payload (DCRat)", "value": "750d2eb5017b9c9f589694815af51f4721435ed2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265001, "uuid": "0dc1483b-eade-4d8d-b464-7aeaf39b4259", "comment": "Malware payload (DCRat)", "value": "a254cf10b4c5210c47b87c17f5a196950c4366ea038d1e6cc0c4514ac182215c7dc9c65f344ae25e76a510b80fba351a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265001, "uuid": "8656cffe-3025-45e2-a890-3723ee949d46", "value": "T1B185AE417E44CA11F0191A33C2FF55048BB4AC106BAAE72B7EB9376E64123937D1DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265001, "uuid": "b06ec757-884d-43ca-9a02-25ac0dc5e8d8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265001, "uuid": "3b8ddf6f-3e2b-4ed3-821b-80d549cca6e9", "value": "24576:u2G/nvxW3WieCvDNbRlYM0b7D0hKtpWBMV0daBdOM5hbY8MFekeM:ubA3jv+TiyLfvMF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265001, "uuid": "b6e0f1bd-178e-46fe-979e-9bdc525da34e", "value": 1773131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265001, "uuid": "ecc7384c-c594-4959-8107-240e1824bb29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265001, "uuid": "b26387cb-fdd4-4968-8129-8a92d4c8b54e", "value": "DCRatBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a30b6f4-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777291542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291542, "uuid": "8545e79e-cef6-4fd1-bc80-31abfec11831", "comment": "Malware payload (Mirai)", "value": "9541b9d9cc4c6d74b10502cb25fd89f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291542, "uuid": "0e4edac7-a6ad-4970-8a3c-46a09f705bfe", "comment": "Malware payload (Mirai)", "value": "c15b1ec9223980d2040e41dedb8875dfac0fdaec6c893352e220591cb8cd91da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291542, "uuid": "7759a45c-644b-424a-b44d-5ab5928c0539", "comment": "Malware payload (Mirai)", "value": "eb393fd4e616688934a43773c4a1ba1894c86a88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291542, "uuid": "dcb058d9-4ab3-4aac-bda5-fffcb9ecc633", "comment": "Malware payload (Mirai)", "value": "260ca4f5aba98a89fa9d5364892e820d4f687a137e78b9e073c16cdd67523b2ce19aaeca7df377b5ac90846d599906fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291542, "uuid": "d619b364-b8bb-4241-8bd8-de4e59b51e96", "value": "T197F33ACBF800DABDF80AE37A48170909B530B7D151925B377357B96BFC7A1980927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291542, "uuid": "f72f8ac2-22d7-45b0-adaa-c786b8f9cd8d", "value": "3072:5HjyFXWMCDfsPUMoevuNXWuVJjbiuLg1UHSROuR/Ry8+yeAfwEB:B6XWMjoe0XWmLg+yvZyye+TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291542, "uuid": "c52d651a-4e0a-4322-b73c-0f2985dd6dc3", "value": 159872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291542, "uuid": "800e2a1e-f643-4d10-8aec-954db09306e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291542, "uuid": "600e3c95-05f4-4f5e-be2f-1deb611c2c3c", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21ee03a-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276228, "uuid": "64c31a46-7f9b-4bd9-ad40-3f796bcf912f", "comment": "Malware payload", "value": "b8a11d72c8794fb0ae46043802bd68a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276228, "uuid": "56247e93-8562-4c60-b2ab-ee0a69a1ba97", "comment": "Malware payload", "value": "c209d4c31d6abd769ac1fe6b5d2ddd21bfca40447c443d758c66241dbb702f9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276228, "uuid": "e94aa42e-7693-4267-9ae4-03ed2098f24d", "comment": "Malware payload", "value": "68058a1c902e3c84c55a2194dc021dd4f9d491b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276228, "uuid": "9f47d790-3648-4536-ae0b-49550dd9c409", "comment": "Malware payload", "value": "8f60c94a31441db3819430ada35b426c032cbeb9b50064be85dad770f85c20cf94d4f5f04f32eb0c2e563dd2faa1969f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276228, "uuid": "85caef12-d1b0-4cd9-8968-d69eac7842ca", "value": "T198372322C71AAD7F03B9257C80BE1BC548DECAC52010BDDE7F646C9B6D59F289813366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276228, "uuid": "61e85fc4-4224-4c92-9b7f-309e6c88437b", "value": "49152:tGAbSYezF1Vzke2DebAYUie2DDZw1WsHo1EWgZN5e2DJe2Djjdje2DyXfuGv3wg0:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276228, "uuid": "40106201-ae8a-486d-a918-d0ee3ca7a812", "value": 23684311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276228, "uuid": "cfa2b1ec-1500-464f-85b3-416118fcd5f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276228, "uuid": "f02cec09-dc61-4f12-80fd-6cc0a2d0876e", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d1035f-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278925, "uuid": "3bc5d26f-e339-4ccc-ba4d-7a4f4cc6dda4", "comment": "Malware payload", "value": "cd9eec17926a6d3f815950b988c741ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278925, "uuid": "268296e5-431d-41cb-9288-2fa7fd69c34f", "comment": "Malware payload", "value": "c2789d75e73fe36b20f765ed1f59850f19f4d701dbc33fd19858eca771ff2206", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278925, "uuid": "4c39bc8a-798d-4147-87f9-363817d96fbd", "comment": "Malware payload", "value": "adde5676c512b5798d96e6113bc3273fc5b7ea45", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278925, "uuid": "fa7aaf85-1bc6-4bfa-966d-2675318af16d", "comment": "Malware payload", "value": "0213e15877107021a32e7ccbe7a745d587e63b039af66b6e1321b91d4ccd7ef1b1e3a91e9320088abf42f4e85547416c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278925, "uuid": "1577843b-575e-4419-85b7-7c3b2b145cbe", "value": "T1EF3723135DDE5E2AC758339D30AB4A5ACACFC8884134F3A3E55B8C4E81E8F55315A8DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278925, "uuid": "57dea8a8-97ce-4443-9f59-fa17255839e3", "value": "49152:ZZoiz5ZoizKZoizSZoizxZoizTZoiz1ZoizvZoizoZoizEZoiz9ZoizyZoizTFYO:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278925, "uuid": "e4b34074-403d-447d-8f0e-8c96bff6b930", "value": 23424194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278925, "uuid": "ef2d21eb-d07b-48a3-90e8-946331d9348d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278925, "uuid": "fcb3ac9b-93a5-482c-a6cd-54f28ca7b070", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce08689-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777291574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291574, "uuid": "a4db32ff-49ab-48da-9a76-4445b1b4393d", "comment": "Malware payload (Mirai)", "value": "087d2729ed0da323b63c32a8b47c4cf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291574, "uuid": "dece3ca7-6376-42ea-9a51-d82b0922f4a9", "comment": "Malware payload (Mirai)", "value": "c284a66fffae9e5b50f29c2bcaea6c9b6ea0d6806ded76c10bde1669d9a00cd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291574, "uuid": "9ec66bd4-c959-40d7-bf44-a76204776885", "comment": "Malware payload (Mirai)", "value": "4e4a0ab1502c8d8bc43c0d372012ea4bb68c71c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291574, "uuid": "9ee7f6a1-5e90-45c1-a918-d22298e40c94", "comment": "Malware payload (Mirai)", "value": "4f9b8129590d486e76952efa4d1bbe16d97027bb8058ee57938a019e2cb131c64e58cc67d4d147acaee837c839ee1723", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291574, "uuid": "f6dae921-40f6-420f-a30e-f9fedf4a1672", "value": "T15003F12AE1EAE7C4D81F927D0CBB722D54589199D048F0EB8FC020DB6F26F3111609E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291574, "uuid": "a745fca4-c752-400c-a03c-9eaa8b8857cf", "value": "768:NEVS6xwNi0M8X/6j1Z1P7doP07IJPT9tLFgWGaKpuO+4KTd+QSnbcuyD7UoQRjW:p6An2Es7yLF3GaNO+Xd9Snouy8oyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291574, "uuid": "704b6218-a235-465c-8ae9-9f8544de57c2", "value": 37740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291574, "uuid": "4f884a58-c0e6-4095-bafa-6aaa092e8431", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291574, "uuid": "1a65e60f-9bc8-4f58-8b86-da9e0097b754", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1b32ff-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302660, "uuid": "947ab8fc-5dc5-4b8f-bd76-219de8dcb7bc", "comment": "Malware payload (AgentTesla)", "value": "2df3dcbea7a6317a827bcc72d3245e76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302660, "uuid": "cd9f2270-914b-45d1-888b-e93170eacc67", "comment": "Malware payload (AgentTesla)", "value": "c3541330d15b94081ec862fdb6c4edb252cdb84379e3e3799ab698ca2ddfb7ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302660, "uuid": "9128240b-e2a1-4de1-ae38-2f5e0bc4a4f9", "comment": "Malware payload (AgentTesla)", "value": "7a1083f31ab2f0949c93e2afb90ac1aed1470964", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302660, "uuid": "6314ed33-3e4f-4749-b3ff-c050de19b84e", "comment": "Malware payload (AgentTesla)", "value": "c1641cd2165677259084ec24c0d6330ceaa393fdaf0e7526c4ca00dd272e621ceeb364196379884bedc49356ac8d3fb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302660, "uuid": "1f8b5f01-ec55-4497-ac18-6059339c1973", "value": "T11E2533E3615E07F45968926AF18BDF8FC851EBC80842C5EB67F851E6A652F42C70FC18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302660, "uuid": "27d63fc0-ff39-4c62-9ced-e943bbae0ce8", "value": "12288:sy2IkjWbnwxkR8wZ3Cfxpk+DwOyfF1RizV8RykPHe4dgPU2xnV4QOztQ4UcY98zt:JLweLI/0MV8RyasU2B+166z+GIpLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302660, "uuid": "12ffda18-5574-4e13-ac93-126e39998fd2", "value": 1013082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302660, "uuid": "0296814c-cb65-489d-b78f-50ac942d34b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302660, "uuid": "c22ef74b-99dc-4d44-bfc0-a5e6e70a4c5d", "value": "ps_jnhIGcux3Saf_1776242012926.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffae0a52-421a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777281915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777281915, "uuid": "b024b45d-f76e-4158-9143-6d0b9a11ab51", "comment": "Malware payload", "value": "6a666067f2cb76f63372c9dfacfd619b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777281915, "uuid": "3a555b23-6955-4ca5-9752-fbb616544e64", "comment": "Malware payload", "value": "c3fc1c7f802b1d51c539eb14ae3551d1e54a77bfb0b03210fedbab0a85f2cc13", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777281915, "uuid": "4a82bb7f-a2d3-4e23-903d-1f14da7d7137", "comment": "Malware payload", "value": "fc9d1a536ddf9cc683f7dd31178caa166d9d8ac1", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777281915, "uuid": "4d2e57b4-a6f9-4083-97c7-d7fc4edc1947", "comment": "Malware payload", "value": "07815e925953c6dce345cbbebf32e6348a0f69c73bb8622263815119263aac8f4f0dfef0cb2ebba26705fca2a7e97a76", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777281915, "uuid": "c8fbf274-6bd0-4cc9-b181-5a25fce27a24", "value": "T16D6418966E9405F6DA2EE13C85A3732DD737783927E2CF9F529A2D112F332984D29310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777281915, "uuid": "8342dd24-0c36-48da-9295-a88415e95fcd", "value": "c1dc9a962abc6a9d38e96ffb899bbdda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777281915, "uuid": "b6de1d32-1ee5-48dc-bfd6-d0307acf6106", "value": "3072:Mm4KRb/vR/oCev8okzJdlC30ZHXXJ1oSijT2wJ2b0JMsH69Wsx1zoeeyr8zz4jP:MmdRb/OCev8ok03+JCSitEb0aj8/zQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777281915, "uuid": "5e5cd423-9fbf-4acc-8fdf-4c87e12a3a67", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777281915, "uuid": "be0e96f5-6002-4cb4-b887-22c3d953ea64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777281915, "uuid": "b67cc8a0-6fcf-413e-bd5b-7b065454cde6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4baaf2f1-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279465, "uuid": "803e4b98-d736-4030-8503-bb03cc9c65e5", "comment": "Malware payload", "value": "1fefb1c10abd31b53e1cfb6f97975fce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279465, "uuid": "4515d4ad-07d8-477d-b055-d81e7b569a03", "comment": "Malware payload", "value": "c47689d271c7d96fddfb33078ff263be902f60222cab16ddf9982e3103b61138", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279465, "uuid": "c53bd45c-62f7-4424-a1ef-320d8e17c43f", "comment": "Malware payload", "value": "f40762b7327485834625dc63b37cef66d99fc648", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279465, "uuid": "141cd2f8-bbc2-4d0e-920e-1f0cf1786dbc", "comment": "Malware payload", "value": "8fcf5a08d0ae87408ff40d08a28f4006abd5ab8a5eff5a8213d272879cfffe66bb54bf7becab4a5581ae4347defd45bf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279465, "uuid": "dafb6b2b-a7e9-45ab-a681-65c7365654e1", "value": "T1543723474E974B2F2634150D70AE9FCA15BA4C44C4ACEDF297B6300EBB9DB87614E2C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279465, "uuid": "b24fcaa4-b1eb-4f99-b0f6-3c76d8cfb27f", "value": "49152:Gn3vAn3vWn3vtn3v7n3vin3v4n3v0n3v+n3v/n3vin3vAn3vu0tn3ven3vln3vJq:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279465, "uuid": "908e5cd8-f8ee-4024-a6fb-4b678e62da8b", "value": 23164082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279465, "uuid": "58790361-751c-4e28-b7a5-c89e5e6f153b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279465, "uuid": "12f09f4b-71be-4f89-a467-1f2d4fb3d29d", "value": "invoice-1645080830.pdf (55).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dec6df3-41f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777265376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265376, "uuid": "978d1137-aad5-4543-8dcd-2553fe24ca43", "comment": "Malware payload", "value": "7a5f07544468e137373c288f9d41b57e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265376, "uuid": "2f2cf8e7-7986-453f-927a-fb6f8ed2c9c2", "comment": "Malware payload", "value": "c487f397bc3920e2271342bc3c7a4511b67544e1e9b770d955657178a3b19930", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265376, "uuid": "bef5f695-939d-4d4c-a5de-02caaa9cbf82", "comment": "Malware payload", "value": "3d9eae9eeddd87a9885214b153dc655ac883c481", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265376, "uuid": "34e438d8-51df-4811-980e-d8a9b8be5363", "comment": "Malware payload", "value": "38c4ccb2d2bf57eb4505ebbef574c75cd5c2ec7fb8d765e21917fc66173092bb74cc26799d67ef24d63adb2e73a58d21", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265376, "uuid": "71f43964-42ea-4d79-b537-4439ad4fff5e", "value": "T1B3A45C15D3A501FCE0A7D23C8AA39902E67678494761E7DF13A8D6361F637D0AE3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265376, "uuid": "372ef1b9-a989-46b6-8164-b8292095a712", "value": "5220194da888f7a400d46d88743e7582", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265376, "uuid": "1822c225-b3a9-43d6-9a11-ac3af27f5ffe", "value": "6144:7enCAYHli90YWFp00+CUGIQ/fTXrgUi7JJpmGFRHpjqwj3:7thHlzY2RIIbkUUJDmGFjjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265376, "uuid": "217c832d-2c40-4bdc-b000-0fc7c7df3095", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265376, "uuid": "c0e9082c-99d6-4f5b-93bd-9e4addfd13c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265376, "uuid": "80a80089-9bd5-49da-81f8-5e5502b9c78c", "value": "c487f397bc3920e2271342bc3c7a4511b67544e1e9b770d955657178a3b19930.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c79b21b-4238-11f1-a769-42010a9c0008", "comment": "Malware payload (RevengeRAT)", "timestamp": 1777294499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294499, "uuid": "ed8e259e-1ce0-45b4-945d-cd2a9a4e75d5", "comment": "Malware payload (RevengeRAT)", "value": "036af78a1242ffde3428b2d0f585382f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294499, "uuid": "d3e04f5d-a50f-49f9-88b8-1eb4553f806c", "comment": "Malware payload (RevengeRAT)", "value": "c4bcd7b781b2f5401e5a03c27592dfdd692e8085c983b32a9bfd45e429cb0e0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294499, "uuid": "5bcb147a-a9ac-4347-aa9d-cd6e8319c577", "comment": "Malware payload (RevengeRAT)", "value": "cb3a71652cfeba198bbcc4b0ca031b14b31fbef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294499, "uuid": "54dbaf33-dddf-4ed1-befd-e21dd74e377f", "comment": "Malware payload (RevengeRAT)", "value": "bd6d073fc6664977d9fc4516a98303c09f67b87f27486c32e44745a0774ef76dd5e631a6ddeedfaa5a34c79a45818dd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294499, "uuid": "b29a34a6-2326-4472-83df-71b82a5b1d94", "value": "T1B9F34AD2B287C795D82A4472C4EB59F013903FD7DBBB560B39883F0DB9B21522E2B516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294499, "uuid": "fe6aa7fc-29bd-4ce9-a146-e2544c5a64f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294499, "uuid": "66e91f62-7206-45c8-a9a8-d0b12cc6be2e", "value": "3072:Q61X9Z7e0dmJFsf5WcYjBdJmSwpTes8nP4B+:Q61NnmJFsRWNBjtieZ2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294499, "uuid": "966b4f2f-9ae0-44b0-b41a-415aecb944b4", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294499, "uuid": "88a96411-dbdf-4823-bdce-e2e5acd08fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294499, "uuid": "5f52af08-11bb-4383-bdba-101ed589f994", "value": "sextop1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac53935-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285745, "uuid": "0f4a55fd-08f6-4345-addf-cc03f3b79637", "comment": "Malware payload", "value": "71e59085f8b72591fa8b167f2bee66dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285745, "uuid": "68bed553-a762-40f7-baac-02e6952c63cb", "comment": "Malware payload", "value": "c5576e133efeb9faba0792c6cbc5097b113e3137debd01b37a6b47a42964d70a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285745, "uuid": "18a3762e-62fe-44e5-ae4c-0572da8a24c7", "comment": "Malware payload", "value": "274b92abe502f29bf741448ed9b5a4f90e9ad2bc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285745, "uuid": "4f5c152f-9f00-49e2-87d1-75f142c9087f", "comment": "Malware payload", "value": "b9d7e3fa2e23280ee081b8f5711689064c20fec438d5e3d959e7ec1b8139d37bb2e133e0843480865cae9a01cbefa565", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285745, "uuid": "2b291d6d-153b-4f2a-a11d-8c4e9a7d2448", "value": "T1D33723955ABAFE7F8E4A8A2C6063036979594CC8CA93E0D4F3A57023F60EF70351758D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285745, "uuid": "55eafc4a-0dfc-4bc8-87ac-83276ebb0f79", "value": "49152:jsg86s2sg86sHsg86sOsg86s+sg86sJsg86sHsg86s3sg86s1sg86sEsg86sxsgP:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285745, "uuid": "68ebc16d-b5a9-4952-8fa7-6c514e41f4dc", "value": 22383675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285745, "uuid": "6d7e756c-f88c-4ebc-991f-e378d28c7b51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285745, "uuid": "7880db07-6e01-4e50-8e26-df7b399d7028", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f452dfd0-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285761, "uuid": "c6ab5d77-3860-4393-aa16-48fe5ee2e756", "comment": "Malware payload", "value": "994a86be5182830ad2091ff0e44762cb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285761, "uuid": "ca219f00-122f-438d-bf77-753ad0c1d545", "comment": "Malware payload", "value": "c5d0b067c6284d8532668b69c7df405770a930bce4dd5163c48bde99e95b73d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285761, "uuid": "b164293f-b766-4d66-9039-f130e0f23adc", "comment": "Malware payload", "value": "2e8a0576d35899c130522978e467a735559fb8fa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285761, "uuid": "34a115b7-b48b-44a5-bae9-f1e0fd1a0f4a", "comment": "Malware payload", "value": "b5a1101842a012447dd4aae32c2ff9b96da083288040a1ef5a027e816dc9872405940e3ab66335638d47b20321e7089e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285761, "uuid": "326efe57-5993-473f-b0f9-fa30e131d64a", "value": "T1633723572E7A49575B7CB2AC882B0B4D3FE4CE60582057D49358B94F2CBFB723283469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285761, "uuid": "6dcfdedf-6405-4705-b496-7c6f2195d0c5", "value": "49152:DVq++np8Vq++npTVq++npbVq++npGVq++npsVq++npaVq++npHVq++nplVq++np5:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285761, "uuid": "4297452b-ed28-4c85-8bbb-45702e37b091", "value": 23684337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285761, "uuid": "64ec5cdc-1161-4b50-8a55-cc5ad8249c67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285761, "uuid": "b57108b0-030d-492f-aa93-cead02fa8452", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af064242-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323011, "uuid": "59c7464e-3f52-4eff-84bf-941917dd5cf2", "comment": "Malware payload (Mirai)", "value": "52e341301a9d825511c3f0cfa62f524e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323011, "uuid": "6aa9ddcd-83c2-4e77-aa7f-b765f14ea250", "comment": "Malware payload (Mirai)", "value": "c6e0853c54917050160156674ddeda95cdf54472af95535a1fca368a774df7aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323011, "uuid": "0ee8316b-2536-4eb3-9e45-3e8885f68114", "comment": "Malware payload (Mirai)", "value": "d6ff718379c6389ce4fa0f427b318219633de20d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323011, "uuid": "254c961b-9a3f-4c15-96a3-ee6f31975558", "comment": "Malware payload (Mirai)", "value": "e5feb5dc9688dee431d2a26606abae8c003ddd5fa4bb5f46e6aee4e0b2a295d962f4022c51ad9f01652fe1c1f98aa724", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323011, "uuid": "75986fd4-7a0b-4ad9-ad38-804d9a77b283", "value": "T1827162CE803187715A59B97A76EF0084344BDB6274CACF15C6EC68DE52CCF44DCA5632", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323011, "uuid": "8f78c603-1103-4f97-bae4-118c3e3b15f4", "value": "24:Itas6E0x3IxsSobGJH7wwFCLF8u8NI2WkswKNpQ+DYC9:ib63x46SobE7QLvJwKNpQ+DD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323011, "uuid": "ce37a0bd-f265-4ba7-b3be-c2e4776e180b", "value": 3704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323011, "uuid": "5bb285e8-130f-40d6-b98b-bc84a297a17d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323011, "uuid": "cb85ca48-2319-4df1-a7e3-5ab57b1a2d47", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7646f981-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279107, "uuid": "c7622b9f-7229-4e3c-8f63-efb7f964b797", "comment": "Malware payload", "value": "7a25a73b64ea23bac5d03a04ec319241", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279107, "uuid": "0d244f9b-4c9d-4174-aed9-7abb3efc99af", "comment": "Malware payload", "value": "c79fa1f6c66b99971f67b7ceaa91f89d486956eecf6d3af234b772e7576b35cd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279107, "uuid": "f787026e-2bed-45d5-b1fc-7725ad7d7a11", "comment": "Malware payload", "value": "12a9a26770cc721c7c55dd99de82ae176af13ce2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279107, "uuid": "3a17e6ea-98f0-4412-b462-85404003cef6", "comment": "Malware payload", "value": "167594be123c6287a3451a87b2fe41fd4e78f51b6b1cf62b5f6ba6b71893bcbdf4d23f0b13a91e39b9ce2df0396b7876", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279107, "uuid": "a9a551f0-465e-443e-8fa5-f94629c3dcb4", "value": "T1533723561CBFDEDEA978B028667B0D1B5FC12B8228695E7713C5380B8A4EF1CD4160BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279107, "uuid": "82e98bfc-accf-4efb-86f5-f910622b3805", "value": "49152:m01yY01y001y201y801y/01yt01yw01yu01yc01yu01yA01y1sP/L601yK01yK0S:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279107, "uuid": "c7e1e9fd-58e5-405e-87e6-13658d54515a", "value": 22903928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279107, "uuid": "a4903437-e554-4f9b-8269-c55ab27a8a57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279107, "uuid": "3b56d26f-d205-43dd-a794-95c0b895396d", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc1550c-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321965, "uuid": "8e6a6599-2170-4e59-81ca-900e3111fe5e", "comment": "Malware payload", "value": "a039c1bc99340d6ded68141f88c53199", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321965, "uuid": "bff6281f-b40c-4fed-9c62-ddbc83776f5e", "comment": "Malware payload", "value": "c807041f16a61b2777252993e0243fc36079e0658284281ee4f7d488d609ba66", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321965, "uuid": "0d153bf8-d94a-49a5-9196-65e5560f8158", "comment": "Malware payload", "value": "f8702fe98dd45e44f8eb122fe6024eed28b64b5d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321965, "uuid": "6eb2f580-7b04-411d-91c5-d8819fcbc4f3", "comment": "Malware payload", "value": "ec86c889ba7e158e70618fdef6333b7adbee903bfa19fd8dc51f9c65d23fff235082dfd43c4b1ce4e522caecf6ad9aa9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321965, "uuid": "51855d8b-2bb5-45a8-a204-0ee6cd80609f", "value": "T1EA51F9A8C7421632FFA7182FFAA1645847C6AC03DB61154D5EFB5CCE01E0A06A67DB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321965, "uuid": "4c978263-62e4-47e9-ba68-b8db807eb1a3", "value": "48:y+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:ykatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321965, "uuid": "d684451a-27ec-4ecc-93d7-8e6f164df754", "value": 2492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321965, "uuid": "b481d947-1377-4777-884f-43a5de977fe6", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321965, "uuid": "a12bebca-f888-4882-b3be-7c84ff9a5841", "value": "164.90.195.107_1777321926101750_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5a813a-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777291626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291626, "uuid": "d8e97ae6-f527-462a-8ccd-a741787cc226", "comment": "Malware payload (Mirai)", "value": "dfa132e2c47a2d6407fc623c1754a19f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291626, "uuid": "8a8f6fe4-61d0-4b8b-ac0f-342bc700d666", "comment": "Malware payload (Mirai)", "value": "c8cc682367354b9004def1f13d29556a4de7e73a5b0760284680953fd6c026df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291626, "uuid": "3f5aa542-78a2-4036-b393-21da8639602d", "comment": "Malware payload (Mirai)", "value": "d31cbdb5f7fe81c2498d5c51ee9688c235b6a60f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291626, "uuid": "546754e4-fa6d-4ee4-8300-7baa2934d8fc", "comment": "Malware payload (Mirai)", "value": "8add6f9ea2a725e75c0424c6f60a3934c681974a7e8c6291bb1896c52f1aa4dd78ac588a3114f0688dfb728e3b3db9f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291626, "uuid": "650a8bfb-1bcb-4357-8208-9faac49f386b", "value": "T1F143012067263C14D81D60BD8834C5F6422973B1D3FB322B0D6F57F919EF4766A2E8A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291626, "uuid": "1aea6c18-969b-4d21-8fdf-172728596099", "value": "1536:w9wcrz7iBnFHp8AO2InG6Yl+gj4+FNGFqLb:+x+nE2t6Yl+c4+FGqLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291626, "uuid": "7d815979-ea71-44d1-90c7-8e487746f98d", "value": 55448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291626, "uuid": "dba3a48c-7e6a-4861-a752-d9a6d9dd520e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291626, "uuid": "5e443ab5-64da-4cee-9cf6-e509cc79e506", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae36de3-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283974, "uuid": "422e0735-57a0-49ae-ba0c-640bf57ff683", "comment": "Malware payload", "value": "b178298d12d30e8414ad7430f2a31bf8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283974, "uuid": "ad95308e-f2a5-4dea-a19f-ef738852665f", "comment": "Malware payload", "value": "c931251ed4681d9e0f2a6a157abd0032649c36dd79d174d9a3c76323182957fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283974, "uuid": "913c04d3-da70-4704-b493-a17df8c12fad", "comment": "Malware payload", "value": "6404cac9b873757244c039ae73361116a1e5d5be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283974, "uuid": "f804b83d-db33-4c2c-adb5-f158dadd350a", "comment": "Malware payload", "value": "03e57f168762584a92774b2f4262366337c5a1ccf7bf49a9bb3e7f6b6f5e74db4bcbc540e89dcf3f25ca41fa1feda155", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283974, "uuid": "5f3ad059-1f4f-467c-b79e-b44db6e331c2", "value": "T1403723109F3B0D6B836CB1A775EB9C4921BC4D790D0206E4B76610AFF1DF852A5CE9B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283974, "uuid": "83b38969-fc66-40d0-824b-47d61e5b81ea", "value": "49152:xktf+Qktf+Mktf+Dktf+sktf+Qktf+Gktf+Uktf+Lktf+lktf+Kktf+tktf+8R0t:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283974, "uuid": "3ba4f47a-d0ec-4a2a-90eb-7107c424e5cd", "value": 22643800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283974, "uuid": "b2999c88-ae35-44bf-bf05-8957bf6f3504", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283974, "uuid": "91114a16-abec-4041-bf92-9bfba7e9ba5d", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914f89a2-4237-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777294185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294185, "uuid": "33a5e719-9dd9-40e7-a246-ff41b84869fd", "comment": "Malware payload (Mirai)", "value": "b58b7facd7a0dc71563ac9979c8ae2dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294185, "uuid": "d2538ec6-f69a-45c8-ac25-2e7aa994a1a2", "comment": "Malware payload (Mirai)", "value": "c935e1729486ce46386c70ebe75cdf132cf956a18a6b11890b7418d86820dd91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294185, "uuid": "fa611b94-93a5-47f1-b9a1-417f4e854d3a", "comment": "Malware payload (Mirai)", "value": "42f151f0412d153d24ab2b5a580a7109d8f99513", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294185, "uuid": "91df575a-674f-4234-b281-1fc8983673ab", "comment": "Malware payload (Mirai)", "value": "a87959c4a6b0ccf10c2a8e1d9eb5e7882c848943699a6c4c6f46d20fb72b8855c627a8c0c34774c5b90920222f0c873d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294185, "uuid": "a9bb13bb-28df-4baf-a9ba-a105d100b9f6", "value": "T15AF2F12F54BE068DDDBF92B80CDFB91E0660F04A18404553FFD990B6D671B2A1927AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294185, "uuid": "d0e2898b-e221-413b-adf1-e4677d35216e", "value": "768:sdsv3NxoVtdM//JHEH2L3AryggBBJxYALm4+K1PYyaQ1SsnbcuyD7UoQRjJ:f3Nx6MBE4FjBbxYWm4+K1sIRnouy8oyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294185, "uuid": "17329f76-7373-4a86-8b1c-9763a83d15c4", "value": 36560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294185, "uuid": "312910e5-d823-48c5-a5cd-28c56b7155aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294185, "uuid": "c2687a16-6755-4d2c-b567-1d5317f9a8f5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c261ab13-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276658, "uuid": "c22c6e7f-6d00-4076-8e95-bfcd4878ee02", "comment": "Malware payload", "value": "737761f82712d4ec611e7bed41950144", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276658, "uuid": "c6b59aad-5b53-44c0-8985-9fd7984a40ef", "comment": "Malware payload", "value": "c9dcb8d9e00f89a6f683c9006587de0fed19eb32fa33f9903461a3206672e796", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276658, "uuid": "b0a13fc9-488d-405a-ab44-c795a120483b", "comment": "Malware payload", "value": "c9b33829a6589984b4fb1d6a1f7194fefbb6cfdb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276658, "uuid": "00692079-5766-4ac4-b68f-cedf3037f2c4", "comment": "Malware payload", "value": "5cbdee53c612fe657eaec19e4e07253efd1f6c9c391c3e94d9266469d290eea66265250500e4ba7583812faf88574043", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276658, "uuid": "df897ff5-bb7d-46f7-bd29-2b736ef550e5", "value": "T1F03723101E778AFAB754232C3EF32F9A63ECAC88582E98577BA13C4EC646F154517319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276658, "uuid": "51063ead-4170-46e4-a8e9-cfe9b25675e9", "value": "49152:6p3pXpnpkpypcp1pPpFpTpVpN+BMgpfpmpKpKpR+BMvp8pQpdp9p4pWpsp9pSpCf:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276658, "uuid": "b5f2f9c3-2f33-41fd-9b96-775b144d563b", "value": 23684334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276658, "uuid": "799c5b80-1eaa-4030-ad4f-2f01a3482d88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276658, "uuid": "96e38255-bc02-473b-bd1e-259b3fb034cd", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5c8f77-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294557, "uuid": "5b94f8c9-9be5-4fcd-989d-ac2cbc088b5e", "comment": "Malware payload", "value": "bd6f46e353b5ebe91a2ef2500a0ceba3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294557, "uuid": "794b3fbe-49f5-4c33-9363-1874845eec0c", "comment": "Malware payload", "value": "cbb5f1c3a9be0703f6ed9098056ef203d862b8b07c9bc3e5e583a76a87551e8d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294557, "uuid": "c08ddc18-3476-4b65-bb23-08dd0b630b52", "comment": "Malware payload", "value": "27ec74b3540082ca3e7e5c40e85be6f8f9950c11", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294557, "uuid": "d88521a9-08b2-4f04-91c9-44191dafd502", "comment": "Malware payload", "value": "febd5ce1645b2b7fec0be18dbefa23fe7ef48597416c40ce9462706f7eaec888033a2c9dfea259095687e4e502b4767c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294557, "uuid": "796c9bfc-9b26-4142-8cf2-ddc3467a37ab", "value": "T1A737234B873AD8BD01B965EC4C7B0F4F73904B09881963DB8BD961B2CF58A0561FA1F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294557, "uuid": "d6a49a4f-4f4f-4f97-92cc-558fd31d21bf", "value": "49152:HyP9+lWyP9+lHyP9+l2yP9+lJyP9+lnyP9+lpyP9+lZyP9+lOyP9+lsyP9+lzyP1:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294557, "uuid": "004b927d-3c95-4c25-b026-c120831b5a8d", "value": 22643782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294557, "uuid": "805aae50-36d5-4aa4-8693-73ca326dea03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294557, "uuid": "99ef6247-1115-4354-89ae-21a70a41d1b4", "value": "invoice-1645080830.pdf (58).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a2a5a2-4257-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777307718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777307718, "uuid": "48544311-374e-4c26-9d7d-60c2772366ed", "comment": "Malware payload (Smoke Loader)", "value": "521c4f26dcd52f06c3c6520a289e1f08", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777307718, "uuid": "8043b7b7-160a-40d0-81d3-e9ee6734e2ba", "comment": "Malware payload (Smoke Loader)", "value": "cbd623c8155afafef79eb8939b94fccabe2dad5237813a10e05d64eca79405ed", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777307718, "uuid": "e1879593-ec2b-4363-8052-85defd5e5d1b", "comment": "Malware payload (Smoke Loader)", "value": "1e38b55379df294c06e26b7229125f065797230e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777307718, "uuid": "e68c7c6a-64e0-4919-8055-708423394143", "comment": "Malware payload (Smoke Loader)", "value": "8181ed99c03a6d2af119399ab8fb902f5a4d9f6bb0a3228b2aa7ac217ccd398008ade6d311f3cc5af3f93ca3b777451f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777307718, "uuid": "68dd8ebc-1eda-4c81-a9f4-7e93c705aa13", "value": "T1F2F53306A3F44A6CF077273C09B19841723BBE514BBA96CF1BE5006F4997AC1A1B1F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777307718, "uuid": "129b4a17-d127-41df-a335-c6519a4caca9", "value": "98304:LpOyO1r6+2onHKy5a5q2Nhk7G7tEYLcbMoV2VVI:Fg9bsNhn7tEkcbMG2XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777307718, "uuid": "84033dcc-eb66-4501-8414-cae4afa70d44", "value": 3448320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777307718, "uuid": "8e6cc07d-b333-4293-ba1b-824d77235528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777307718, "uuid": "9b0fb18f-5705-4b8f-bed8-804860fe2f8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51750660-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285488, "uuid": "0dca6d4b-713d-4403-b1df-a8fe12e9f309", "comment": "Malware payload", "value": "8426807e74a719a962c5aeec7411b6cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285488, "uuid": "3e19f11a-bd6a-4c4f-88dd-6eebf21cc8dc", "comment": "Malware payload", "value": "cbd7c5fd6fe44ff1a5ab597c7cb438aba8093ed89586556c67603a84843f41e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285488, "uuid": "2ed61239-35b9-4601-b144-45703ee88692", "comment": "Malware payload", "value": "9b870fa492692bf1af39127dee8ca5d43b118983", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285488, "uuid": "aea15f7d-9f24-4dfb-827c-eb74ed62b7d0", "comment": "Malware payload", "value": "22efdc2985fff6b4975351757a8f54a060d472021c99acffe31356f478e98ddae9b1eb7e60357aed052799b336a3180d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285488, "uuid": "9866e3f3-6b34-4c25-9f0e-675f2db6b3b5", "value": "T140372313DE1ACDBA07FC025D5575A60FAFF48E01802266D5866218C5FB8FD6831AB6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285488, "uuid": "144917fd-9c1d-465f-b378-6bed234aee0d", "value": "49152:dKtKiKkKVK/KVKoKLKyKeKNKzkkD3oKxKMKOK2K8kkD31KdKtKTKqK4KMKmK5KgT:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285488, "uuid": "5f4884d1-978b-491f-91fa-b5f5bb0f4022", "value": 23944458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285488, "uuid": "6b2e52ef-2ede-4059-a342-362cb2310c5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285488, "uuid": "7f0be03f-ba60-4bc6-9992-c407bcaea7ca", "value": "invoice-1645080830.pdf (64).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa34712a-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323137, "uuid": "afa40ea9-5a11-48ff-b21d-e6d89d496fd9", "comment": "Malware payload (Mirai)", "value": "70e47eb638ee76eb6c2fcd0f024b7c9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323137, "uuid": "1908a1c2-85de-45d7-b9c3-2dd9266f5571", "comment": "Malware payload (Mirai)", "value": "cbf937163f6607c1d582b86dd237a811fd2cc655e4d6dd31a60631ffff4f013e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323137, "uuid": "a57b94b7-358d-4bbe-a360-0a9ee37e06a4", "comment": "Malware payload (Mirai)", "value": "4240904189fc5e52ea90e0ff6b4acaa94f3b0895", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323137, "uuid": "910d9107-44fa-4faf-ad4a-93be83a42f17", "comment": "Malware payload (Mirai)", "value": "7b1d79ca1368893a6ac7c4b4cac95ca9194821f529c5a8add950c1b8474b49f1a0df2a920cc8b3af70aa4d5cd98e6bb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323137, "uuid": "2d28c589-62ee-44d8-9b59-3da86f405059", "value": "T180B3E84E6F319F7DFBA8C23447B39A21975823D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323137, "uuid": "ecc25a90-c89f-474e-8fc3-54e30cb9294c", "value": "1536:GEkWi8LiZECcpHOWWJDmmn5Pd1Oe4MPrs9j4ZWn+E7+TeVedVPneQBZN0xS0C:U4i50poFtP49j4+7+Te0dVPZ0xS0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323137, "uuid": "0cc0b823-f925-4a2c-92f0-20260e779458", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323137, "uuid": "5f9fabc2-a69e-4b99-8460-d007a9868326", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323137, "uuid": "67e3e076-f537-4841-9cec-1e9b7fff566b", "value": "vaxstresser.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f7865b-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277031, "uuid": "b68b83ca-3bcf-4d34-b790-b87cc64987fa", "comment": "Malware payload", "value": "d41caa16a0ad2f992d9dec8a1006468d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277031, "uuid": "c5faaae2-8381-456c-852a-08d54600a9da", "comment": "Malware payload", "value": "cc04536f52004bca80a6caa72aa115ba3a70aa5d96db4a16ca0225335cf08163", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277031, "uuid": "14e449eb-fa5f-49e8-82ca-3b978f4250a1", "comment": "Malware payload", "value": "dea157b26b9251f9f672b7440bd26300129e999c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277031, "uuid": "7316064d-b087-4ad6-aecd-e30899668b1c", "comment": "Malware payload", "value": "40316fe220a2e286f4254aa6fbebaa1700bccd80298271e98b1c3e9eafa827fe6d180646253baa742faf520708c0efdd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277031, "uuid": "06630b1b-8f7d-42db-bbe8-7445f225de4c", "value": "T1183723040B37AF6E459511EE189F0C298EA64C428E52F4EAD73635DBA1FEF411837B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277031, "uuid": "542dc58e-9173-49a9-826b-57aab7a6dc20", "value": "49152:eeAKheAKTeAKHeAKkeAKOeAK4eAKweAKzeAKdeAKyeAK5eAKEFEeAKueAK6eAKne:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277031, "uuid": "a10e1977-5ce8-4162-ae5d-195085c3527a", "value": 22903953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277031, "uuid": "e58b000a-d2ea-46ae-9007-1653d778ed0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277031, "uuid": "2deb12ce-05e7-4da4-8ef5-8f48b7ab807f", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4fc25b-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279517, "uuid": "303eb78b-3f44-4732-8121-6da1f57753bb", "comment": "Malware payload", "value": "ab376b1fe323098c9b500137f6c584ba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279517, "uuid": "a4a2a96c-8dce-4b44-9f1e-0754b2b85e18", "comment": "Malware payload", "value": "ce546834be69dec37f1573c33004d475a599f9df9e0b3fe73fed8acebbc16925", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279517, "uuid": "46a72d36-a493-40df-9a0e-6a416cfd640d", "comment": "Malware payload", "value": "31c869664e5130da9bdb34324dc4aaca639bb6c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279517, "uuid": "995c3840-acc2-4254-9c00-6cfcbda2f929", "comment": "Malware payload", "value": "5c637aebeeb9cfba247ac0a377424915ff71fef4e5443fdd8101e28c64904604a775e7463cb36ea574035420c390b047", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279517, "uuid": "6193612e-c723-4b86-808e-9a48dae5c680", "value": "T163372327809A97D418A110EC58EE0F6EBFF65E20408E8EF8D75B78DA398DF5414153EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279517, "uuid": "e6f3029b-407a-4eae-98f0-2e93bafc816d", "value": "49152:RJnbZdJnbZhJnbZ5JnbZKJnbZmJnbZMJnbZJJnbZwJnbZnJnbZfJnbZuJnbZeGJa:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279517, "uuid": "15e2123f-dd12-450d-997d-bf1752bf2a20", "value": 23424206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279517, "uuid": "b9c43d1d-3611-472d-8f56-2c4cdb59fdc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279517, "uuid": "af12c034-8eee-444d-9876-12ef12689130", "value": "invoice-1645080830.pdf (63).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d52789-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283957, "uuid": "1b0612a3-711b-495f-a35a-292514830a95", "comment": "Malware payload", "value": "43e95329aa6d0feba5bc69167ebf7b97", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283957, "uuid": "7b3c118d-7540-4b06-bbbc-068f3b64eb2f", "comment": "Malware payload", "value": "ce7c51ed6182a9fed9a5c256d0bf0968ceb7961eb718b1635d62bf1bd6c91a47", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283957, "uuid": "cf5044f0-12e4-4034-ad84-361c3106e423", "comment": "Malware payload", "value": "550dc0b16ad66645ba3ec1c21390d7bdede90240", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283957, "uuid": "011d9fe6-1533-45be-b42f-c1f9ad36605d", "comment": "Malware payload", "value": "65af6b68aa61807054a479a3c2bfd7d563f9fe1aa3e2cd8ccb4a45862df1dce13528568e42f68144ecf52462bd1f5ae7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283957, "uuid": "d6f7bf3d-eb33-4b6f-91f4-241cf522a358", "value": "T11D37234E2F6E9EB1D9A807B0943B99CF8F189F94C860FD1293F76490663E718C95358C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283957, "uuid": "083e2667-41a4-458a-b005-6377dab9ed6a", "value": "49152:c9w9u9F9S9s9W9N9J9r9L9/9Fr90919t9N9t09d9S9m9a9v9n9f9U9f9x9T9E9hV:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283957, "uuid": "5a3b0840-7510-416a-8b7a-3ebb3fab220c", "value": 23424199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283957, "uuid": "9991d938-d0e2-40e2-95ac-620dfb1d6e73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283957, "uuid": "2868bd65-6186-440c-b6b4-c41024d277fe", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a67cdad-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321956, "uuid": "f507d493-6b31-4047-867d-b1862c8c8e78", "comment": "Malware payload", "value": "3fbb7b590a90d624ffab65ffaffe0263", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321956, "uuid": "530ca77b-5edf-4a44-9313-52f83194a392", "comment": "Malware payload", "value": "ceb309f347cc5e593375ef96c7fb49bcc8156bbd5eaacd6c2935efce7dcdbf95", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321956, "uuid": "07d9994d-e557-4651-8527-3366fc414379", "comment": "Malware payload", "value": "4040830c7528695911ef4a4204639afe8ed48b31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321956, "uuid": "904e71b9-23f5-480d-a0fb-44027afa3c20", "comment": "Malware payload", "value": "d704ffee748e17b79ef97873ae05c4d24485b3a74ee1f5461f5acb765420097622b494bb0e0173b96c50639c77991f50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321956, "uuid": "d02ccd55-b6f8-453f-b9a6-6d2641463e3e", "value": "T110B01259B05CBC3A87DB7BC5DA74B4A21157C50F42594CD7035551EC85E0A0830F6013", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321956, "uuid": "0fd21e2e-188c-4a6c-a6b5-4f26c969a57c", "value": "3:gdQTtQ8wVRrCyLMTDNkxLNBkMxhJH0fJH6tM:gdhRZW1gf/jUfJH6tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321956, "uuid": "0fd388fa-e9f1-4e70-9d1a-593c1727e5ce", "value": 111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321956, "uuid": "9554b2ab-83d1-4d97-9313-6224be633dbf", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321956, "uuid": "f6684090-26a1-4792-ac41-bbfb2047d46e", "value": "164.90.195.107_1777321923908923_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587a0469-423d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777296667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296667, "uuid": "92e22456-773e-422f-a1b6-755c97b2b3b5", "comment": "Malware payload (Mirai)", "value": "d3e4b9a44582a3a0818673cc112f28f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296667, "uuid": "b0d56637-9719-4a83-a7f9-845411a5d2d3", "comment": "Malware payload (Mirai)", "value": "cf086e93dd2fada3a194e88792e77d38d61ba87c505e51e7876df368c76d5f5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296667, "uuid": "93efbd5f-994c-47f4-999c-d306e6b8c066", "comment": "Malware payload (Mirai)", "value": "41cfa21fc76b1a8bbf3ce26cfe33e9420bacf1bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296667, "uuid": "53b120ea-a1b2-4514-81f5-a53307c46078", "comment": "Malware payload (Mirai)", "value": "59c61fe36b87defdf8bf398e68c665a961396df5c794b37387950beb70719586af357d1661f81bb335cdefd79eeb4a47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296667, "uuid": "5d7b028e-9734-4043-8c71-aacfe1fd62ca", "value": "T10AE32806731C0A07D1A32EB4363F6BE093EFEAC121E4F641255F9A8A9171E335589EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296667, "uuid": "042415b2-00e6-4d67-8b16-069f99a8b66b", "value": "1536:IrrJ/ZBBtfck85N4uZxKreoqrS5HRvAsh7Kj6p9lFcAqCV6YacIT5Acex:Sr7tkB5NXxPSIsN7pMAcex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777296667, "uuid": "11036b9d-e6ad-4adc-b72f-e4c755a97a73", "value": 146104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777296667, "uuid": "86af76d5-e07b-4d61-b047-955d9ff24259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296667, "uuid": "ac2808b1-6f22-4938-a606-89284cd57abd", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9f38ed-4290-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777332293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332293, "uuid": "7b660948-f853-43d8-8e0d-bf96930ed8f2", "comment": "Malware payload (Mirai)", "value": "5d30e030c9fafe031a8d562b0eb564fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332293, "uuid": "a7042c53-dc59-4b88-b87f-8aa4fee14f50", "comment": "Malware payload (Mirai)", "value": "cfb7f5027200cf033d67958c6cf1654723e91980928ab31e462bd8f8b08b9d32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332293, "uuid": "d8534454-e449-4a64-a142-fb433f023239", "comment": "Malware payload (Mirai)", "value": "0a1a14238ab143d4ffc613400f3819ce706382ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332293, "uuid": "63a9ef0a-53e9-404d-9391-b4af10630b65", "comment": "Malware payload (Mirai)", "value": "f89dd5af2dde531ddac149182da00012a0e79256676e4df62e57004be802e06ea4dbd0ea8ee09329d06edd69f66f6f87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332293, "uuid": "5b933398-8f65-44cb-8a11-bc5939715fa8", "value": "T199E2E1B1B661EC31DB32E935BDB806C7A8E30FB9F0F2352454182D6881D661E2DF22D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332293, "uuid": "ed40499a-02b6-4cf3-bdff-8149357d63e4", "value": "768:c4kK5EiG1pWnX4IZjvnmwsuJL2MxpVRss3Uoz3:c4t5ENH1I1FZJLLphz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777332293, "uuid": "7568e9a6-e808-496f-8c60-313976a9c054", "value": 33008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777332293, "uuid": "d9ddf9da-5ae4-4762-88d1-cc147ad0cc31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332293, "uuid": "548d0982-2290-4932-8561-851208af38b8", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7580d0a0-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294568, "uuid": "ac22cdd9-4f80-4e7b-9081-6be8cd36ce2a", "comment": "Malware payload", "value": "bf0ed209b20c47a16a261b4bc4672599", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294568, "uuid": "c11fe25a-bb27-4975-8274-c3b462ac8b28", "comment": "Malware payload", "value": "d036917b36bc67b5f2775ce9207fcf6d2f3b509963c6ee9d08488c75f8cbe5be", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294568, "uuid": "943f5082-57b1-4e02-9dc1-c2a0dde70da3", "comment": "Malware payload", "value": "cfb9c3197b54f3625975d3773695638a448845c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294568, "uuid": "ed923d58-138f-43e0-88de-ae82bbb9e1e6", "comment": "Malware payload", "value": "a98f567e34c1d23174195a348031609b07a8783ede04be9147c668b4de94dbe93403ae35ee75cbacc379413111cc8433", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294568, "uuid": "1d5f7bd8-70b0-4085-ae38-0bc626df71cb", "value": "T1203723069E2FAD9F8CDD2044609B5B9E5BE00F0204C4769F9BAE1C975E4FF1C9A87274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294568, "uuid": "5dfb9303-9cae-482c-9065-19a7aeb9f72f", "value": "49152:xhLwhLahLghLvhLnhLlhLKhLrhLGhLIhLVhLNC+KhLShLrhL5hLJhLvC+DhLZhLx:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294568, "uuid": "5053172f-85e0-4d2f-850f-08149823b077", "value": 22903960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294568, "uuid": "90c44a11-ff93-485e-9f0b-e550972a3e01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294568, "uuid": "122d51fb-9253-47dd-a71a-2a29c8237279", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b649d4c-41d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777253668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253668, "uuid": "73062e43-cb41-4436-a300-6333e395d041", "comment": "Malware payload (Mirai)", "value": "4c4442a44449b27b10aa07f92e93343a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253668, "uuid": "cf3e7004-da37-41dd-9996-a842b54fe3dc", "comment": "Malware payload (Mirai)", "value": "d0aa34b8e35bf884edbe5e92cb733e38c0f9c9c7e2d77a9d979bc24e5c751b94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253668, "uuid": "8705a232-1d57-41c5-8b68-85b6902769cb", "comment": "Malware payload (Mirai)", "value": "842f0d979168d7c89e33bf2a2c89aa689477fc7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253668, "uuid": "679413f6-81f2-4de3-8d8f-e5c3e4ab1069", "comment": "Malware payload (Mirai)", "value": "0bcd26c669dd0383efa865b1dff006cf50c2393424d099d791919fdafffe5549317002f395e8009395c62587816b6bf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253668, "uuid": "ab1fdeba-655a-4d09-8fea-573085d06aec", "value": "T155E44B56F880DF62C5D12976F65F82A8731347B4C3EB720689199B383BD782F4B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253668, "uuid": "b918802a-e013-4456-b688-ed1bf1f46e65", "value": "12288:UBpSwwlgqBnyuh3hfhYABXzEQ0XxRMn4Z2qzM6gpketW0lji2q4yqp:Tnyuh3JhY4rORG4/zKIMjiH4yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777253668, "uuid": "1a4e9334-d98e-4d82-8acc-2c3e826a7885", "value": 681184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777253668, "uuid": "72182ef6-9551-4510-9b34-8115c9abf439", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253668, "uuid": "2e5f9c92-5898-40a3-8fe1-73414eb35b35", "value": "SecuriteInfo.com.ELF.Mirai-BTE.29542214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b6ca66-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321972, "uuid": "9bed6656-4c76-47c2-842d-4d319cfaceed", "comment": "Malware payload", "value": "592e5ad7128c2d99d6c9ab81d5f7777e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321972, "uuid": "0bf92079-80b3-45da-a50b-86e678f55079", "comment": "Malware payload", "value": "d1581a037ff6e213c64b20e81ddb84c44bd4ae3c2f36bcb94239c6bcae84201c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321972, "uuid": "fd3b1a17-d100-4d4e-bd2e-564932cd5287", "comment": "Malware payload", "value": "6c535469e79c3226bc3638d00601ff22bb56b235", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321972, "uuid": "a30e0914-0ca7-4434-9fd6-3f07a5d44f3e", "comment": "Malware payload", "value": "2d86539bed985b2788105d86fa7662d1b06210c4c49deeaf1d2938d91935e992842284db7c096c87d6cafd27355d27d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321972, "uuid": "9e8b9d85-5a36-4cf5-869d-77343e6c983f", "value": "T15E51FAA8C7421532FF67182FFAA1685847C6AC03EB51154D5EFF5CCE01E0A06A67DB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321972, "uuid": "656f2d72-e3ac-4fa5-ac61-373f57b9744b", "value": "48:1+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:1katIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321972, "uuid": "26deae90-5e31-4528-8bb8-b3c190f20437", "value": 2501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321972, "uuid": "29aada2e-a408-4c73-bd3d-53ab56140a7c", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321972, "uuid": "10079745-aa6b-4e72-b907-0cdb8347e11e", "value": "164.90.195.107_1777321927924959_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87371237-4242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777298892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777298892, "uuid": "435c965a-8e27-431f-9d42-2e500a7c19b7", "comment": "Malware payload", "value": "e16774abe801617b9668301327c93cb3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777298892, "uuid": "4f8708f6-f205-4582-9a17-8855f264bc7f", "comment": "Malware payload", "value": "d1d89530dafec1f0318f1d0e5c6a5397876728b1475d8e1f2d8e7e60f99972cb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777298892, "uuid": "142d7666-3112-4900-a859-76ade6634eaa", "comment": "Malware payload", "value": "fc281f3bd3e9fe354e630f494963691a8d25cb7d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777298892, "uuid": "a657b61d-2cd9-4756-a9fb-028772bd794e", "comment": "Malware payload", "value": "560e9b83283da4a9db2176d5e247b60378062e7dd9e6c5fe332da861352f029ef1ec78fcca893c0bab7c433737ceff90", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777298892, "uuid": "5ad78e92-836c-4d9b-8f92-8d2c62a56318", "value": "T1DA16332725C877B9D3778532ACA61DB0B6F4CCA5D6BCA1BA3334183741B7EA8017606D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777298892, "uuid": "df22b19b-aa63-40a7-9580-b2a967bd01ff", "value": "98304:qIDrDyfgkd551y7O++G1hjZ19MgLGPOmmZOr7gTKr6jO0fbWmU:q+yfXdbY7O++GGEbbG7gu0TWmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777298892, "uuid": "81c1ae08-f01b-421c-ba61-a6af0146da1b", "value": 4130050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777298892, "uuid": "25da3cde-0ad9-40b6-b65c-7709b84cf02e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777298892, "uuid": "d0200323-20bd-4af6-90c0-56e5a1445291", "value": "0Sld7JS3VIMGKI-7240840D9HLPNZVssxbdm.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4930e4-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279090, "uuid": "6aa288e3-3881-47a5-9a5a-31dbe5895476", "comment": "Malware payload", "value": "4efd81f6a18c9d2baf15ec0c382f04fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279090, "uuid": "ae800137-9084-490b-8f20-8f947e7f0bc7", "comment": "Malware payload", "value": "d1e67ec42e0fb1747ce89436ff6726bc8bd768c259606d7294bc5a28e92cf254", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279090, "uuid": "122b5fc1-6506-4644-8d94-42c767eebbb3", "comment": "Malware payload", "value": "f241c38c964d7ff8fd6e1a89a5e5ae3dabdf1b48", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279090, "uuid": "26f95407-89f1-4a59-a8d6-0e0d2590ce4f", "comment": "Malware payload", "value": "bc8c9195dfd20703d8ba0f70210b62b6d2a9c827597028a6cb64a8d2631e3988ba02e48b8ebbedc8b31acd9e74faea30", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279090, "uuid": "2c73c126-979c-4ca2-95fc-d6b78056c61b", "value": "T12B3723E42F068A28062A05DDB4BF8F276A91D58CC95DF1FA53D13D7FC35E168200EAD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279090, "uuid": "37fdd8ca-67ff-4a50-a0a1-1d1ee9e4bbf1", "value": "49152:xtjt2tctMt9trtft9tetFtvtHJetitUtDtvt0JFtNtrtct0tQtFt1tNtatutktAj:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279090, "uuid": "c9dc5837-81bc-44a7-8c30-eb038627d480", "value": 23944459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279090, "uuid": "66b35efe-e4c8-4e13-ac2c-6ae27be93aa6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279090, "uuid": "63df0730-32c1-45e2-8111-a3702c8e1664", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468ae2a0-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279457, "uuid": "661b3597-4261-4706-8e1e-dafb28bf3ed0", "comment": "Malware payload", "value": "8440b49d1af1da4d823b6c25bf075871", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279457, "uuid": "a16704da-d7fa-4210-a39b-70fae71efcd8", "comment": "Malware payload", "value": "d2de16b604bded66041bb44088510897da22c658f10ae149b0ef4fdc56c9068c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279457, "uuid": "9706a828-e964-494d-9f3d-c2bad323c520", "comment": "Malware payload", "value": "285284ace9e283c4a08d0e76e281a598bde81dc0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279457, "uuid": "f51626e5-c83e-4c6d-8df0-39393177b81a", "comment": "Malware payload", "value": "d4ee98280043d77d985e40e2cd779e4520651da11f1a7886f7946bf8d59771f829acfcd9547c2ba14ec8a66c39479a86", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279457, "uuid": "abf95175-cd81-409b-a90c-9395c80edb80", "value": "T18D2723267F17EA2D130822BCAB770919458A9BD04080AEDFF7E5629C4C1FF17494F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279457, "uuid": "66efc1b8-7ca0-417c-b877-50214e092a59", "value": "49152:4+Ng+N5+NQ+NR+NV+N3+Nt+NJ+N6+NT+Nn+NRxYs+Ne+N8+Nj+NH+NTxYz+N1+Nd:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279457, "uuid": "a325b39c-14c9-4306-b121-7fd3e9a2aeb3", "value": 21343156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279457, "uuid": "8fc44ae7-199f-4a7b-b5f1-c09319bf84b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279457, "uuid": "0b566647-8291-4497-9003-3132e39e2737", "value": "invoice-1645080830.pdf (54).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1c72b0-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271463, "uuid": "b725ff5b-a018-4fd1-9b86-b953de0dc48e", "comment": "Malware payload", "value": "8bd5e681f4bdba4f8ec005fef744b8d5", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271463, "uuid": "9a19356f-5901-4b89-81c2-9ca6faca3d83", "comment": "Malware payload", "value": "d333df867eb8d72c860439324f9f0033dfe0ca4ccf7b6e313511056be9a42ae8", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271463, "uuid": "885dc78e-723c-46e6-954a-b97c83fac519", "comment": "Malware payload", "value": "b63c0f41ecbff6a2b7fe881c262e6ffeb9bb4150", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271463, "uuid": "065506ca-f981-4a4c-a279-2be0fc504b31", "comment": "Malware payload", "value": "05be09232a11412842e3a575e9bbd8fe1684479adab217003547e5bf1243bf16dbb23984e5ecf122715aaa1de922839b", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271463, "uuid": "f2191fac-51cb-4492-b82e-015b8f356aa7", "value": "T1A73723228F1C3E1F869C1329314F2DD508688B49DE567DF4AFE396C1D21D6A2688F2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271463, "uuid": "732d542c-e228-41f5-955e-5f66466646bd", "value": "49152:4bobzb9bCbebobzblb/bdbzbz6h8bmbpbFbZbB6hRbGb6bcbxbSbWbZb4bNbQbAZ:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271463, "uuid": "de82a64b-1d49-4ec5-bbc6-06b09637e63d", "value": 22643800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271463, "uuid": "87e033da-8606-4cbc-b77c-24576ccd45e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271463, "uuid": "6ee4356d-1327-46d0-937e-e98eb0141e18", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cbd79d-41fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777268792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268792, "uuid": "58d8c1bf-093f-481e-8462-fd90ebf3a470", "comment": "Malware payload", "value": "b49a88cac04f6eb57cc47268a7300532", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268792, "uuid": "822f591c-6fde-42e1-b8ef-7a04751a7ff8", "comment": "Malware payload", "value": "d33cf159a7f1960cc476b5d68f53698819218c110cd9215a22eee41f089c7c3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268792, "uuid": "b67d977b-82d7-4485-af30-aa32ba6cb454", "comment": "Malware payload", "value": "d2afa3705436e54d015dd834253064368ec7f74a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268792, "uuid": "062c47e4-c13b-4d70-87e6-06cb68d03645", "comment": "Malware payload", "value": "0d3ebf68e53cdebbd6a2b737bb5ce66e15a4b125ff963db9e026a27082969438d1e4ec4b8dff6bea6373c5152aa35a31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268792, "uuid": "bac0b957-905f-4d2b-be81-de23519f038e", "value": "T158B65C06BCC42BBAC46C4A7484FAC95122B05E104AF1467A6565FFEDBCB72797F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268792, "uuid": "a846e223-25f4-4486-b6bb-857202493514", "value": "98304:nhbGCDCXMQEFgGcR5rt3/emgL11TZcIGCX4Zcx+:xGC6MpSGwrNGmkzJX4Zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777268792, "uuid": "cdfc9eb1-d261-4103-b46f-9f40da3fd514", "value": 10900221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777268792, "uuid": "c7dd0c25-28a9-4fdb-82a1-3c13b0f05514", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268792, "uuid": "7ac565a2-6135-4ee3-acf7-7ecf18d1cf88", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521ba152-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279046, "uuid": "af5b5a39-d978-4c61-bbfe-bd89d4b1f716", "comment": "Malware payload", "value": "93b78033350285e6dbc40a6146f1a57f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279046, "uuid": "704cb6a3-44cc-44ed-a721-230cf32e6030", "comment": "Malware payload", "value": "d3af2a5dbf32dc4259764567a13cedb89b3618ee837203c8efa799b57d3af2ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279046, "uuid": "6bdbfd2c-13b4-4ca6-b37b-3b8ecf8bff2e", "comment": "Malware payload", "value": "e3e7c76db4afa812672bd6271d23db7e4a8af7ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279046, "uuid": "ea1d361e-b4f5-4c1e-bb8f-7530c9e39b58", "comment": "Malware payload", "value": "6976ce41a8280b12952e57f5e52ee9173851dfba6fb161609b12aefa1d29086e684cb26f75cbf8bdccac92ed37d7452b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279046, "uuid": "bd017000-00ad-4dea-88ba-4b04db00c05c", "value": "T18437230D0A97EF3E8ABCA67D419F4B9E4461CC440529759AE2F42C97170FF08BAEF059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279046, "uuid": "c6fb09af-4df1-4a46-b4de-f013a94b5f15", "value": "24576:IR1JEYOrR1JEYONR1JEYORR1JEYOQR1JEYO4R1JEYOWR1JEYODR1JEYOOR1JEYOM:U9LyhmhS3f2tHE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279046, "uuid": "843ec80d-3165-4bae-947b-349c6c0e05cf", "value": 23164064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279046, "uuid": "b990983b-a026-43b8-8a6a-710ad22358c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279046, "uuid": "50e7eee7-2b80-413a-9267-d44cbccc4d15", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a16d81-4252-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777305580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305580, "uuid": "180e535a-b93c-4caf-94ae-fb73d95e5a20", "comment": "Malware payload (NanoCore)", "value": "d44461c2e87dd97219d0e9a746e72be9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305580, "uuid": "3314b125-85e0-4747-bb86-bb49f279f230", "comment": "Malware payload (NanoCore)", "value": "d3d317ac08701a460899c96845ab9327a897dcfccad944ce9f93a297d3d7bd47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305580, "uuid": "1835f5a4-d57f-4877-b912-83736695dc61", "comment": "Malware payload (NanoCore)", "value": "8a157a2a048814609e364f022fd8f546f5ee6576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305580, "uuid": "30dfec51-df22-46f3-92f1-3665c1f604c0", "comment": "Malware payload (NanoCore)", "value": "ccc773c2f562dc8864b9c5ac24eb942b5a0beaacde4226446fbd7194f04b5edc9c0236056c4025f733a0345743f18fa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305580, "uuid": "214ec58a-1a5e-47e5-99e8-4ef256b05c24", "value": "T15664BE5537A4B51ED28D467563116172437889E2ACC3F3DA28C872FB7A7EAE106370D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305580, "uuid": "945253d3-bebb-48aa-aa05-870aa5977ba0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305580, "uuid": "bd541233-5d4b-4195-8ced-97639aa203f2", "value": "6144:WLV6Bta6dtJmakIM54xgqnkGcxb/W/5H8B:WLV6BtpmkUqnkGUM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777305580, "uuid": "3b890141-6eff-4e0a-8111-573201a878e5", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777305580, "uuid": "1ec688f5-6431-44a3-a603-c3155acb1dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305580, "uuid": "b8460128-68c1-4a08-8400-8ec95bba6367", "value": "1.1.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236ce5d6-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276391, "uuid": "6608b386-8366-4605-9e57-ea590443fd46", "comment": "Malware payload", "value": "aacf96fbefdd889877455719910d2646", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276391, "uuid": "461904bc-de81-438b-bfd6-12b00d270334", "comment": "Malware payload", "value": "d483470a2a39c40e53f9ba063b558bc34c0797f43f2383fbe4e670f6e9b2a8e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276391, "uuid": "45a88021-4693-4e0d-a2d0-34ca5679dfc6", "comment": "Malware payload", "value": "7e984da9be75bdc973300cb558d3576f639ebd4a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276391, "uuid": "f91c22c4-9b4b-45d0-8c00-1cccbd643b68", "comment": "Malware payload", "value": "5c224bab2ad8593b8e7751c68dd2246599ca3ce041b2fa48e4098f4f40f84f69314c11fa24425c7d70af04aea112eb36", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276391, "uuid": "1363c0f5-28b4-40e7-97fc-b45927f88f3d", "value": "T1D63723569D2E9E6F45B9331E00BD17591DB50DEC4AA102A9F3B3FC0E782FF8128069E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276391, "uuid": "72b9ce44-93f4-4505-adb7-5b3c2c46d2ae", "value": "49152:+DrPUDrPuDrPwDrPQDrPVDrPzDrPvDrPEDrPSDrPlDrPeDrPqVpBpC3TzDrPlDrO:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276391, "uuid": "416174f7-c768-448b-9221-1232a5d9f612", "value": 23164072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276391, "uuid": "1ce8b6d3-b7c5-48c2-8d54-358c724e5afe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276391, "uuid": "22b88054-c3a6-43a1-b88e-78bb6893888b", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8d86c6-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276672, "uuid": "4ff8f41d-7aa4-4f1f-9805-da7b1d90cfca", "comment": "Malware payload", "value": "921631b04d5912bef5bdc8db2c3a7614", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276672, "uuid": "352fc060-8b3b-4f6e-895a-a6b977cbc458", "comment": "Malware payload", "value": "d4c8ee4c3d4f20e313f9fb78d09f4a5d61a9e6eb8bd5915ef3b03dda67ea4e03", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276672, "uuid": "6ccdbe56-01f9-4e15-91d3-b296ded48f52", "comment": "Malware payload", "value": "6aeda0190c18de5bd1229e2e7c6879a5cbde0129", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276672, "uuid": "b8d5b8e9-1bdd-4cc1-b31c-536cc00e1b1c", "comment": "Malware payload", "value": "a8628050b2cbbe4d347ed14b3e229a50fb6a90826dbedbb5e482b424473ed137586c8a455b759ae1c324f3e2d4cbca2b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276672, "uuid": "d5c259e0-8a5a-4419-a133-8fdfa681502a", "value": "T1243723639DB6CD6BC514536180FF0D3B9ADD0D51A01FD2BA69F8B847AB8C7AB409310B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276672, "uuid": "dc7e726b-4ba8-4c84-946c-a14b01e9451f", "value": "49152:foEosoPoRoooqopowo5oboOoI2D0JsYoZohoSoWoc2D0JsJoUodoToRoao6o6oaZ:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276672, "uuid": "6fe273fa-4d70-4073-af14-599c2e4ba46f", "value": 23944456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276672, "uuid": "03f750f5-99fa-4454-90d4-9d648669ccfc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276672, "uuid": "59f4f286-3285-4adf-9300-1e7f1b60e5f3", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f75e267-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276895, "uuid": "b7e42ef2-13b7-498d-abd7-eddd3d8fe2bc", "comment": "Malware payload", "value": "e9be97df6025c4a6daf170fd68b68b3a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276895, "uuid": "706648eb-506a-4b64-9d8b-174872b37bc7", "comment": "Malware payload", "value": "d5a89778f17b59fb299b1d4d95f84e6a98fdcb57bfba187720851eacef69ee71", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276895, "uuid": "fa4e2295-857d-4e60-b215-95a530b0d17a", "comment": "Malware payload", "value": "e4d09b08dca82ee9e9d85b93d7fd31bc750b7c9f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276895, "uuid": "e4a5ea75-ff86-4e66-8ec1-7a352d2fe41b", "comment": "Malware payload", "value": "f81e2711d430184aa74ff4a38f10016ef89d9143ea25237dc95c0ee789cc50ec4c50561b266595a4cd6b46b58a5e1eb4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276895, "uuid": "22080ee1-2c7d-4d6f-afc7-04f1d7610f52", "value": "T1E53723230F668A2A819C317D34464B964FE0CE82D0627B7AF7F5AC51EECED331229755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276895, "uuid": "904eae19-9890-420e-b90c-1497c3db0b5e", "value": "49152:CXZUNlT0eumEbjOnPsOWsjOYH0F8Af68ziSXRnjO2jO4m2tjODei047TKauYC1lU:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276895, "uuid": "9c493864-9bf6-4417-9710-b965fd339c08", "value": 22383669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276895, "uuid": "bcce091f-2028-4e65-a3f7-b7c377147f4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276895, "uuid": "41922cd9-c755-4b1c-bb7a-737b8938e6a7", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c3d6bc-4213-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278888, "uuid": "fe35a9d8-d441-4ab2-a781-d6174a4c26be", "comment": "Malware payload", "value": "ac9f7c43804a8db7afc6a1e5a55c2f24", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278888, "uuid": "5b25accd-3741-4c9b-b5c0-5c9a78adeb94", "comment": "Malware payload", "value": "d634b614ede78e9098a3c87356684539975e371a3a7929f6426f68441e49f306", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278888, "uuid": "3a219f37-9fc0-4cfe-8eac-15404548bc38", "comment": "Malware payload", "value": "55746f5bfafb1c1eecd68fae6d9dcd1cbb347004", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278888, "uuid": "6879ab92-3063-48a3-9257-bda318010ca9", "comment": "Malware payload", "value": "88f3ace039212686101994929a569f27beeab131f0d9c9762660bf76891fa0c88ee66fbbe61619be35b41bb695503286", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278888, "uuid": "b18df9d0-985d-4667-a2b0-d6deaf2d6107", "value": "T1A93723406E0F4FAF85F8CF9DB2BA3F2704C25995815078939EB12C3A79AFD25512E325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278888, "uuid": "539799d5-4561-4b16-a2d4-12ff1a19403c", "value": "49152:T1ZI1Zl1Zc1ZU1ZH1ZV1ZJ1Zr1Z21Zv1ZF1ZxUd1Z91Za1Z61Z+1ZmU41Zg1ZZ1S:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278888, "uuid": "c32d9e9d-79f6-4200-913e-9c9ebb2f5322", "value": 23684335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278888, "uuid": "8127bd90-201f-4dc6-ab8c-692f2cad0329", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278888, "uuid": "0731f1fd-c87d-44fa-ad0a-1fcf64579582", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd25d5d1-426c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777317049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317049, "uuid": "f9cefaf6-1535-4ace-b945-e57b107a477c", "comment": "Malware payload (Mirai)", "value": "cae7c40e3e0656ac2c348eb4265f129a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317049, "uuid": "5f15b641-4248-4e9d-b667-f6b87bc3640e", "comment": "Malware payload (Mirai)", "value": "d6873afa581f21e431907e6cdd05bd90fd90915d8370afb098b108a03b9d9dcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317049, "uuid": "509c6030-c362-4660-b791-86da2f048d1a", "comment": "Malware payload (Mirai)", "value": "85a473320cefb8645fa465e3f53965838fb1e8cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777317049, "uuid": "96e98892-be4c-4e23-ac03-db83d9c0eabc", "comment": "Malware payload (Mirai)", "value": "978fee69318548c83036afb9fdc5399736aa5343b7b4da88daf4ba861cd410e96f94d0ce4c6cefb7d0ad51029f12af40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777317049, "uuid": "194418b7-85e2-4f5d-b3fd-0429fbe424fd", "value": "T17D83E60AEF500EFBC86FDE3745A90B4634CC554722B93B3A3674C928F65A64B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777317049, "uuid": "096feb23-baba-4be6-b5f5-a586e723b684", "value": "1536:zbhEtALygZM92JgsZi99gl5lGsIB+yPQgcMxSL2AP+cxidS:PXy79siTpoiuPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777317049, "uuid": "16c2ce82-fdf6-4a24-ade9-9732b0b2ec58", "value": 81192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777317049, "uuid": "98270ab9-3794-46ff-b1ef-8ae0f44575c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777317049, "uuid": "9e118370-4250-464b-a57d-d648763d3253", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2444e0c-4202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777271450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271450, "uuid": "0dc01d51-351b-4902-968f-e7fc5d4b320f", "comment": "Malware payload", "value": "9ce4de63ff4c8d5e444b5822b12a68cf", "object_relation": "md5", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271450, "uuid": "8c782af9-f8f6-4b5a-bf23-8c1630288f4c", "comment": "Malware payload", "value": "d75d839aee53a5afeaf7fdd8db7f8e2b828042c9ca058cd280f8a509e0776b46", "object_relation": "sha256", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271450, "uuid": "01a98845-b5a4-46f8-bbf4-37b8aba3bae4", "comment": "Malware payload", "value": "f8402908da2fce4d72fcb3579402983ba0b26782", "object_relation": "sha1", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777271450, "uuid": "6460621b-d793-4e78-821c-22eb63503ca3", "comment": "Malware payload", "value": "3aa8f122ab8709355f3418ac8c52e0f7f7584fff0306e1df5010eda502b6284ceba849bc1e6b400b33cd486a342b2ca5", "object_relation": "sha3-384", "Tag": [ { "name": "accounts-bookings-vercel-app", "colour": "#9EF429", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271450, "uuid": "2864d4a2-326f-4eb3-bd4c-a40ff5d45d0a", "value": "T189033D538C985E43A878C7A9BF470F6D6B497D4EA4827AFF302E0D927F312605C0D16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271450, "uuid": "3f3e52f2-2b0d-4401-9948-d1b92c4d067a", "value": "384:+nx241osPjFLjhdlCxJPxncS45sJflFbfhfhfhfhfTZZZZZZZZ651i5J:6x24lpdCxJZnjWsh3bfhfhfhfhfm5AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777271450, "uuid": "e85da752-27ba-416c-b030-4e7c32ed10cb", "value": 40420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777271450, "uuid": "f8250b89-7ecd-4997-a708-d26ef957c7ec", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777271450, "uuid": "c7e47656-172b-4e33-963c-606df983576a", "value": "invoice-1645080830.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e559907-4292-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777333184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333184, "uuid": "b367f17c-f40a-4cab-9331-c90b098ce1ff", "comment": "Malware payload (Mirai)", "value": "5b53107d3c84d0c3ab4d34a4c0053293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333184, "uuid": "260e4cd9-1fca-49a3-8cf5-c17042e66dae", "comment": "Malware payload (Mirai)", "value": "d776297a6aedaf1a27ebb330d6de43529f2fdb1f0ab834890d40db7ab513b2e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333184, "uuid": "cb6bda0a-8fd7-467f-b85e-9f875e9065ca", "comment": "Malware payload (Mirai)", "value": "c1c6f3420435406d7c84cfbcdac5aca067fb4e7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333184, "uuid": "a22c3092-d722-45e3-9895-2107b04aebd0", "comment": "Malware payload (Mirai)", "value": "9f64e337eda29a8c43f0c2f8b89a2490d903c35a027971275002c643553bfea06d50858a420a10c8402366adc38a8b39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333184, "uuid": "a64ed04b-ac16-4014-9d98-e289bfd668e1", "value": "T17773295AE9819B11C5C115BAFE1E528D7313077CE3EE7226AE24AF24378796B0E3B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333184, "uuid": "68555e34-8110-40de-ae9a-1d887a8340a9", "value": "1536:isnYE+ajzSINoVFjIgi9MY0ekw/NsG1gt7pUln5qY1cdZ:7+af3aY0ekw/NsKgt+lnwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777333184, "uuid": "80b54892-29ce-424f-a1e1-f5789b871f16", "value": 75156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777333184, "uuid": "bf87e9f3-fe09-4b43-8232-3fea9ef5b6cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333184, "uuid": "f796141f-1700-42b0-9150-c0f051e76830", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c936b698-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279246, "uuid": "c0ffaa18-8eda-40d9-8e68-d4e7aef6b69d", "comment": "Malware payload", "value": "3aefd8c09602c22d1fa5ca099163b3ae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279246, "uuid": "3eefd8f3-e936-4238-9ed1-a6a144c6d677", "comment": "Malware payload", "value": "d78c58b07588c47c9bb879d62c3296344355a232666a32ed39ec689c51c4f5c0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279246, "uuid": "8dc192a6-0a37-4332-b5f0-f8538d67e531", "comment": "Malware payload", "value": "922f98ffead5735c47eba4e2532da28058bc1ebc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279246, "uuid": "1429b6e0-6e90-4972-a898-ca15490cbb51", "comment": "Malware payload", "value": "554d173f1d4c9cf0c3579d537bc5d62eb2e1d34a7c146d16dba8951647dcca2d79ecb861b6b3566da83e98693957661f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279246, "uuid": "703beae2-88ae-4deb-8fcd-a3feac0db75a", "value": "T13B372322CF2E18E8419636CC583B165B1EF78909226EF6B563C43AD2F5C8F1B71D64D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279246, "uuid": "b4e9858e-813f-4a62-bd61-45e94279f1a8", "value": "49152:SXMhlMXMhlMXMhloXMhlTXMhlbXMhl5XMhlOXMhl3XMhl6XMhl4XMhlhXMhl8QMD:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279246, "uuid": "d3685fc9-7848-4a60-a270-edd841a19549", "value": 23424210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279246, "uuid": "20692dda-0f50-431a-a761-37bf2a518d22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279246, "uuid": "38241deb-9880-4b89-80b0-c9ce612e64d2", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7154abc6-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279099, "uuid": "81660165-859c-4690-8321-3a85d5e6f5a7", "comment": "Malware payload", "value": "690ef6c6b20e63e413164e2c07cb4e33", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279099, "uuid": "243f2da5-9071-4ac7-915a-bacdf9d0705c", "comment": "Malware payload", "value": "d7a8cbc234dcc2dbfebef34f2b6a8caad510b89507afcb244e03bbc25f20eb13", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279099, "uuid": "c6af2c8f-64df-4abc-89aa-39e4c24ea636", "comment": "Malware payload", "value": "57a8f6db308a8ca5056c806cf17663adbe024b6c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279099, "uuid": "d27ea449-c2a7-47aa-be11-89162bade5ab", "comment": "Malware payload", "value": "24a6f8993b397e94da41cce2facb0661eadecbeb327925316ab9ef02bed4ec78e297e96df2bfdd7d6c0528e4807e2954", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279099, "uuid": "2a8a0a46-a4d5-4a3c-852f-f574da89428b", "value": "T1443723B28E1B6B6F2778122A04FEAB0F35FD0544805674EDA3D0958B3A97DB32457378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279099, "uuid": "6fbbb312-96bf-4dc3-ae8b-79707dd16342", "value": "49152:Y9OK9Oj9Oj9O19Os9OS9Ot9Oq9O19On9OA9OUYVs9OD9Oh9OM9OE9OOYVh9OM9Os:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279099, "uuid": "40b08462-830d-4a5e-ad4e-d0a2e43650e3", "value": 22643805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279099, "uuid": "82e8c8a4-4a79-4cf8-be1f-605da2128a5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279099, "uuid": "d82af494-f70f-42a0-8456-d3d44db8b669", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c718ae-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321868, "uuid": "b250c950-b1d5-430c-b38b-749bffa90f6c", "comment": "Malware payload", "value": "59f81678cf82e616b5b6354c7a94938c", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321868, "uuid": "7afeedca-74f4-44e4-b6c8-d31491cab25b", "comment": "Malware payload", "value": "d878efb998d32b46c865b9aba96ef078bb26d6ae0c8ec712221235aa51c2e703", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321868, "uuid": "062a9410-db07-4a39-86e5-fbde962b09d6", "comment": "Malware payload", "value": "8ba6cbf0bcf7e45f0a9135b97342c4158203f0e0", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321868, "uuid": "e20d8644-6471-4ace-ad16-6e2d7326b127", "comment": "Malware payload", "value": "0ea867ffb85c6c84c8a6bd6ad878d849586de4d086a0bd6f946c25f16a7b62022ded15f1e39fc65bc06cb8b0ccade976", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321868, "uuid": "191d0b15-8734-4732-be84-a1079ce79d3c", "value": "T16163C3067C1285E405707013F7BD2D219AFF69407272423D9B095BAFBAB4ED99C8DCAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321868, "uuid": "8990dc37-b9b6-45c9-90a9-3a3cd3055953", "value": "384:CJJy1Vpy3y45Zug6++mRN48jbeLxBgldBumhzmwZbuoliQk+R2EhoEOIlqk+8Q3t:8Dame3pGXy73zAgogoyG088SMG6vrWsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321868, "uuid": "7730ccc8-4e08-4d8f-ac2a-a97c0e73ce5a", "value": 68281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321868, "uuid": "d1e40751-5468-4128-941d-1aa145bf3eb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321868, "uuid": "c181bce4-9cae-46e5-ab75-c3ff135fe926", "value": "license.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2c3e42-41d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777250284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250284, "uuid": "2228d53b-5630-4d98-b381-265e4c75ea68", "comment": "Malware payload (Mirai)", "value": "edb61884f6732402a8bcd78e4eae2549", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250284, "uuid": "03a199f9-49e9-4862-84f7-234936ae3d3e", "comment": "Malware payload (Mirai)", "value": "d8798a77840313c4e109c82a719f36b428bd4d9fe6e3dae9b651af658b4c673e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250284, "uuid": "be4f47bb-9608-4cda-a213-ab68a6d15d0b", "comment": "Malware payload (Mirai)", "value": "a0aceee3718991ad85a49470c1d9854c036d42a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250284, "uuid": "803f616f-e549-4ffd-b810-747ac95857b2", "comment": "Malware payload (Mirai)", "value": "7c1e39d96edc9be38a7481578b94cb2ca83b6d7a2da1f7bcbb264147d0ae3cae1f1e7f251554642ef5c798cd369610c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250284, "uuid": "8ade5b4c-00e5-4a76-86bf-7f66f909d77a", "value": "T128158D89E7C7D4E1F55300F50A8FC7B60534A2265043F6F6EB8CAA767472B522B1722E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250284, "uuid": "23926e83-515c-4c62-9efd-a028cfdc74e9", "value": "24576:G/C8PpOghl0h4wKPZtE9hUwcuGbd45oFJMErd14sAmq6NXKyXkJSJ:GnpPhl0hyR8zcuowELTXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250284, "uuid": "50dc20d2-5453-4c0d-82aa-b01c60b478e9", "value": 941356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250284, "uuid": "17b5d96b-2c82-40fa-b290-538359a0fb46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250284, "uuid": "b78bb2d3-821a-4995-9c92-91e461f7d64b", "value": "SecuriteInfo.com.Heur.4319.9248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3af7f0-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280489, "uuid": "a4986c11-98de-4af4-8172-1583e51aa227", "comment": "Malware payload", "value": "e43a4b7d8c2a6f75366c98295e099aec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280489, "uuid": "8ae75eb2-31f9-4e60-86bf-7a50195e6074", "comment": "Malware payload", "value": "d8ca5b68c74d4b57a4f0eaa9f47ae47ebbfcfad1af9065e31de5c8d7454b31ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280489, "uuid": "3bc70992-0605-4144-bf6e-ce312ddf309d", "comment": "Malware payload", "value": "1b9267501c90161bd64b03b6e53d645eda5ac9d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280489, "uuid": "5605cb93-f645-45e1-a789-8bdd6acca541", "comment": "Malware payload", "value": "14702e16bf8625338c0bd2f9750534ed58f60c4539ecaa1ddbe7545624bafdac4c5b9fc17009c39723c25e225f111608", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280489, "uuid": "69f6c8b6-772a-449f-a0d2-480b4854f938", "value": "T1C037230A8E1C184F47F8AA1841BB0FCFE7B58AB840396EC68FE776D51747D22606759C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280489, "uuid": "891d35f7-086c-475b-9501-b816b2e4482f", "value": "49152:zfoH+PfoH+SfoH+3foH+dfoH+afoH+0foH+jfoH+BfoH+hfoH+VfoH+rfoH+pDsn:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280489, "uuid": "a732673d-201c-4c7d-9f6b-b862869c3237", "value": 23164080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280489, "uuid": "0933c31b-228c-4aeb-87db-29e296a701d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280489, "uuid": "aee6c0ce-85d2-464c-88e1-bcfa00cabc21", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13056a19-427b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777323179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323179, "uuid": "8c5719e9-5164-415c-8441-7bc4c88b11fa", "comment": "Malware payload", "value": "73ce2438d4ed475e03727b7b000d2794", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323179, "uuid": "44eecea8-9214-4a39-9ecd-d3a89ae78804", "comment": "Malware payload", "value": "d9487fdc097f770e5661f9e5dee130068cb179d33716abff1a21c8cb901f25a6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323179, "uuid": "954956fc-4590-42f6-8ce0-7243a1f79f70", "comment": "Malware payload", "value": "3d5ee8429ef00824c0351cba507dfeb92b54f83b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323179, "uuid": "f4f3a0cc-f8a5-4855-8e33-ed26c9b49673", "comment": "Malware payload", "value": "96e8a31369f415f1056f13fd4a402a90a6cbaf5ef1518dcc12ac526209cb902ae62b28397dd45758494b8da2f49b44d8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323179, "uuid": "212942e8-0c35-40f2-bd50-e73f5b47084c", "value": "T137D25C46B600A332C5871F324A5BEBD95F799C04DF57210236CBB39D2E76AD026B79D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323179, "uuid": "cf2a7426-78f5-4044-82be-f157ec2fd553", "value": "768:Sm/WjwJC1oRRXWxV/jpRJeWMbC9qZN/nq:k1oRRXWnpbob6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323179, "uuid": "0ea7b038-cd10-4719-9455-8bc1e8c80449", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323179, "uuid": "ad2cdd76-de7d-4cda-b6ea-16b80d2e64a2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323179, "uuid": "416fe316-d24c-4061-aa3d-551512f07412", "value": "RAMMap.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7bba5e-4215-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279552, "uuid": "888ffcd5-de5d-4fa4-9df1-d37c0bd2b78e", "comment": "Malware payload", "value": "f4a99baef642136e9d436ca4bec1ecf0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279552, "uuid": "c319c2ad-3979-4d22-a64c-6786fcd6b2db", "comment": "Malware payload", "value": "d94d1c2484c0fe674c1218b0f49cc45f37dc94409230548e63ca275e2dfe00b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279552, "uuid": "1c194051-1fcf-4d61-afd5-bc2154a8326e", "comment": "Malware payload", "value": "cc8ce1c326c451802d595defb1e971578f55420c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279552, "uuid": "bbb3897e-70d6-490f-b0b5-8eee533553f7", "comment": "Malware payload", "value": "cd56912d51701a36f8043068ff4b86b05063fb6f75168caf6736d474dfd2e19f39741a07f2a0028a7b48abc9998b9cbf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279552, "uuid": "e1f17c67-1e67-47ba-8277-52d4148b71f2", "value": "T19F37232287FD5B9EAD7412FE70BE0B8A06B89F095504FAD9F2D7482F436FB58005B065", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279552, "uuid": "7a963c61-43aa-4252-9f74-816d2ca26b3b", "value": "49152:B9JtH9Jth9Jtg9JtJ9Jt99Jtj9JtO9Jt29JtS9JtA9Jt89JtaUdnW9JtH9JtY9JT:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279552, "uuid": "c88c9d05-6056-470e-8401-e0677af0fccf", "value": 23684327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279552, "uuid": "be1d2881-c6e0-4a94-b9a3-d45668b6fdcb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279552, "uuid": "daad1846-4ded-48ec-bac4-7cc36dd5167a", "value": "invoice-1645080830.pdf (61).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96c1190-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279273, "uuid": "901a6f87-abf2-4a7e-b914-d31b9d265285", "comment": "Malware payload", "value": "6c1a6b36b5262bce335a8f224b2093c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279273, "uuid": "696a910d-78cd-4b81-bc19-55100d0b2490", "comment": "Malware payload", "value": "d956471ff0c451df8c8dd890edfeb480702334164ed995b6512d58d9f0ab5720", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279273, "uuid": "49ef9500-189a-4e0d-a43e-fbfd8efc06bc", "comment": "Malware payload", "value": "fbff69047da2cb7299312798afa8a646f6d2c367", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279273, "uuid": "90744df3-64f4-457b-be4e-3d78c6c35bb7", "comment": "Malware payload", "value": "3581dc82af6d6c9dd024dc6cad0f368c3120c3b52a9a19c2e9db88bd0c629923bd851d00aebfa93ce7b4f984f922df26", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279273, "uuid": "1d8e6c0f-4d89-4942-8ed4-bb22885d0ea9", "value": "T11737230B5BBF1CB196FC24A86432640981F44E60A857F7A85B9AF133DB7C72309757B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279273, "uuid": "0db425ae-7fb1-4a17-a976-9150e9e3a637", "value": "49152:BuJ2S3quJ2S3euJ2S3IuJ2S3KuJ2S33uJ2S3duJ2S3luJ2S3AuJ2S3uuJ2S3nuJg:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279273, "uuid": "0caf3cc5-8476-4b7c-b929-ce4a6cec7b17", "value": 22643821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279273, "uuid": "14b402a5-5f4e-41c2-9c50-6a2704ef601d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279273, "uuid": "7630f959-33c2-48e8-912d-a118114d1c51", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a4d249-4251-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777305518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305518, "uuid": "15b6767f-f54c-4ae2-a1c8-d5b76bddea28", "comment": "Malware payload (NanoCore)", "value": "5035fbb3e041526025051c4de12c190c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305518, "uuid": "430ecaff-65ed-4ab3-859e-e0dc59d657a3", "comment": "Malware payload (NanoCore)", "value": "d994e7f8a554bd4a991f36e5d1659fff8e27f9a544a3d6d421261878f451b599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305518, "uuid": "5430e862-f8f5-4699-a78d-819d55cd0472", "comment": "Malware payload (NanoCore)", "value": "b30a5b62ae12710e571157117e340caebb10f5e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777305518, "uuid": "b10b27ce-1d02-4ba5-bc41-e8f6160880f9", "comment": "Malware payload (NanoCore)", "value": "928b5c826728332322697fdbb015793655c0f35f2da3dc7857327fad4c2fd55893d0558a7b4508a967a1402f3f397260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305518, "uuid": "4b5fc061-5ede-4bdb-9245-86f08d2656c1", "value": "T19D14CF5537A88A2EE2DF86BD712206129778C2E3ADC3F3DA18D455B78F227E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305518, "uuid": "90d9b94b-f255-4442-aa6c-d558e456da21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305518, "uuid": "b44c73d3-0646-46d4-9789-9ad04a9547a4", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIuFYxWJpgYWvuGNhgZXT4fZjEC:sLV6Bta6dtJmakIM5GxlYONGZXM2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777305518, "uuid": "d43f75e0-3ba9-4409-9969-bfdca0339985", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777305518, "uuid": "3d52f9f7-6002-4d58-a09e-72cb5fa14630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777305518, "uuid": "1b23f6f5-28df-475d-bfa9-32cab73dc2d4", "value": "venratnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c98bd5-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276236, "uuid": "347d5826-fae8-4b4f-9349-26380a94be2f", "comment": "Malware payload", "value": "454c7fe1d15b3bd6b4cc94b88c584099", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276236, "uuid": "a243b358-57dc-4581-9e81-b57e09a36c84", "comment": "Malware payload", "value": "d9db39286ebf026ad6067a4fe6d5fb9843a2b85a08e6d8f518a0ca4765eabba3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276236, "uuid": "5213d9af-b746-416a-8e16-ce21df769e1f", "comment": "Malware payload", "value": "d4387c83b08cc11ae9d4e609c414b095d8c88514", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276236, "uuid": "75327466-9688-437f-a780-2c74d34d8ad5", "comment": "Malware payload", "value": "3ba918e069da50322b6c76ad050db34d494f6663262a21abe53bfc7784fc5f98e0cefa8821b767045549e63a695a699a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276236, "uuid": "966b71a3-d46f-4cc2-8a33-e49d826443c5", "value": "T18D272345562D553C4BF404E830BD6F8F2AA39E468052A8BBD7D0B8DF832FC5E3897825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276236, "uuid": "c780f2c2-a756-4127-b9f1-22e0a85da576", "value": "49152:D1Q1C1B1Q1E1q1R141T1r1a1QuEcEM1D1e1G121PuEcET1Q1211131a1o191i1dt:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276236, "uuid": "689cbf08-8071-466e-8972-8f1b17661fc1", "value": 22123569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276236, "uuid": "e0acd5a7-76ef-480a-9199-bbba85245d62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276236, "uuid": "1e49a698-a6fe-4d8c-9d48-e380e51df04d", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8378db-4270-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777318630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777318630, "uuid": "4c99fd0a-482b-44f9-8dbd-96c649a4c023", "comment": "Malware payload (Smoke Loader)", "value": "c4ad1a9174023fc92597cad09d32cdc1", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777318630, "uuid": "c50e0a0b-f658-45ec-bbb6-4988ff8bc8f4", "comment": "Malware payload (Smoke Loader)", "value": "d9dd1702cf4396cb65dd321582dc644c44f4d4258d770abd5c8577d25b6ff34e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777318630, "uuid": "378de83c-837c-4e00-9b02-0d85715ff29e", "comment": "Malware payload (Smoke Loader)", "value": "f0536e54db62c2f675db5a48793e96390e77096f", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777318630, "uuid": "35c41c0d-110a-4b0b-8c6b-4f5593406178", "comment": "Malware payload (Smoke Loader)", "value": "eed2b6fba08febac9ad166c0f079bf606ee972f239b2896f80dc8688ea358326131a05ce929df68bd21950f253fb8ef8", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777318630, "uuid": "5a7c5135-6d68-454c-931e-bcfbc123fb22", "value": "T1BFA5594678D004EDC09D7A3248F276867B34BC480B3263D72E95AA783EB7BD11D7671A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777318630, "uuid": "97b95ef1-9d2a-4601-9741-f4a2e8b76c8d", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777318630, "uuid": "a7085caa-c99e-4c28-a094-a115043866cb", "value": "49152:eRCdIniV6+jg11orNPc1/yoc6qsX1UduQ9o3cU:eR4nM7orNk11T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777318630, "uuid": "4f05371e-d21d-4fad-bb77-eca68f8ce0d6", "value": 2190040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777318630, "uuid": "f3044e5a-3147-4994-9618-53d7d8c8be27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777318630, "uuid": "075a2010-add9-4eb7-aad0-c0b15f70e3ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8464cc01-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1777264957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264957, "uuid": "7398301b-707f-4dd6-a6ee-df918d390acc", "comment": "Malware payload (QuasarRAT)", "value": "7a1bb754b7296d7c7c209b7e947a8c2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264957, "uuid": "d57710f9-615f-47ca-ab12-8ce6a00a0e13", "comment": "Malware payload (QuasarRAT)", "value": "da231f0ce2a812ce1ccffcd84d660d2b19ad106673dea3929364566ebeb65746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264957, "uuid": "7a76c295-3600-4a70-9bd2-d8f61551eb7d", "comment": "Malware payload (QuasarRAT)", "value": "0f12c802cab4f987dd76f03c201b183146601bff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264957, "uuid": "1a7e03a0-d72a-4251-9c5f-ace21e3b90eb", "comment": "Malware payload (QuasarRAT)", "value": "1177572a761e18e9ed162ba218a007768660e8354825708c24e3eeba941632bb5912bbe9ddfbd10e700de95d879247ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264957, "uuid": "13be687c-3f14-4b4a-810b-be3b86fc77d4", "value": "T1D8E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264957, "uuid": "c3d23441-4580-4de1-905b-226296de8e11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264957, "uuid": "5909b1aa-b333-4aa1-a10c-f9ad87ec26e5", "value": "49152:zveI22SsaNYfdPBldt698dBcjHKMRJ6ObR3LoGdtTHHB72eh2NT:zvT22SsaNYfdPBldt6+dBcjHKMRJ6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777264957, "uuid": "a7fa7dab-2b1b-4819-b093-0c2a4e419557", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777264957, "uuid": "8ec4da35-8143-4392-85b2-d3a9ae686ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264957, "uuid": "afd8ac9b-ab5f-4a77-a932-783a96fb7ab2", "value": "WebSocketHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb61106a-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323059, "uuid": "22c7c4ff-cffd-487f-b819-30429388190f", "comment": "Malware payload (Mirai)", "value": "6dcf91320d122bc8b2746ccfe6abb352", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323059, "uuid": "ec082135-4bce-45e5-9a98-f6f988d75153", "comment": "Malware payload (Mirai)", "value": "db024124310e064e860f5f7afe0a4f4c3181db0b2eef4468f696891d479cef38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323059, "uuid": "d4a4c4c7-cb4b-4916-9a89-0c0ea7b511b5", "comment": "Malware payload (Mirai)", "value": "5f05c0b5a382ca6c77fabd93a8c58ec3aee2ffe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323059, "uuid": "68bcb4ba-e7fd-4a14-9eb7-b5735d7380f8", "comment": "Malware payload (Mirai)", "value": "c9127a94757f4551912ca01732d2455736e9ecd2407a4b277f370cfc02ae07331add74185f35e4c36db19ae6b9a239fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323059, "uuid": "47f62002-689a-4d7d-9973-c90e4cbff479", "value": "T1AF833947B981D0FEC499D03887BF7537C923B47E1239B29A67D4AE262D09EE01F19742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323059, "uuid": "59b2eccd-f577-401d-88d6-b2c91d308707", "value": "1536:0THF5amJjfczdAyI+1ZUjtEVkCkj6Rv3U8GbdGrAyvTnol:0THJFczdAy7ZUWVkCdRvAbdGrXTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323059, "uuid": "7206e59f-30d8-4d5e-97c6-219360d9e384", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323059, "uuid": "0afdff35-4266-4f38-8cae-3dac968a4ab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323059, "uuid": "b0791323-ff2a-47cf-ada4-2d427a08e62a", "value": "vaxstresser.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29e7e70-41cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777249573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777249573, "uuid": "396db93c-55ad-4138-854b-6905bce67fb9", "comment": "Malware payload (Mirai)", "value": "241859160b0a8f56fad8b14cfac45cb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777249573, "uuid": "b1a615af-8ab1-4ad7-b822-69f28c2876ba", "comment": "Malware payload (Mirai)", "value": "db44de643688716576b4f0d6b6b5bdedda63cf4a96ae307b2ed680ef35d73141", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777249573, "uuid": "3ec1db8f-5de0-4403-b4e5-385ddc272e2c", "comment": "Malware payload (Mirai)", "value": "d52296831208e69ce3627ba093dda25a991c968c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777249573, "uuid": "168a9f9a-662d-4fc6-a61d-238736e6d464", "comment": "Malware payload (Mirai)", "value": "af5f5d71f993dbfba1a3ef2a20c58318a320273acd739b235f7c979c5a6d21f4ae788d5eff5fec3469ac29642e69dfd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777249573, "uuid": "d0f59cfe-5727-4d6f-b918-b750c9e8ceec", "value": "T130144C537B60AF62C229C63148F3C72267F5329217D1D14A622DDB1C3E227896D5BFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777249573, "uuid": "33071ce8-7bea-476e-9089-cf680a4fa5d0", "value": "3072:/vqmVnwN/weD17OOkwHYnrKl32O0IpVjmIIL/d6irRYjF7:X3lo/weJV4nmB29a9iSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777249573, "uuid": "d6166230-2459-49e6-9347-9c782a7c05ea", "value": 196992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777249573, "uuid": "2906a9fd-da85-4233-b1da-7457db23e072", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777249573, "uuid": "f4ce1d9f-5af4-4ce6-af62-3f46a82ef577", "value": "agent_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d704fb9a-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276263, "uuid": "e576eee6-3a0d-47d1-8d09-cec328efc369", "comment": "Malware payload", "value": "d3aeaaa60d3a853aeea8d4617ac7603a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276263, "uuid": "0fc82ab2-21f6-46a4-adf1-a590210b6369", "comment": "Malware payload", "value": "db8db32eecd059cc026d81e5ed460f0d6f412c5e6ab48c16128b062cfcf32039", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276263, "uuid": "ed5b9987-8bd0-443b-924d-84a994256ed4", "comment": "Malware payload", "value": "8ebfc2ecbcc22cbb8615149a2eef4096d07d378c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276263, "uuid": "2db2f2b4-fd8b-4011-92b8-dde0b2b56c87", "comment": "Malware payload", "value": "ed4fc33c1ba18bf38a4f5330b8f29ebbd01256b08fd61ab89343885d7cce857de2fd4eec386dc6e72663467f78e189ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276263, "uuid": "97c3feba-949e-4cc1-8611-49281a0b28db", "value": "T14A3723B86DAD2D67D3FEA9181136112A5FA88049138CB575E46CFCC5814DF0A06FBB3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276263, "uuid": "8402b654-7510-4ef3-ae8f-6f9e1e92e070", "value": "49152:MPmTGb5PmTGbiPmTGb0PmTGb/PmTGbxPmTGbLPmTGbePmTGb/PmTGb2PmTGbwPmK:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276263, "uuid": "c7c5f495-c0d6-4850-aa82-c8151b33e039", "value": 24204599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276263, "uuid": "49b37a4c-b4cd-4d38-ac4e-780fbeb56427", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276263, "uuid": "fd147215-2c97-4987-be00-dbdccbced9f2", "value": "invoice-1645080830.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c0b6e4-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294462, "uuid": "2df8223e-1c69-4e79-b0ca-313006dc9ac6", "comment": "Malware payload", "value": "a2e8d7710bf8029a91ab31ecd47cb2bc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294462, "uuid": "d87a5a1a-583a-48ac-8e62-755c1bdcca8b", "comment": "Malware payload", "value": "dbaebe8c23e2c61c2d06f76e74f4b3addf6b743b809b8ad167704dfa1e880ae2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294462, "uuid": "0f135d55-b303-4156-82d8-7c48f151366c", "comment": "Malware payload", "value": "af01eccac4ea6d2ea090be8b5ee71e2a440f7501", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294462, "uuid": "31900bc7-f568-4976-9d71-907b01d3aade", "comment": "Malware payload", "value": "6a6a585451bdd14065cc00053144ed12fdc78fe026d0a106308025cc7488377fc34b75b1df2bcd50b7aaa60cd127268c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294462, "uuid": "35f9f382-cf7c-4673-b9ca-1148fb235833", "value": "T1E23723425E270869DBB6D2FC20FA9BDDC7344E9AA3947EC1E269488F8ECEF17511015C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294462, "uuid": "00dafda4-a8a6-4be2-b520-d64fde86766f", "value": "49152:rU473ykp+Nz01uwZx1Zpft+eNUhuVff8ukPJBy3y7NC0Dbmqi+6nFh7BVh7hgapP:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294462, "uuid": "b60cdadf-1e4c-45a8-b92d-01aa5227dbf5", "value": 22903954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294462, "uuid": "f3141c98-8d6a-4ce5-a1e4-5d42ffc82760", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294462, "uuid": "1815be86-3d32-47dc-8717-e1e1e5848925", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c11ac04-4294-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777333958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333958, "uuid": "2dee3de7-20a2-4221-b397-270a83241ce8", "comment": "Malware payload (Mirai)", "value": "0ba2c8a2a61a38d9e6e08aa381d4c5d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333958, "uuid": "cd49a5c7-52c4-4e81-ac15-20a4ed967452", "comment": "Malware payload (Mirai)", "value": "dc312cd2b1cddf1320b1759ddc9654f55e1dc7d8dc8e00d2275ddcbcb414b0ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333958, "uuid": "9d343647-d246-4db6-8768-f6036f6e2b29", "comment": "Malware payload (Mirai)", "value": "b327b2655475c4a8a5d1e923c08c1bea2175eb4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333958, "uuid": "32dc07e8-d654-4144-8821-765d6688618d", "comment": "Malware payload (Mirai)", "value": "fb0d145881973a5e831f12f3bc98801402de65d9ac522ef89b4d4a9731aa52065c93f71e53dda37500fe171c883e23ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333958, "uuid": "aa7af876-4bb7-4698-8b96-8127f31550fd", "value": "T1C3F2F10069B5E420C085A33A710F9E7CCFFDE595CE208B1BA95496326FD9833F7219D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333958, "uuid": "5ddcbd50-45e4-4de9-b7c7-cc7dd0237c52", "value": "768:Vw+ZguG6luj5iVK8bNPvPcAfZs0aZ0l9GI+sUQIgj5cvXPUpz2/Kt:V1gK5V3bJPceiIOsUQQXPf/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777333958, "uuid": "cd5db8a5-c682-4f00-a1f9-3ad39439975a", "value": 34752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777333958, "uuid": "7c494ce4-f36b-4253-8d03-76c52b514528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333958, "uuid": "39cbe206-3977-4d69-859d-07de8edc51dd", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7335e16b-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1777264929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264929, "uuid": "d87711f4-9f60-4361-a538-1a6e176c73bb", "comment": "Malware payload (Vjw0rm)", "value": "14dd865108d20efa06c21ac43be8cc3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264929, "uuid": "1721dc2d-cee7-4991-9e09-0e572531983e", "comment": "Malware payload (Vjw0rm)", "value": "dc7926a343bf4a612ebd57924bd5e3a6df997164b090c662855f2f3e6e91c930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264929, "uuid": "535990d2-72ff-4001-8c32-3317bf0d3382", "comment": "Malware payload (Vjw0rm)", "value": "931ee6aceddbe8d247b8b9e64d72fa7a99c3125c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777264929, "uuid": "6e33c5a2-2eca-4921-84fd-184d63ceff40", "comment": "Malware payload (Vjw0rm)", "value": "dec5f8532a20e3d89b44f358067c3602339a551f71f6367a6936b90ece47168760afda49b0e4111dff6f9ab8a13b1772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264929, "uuid": "5da2d604-ef1b-4517-b075-38c70260379d", "value": "T1C555E044D3F415FDE0B7E174D9928A16E7337C491771E68F03AC6AAA5F232908E39B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264929, "uuid": "792da15c-75bb-46d6-8844-caf079fe1b2a", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264929, "uuid": "238c9079-f628-4a22-870b-169de6ab8805", "value": "24576:LRSfrAEH9XIYpj0BErpOtg58+um1Cx8749vYVXAVNrQtRiToEkfZ0HudrxpcDHAs:LgTbH94YxBQW58BmAx8749vYVXAVNrQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777264929, "uuid": "6e47905a-efc4-4845-b560-8fb089287b26", "value": 1317475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777264929, "uuid": "d2289176-23d0-404f-a418-fc8e0950d5ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777264929, "uuid": "81002185-3be3-4e16-bb44-2e3e3f1a52b3", "value": "14dd865108d20efa06c21ac43be8cc3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740f643e-4237-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294136, "uuid": "4ae4ba73-3bf4-4574-ad02-d999134d8226", "comment": "Malware payload", "value": "01819022e9e826e6f8f49888fd5bcbe6", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294136, "uuid": "d9b326a0-9995-4ab1-8350-3d7e855bb2e0", "comment": "Malware payload", "value": "dd5447b76c2ec3db1ea0c2ffa3070edd05d4858940ed3a51a7c5f561f468e71a", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294136, "uuid": "e0a3d164-05dc-442b-b12e-8f2f6c8939f9", "comment": "Malware payload", "value": "5a3764cd6b0cd3580fca83dfa89257eb76035b10", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294136, "uuid": "29fe665a-cbf1-420f-8443-9275bcfefd87", "comment": "Malware payload", "value": "4cc47bc3c66a8cdb32a9412aabd1275a82c7962399d5a74a1c92acb9ad5d73dbce6409b4813a506d972e0a57299a3afa", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294136, "uuid": "637c7686-0b3d-431d-8632-0145690406cb", "value": "T13564299B6E9405F7D65EE13884E3772ED33B783927A6CF8F929A1D111F332984D29210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294136, "uuid": "47cb91eb-ae9a-4653-b349-26c9e69642ed", "value": "0a1ec188b20e2a1aff7d3fb73454f2e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294136, "uuid": "818d948d-4638-4889-af1c-89e748a5731b", "value": "3072:TrPXxo5B2eiiZqSt2qw5i5J5d6A04d6Nl/a6l0I+8wKxWd1YBx2+1cAyjTYmcHBw:Tr/xo5B2eiXO2mJd6/7qI+JjJrAucH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294136, "uuid": "380893d1-b9e7-451c-a83d-f5b3a874cbc2", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294136, "uuid": "5ed3e06d-18b5-4afb-811b-d8fb11bd1c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294136, "uuid": "ac992b40-b615-4afc-a201-7fccdfe4039a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7405162c-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285546, "uuid": "2f17fe0d-036f-42a7-b827-a1ca93633a8b", "comment": "Malware payload", "value": "7dabb03e30d7bdea5ccbfa86cc423a3f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285546, "uuid": "37ff870e-56a1-4522-b234-05f597e771ca", "comment": "Malware payload", "value": "ddf3b9ff35f54362a37ca7914501372fab3fdf0b9496573f9971cfe9497aa7de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285546, "uuid": "38216481-5a63-4328-ad30-89d44b9980c5", "comment": "Malware payload", "value": "442c3bb007f9839d4c1ec3f986eea6a64c3fcdbd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285546, "uuid": "c8d4f88c-fd25-4e89-8037-804f8d7d3be0", "comment": "Malware payload", "value": "b761778df14f4db6b1287151de6721240b5974ee192be916069c547971041ca0e2a6aa2724f978ddfe34ff52e24d9069", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285546, "uuid": "c6a366e0-04d1-48e2-b7ef-80a590c5c970", "value": "T19D37220F0A2A5EB2A6D0CA4B88AE3D6E1E7F0C40553179B711B1D05FA39EB47E3D164D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285546, "uuid": "2f110fc1-46b6-4012-bb67-d220888768ef", "value": "49152:6A1pizgA1pizXA1pizKA1pizKA1pizVA1pizvA1pizZA1pizcA1piz0A1piznA1m:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285546, "uuid": "eba0f322-a2a0-4c84-b94b-b5b468dfa0e8", "value": 23944463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285546, "uuid": "f2aaad3b-39e8-4790-9186-ffdc3b26d4ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285546, "uuid": "30dbef15-ea03-4387-a0c1-34449a6fb4e8", "value": "invoice-1645080830.pdf (65).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fc5e53-422a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777288769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288769, "uuid": "d8b4b889-a74b-4209-98bd-b12cca126a21", "comment": "Malware payload", "value": "b62f39f5aaa67f4e870668e10dc81321", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288769, "uuid": "12257dc6-1e4f-45a2-ac9c-d90d4765e675", "comment": "Malware payload", "value": "de0aea4f98b0b361226d2f0c4e012942a60eb98c0ab63e074591cfcf2199d107", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288769, "uuid": "6dbac248-dc20-4ace-a749-9b75ec79febb", "comment": "Malware payload", "value": "d61f55947db0447fd217edaa63d53cb213da7e24", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777288769, "uuid": "47524576-909c-40b6-8c10-8324d9234806", "comment": "Malware payload", "value": "094c19824160d455df477a8b0232548091832908799baf43efa222bcbaa51435cc20959c190bb5acd95b1c6122188b01", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288769, "uuid": "d9befc3c-21c7-44be-a060-01f09701c2df", "value": "T102D25B5AB544D331C5820B324A5BDBF58F759C188FA23106768BB38C2D776A426B79E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288769, "uuid": "ddd31dbb-00a7-4107-9520-487155b9d730", "value": "384:YwW7eNa3JjdYUiAvTPjE0tpksXJZMey3M5JC0ioXnmFNo4G+OwEfg0uN/nq:nVsiC7E0tpHUeWMbCnC2N/nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777288769, "uuid": "67222e06-5d54-42fe-9cd0-56a64123bd2e", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777288769, "uuid": "ef7be81c-b2d0-4f09-90f6-8066e634e9b7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777288769, "uuid": "72455a54-59a4-460a-b34a-343d6f8a0684", "value": "nssm.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a8df53-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280687, "uuid": "1d151ced-5625-445b-adab-909e6344f44a", "comment": "Malware payload", "value": "3e58ca15fd9174d69f8f42c1769605bb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280687, "uuid": "71c494b2-c324-4711-841e-96bcf445c5f3", "comment": "Malware payload", "value": "deb0fc052d2ec0427fec7b13fe2163e6a0421e96775c0e780afde49d0b5562d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280687, "uuid": "850e6a90-77d7-4138-a1cd-61ae8f0eb880", "comment": "Malware payload", "value": "98ef15e7d2c51d8f6123ab7b45f66204a51a9b6e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280687, "uuid": "9df9cef0-cbbd-4443-88b6-83d4383fe1c4", "comment": "Malware payload", "value": "ecca926d79d6a071f34417b5aa8cb3f7a28f5ca70e06289d58872cfedf9c98f0fa61808ad9f77f5f7a6b242ad1f6be14", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280687, "uuid": "7a23124b-35d5-42a9-be7f-d4ad80f8b6a9", "value": "T17F2723262FD3EB4F06BC706020BF4F9B79D81F6D85088DA423B2959E696F31B46035B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280687, "uuid": "20156d5f-3dd9-45ed-85fd-1a7929be45f1", "value": "49152:kA0ASAbAkAaAMA+AiAtAkAQALVAWAeA3ATAtaA1AtAkAOAqADA8AqAdAYAYABABH:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280687, "uuid": "c00a7a10-5402-4cb3-8da4-d213a2a555de", "value": 21863398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280687, "uuid": "4022c6f7-253b-468a-ba3c-386326c03f68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280687, "uuid": "52fb0da4-6bb2-4248-a398-eec9db60a152", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c51cb1-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280415, "uuid": "c78dad9b-b486-4263-9668-6031d3257d34", "comment": "Malware payload", "value": "41b4a8cb32018176ff489101d5d21066", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280415, "uuid": "9f5554ff-958c-4ffa-be20-f1617dcd3fcc", "comment": "Malware payload", "value": "df6b79c275e2c6dafaa196514c33b4d42309eff7b167ae21ff867194b2360d62", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280415, "uuid": "52eb5456-0610-4c86-9268-b3a558fcfab5", "comment": "Malware payload", "value": "27df86a6fff9ac98d19f412d0ea2ff0fdd33c3ea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280415, "uuid": "30fc4de8-128d-44e3-80d2-a60ba6cffe7a", "comment": "Malware payload", "value": "71f285ca30e18723ee4efb1a0ba9f4fa9ca207540d6aef1d1ee255bbb7e139b418d982ba7f153fe2a8f39f0dcc01710f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280415, "uuid": "c98dc7eb-51c1-4001-a1bf-385f6bc10ca7", "value": "T1723712034E3BDD1F867C27AD15FF08093F9C2CD120126AD63BB675ACA91EE5A5C68718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280415, "uuid": "cba133a2-a16e-426b-8729-6d5291f52ba4", "value": "49152:IjlHjlOjl3jlkjl8jl2jl+jl0jlVjlQjl6jlps/njl2jlijlpjl1jlUs/WjlbjlR:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280415, "uuid": "643af00b-7f0e-4a0b-9816-bde06be7bdb8", "value": 23424208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280415, "uuid": "6116da55-ad9b-4aef-8700-4f588d4712f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280415, "uuid": "cd82504d-4e22-418a-869e-78f1e8d1f0b1", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c601af0-4267-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777314685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777314685, "uuid": "3b064c7b-3359-4b18-b9bd-35494cd48884", "comment": "Malware payload (Smoke Loader)", "value": "670ec9ca8e0fd5d16f53c2cf97d0d6d9", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777314685, "uuid": "359a256f-417a-4bff-8aa9-0256fa0f92ed", "comment": "Malware payload (Smoke Loader)", "value": "df9dcd5d8873661504de9f43c747aeedaa1b67cf3fd7dc265c23800e9ecdee21", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777314685, "uuid": "9b0c5417-d247-48e8-b33d-2aca0a798596", "comment": "Malware payload (Smoke Loader)", "value": "b18f47061447b1b0c3089c1d123e57dde42ff7f4", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777314685, "uuid": "f9a9e04c-3a38-40eb-a5e4-5ed0f2b5261b", "comment": "Malware payload (Smoke Loader)", "value": "5da6a5f839fc5ed88a3b341d9dca6e4cd75c75d55a9229ee8ec91269b2342706f1e407f816ff555e2975106db7a26a97", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777314685, "uuid": "ff5d31fe-4053-4118-81c1-8dc39ead1a87", "value": "T168C533998919E45AC8D723312A35D3B157B48DFEED60C787C4FA2CEF78082F85868917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777314685, "uuid": "53fbe579-f39e-4cb0-82ee-05851fb9369b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777314685, "uuid": "748bce37-8633-4c0a-afcc-0d5d561ac852", "value": "49152:R9YCnrrYfstBOnJ0lAAPW1HZMUk2HmzaIv7OvZT/8A1D9bE1o8raOCQvVoMSbA8:Xlr00tealAAPW1Dk2Hmnv70Z7dKragVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777314685, "uuid": "d0e3337a-d6a6-4bb9-8cfa-cd5a47f10f5d", "value": 2595840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777314685, "uuid": "e9403f77-6767-426d-a688-e6943d34895a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777314685, "uuid": "afc8faa3-8ccc-4ed3-b271-d3c30fb174f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b115cac-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294577, "uuid": "150a1b38-bb5c-40f7-a71b-f54f82991139", "comment": "Malware payload", "value": "e3fd66275175ba9ecfe25a2a7b0b55ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294577, "uuid": "e59ce304-bb6c-4faf-b4a4-9a5f69ddaaa4", "comment": "Malware payload", "value": "e037534a305e4fab86ba4418b73b203479da47bd3a196f8f0b825140d6b49a6a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294577, "uuid": "ec706aa0-7881-4ff9-a04a-decee9e2f4f9", "comment": "Malware payload", "value": "da2f1fb550003ff97830255a41536f099b8344c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294577, "uuid": "2e53ba0a-f0ec-43e3-8483-3884c2a2d739", "comment": "Malware payload", "value": "b4aadb214e436117c7f6b7c5b5b6583004ca255e2e222be951e3b8d15f55eec52a002ce19ff79fe046c785a85c8f441a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294577, "uuid": "9166df15-0cf5-4ba8-b3da-470dd6b94c51", "value": "T1B737230A5E78AD3E83A4177640774CFF45F8BD408B83A48A7FD442875B8E5DA39A342D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294577, "uuid": "2aecb734-b21d-4ec0-a86a-0e62ccab9e83", "value": "49152:MkgOkg0kgmkgukgTkgpkg6kgqkgwkg8kgckgEgNkgukgGkg7kgnkg6gKkgXkg9ky:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294577, "uuid": "d5844349-030e-4a8e-8435-f59195239af3", "value": 23684319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294577, "uuid": "c152899b-b44b-424a-9f66-5a87a5fc6eca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294577, "uuid": "66b94dec-5bd3-42f3-992d-07f34f0eb716", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877cb3b0-41e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777260668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260668, "uuid": "1a901f51-dd55-4b68-892c-4b5eb9b8eed8", "comment": "Malware payload (Formbook)", "value": "a6d8162bbed598222b85e94e54ad21e0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260668, "uuid": "ef704612-508a-42e4-9fc2-3d0ed3766549", "comment": "Malware payload (Formbook)", "value": "e1134e75fde09057073afdda16a17e0ce921beb35c88f543825c07880916d3ec", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260668, "uuid": "7deca2d7-f0eb-4966-b298-a3cf66c82fab", "comment": "Malware payload (Formbook)", "value": "12ec094e7df2f8686706b63715ca40e5fdeaaad3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777260668, "uuid": "674e06ea-62a0-4321-aa42-d443dad2eb15", "comment": "Malware payload (Formbook)", "value": "049ddfaa7bf7c47274974b3db48678b6d5e87cb3072d3e6c6ea1614af477a91f987a9a732a2943ffeb4d8972bc0890cb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777260668, "uuid": "d7f72a79-cec7-492d-890a-2aed0f96ac46", "value": "T183659E737E82CB77C969A32CE07D7E6AF471040415BD0097598B2E4DCB8722B93B4AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777260668, "uuid": "e6a9d4b9-4f62-4bd0-9bae-15e68eb4a667", "value": "24576:0rdmeKS4Wu9mD3OYDkh3xOtY7kYpD6TXfCQ1gq:0hdKbHHOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777260668, "uuid": "479c0359-2320-4230-8210-abf5ca9b21d9", "value": 1461009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777260668, "uuid": "84ed4a29-1554-4e38-9f66-be803501e414", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777260668, "uuid": "478b9127-c7a1-4e29-8c44-38738c495668", "value": "ps_Cirg8HHyMP4v_1773244419846.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16e8f21-41f3-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1777265114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265114, "uuid": "70485cd5-fce3-4a1e-aed2-ba5ac411c590", "comment": "Malware payload (RatonRAT)", "value": "9fced5696e03f45c7e742b8c3b10e04a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265114, "uuid": "c7577c33-1911-4c6b-a943-186a3a4608a4", "comment": "Malware payload (RatonRAT)", "value": "e11e11a539182b79dc653767028a68a30b3e9cd2ff0dcc171f6ff7f0ec72d53d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265114, "uuid": "48b64f2d-98fa-44e7-868f-d808e2218b6f", "comment": "Malware payload (RatonRAT)", "value": "e66f41609850b9dffa7f295e3bd48cb0483fb7d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265114, "uuid": "28c40f17-36e8-4896-9036-34db07fca9b6", "comment": "Malware payload (RatonRAT)", "value": "09478fc636c72f1673f9133acf471f0a665aeb2aacbaba9a65c401759fb7c05d248d7ea13212d59dd7c809303e9a17c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265114, "uuid": "fbe301fb-a4d4-4909-af1c-45d5550d746b", "value": "T1CAD5020C33FACA08F2BF4BF4A87585654771FE179C62D76C59A179AE14B2F04AA10723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265114, "uuid": "57e05ca0-3c2c-43e8-9af2-d5e4fbfa304a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265114, "uuid": "4551a7df-b0f0-419d-a955-16933a50a314", "value": "49152:axgVUlsHjkmiGWU5FLGpMZ7iKPJ5W16sclR0BxMfzaRw42sg:axgVUuHjkDGjzqpgmwQ13uRxfzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265114, "uuid": "95b9b9e9-f11d-4e8e-807e-809cdc015460", "value": 3003904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265114, "uuid": "b3fe598c-e24d-4711-9c03-3110ce7ed263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265114, "uuid": "dec0987c-56b7-4778-bb94-eaa580cd2a17", "value": "nigga.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e8e9ac-4238-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777294518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294518, "uuid": "f167eed1-721c-41ae-95ab-0e380f1cc30d", "comment": "Malware payload", "value": "b54bee35d2b7b953dbe4df846c70b37c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294518, "uuid": "9cacc068-187f-4d1c-9dd1-1e3911c62268", "comment": "Malware payload", "value": "e1c5f542664ca0cf06444ba662c019cb014ab4b8fb6c75ae51ab1aaac9b953b0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294518, "uuid": "3d52aea2-79ad-4ec3-a859-5eff1a2cfbde", "comment": "Malware payload", "value": "fc6247811c477216258992c7a670ecd4b71814ae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777294518, "uuid": "cf8c118b-ae51-493a-a911-c6a11a1efe41", "comment": "Malware payload", "value": "a95be870f28522bddc5ca44478ade29df1f447ef05d4b57b21557b50f21783f13fd2051eb7e63538e4207f9747b47b79", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294518, "uuid": "3c68b885-4d2f-43e6-bf6a-59ccf21add1b", "value": "T1E8372345DC38CCF72AFA63EC35DE084E21855BD0CD9DAE6A6769188E9D6DE30038B15C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294518, "uuid": "b637c34d-3fc4-4c62-bc2c-c1d08b17bf45", "value": "49152:+8hAs8hA68hAF8hAW8hAs8hAC8hAG8hA+8hA78hAI8hAU8hALV8hAE8hAR8hA98w:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777294518, "uuid": "876c21d8-714a-4f46-9f79-029bfa59f62d", "value": 23164065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777294518, "uuid": "b2d7b4a9-4241-404e-9f25-ef79af929b90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777294518, "uuid": "9f51bcbe-b91d-4f33-89fb-1e4cc1971c61", "value": "invoice-1645080830.pdf (60).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d7336f-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276848, "uuid": "9b6db5e2-7c07-4182-8e98-724909fde8c9", "comment": "Malware payload", "value": "3b69a7c5ae2c8a40872013133b6ac733", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276848, "uuid": "10639716-9e8b-4175-979d-f622732d7448", "comment": "Malware payload", "value": "e25ab836096cfd5043cbd616d4444a36df36c5b259c004ab002fb160f4636225", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276848, "uuid": "7b00e1ec-67a6-4b9a-81fe-58dc05a8f848", "comment": "Malware payload", "value": "6c7997c38f99985762cdf3274f54b1e91ed0893e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276848, "uuid": "2ef0f30c-80b6-49c2-aee4-e21be971e34c", "comment": "Malware payload", "value": "2a9fc67ad8d7859a315f1d9ab9e9ad1911393d35086cee6ab84b2729a32c3ab3f63d64df6b2600615ccac43385047751", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276848, "uuid": "9bb5a4fc-2725-47dd-889f-d01fa1cda3c0", "value": "T1A43723C2BDBBFE16885934DE0D6E0B9B4650EE07D406D7E39AF9280CB6D914524CBD8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276848, "uuid": "c122b7ae-ed19-487b-b6de-d209cdced5a2", "value": "49152:o03zZ03zZ03zQ03zS03zJ03zb03zP03zv03zy03z103zh03zVe03zc03z/03zl0Z:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276848, "uuid": "8d89a41c-bf2d-4a79-80bb-71055292b078", "value": 23164071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276848, "uuid": "041952e4-cb31-43fb-a0cc-65136c66f0a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276848, "uuid": "03857c26-904f-4f1b-a9cd-d68b772daa0e", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccb32b2-4243-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777299358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777299358, "uuid": "cd2733cf-701d-45aa-83b5-76065678fbf7", "comment": "Malware payload", "value": "82c34879ae053479d309d708d1147096", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777299358, "uuid": "7277f68f-3a8a-4371-b795-dd830249ec16", "comment": "Malware payload", "value": "e374b8336651320fc54763299c3dc909edd65ff1659c8e675a0a71afbc4ffdd3", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777299358, "uuid": "b6744265-c9c6-4c1c-bd06-e181347da1e9", "comment": "Malware payload", "value": "6783dc0f56173ceaeff06a3bea6dc455f5fd9a17", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777299358, "uuid": "c9efffac-7703-4973-b82b-6a205b639c67", "comment": "Malware payload", "value": "1caf934c41df1e30348dcd5bac16c851064d869b8451d0a18f11be2a789c5a2c0c0c521c3364a3fd857337f3f30302df", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777299358, "uuid": "c1ca1a9a-a6c0-4e3a-a98c-0e57036c160e", "value": "T14315E01033E8B816E2BE8BB95BA1A07406357C569D21C60A75CDB3DF397DF819838B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777299358, "uuid": "978f8fd3-9129-46a8-925f-a84e6f8bf84f", "value": "890e522b31701e079a367b89393329e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777299358, "uuid": "bf79ce60-474a-431a-b1b6-b9a518b11c75", "value": "12288:yA6bf5K2ytQPDhzJzt5KRybqy7rFPOeOJ2uGE:yA6tK2yyRJJkaqyxOpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777299358, "uuid": "25788803-2395-488c-90e0-559e08bba837", "value": 894552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777299358, "uuid": "8fe13319-4063-40c4-8e22-9d454260ebed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777299358, "uuid": "7001bd95-04f3-4c0f-b738-210d6f04ee65", "value": "M3Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33cc6b56-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278996, "uuid": "de206c94-f040-4fc6-8146-e83d44454779", "comment": "Malware payload", "value": "5d0bc40df0e4ba4d7663212a3e4e3af2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278996, "uuid": "270826a9-f029-4126-a0ce-f9fb407d54be", "comment": "Malware payload", "value": "e3ac51d388e725b7e2ee2f3bc3569c0e11eb3751863405c0f52748a31769010b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278996, "uuid": "e4b3255f-325a-4ef8-b7f8-24d5b8b06bda", "comment": "Malware payload", "value": "caf93a6f543a32b37bc5b4d5a264863d128189d6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278996, "uuid": "8999f509-ae5b-4a21-946f-cf890f82f523", "comment": "Malware payload", "value": "4c8d1572d2a069f8b1f188b1fcd40ef6c544b85d4169f43971a5dd6b4a57435c576fb9f28a2425b05a58936ccfa0cf4f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278996, "uuid": "8187a587-be25-4d3d-ba7a-4ca35a07303b", "value": "T1783723032FB85C2757B85689283B060F5DF08E142477B0995AF07E49AFBFB949D2F1A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278996, "uuid": "41bc8946-4c22-4812-b9be-a9f24d988760", "value": "49152:rwTidxwTiduwTidswTidewTidrwTidZwTidawTidNwTidewTidswTidbwTidwXTO:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278996, "uuid": "0722042f-fd2b-4fee-8884-eee68be5a532", "value": 23424199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278996, "uuid": "341f9c87-aadb-4b51-9c3f-be10cfb28601", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278996, "uuid": "adae2157-19c0-45cc-bc7f-e3ef84738f55", "value": "invoice-1645080830.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0585cf-420e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777276597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276597, "uuid": "e6945fb4-41df-46a5-8a5c-85b7b31de6b2", "comment": "Malware payload (PhantomStealer)", "value": "d8bc53f789f5c33ea40315eac820f8e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276597, "uuid": "bf9702f0-16a7-4d72-9070-5c0fa3445600", "comment": "Malware payload (PhantomStealer)", "value": "e3aeb7f86f362b9c16a292cd4bd9f76ed2f653de8b405557a661927c6c65a59f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276597, "uuid": "48270266-91e1-4e9c-8dcd-fae026523be4", "comment": "Malware payload (PhantomStealer)", "value": "e0ad084a1291fe206898c6094dede48f7890b46a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276597, "uuid": "4aba2b40-9f70-42b2-bb38-5cde35f5b4a8", "comment": "Malware payload (PhantomStealer)", "value": "722ade1fb4b8339dba90c7f10681b38e999511884a4e144e8cc8cf2363de109ef81cf111349b3769b605193b1ca12669", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276597, "uuid": "1bc3ccfe-4f97-427d-88b5-1e5825ddf7be", "value": "T1EE95F0053354DF11C52F56B5C9A2D2F917BBAE04EC00D3CB6AC8BEAF75B27A99900583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276597, "uuid": "4cc49351-a137-42f8-b289-e65d5667ef85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276597, "uuid": "7c9d6ea6-9f80-4076-a651-c98c5ba968c1", "value": "24576:1zateF8phuSHvp2UkHw2QaAprrzeLpbw6kLdtMVRyV+M4vUlQHYn2Lnl:NKeF49vp92Qa0rrz4xwnLz+M4vGz2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276597, "uuid": "0149d933-de14-4d0b-aeaf-b13e4ce11f12", "value": 1989120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276597, "uuid": "acf36c9a-b855-4e1c-ab9d-2046dbbbc531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276597, "uuid": "d4f27ab2-6f85-4f62-a2c5-31aaca3c0991", "value": "HBL_SH6449A0475KQSHYQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee1ffcc-4249-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777301724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301724, "uuid": "87090f32-3177-414b-9f8a-95e034e44710", "comment": "Malware payload", "value": "98d33261f3c2d28dd296c2281b29355e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301724, "uuid": "020c1ca7-6757-4e9d-a957-46f9eb5a7e5a", "comment": "Malware payload", "value": "e44b255a40a4f93eaee602df44bfbc37f87c3c9e8114b581158ce035bce11f22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301724, "uuid": "ddf38500-e3e1-437d-a45a-99da1f3da369", "comment": "Malware payload", "value": "a76969832076dfd676522358a2a07105064b2745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301724, "uuid": "50aaf35c-bf12-47c6-978f-b167196e2b3c", "comment": "Malware payload", "value": "ae792e438d3f7229484eae7947a53f05239cf6ba7bc3021a03973ec1c9d0cca0c3366eb25d9785659a3ec2463b3ad32e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301724, "uuid": "ecef6dd8-cee6-4dd3-a1f5-395b5e5b3707", "value": "T1AE863347B4C48A5DD54907F1A4955D2262F2DCA83B304C874AFE3A279335BD0B83EBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301724, "uuid": "cb6d7272-201a-44bf-af1e-5e6b82a127b7", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301724, "uuid": "1792603e-75fd-4154-bb65-3124cd80d8c1", "value": "196608:w/+W/Ccuo8JrrEi7CnxCW10Ud/b2w6lZrh96d40LT:w/+Wq6abG0WCyb2nrh9YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777301724, "uuid": "48c7cc98-0c44-4494-93f2-5429f66f571d", "value": 8145981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777301724, "uuid": "2b397235-6f90-4b14-b470-e36a56be7c30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301724, "uuid": "f2d59fa3-6b36-4704-a53f-8dacd5df3254", "value": "2026.04.27setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8b9f7e-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285726, "uuid": "1562d70d-dd2d-4064-a0c3-548c85cafd80", "comment": "Malware payload", "value": "26f2feaf0efc4f7bf1a79cf434c4b6be", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285726, "uuid": "adbc3d98-a555-4e3b-acb3-5e54b2b0eaa7", "comment": "Malware payload", "value": "e47a01d711de258682711a2003dd6c2b16f9a26a182dd3b7307c0831576bbcb7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285726, "uuid": "b005f798-39e8-474e-99f0-776020102ea0", "comment": "Malware payload", "value": "9a69acce7abf5fee3fc36bf993cc460eb20d2cff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285726, "uuid": "e3f9a8af-2f51-43fe-a017-9648f96ed8e3", "comment": "Malware payload", "value": "6ec18d3026b8bf282b0346759bcd40bf11a2cc88911e16226bf8b2d10ae33681a809f2b8550ddd322e405093aedb5520", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285726, "uuid": "c2e7e8eb-270e-4da7-bfa4-d475a88e81ed", "value": "T17F3723DAAF1F963F827C93CD29FD0A8D6089CE8394E9D56703FB315F278DA4A0196150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285726, "uuid": "1cdf1561-3419-49c7-a9bc-cefe6e33cccb", "value": "49152:e8J1yGq8J1yGA8J1yGs8J1yGO8J1yGX8J1yG98J1yGp8J1yGv8J1yGG8J1yGH8JP:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285726, "uuid": "1b635ce0-4151-4fcc-b219-ac8e3a7b9210", "value": 23424196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285726, "uuid": "48b05017-f04f-415b-aea7-7ffb918df8d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285726, "uuid": "6d285c7c-e63a-4249-886e-a3db6088e3db", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eaa2c9f-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278933, "uuid": "86615757-8484-4b6f-ac11-d147fc9bd980", "comment": "Malware payload", "value": "a4c94156dda372701f955ade799a7d0a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278933, "uuid": "3242a6db-c266-4a0e-9a17-22b5f6e19f93", "comment": "Malware payload", "value": "e4a82bff1db1652847fcadc4186edd9d8fca006824cf7d3ce4078841804ec362", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278933, "uuid": "7f9c35fc-597d-4b32-a8a0-421178e19f17", "comment": "Malware payload", "value": "b8919743c034e36f1ae93cd520911ab64b3682fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278933, "uuid": "380bdd21-e00b-4c69-b736-3d4aa50cdb5c", "comment": "Malware payload", "value": "fc3c53850913f23c9e9bb76c8ebd5229148a38cae0fad184486dbb4c606679be172ba9216df8c550cff0b69f84baf40a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278933, "uuid": "309e0158-d5c1-49c3-a855-bb1eb39729eb", "value": "T1D63723094F680FEE06EC94E8605B8E7FAF66DF105181DEAA63E66CE0934FC5494335E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278933, "uuid": "5899b294-15bc-4012-a73f-7327ec3f3129", "value": "49152:40x190x1b0x1J0x130x100x1G0x1I0x1c0x1P0x1y0x1C0x1800x1c0x1Z0x1x0l:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278933, "uuid": "7f900f51-ae6c-4784-a614-3b781629fc3a", "value": 23684335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278933, "uuid": "6938260a-7860-48f2-b645-5cdc0d17b218", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278933, "uuid": "597aa8c9-03ab-432d-84ef-eecb76d3ec76", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e2dad9-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280400, "uuid": "d68da4e0-8f91-444a-be99-f3d6c964c7f7", "comment": "Malware payload", "value": "ed6a9c98bf2fbaf9d7076857c637f750", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280400, "uuid": "48dc49ad-330a-495f-94f8-9a80e818b52a", "comment": "Malware payload", "value": "e6065ff07558adc22bae54bf820e6bf53f572090498180815b02714fb7bb3621", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280400, "uuid": "339ccb68-5bcd-43a7-9750-f78cbc909260", "comment": "Malware payload", "value": "7f6d0800f478380dfc6c2798a508f1e2a0343cef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280400, "uuid": "d45cc9b0-0e0a-4e48-ac49-c360dea8c16f", "comment": "Malware payload", "value": "f4ff52d2f06c029969cfe7a9d014099613aa1c83237667a22950cb83538f4387fe6a357179c110a85475d1af865214fa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280400, "uuid": "c47ac46a-e9a0-442e-957e-a7d2faa8a314", "value": "T122372343CF0E5FB149AEF66D28AB289C89710F5054697FEBFF0569CC470EE2A6A05134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280400, "uuid": "2dc79281-1128-4f2a-a2db-87cc90c8d609", "value": "49152:/AbAdAEAfAlAHAfAdAuAtAjA6eKLLtLA1A/A0AQAleKLLtIAZAbA7AUAiAWA/A0h:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280400, "uuid": "ef6ed9fe-b383-4344-b872-2c95d6e74830", "value": 23684322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280400, "uuid": "1703d376-1398-4bab-aff0-71d7ac290ce5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280400, "uuid": "4f95fc0e-5d5c-419b-9755-e86dc666b597", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3776e898-424b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777302624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302624, "uuid": "659fabed-1163-42e7-9700-35d58e0ccb6a", "comment": "Malware payload (AgentTesla)", "value": "8c854cc81af6a23d9032a7e71852a46b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302624, "uuid": "1b6711b5-d902-4bc0-844a-6bec9276816d", "comment": "Malware payload (AgentTesla)", "value": "e66a818739fb9733518fabf881dbe876e3bdd28b918f057ca2ef5599ca4d47bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302624, "uuid": "b6869b7a-9a0d-425c-9aa9-84d897187cc3", "comment": "Malware payload (AgentTesla)", "value": "b04bb1e11204d56bb62813ec76bf84c98ab2ce04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777302624, "uuid": "5461979d-7a1e-4cc0-8ba5-aa36d59f13d9", "comment": "Malware payload (AgentTesla)", "value": "1b83be6ceac911412b11d05b5cc23a7d9752a053601fa2b68cbc391057e250466c30fa1afdd7e337cbbe5311658fa866", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302624, "uuid": "1b786869-be41-4350-afa6-5ccad3de5b50", "value": "T1192533D2BE433DAF5A24D31D54F228051FF394938086218B05E6E9CA5F3F19BE359D8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302624, "uuid": "5ad96cc2-fb8e-4f43-9ced-9ed0bbbe0f70", "value": "24576:Kzyd5vKDoIlQ5XGGNsdinrCcka7BCvaugXYgJN:DCDW5XPs4Wq7kvabXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777302624, "uuid": "b938aa90-87c1-49ac-99c2-075b3d5352e3", "value": 1016222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777302624, "uuid": "06da0ffd-8d84-4d6b-aee4-06fb4556a75c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777302624, "uuid": "b41b454d-fdec-48ec-b16a-eb3942f228a0", "value": "ps_HVLZifZMYPsQ_1776261626763.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60760de3-41d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777250294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250294, "uuid": "748792af-d5f5-434b-9d7d-da9724cf0bde", "comment": "Malware payload (Mirai)", "value": "00e457d3c25de61a4e83bd4a3ad39ae0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250294, "uuid": "9b7e998a-ed74-4dea-999b-499e5ebe72df", "comment": "Malware payload (Mirai)", "value": "e6d5de68acd204b5762d744bfd486dc58de61a6a15814d41eee1c2f30a9305a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250294, "uuid": "62604e16-d9bf-44fb-8444-f6bcef4044d1", "comment": "Malware payload (Mirai)", "value": "96ef2c7682b909ab13596b0babadeb76b8a2abca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777250294, "uuid": "7a6ac2b5-cab1-46ec-90ae-96b9dc4992ce", "comment": "Malware payload (Mirai)", "value": "53886143979087f759d41b7ad48bf03e85d90b1b79349493a5151450aa924f2e01aafde6d0eb0432e27bde389bb30f26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250294, "uuid": "db209a54-3faf-4aac-8992-c9962b33c156", "value": "T1D5F48E9EFE5E3C43D2DBD33D9B4E83B1A22BB190C21351A33541436C94C699DCBB169A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250294, "uuid": "79be64df-0a36-4089-9704-d9372a091e50", "value": "12288:cUQ3cUwB1vJCDElnlji2e/WxVHa6S00RY9wzaxw5C6iU3+7g/teYDP:cUw/468n82ieZzSw94auL3ggVeYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777250294, "uuid": "29049415-33d9-4a52-8a47-a448c71a7192", "value": 778600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777250294, "uuid": "3833a974-6105-4064-82a4-72cc4b587897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777250294, "uuid": "31e3306d-043d-4790-a45f-43c2dc89e453", "value": "SecuriteInfo.com.Heur.5204.23836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2ef79b-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276161, "uuid": "ad70955c-53d4-41c2-a4d8-b7d4e006841c", "comment": "Malware payload", "value": "0bbe518cb6d787681f4acbc50012c183", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276161, "uuid": "20d2f616-a34e-4ee2-8cbb-f5c0b7dcc13c", "comment": "Malware payload", "value": "e711e4f48c0a75ec0689e16c3ebc57fbb7ecc54c5cbaf6e93cd233a6086aad77", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276161, "uuid": "3aeef33e-0233-4782-8bc3-9812eedd8a91", "comment": "Malware payload", "value": "798e812e183690be8b9fa11c8468b2971308705f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276161, "uuid": "3c0dfcd7-c86e-4609-bb17-5126f8a031d6", "comment": "Malware payload", "value": "e759204a82efba69325c05236c4c0fb8fd161b41f24ae4f186da09ecb4a17dd26eaac2a124ad64c7a9c81f64af1f3db0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276161, "uuid": "5b4c7d7d-6470-4ec2-bb19-a6588e934eb1", "value": "T1C43723611FBFAF2F6738616600FF8F5786D2C90009563EC0E7646962AD9D920406FBDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276161, "uuid": "dc8d9838-721d-49eb-85c8-e6cad6c1a6ef", "value": "49152:WNvrE2EWVVEzxlmT7L4OI3cpkdHNmCCczoPeNLNp0p9B+2vDbnz4EigiAvigicmM:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276161, "uuid": "3c22de22-47bd-4d88-a8b9-34fa8a666370", "value": 23424209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276161, "uuid": "35180aaf-6399-4a9c-a5d9-efccbe5c9b4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276161, "uuid": "afdc964d-f799-4d00-a1a0-34fd9403d782", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36302006-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321949, "uuid": "d4e40d97-dc7e-48cc-ac60-aa4f369a1bfc", "comment": "Malware payload", "value": "cc11403d519bf7e5e191fce5bfe78ae9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321949, "uuid": "d184cae9-9b59-4c7c-8863-d6fb5daada54", "comment": "Malware payload", "value": "e716240fb34485f1cd98bb42d04efc60e78f513641dd31c351e7870a49d7a676", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321949, "uuid": "11b65294-0f68-4a8b-875a-8d8628479f71", "comment": "Malware payload", "value": "c24cd76faf9c8ff308e8f82210cb94940319ca3b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321949, "uuid": "da7b779f-fe28-43ca-af52-a8ad4de0ee0e", "comment": "Malware payload", "value": "be6c5a171040588275f20d4f0c498a31dec402b3fe299a0a81dee928f664cb13453fd413ad69575a25527f5ba7046b48", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321949, "uuid": "7a219e8c-776a-4f70-b185-394a842431e8", "value": "T130B01259A04DBC394BC76FC18EA874A91567D40F025D4CD3035661FC84F2E5C34F6213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321949, "uuid": "a509a6fc-750c-4db6-bbaa-b23bf28ba37d", "value": "3:gdQTtQ8wVIEXjKUJKLu4TDNkxLNBkMxhJH0fJH6tM:gdhRIBU341gf/jUfJH6tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321949, "uuid": "650fcf10-ffae-4b46-a94a-bd12b00baa20", "value": 116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321949, "uuid": "9c1cde09-4ab6-402b-b6cc-c7a767d0cd11", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321949, "uuid": "325fefca-da94-4cf6-a3fd-0765d9c079c0", "value": "164.90.195.107_1777321921706292_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0ca0c7-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777275953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275953, "uuid": "cc0aed95-a48f-4c24-af7e-220d50da495b", "comment": "Malware payload", "value": "038d2e3bb036a65b6d2564c2898d543c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275953, "uuid": "f08cc5d0-57cf-44ec-9fa0-0b40faa1309a", "comment": "Malware payload", "value": "e7d70839f005670527b2ba422681a8ad1d0dd98170643e291a0e8eafa6c59f6f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275953, "uuid": "33bc4c99-771e-4368-abb4-778b1da042e2", "comment": "Malware payload", "value": "98788ceee67d26db5943ddd019a5318d2277af6f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777275953, "uuid": "f0302f6a-1cf0-4734-8e03-dcb15fd37e73", "comment": "Malware payload", "value": "c7700de54e89039346e07992015a6b248595053ddfa658d9bd84f667b8e43812e248253725175e0e7553b264d1c98894", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275953, "uuid": "92f52715-d603-4d23-8133-96735153948a", "value": "T12E372346C55B4F1E5B84657A206A28CFE5ECED45D2003B82A2EF65DD823FB5E3037227", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275953, "uuid": "d9776706-cbe9-4a86-8622-b9bcb8e18c45", "value": "49152:mqeVMqeVxqeVWqeVNqeV3qeVZqeVhqeVVqeVwqeVXqeVvqeVHBuqeVfqeVhqeV+7:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777275953, "uuid": "8461dcc6-7956-4cbd-880d-c97be29db036", "value": 22903938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777275953, "uuid": "7e45bb06-1235-4c26-977c-d0368a509c50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777275953, "uuid": "8c9beadd-cff3-4fa3-a030-c5c835ce92ea", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb69c29-420d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276244, "uuid": "2eccd0ee-fee7-4482-9107-d92fde599514", "comment": "Malware payload", "value": "0e18108aeead5b7ca83eba316584fdec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276244, "uuid": "a1011a9f-859e-4f72-90c5-394dee28403a", "comment": "Malware payload", "value": "e8124b4989f5f2e108ca9e9ac4ad84fa162fb8c9648bdf025a56d03a299ae420", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276244, "uuid": "91a9ad08-3488-4f1c-a24b-a479519e1137", "comment": "Malware payload", "value": "7fc9601a3216dd6dc1c206a5e1743848be33a690", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276244, "uuid": "9847342a-8d83-4d8b-89d7-7aeeb5a84e20", "comment": "Malware payload", "value": "4c7283e5d90ca8017d9493b1cbf91499609a14fdef453c637a1feff49dbb828b3ead1eb5bfb4251739ee22f2625a83d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276244, "uuid": "8912f31a-996b-4152-a639-e9a6f8fc0a2a", "value": "T1283723DB1F68CB1E8C94B92C117B2EC8E9DA06E1C31018CED532F66D985EF5920F964D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276244, "uuid": "16d45b67-be51-415a-82bc-fa5cd3aff006", "value": "49152:dwIJHf/wIJHflwIJHfawIJHf6wIJHfHwIJHfdwIJHfcwIJHfDwIJHfwwIJHfqwIY:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276244, "uuid": "921c8118-20f1-49c2-b0ff-74abf04a01c5", "value": 23684352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276244, "uuid": "17860e6c-b66f-4240-9d5f-29864ca696aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276244, "uuid": "64473e76-8738-4641-ac84-52eac29e329f", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a48f593-4210-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277235, "uuid": "aabc8409-f94c-4711-bc17-055e5596f479", "comment": "Malware payload", "value": "a6764247bb37e24faedab64f4f22cf9a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277235, "uuid": "3c55618d-a8f2-4111-b9ec-118731398e04", "comment": "Malware payload", "value": "e8405c8396748dec88790c332317e2cd8cca4d067e8c70a01d825a43cfdbb61e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277235, "uuid": "18240c74-9e17-4225-b613-5d928fc18afc", "comment": "Malware payload", "value": "5a71f63b6c449f7183ed4d97533899409ec038e8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277235, "uuid": "51fb54a8-b249-4e31-990d-c633ae81cbc6", "comment": "Malware payload", "value": "952c25d1768dce2db99388b681276afa23184e75e5ad63a4d516b9b79ac73b1222bc2a851092fb1f9ee0d517ddc193e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277235, "uuid": "01c37f63-0eba-4eea-be56-654a4f5ea19f", "value": "T11C3722048C695DBD03B617F8BA7F0A9F0CED4D4E253CD4926F7BB65B121C99AC04A389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277235, "uuid": "97a30d57-105c-46c6-ad15-34fafc63b9f2", "value": "49152:W4W80D5ghmC/JCRA34QMjCRRcSNnRGw9s7lDc8CRKCR1OawCR8pa8OnXQM4GcjPf:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277235, "uuid": "3871c6bd-c8ae-4e51-a4d9-f7ff1bef6e03", "value": 23684341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277235, "uuid": "918f236d-e845-43f6-bf11-95fdd9a9dc0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277235, "uuid": "6b67d46c-0b1e-459f-9db8-a405df09c850", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59498850-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280776, "uuid": "5cbda731-75e0-4ff4-b226-2fab693d8dad", "comment": "Malware payload", "value": "59f93499c7ca6241eaa79874e89547a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280776, "uuid": "0d5d4880-11df-4ab4-8dc7-b2564e20f874", "comment": "Malware payload", "value": "e888d53936f8c959a15995fbe0aeb01c6b5a6ece11cb95b145f6ef4b81c7cf05", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280776, "uuid": "57dea941-73d7-4e30-9b8f-6428f441de28", "comment": "Malware payload", "value": "5d407e90b32a0d2ea62d3dd0a2f5b0fcda1d5a3b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280776, "uuid": "f7e853b1-e02a-48cd-b2c0-13f922e7c863", "comment": "Malware payload", "value": "f9058a1c9e24ee4011484a096f07abb769b4d91c9dce2ffac1fbe1aa1e40707c1722360956db8d5bec5abf21ba0500fc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280776, "uuid": "055ea375-1d3b-43cc-bfef-fa4ebd43d6cb", "value": "T15337232D071F8E16CB3C21AC11DD355F24868EC64025FAA7F6B3A87FEADD94A1C29435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280776, "uuid": "1ab55f8a-c8f6-4772-893d-7d10f6988c6b", "value": "49152:4OWiw9OWiwKOWiwvOWiwkOWiwiOWiwAOWiwtOWiwhOWiwFOWiwDOWiw/OWiwWJzE:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280776, "uuid": "69a39ef2-95fc-4bf3-92ce-0585d9474274", "value": 23164062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280776, "uuid": "2cc39990-cc18-4410-883b-60a98be827fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280776, "uuid": "0ad1939a-dba3-4415-af3e-589bddb445e7", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d8882d-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277100, "uuid": "d0720e6f-2ff4-454d-af6d-080e3fe667d7", "comment": "Malware payload", "value": "a79c4e53822b02da5f7c08c5da5faa64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277100, "uuid": "cac5c4b7-6b05-454f-97a1-84e45c000175", "comment": "Malware payload", "value": "e8dc8270a66124735f8987ef45ed3acba4fe268afd307b55853a9603187d0a5c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277100, "uuid": "0306fe46-6b91-490c-8e03-ec38ecf19645", "comment": "Malware payload", "value": "df1b095f22fd5b624d7d1e7c128928d0007dfde3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277100, "uuid": "cb125319-04a1-457d-aedc-9c16286c3450", "comment": "Malware payload", "value": "4ea2fb2d83ea2aefd301eed5bdc9ab0520bb0f7fc2d4abde82a881ac9fe6525e429f0524b44130e577002e6d2d7571b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277100, "uuid": "e72f23a3-723b-47ee-b872-2430545df4b6", "value": "T1F03723B39F0A5C9D46ECE24A15BD1A8F37E19E40E0483CE697D6589E4ED5F3580230EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277100, "uuid": "f92df29d-7e56-43f5-a812-23442bc30173", "value": "49152:p75iKl7scUmKHJA89Y6CFJAFuXj7V/xNgrjypIJAdJAl12XJAIr5dUB5KOmi+e33:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277100, "uuid": "2d602029-dab4-4569-8180-860b48ca0102", "value": 23164073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277100, "uuid": "e6fca50b-537f-4b7c-9c70-b3f007422dd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277100, "uuid": "5e54ece3-2b0e-4299-b06f-ad013850c2e8", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1efa4c0-41f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777265866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265866, "uuid": "096cc8c8-8cb7-4d4b-bdb8-4b0026acf937", "comment": "Malware payload", "value": "593a6e47516622e281bce338688145a9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265866, "uuid": "dd0ac719-7b93-4e98-b526-dcc53d496109", "comment": "Malware payload", "value": "e8e97604d6b1fdf1221dcc0ddb85cddc7cbd96ab7014c0d2046f8fecabe3537f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265866, "uuid": "3a8f5ae4-e3a2-412f-af46-80e1e4f43492", "comment": "Malware payload", "value": "c77b751581b94e5491815a4cf99ed68c7543315e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265866, "uuid": "62f5bbaf-8f18-4555-be0f-e8c1505e880b", "comment": "Malware payload", "value": "cc58f64b00fa71db59771ad5f5de8d8aaf34bec8245b0fc9c198ff98cdb8500ed6e421a6f8c1b3eb32810ba11db09583", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Batavia", "colour": "#75A6EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo-likho", "colour": "#42EAD0", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265866, "uuid": "54442a5d-e930-491f-a96d-35a20d109414", "value": "T1CDF57D13A245613ED59B0B3A497BE754983FBF712556880F67F0384C8F3A6806E3A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265866, "uuid": "1f02a070-08db-48d2-ac69-4ab3bffe3e5b", "value": "a51cea9cbca1a8a3d7783926aa532ae1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265866, "uuid": "6886c989-69cb-4018-a572-740bfa277a98", "value": "49152:MpIkDMn4F1RsCoBbiJKSnnl4J09uHeNbfxWC6D:MpIdMRwbmqM9NbJV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265866, "uuid": "4ca173fa-a55e-4e1b-b29f-5afbde86ec14", "value": 3386368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265866, "uuid": "8df65a40-4e51-47d8-bba8-14b0801e395f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265866, "uuid": "e7dc2c2b-b77d-4f24-b788-c4cacbf08f0c", "value": "e8e97604d6b1fdf1221dcc0ddb85cddc7cbd96ab7014c0d2046f8fecabe3537f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d63232a-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285615, "uuid": "2e916903-b145-4306-b3bf-1907bbd5d7eb", "comment": "Malware payload", "value": "a2fa3cf31efc58da10e2944a4e81b139", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285615, "uuid": "5b5d77ec-a384-4064-9e37-0f192769db1b", "comment": "Malware payload", "value": "e939b4a72edb57903b3b9a3cbfc27aad8fd05d8e5405e69fa4365e77412cd34c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285615, "uuid": "60757f40-00fd-4458-977e-7925fa33d120", "comment": "Malware payload", "value": "286160bd53294cb6f693b6389c2ca6a2d893f696", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285615, "uuid": "771b1f5f-be43-4a79-a614-54971b19e766", "comment": "Malware payload", "value": "5174504c58b6b02c091d0403dcbe8f1238b3cb0c9e1032de561f2f38b0c0771b3caa46f3a5cab44cf1ac9a1d32991c7e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285615, "uuid": "87370f7f-4c19-460e-b330-d5c14e85d9dd", "value": "T16637230A5BB91F4FC7B038940ADE1E5A5F7C0E01525CFEAC83D3E8CE8A4D5A505962ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285615, "uuid": "7a8aa96d-6695-4abd-b5a9-0f8e8d3d9494", "value": "49152:qfYUbfYUhfYUXfYUTfYUsfYU6fYU6fYUyfYUNfYU8fYUofYUGWkIwfYUFfYUIfY+:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285615, "uuid": "9b878a5d-fb68-4ff0-9362-7bbb5ae375a6", "value": 23424217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285615, "uuid": "84a55d92-2a91-4b0b-a9bf-c16553408e41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285615, "uuid": "fd9b9e0e-92ef-494f-9ce1-d0c354b4104c", "value": "invoice-1645080830.pdf (59).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92bd791-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285662, "uuid": "e2be4def-d80c-404d-ac4c-0dc725a47a2a", "comment": "Malware payload", "value": "3d6174b5520667dd6eb156d0032dfe41", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285662, "uuid": "da50c7e7-768d-49c6-8013-54d56e3a96c3", "comment": "Malware payload", "value": "e966ce57973801aecd04288e85fb4cb1a01a5291cdf14fe0d7cf0861046da0ac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285662, "uuid": "e896d640-e6ef-4f0b-a7f5-e7d741c557f8", "comment": "Malware payload", "value": "663b89bae770534f1f10fc7dadbfcc5f5747ffe8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285662, "uuid": "d11bbf73-130a-4471-b8e1-ad5d690da4e5", "comment": "Malware payload", "value": "ec6646605fdb193854dbd3bcbd9b7254518776c0597aa38fa2d7096a97594f56ab6d1fe3d7c06d4c313db46eaa65884f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285662, "uuid": "b5e83e55-226e-47ea-8079-00a92149925e", "value": "T17337234DAB7D2A6F42EC11AE10FA4FDD2F8ED488019049D7C62A69F7620D90D73DB21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285662, "uuid": "f9940c6d-9c22-4927-b975-35b7d6f5a69e", "value": "49152:P5blKV5blKt5blKg5blKm5blKP5blKZ5blKq5blK65blKW5blKQ5blK05blK6L5y:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285662, "uuid": "f5f4f826-6fd7-4031-812c-bd2c9a80dd0c", "value": 23684345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285662, "uuid": "ac244b07-e5b8-4562-b16b-399278a58ffd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285662, "uuid": "d965512d-8f93-45cf-8fcf-95c00847051b", "value": "invoice-1645080830.pdf (56).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0899706a-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276776, "uuid": "6afbeca1-2176-406f-b901-2b13b3d94eda", "comment": "Malware payload", "value": "5fec23544942b564cef696320fe1e61f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276776, "uuid": "67cd9001-211e-4fad-b6e6-de9ad8ef88bb", "comment": "Malware payload", "value": "ea103ef712038808ce5bd1b58050bf0ca368c99b751300782000c27a97fc8951", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276776, "uuid": "9a31e33d-f583-4193-999f-403033ab5168", "comment": "Malware payload", "value": "f0c05bfbf2da42c4d603a35f3a6f5e21cbf3a28e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276776, "uuid": "c0bdce50-eec3-41e9-bab1-702663e93369", "comment": "Malware payload", "value": "33b704f3f7781d5232c980b6fc8f911d740b5c29940cf1ddaa4546b3a89dab6e086cbb7b978a935c8320923baa87cd48", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276776, "uuid": "265781ca-e1cb-45aa-81a4-64581e04dcf7", "value": "T1F63723825F3C0E3D03DFB32D347B540DA650D3A51985A484C3A2F8DA5E6EC9AD54F2BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276776, "uuid": "94cd09d4-6cac-4a7b-a18b-fb2a9b673a32", "value": "49152:Ff9cf9nf9qf9af9Df9lf91f9sf9kf9Df9uf9FZdNf9qf9Qf9Df9Pf90ZdCf9Cf9/:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276776, "uuid": "d0c8e744-96ef-40bc-9ac5-be4a71c07c76", "value": 22643798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276776, "uuid": "be53efb8-7ed2-45ea-a390-d74efa56291d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276776, "uuid": "9f68bd22-c691-4048-847e-0256f1385fde", "value": "invoice-1645080830.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bf188e-4222-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285310, "uuid": "d51c4f3d-07aa-455a-9395-5c71df85cf9a", "comment": "Malware payload", "value": "b5082b03458a21b6aff2699ff9c756cb", "object_relation": "md5", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285310, "uuid": "2fa07b48-3243-410c-8531-a124717f0b57", "comment": "Malware payload", "value": "ea332443af2134d329d59849739401a6f3f0758d70741f8fd84870421f9afd66", "object_relation": "sha256", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285310, "uuid": "57b2ff5b-2aa1-4136-99b2-84044cdd2479", "comment": "Malware payload", "value": "ced139dedc4e73f494b6bc5eb0fde86120e0ab95", "object_relation": "sha1", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285310, "uuid": "e2cfcece-480e-4457-a9be-c44e99ba5eaf", "comment": "Malware payload", "value": "2077e2e0d08ec76ff9aab1ebb1ae62b9ec534d2f121971d477f2b45e6195c9bb70f45b5a011ca04a8987bc328116e970", "object_relation": "sha3-384", "Tag": [ { "name": "129.121.38.216", "colour": "#44DF0B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285310, "uuid": "9fcdbab9-13aa-445e-b5e1-a4c501bcd312", "value": "T166F00515CC0599A7C6F660D1949BAA91AF0DD34B00326554534D40413D327A8927D7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285310, "uuid": "48a3e1bc-d840-4b72-ade2-b804e7822dd5", "value": "12:xvWqIwMdfM5rwRuM871eVfLMjKW8VjeR/fUyMvkVF14:xvWjwMuRZPIVzWKW8VS9fUVsVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285310, "uuid": "5691cb92-7643-47e6-9b0a-c4f794feeef7", "value": 515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285310, "uuid": "287d6291-72f3-475b-bade-61d320618816", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285310, "uuid": "251d6d1c-a1c3-4445-860e-a215af6fb1a5", "value": "instalar.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d901a88a-4213-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278843, "uuid": "23d130c3-d1c6-456d-9adf-3991a88fcad5", "comment": "Malware payload", "value": "6a4f8ecb938bfb8acda8bd506b85c443", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278843, "uuid": "e6dd78ad-0bdc-454a-a9a7-d373c4375cdc", "comment": "Malware payload", "value": "eab351ebe2bb266ff467957342f1322256b4e0b36a9415f21f9820ae408bb035", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278843, "uuid": "5724819c-1fa4-43ba-a5eb-51485fa614b4", "comment": "Malware payload", "value": "6244232cc9a0715f4c682a04e4983ce08d9673d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278843, "uuid": "52b32944-1299-4a8a-9fb9-d256730c6072", "comment": "Malware payload", "value": "4a629fb6e9a0bc2a89d4da2eddecbec63e119166480838ca3accf3fe967491072911092ad773e2de934065210dbf39bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278843, "uuid": "4e76ca85-3f33-43ba-bd70-2a1ebe02f41d", "value": "T14037222F2969297E8BBFB0A808DE1E3F07A927045D016DC377977E97B21F412158B0D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278843, "uuid": "a6f513bc-9b3d-449c-83f0-e9255f5fc4d0", "value": "49152:1vSvgvAvOvhvzvMvVvOvCvrvO5VJ0NvLvZv6vGvC5VJ02v6vovdvNv0v4vcvMvj7:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278843, "uuid": "bc4e7848-4b1c-4a19-aa3b-576642d42266", "value": 23164067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278843, "uuid": "7cfd27e3-a482-4371-a0e4-c122b7540c9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278843, "uuid": "2e21190f-12af-4f2e-87e4-3d5094c5fda7", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b40b3e-41f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777265678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265678, "uuid": "23c2e79c-8c59-4a63-9128-b20c47ccac2b", "comment": "Malware payload (Formbook)", "value": "7b7a2da8449ac123eb20c8e78a3ef0ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265678, "uuid": "4682f54c-bb87-402b-8ed8-877110b886cb", "comment": "Malware payload (Formbook)", "value": "eb11e9e446bb14380d22304f7c15d7fb3af08d1443dc019285ca90896e97340e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265678, "uuid": "6807f595-f02d-43d6-bb38-e17c6f62e167", "comment": "Malware payload (Formbook)", "value": "f53b3cfb00c3c8387e80d8221d497bcf9f16cc09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777265678, "uuid": "5b9e0e2e-3e98-460c-acc6-6f41da4f7702", "comment": "Malware payload (Formbook)", "value": "546023e84976bddb7dbeb42ee16d2bb63877b0604080dfe463006b29427e963c8321c1c179b750d0ec5f536cf8187fe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265678, "uuid": "5e41d30a-0c3a-4f99-b42d-97342eab0fc4", "value": "T1A7252362DA46D441C88127FACDB5E3B143B58FEDB912C3436AFD9DFBB8107725868091", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265678, "uuid": "6d928b72-7e9b-4804-8f90-238c0d770645", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265678, "uuid": "82d2334c-b1f3-4d47-8c91-b8424f32759c", "value": "12288:ddbS59SlMPq+9q3D0lVooqT1Cl696MdekVkpX8ghy5zDm2EFWFxq+DLZDvPygu:mDroT0DGTW6QPkOhthylDm2PfByt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777265678, "uuid": "345e3497-f71f-4c95-baad-acb1d22c869b", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777265678, "uuid": "faf85def-c63c-49e3-8da4-93aefd98f052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777265678, "uuid": "7ebb1c42-9d1b-4a10-8d8a-56cd231603cc", "value": "Advice schedule_027.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30af9894-41d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777253650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253650, "uuid": "029d4961-5895-42bb-8fd3-81229b049aff", "comment": "Malware payload (Mirai)", "value": "5a9b402c6e548f2f1ffc2aab78fdb2af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253650, "uuid": "3ade0d2e-3562-4591-9ea0-61ff98ee70ca", "comment": "Malware payload (Mirai)", "value": "eb29ee725c6d9054f6734a2d50b4fff6a7f2c20483787ed916dd4d0e796663d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253650, "uuid": "2e422d17-8e41-4e6d-b485-d8f4768b9bff", "comment": "Malware payload (Mirai)", "value": "9f9068561338b02a6a690e38b0b84848fd51e7e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253650, "uuid": "af3c542f-d683-4e96-8946-45a0a86d2ad2", "comment": "Malware payload (Mirai)", "value": "9f2b32035fefa1e4ab72a1fd1a26d1e966da181dbb0203b5482d7df87d738789e578cca95c6b9d1d273607a7ddaec6ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253650, "uuid": "35313435-ccda-4560-9fa5-c3e6223a7455", "value": "T15D058D9EF95E3C47D2DBD33D9B4E83B1A22BB190C21350623541436C94C6EDDCBB16AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253650, "uuid": "8caaae39-7a01-40a8-8f2d-81ecbfc50379", "value": "12288:0xNkKe5Q1irFv2h0KtRT1EYhsE3000U8+HCaft6w5Cwi7c7TBgcoeZDZ:0x7k2irM/TFsY0XU2e3gQTBgleZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777253650, "uuid": "54b507c2-fe20-4f66-b1f2-54e718bbc772", "value": 845720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777253650, "uuid": "05bf4c31-4a0a-49d7-ae5c-9c8e97450f7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253650, "uuid": "a76e02ff-cd55-4349-88e8-d29d31443f68", "value": "SecuriteInfo.com.ELF.Mirai-BTE.67576168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e800d8e5-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279298, "uuid": "29cbf9ce-b85a-4203-b1ca-feddc53c7b5f", "comment": "Malware payload", "value": "497bee599a51819bae6659e2c10b65bc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279298, "uuid": "e82ca3bc-dbc2-4cb3-ae6a-6a862c14987d", "comment": "Malware payload", "value": "eb7e6e3214d9464238f53e946e43f47468f36b6966c159375a38b0298126dcd3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279298, "uuid": "9d99ab1f-f0ca-47fb-91b7-c72e1c5d4bfb", "comment": "Malware payload", "value": "1113c417ed8c54f58a7cb53808a5a9c029ce2e92", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279298, "uuid": "675d63ee-08e4-4fbf-a0df-906f27fffd32", "comment": "Malware payload", "value": "9c16477659d1190d37522d7551bea9da3f78c44625eebce7bd1cb00fa01e90232cae631f3e6569fa93f7a49d089d23fa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279298, "uuid": "e44f6fe9-ba4c-4c61-b4e0-b5080d96dac2", "value": "T14A3723070EA9C83ED9BD0650385CAF0F74F48D0F54EB76A2F74B3CA6B95AF56085A508", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279298, "uuid": "2ee8f83f-293b-4dd3-9a6d-59d178dc2fd4", "value": "49152:WHfXbg3HfXbgMHfXbgLHfXbg2HfXbg0HfXbgyHfXbgTHfXbggHfXbgpHfXbgJHf6:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279298, "uuid": "d9421491-b1f1-4c03-9d99-104e442bc079", "value": 22903937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279298, "uuid": "33278a88-2151-4ce4-900d-08d7104a884f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279298, "uuid": "16d504c0-00c3-4f05-9801-95896952bd79", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84813fb-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280533, "uuid": "15284190-63e8-4820-8a68-4fe7352daf92", "comment": "Malware payload", "value": "bbc119e0a1b6ff7e67d1c40d1ec1eee6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280533, "uuid": "5e304ee3-5354-4c7b-b26d-d82f413e6391", "comment": "Malware payload", "value": "eba58665efd685c32629f62bdecffb3d192876656738a36e8bdfbe2d0d34802c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280533, "uuid": "0506b89c-b499-4565-856a-a7e73859616b", "comment": "Malware payload", "value": "0900358ecd5e15aae31afb4aab8b41faafa9fce1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280533, "uuid": "20314f4d-e3c9-4704-b3c5-cccdc918ae63", "comment": "Malware payload", "value": "f1732895d2539e91f8b52ed0de15698dcc96aa0b4b05ff4c7625d8abca28cb42d377180f5dd50d3658bb9e707e8f5cd6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280533, "uuid": "367e03b0-d71e-4025-84ce-76b194604b29", "value": "T11037233A2828CCAE412C27FE047D4D579EF584A1A15277FF53A719ED120EA6E223F714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280533, "uuid": "0ea42092-f060-4f00-839e-3814362a1a28", "value": "49152:X/ou/oe/oW/oh/oP/oB/oF/ok/oU/o//oe/oN/oF/oy/o8/og/o5/oa/oy/o3/op:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280533, "uuid": "04cd6c1a-79b3-45d3-a9e4-ca3e19ac8358", "value": 22903941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280533, "uuid": "69ea1774-3e0b-40c4-bc5f-41dc92f3ea36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280533, "uuid": "9041a0b5-aab5-4dd4-91bb-b8d59ec6e143", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd8e006-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283680, "uuid": "529e50db-e842-41d0-abeb-f97c75f26cdc", "comment": "Malware payload", "value": "34f5a944ef04097a992de6c807cfc8f0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283680, "uuid": "44dd3df4-4697-42f9-9b1b-3fdda5ff2ffe", "comment": "Malware payload", "value": "ebfff3311c4ae5c6e56533d13cd315c0e8f4c28d29f496b38b4c689b362e3b47", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283680, "uuid": "2a5caa82-2ac1-44f6-8bbf-255a7ca36075", "comment": "Malware payload", "value": "272844dd3d80f2a95ac7ec36966f02630c1efa74", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283680, "uuid": "a4c53f56-8804-46c0-a5a5-d57613b57fe1", "comment": "Malware payload", "value": "4cf3ea9086eb31af20a49048d3dcb322635cffd9d456fd1bef34c42302ad5b022d3ec832dfddd3e9884ab53fc8c52ef3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283680, "uuid": "9317dbd7-ef53-4bee-aaff-3b69af09e011", "value": "T13337230ACBEF5B6E87A8323451BB492E3FA98E040489FD34F355399B2D90715125F1BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283680, "uuid": "6d52dbc4-af38-46b1-9a5b-69d023868471", "value": "49152:+2pq2pV2pw2pA2pn2pV2pO2pv2pK2pY2pJ2pXioclG2pN2p82p22pm2p1ioclH2J:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283680, "uuid": "d704f5df-e35d-4236-b0a0-cc1ea2a7c424", "value": 22383699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283680, "uuid": "9b060606-77e9-4fce-b7ab-95a6a283f08a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283680, "uuid": "94a45415-8e25-4ef6-9a6e-de5bd909ed0a", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e5d11b-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276870, "uuid": "b0e28ec6-f207-46ea-9841-ef7a6bfea22a", "comment": "Malware payload", "value": "1de2ff632970829b17175bad604e47c1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276870, "uuid": "f8f16a0b-c8f0-4f67-a647-12fe9d5a3ff3", "comment": "Malware payload", "value": "ecfdc97cd8a355ac2a4c1eef20a1a77a37049043208afbe07e07a5519bca4fbd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276870, "uuid": "ac18f883-3cb7-4200-b858-c68bb989c82b", "comment": "Malware payload", "value": "7471cc74566d19d7b737747c7f3a9395fad0207f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276870, "uuid": "fa1946ba-4fc8-48d8-80af-bc44d60128d7", "comment": "Malware payload", "value": "72be88d670d643cd2154bb8262cbe2d7a9f064d6b1da136d54981d7e4d2b8ba279ef9721f59a6a8c7b543e04f193dee3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276870, "uuid": "88350741-486b-4aec-8f7d-972562d0decb", "value": "T1382723261B4FBE2F89CD6B1C14FE4C078A28190CC518A6F57BBD6DA60D3EF52016B674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276870, "uuid": "9c977bd3-cd2d-4c88-b812-a1c2a97fa6eb", "value": "49152:Ql33cl33Hl335l33/l33sl33yl33dl33Il33Tl33/l33Sl33WRMFFDl33Yl33vlf:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276870, "uuid": "56a13a44-0f0e-46e2-96c5-2c0c92aeaf94", "value": 21603282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276870, "uuid": "98339ebe-adb7-4ca1-80e0-3a7e5e427562", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276870, "uuid": "3fb0d128-d7ba-4eaf-932d-dbc90b18ca04", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484c4a9d-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276883, "uuid": "6e708c2a-98f0-4c5a-bc1b-f4659e09c897", "comment": "Malware payload", "value": "251436804621cc0bc7dc3f4a63e0c523", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276883, "uuid": "8e9bb421-3fd9-44dc-8b49-16b2283d384b", "comment": "Malware payload", "value": "ed52cf56f47dc778e87a841e09072cec1c20951f09be39b5ffa9892363545187", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276883, "uuid": "ac8dac0b-477e-4455-83f8-9c853d67540e", "comment": "Malware payload", "value": "0d9a6767d8e3a9b01d7d6314aac490a6c50c95d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276883, "uuid": "671cf4ef-2dab-4a4b-8e5f-ce83b44433af", "comment": "Malware payload", "value": "32332e18860761019258447241a13d21ffbdf204df0878e150fbe785fba22bb58df750a9189e4519d06e7938a617fbf4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276883, "uuid": "a178358e-bf66-477f-9988-5915312a9ea4", "value": "T17A3723433E6A694DA33C1719B1ED88CF17D8CE0002649E9EA6E0BC9F6E5DF584C63197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276883, "uuid": "a1446353-73bd-4001-9315-c4e12f4e03a1", "value": "49152:RCuvJUyOSxUg/LCgsnHQdIyBBTGkOy/WdVovZWZgQ7vTB/lQpLp73pLNC9YnwYHt:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276883, "uuid": "63cc80ed-da29-46ce-a8bc-73e8386f7240", "value": 22903947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276883, "uuid": "a0329184-409b-4f10-9fb7-6bfcd5a0466d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276883, "uuid": "cd0e9e6f-5768-421d-b865-23c127e574e8", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281caaf5-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276399, "uuid": "2ed5ac71-53f4-4385-b453-f5c16c401d5b", "comment": "Malware payload", "value": "53dfa27cc52ae70686afdf85f037a2bd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276399, "uuid": "3a649092-d98e-467d-8c35-bcedca6b6fde", "comment": "Malware payload", "value": "ed69e02f7b2f6ea4996476e0f0b622176b0834226845edf7e87fd688b190cb19", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276399, "uuid": "1dc43a43-70ab-4d6c-9362-f2406061c43d", "comment": "Malware payload", "value": "0740cb6c0dfc81c747bb203e8ca600ac58281753", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276399, "uuid": "d4e29dc6-70d9-4674-bb7c-a38295eb9968", "comment": "Malware payload", "value": "10f84a38d96ee0064c4d605a883f1befc7a56409e587f66c651c8586734e263112a907bff3652f8d15dddb2ef7de3f9a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276399, "uuid": "f71205a7-93a9-4e23-ba6e-41115e78cba7", "value": "T1D93723B5F66F3F1E0B5C06A9027E154D228D088978A1EFEA3897FC3C918DE1A75523C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276399, "uuid": "2acf9f02-b8f2-4bd9-8f6c-79b1de37ce65", "value": "49152:Aktk2kWkWkZkLkPkNkMkpkjkUfNMkckGknk/kofNtkkkIkCk3kJkKkmkmkTkPklq:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276399, "uuid": "dc88c85c-8139-4d86-ad55-5ddd8a3b9a3b", "value": 23684322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276399, "uuid": "b9c8f655-60a4-4672-b3af-d48d8ad395ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276399, "uuid": "46c074ac-3c64-4d57-ae3b-0bf6566c48a3", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fca0f4-4278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777321951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321951, "uuid": "f012117f-3f9c-4a58-9a9e-a0e3f859ca35", "comment": "Malware payload", "value": "f2a32f12504308f180291df14c755ed6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321951, "uuid": "d513cc23-a625-4661-b2be-214170915734", "comment": "Malware payload", "value": "edf123288be5ea2c1bd43c56a65bbdf0abc61dad98147bd8737efa89ef78089d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321951, "uuid": "3ff3e52d-b2da-4c08-ba05-08b91d17a0c3", "comment": "Malware payload", "value": "93d9e9cb5c68f8395587b37980ddf9855225a04c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777321951, "uuid": "e9c3657e-a4bc-4325-b6dc-b9710cdc68f5", "comment": "Malware payload", "value": "c1b9e8d5b0b405dc55fdd8035fe83f4dfcf97ae2122b988962b01033d07c7b5b35d1b44b787433f303d6dbe61263be3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321951, "uuid": "97eb8b0d-1aba-4389-8b56-1ac27f732578", "value": "T1E6B01219A04EBC398BC76BC18E6870A11567D41F02594CD7035661EC84F1D0835F7113", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321951, "uuid": "41b33d3b-b371-43ba-a318-d4de850d7e76", "value": "3:gdQTtQ8wVIEXjKLAHMTDNkxLNBkMxhJH0fJH6tM:gdhRIBLAs1gf/jUfJH6tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777321951, "uuid": "af568e8c-e2bf-4dab-ae77-9b09abd1f382", "value": 111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777321951, "uuid": "73f56afd-5536-46aa-8187-6e0b8f31304d", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777321951, "uuid": "e5ea6420-ce39-4ece-b285-d9911a6971c8", "value": "164.90.195.107_1777321922173507_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1772935-421e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283555, "uuid": "af1582f9-6114-42a1-81a8-fb25638fddb4", "comment": "Malware payload", "value": "ab5e2dee21ce9e8c31d09cea4b2ed204", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283555, "uuid": "577de7ff-30b9-4178-b095-c1389b430f54", "comment": "Malware payload", "value": "ee6b60ed15ec5f4a6231529e75ba2eecff5cbb1645d78fbf4cfae90796d753c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283555, "uuid": "bd164998-72a7-4378-80f7-4f492d47c0f4", "comment": "Malware payload", "value": "dd5d8b3e3e6f0007417a866340a00a02ec262988", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283555, "uuid": "d17b2f8a-780c-46fc-a986-d45cee15c36d", "comment": "Malware payload", "value": "3e6afa79e406adfb253268f5aa84a588de33e83ce9d63b89f44c0635d1e59c93fe0c8d0d80781d7b5504abb00316620f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283555, "uuid": "36c8c671-605a-431d-ba3d-c8a5fc9e3874", "value": "T1AC3723070F66EE5F42A81BEA6C990E2F99C48ED4460D7B0876F8D7CECE09CE2634D554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283555, "uuid": "e498382a-3c23-44b7-a594-7abfa789d0b9", "value": "49152:qBOZBOVBOxBOrBOaBO8BO4BOpBOnBOCBOnBOG74Z4BOPBOBBOABO8BOQ74ZJBO2y:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283555, "uuid": "39269065-484b-42d0-aebe-8244a071d605", "value": 23684324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283555, "uuid": "e7f16555-d5fc-4a24-b48e-584b5c7f10ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283555, "uuid": "50af8bb6-1f37-47c2-8671-ad59805fa663", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa65e36-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276922, "uuid": "712dd7c6-dc1e-49d4-8ec3-e48e236eeef5", "comment": "Malware payload", "value": "f4d70f6c8b349df85f9d038db8da83dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276922, "uuid": "16764eec-2463-4d33-95b2-de4fb4f41d31", "comment": "Malware payload", "value": "ef0bccaf8da59d58fd687847f6d07e8141d22975917974040276d0539c45267d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276922, "uuid": "28fb7aaa-9fd1-4eb9-8798-bde1245b7fb5", "comment": "Malware payload", "value": "703228437f2adef4094ad53fb0746d204b523670", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276922, "uuid": "2b6a88d1-28f5-4253-8e68-3e54f7edeb38", "comment": "Malware payload", "value": "87e6ebf3ff4afc11a6bfef12de6ebabc55288ff4b7bf10bc9b8490872cf19eb8efd69f88986d2beb879cd81eeca78e53", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276922, "uuid": "442a5d71-8870-4ffc-a7ff-60c8ab5674c3", "value": "T1EC37225FCA18A5FD826C7049047E3B7FBDD066144082EBB0F555F4AEE89BB8924F162C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276922, "uuid": "50852da9-cdb1-4ce4-91c3-8113eb917344", "value": "49152:w0dz70dzH0dzA0dzs0dzb0dz10dzY0dzq0dzq0dzK0dz80dz2Kjo0dzW0dzg0dz1:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276922, "uuid": "c03fa326-5762-4464-93a6-34f4dafd6820", "value": 22903934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276922, "uuid": "ec041632-0654-4ae9-8fc3-2179fc961461", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276922, "uuid": "ac61ebf9-13a8-4f0e-b4ba-fdfdf0e634cf", "value": "invoice-1645080830.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c14c578-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279063, "uuid": "c10963c5-ff54-4b57-8a36-76b032894212", "comment": "Malware payload", "value": "a690596b7e2ff96b5f18da34da63247f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279063, "uuid": "1d70a094-c99a-4385-8a6b-a792d8a4400b", "comment": "Malware payload", "value": "efd94f0fcdb1e0c7a2ffad4840e7cc218b5fa8b928318114caa035b4c82807ba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279063, "uuid": "912d9410-7afd-48d3-9ee6-cf0467cdb599", "comment": "Malware payload", "value": "ae2ff6fdb6435768b8242b6ad665176b489853e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279063, "uuid": "4354e81e-f46d-4fee-be85-0354d10cd670", "comment": "Malware payload", "value": "8545802981ec85bc3db46b644e1f9b97effa5e9ddcf951d301cf1c5d009baafdd70075a7ea760e2f90424848eec3ee12", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279063, "uuid": "4d27b0da-ff34-4def-a9d7-50885e72cfad", "value": "T1A2372309137E4433047D611AAD6E0FAF28E50BA58A00667F735F1CE7A16EBD069CF5CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279063, "uuid": "1962007a-727a-42dc-ab18-0c901cde3dab", "value": "49152:8lI6lI5lIFlIHlIelIMlI+lI6lITlIwlIslIuVLlI8lISlIjlIzlILVulIulIAlu:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279063, "uuid": "d297efb3-21f4-4bb0-af39-27ebb3c60c56", "value": 23164058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279063, "uuid": "3448dec7-e3f5-4ec2-8090-dee19bb38b68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279063, "uuid": "b7bed004-4e74-4fa6-9aa9-19ee5d99bb08", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404d4a90-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280305, "uuid": "bd3c5005-e1ce-45ae-ae6d-7fc52e457375", "comment": "Malware payload", "value": "f87b73a22077e5a07e9813093d2bdf55", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280305, "uuid": "b0bff087-8901-4e1e-9151-d1c4bcae3355", "comment": "Malware payload", "value": "f0168a4ecce951cc06d4d569f7a607bf51872dd8daf7696cf0a890376f5ba2f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280305, "uuid": "2b029890-0a22-4557-bf70-21cf9ba0b62e", "comment": "Malware payload", "value": "fa2c6d501c5698b5b2c5acdc66d4144ca4240d62", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280305, "uuid": "9a7987a7-26b1-4680-8a11-393ebdaad7bc", "comment": "Malware payload", "value": "769feecea523df41ba5f8e59ad75ac60c6d66c38d9b1e19b0c6a5080f28016b7a5986a4d2d95d10b792dbf23110d3d40", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280305, "uuid": "ea6b0de5-c014-49cb-b57d-dcb6df821ded", "value": "T111372302453D7DDE07E602B892F3871F1AD20DA0844656E6E1FCB47E53877ACB1B726A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280305, "uuid": "834a89a7-8e21-44fb-8ba1-525e8b08e5b9", "value": "49152:JNUTq68dnRTlUg5xYIlvwlHLWI29SUiJuwlPDVaksHqJmWfjnxzLGmDmjPmDmuqN:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280305, "uuid": "af66e5cc-168e-443a-8f41-a71eb9f8c222", "value": 23424197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280305, "uuid": "e541424c-8644-406e-99a1-4630493f6a1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280305, "uuid": "23e8a351-e20a-45ec-95e1-b0f8bf58342a", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f7a4c7-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279190, "uuid": "78d64751-c392-412e-b4e1-3d1f2ec305a2", "comment": "Malware payload", "value": "53e6838435e88f5861dc245981cf4c2c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279190, "uuid": "4fead9b6-e8ff-4f36-9e31-e54236f9d5cf", "comment": "Malware payload", "value": "f03444256302b5fff7262c6f5afa67a1669e00c71242371757de526783b5df12", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279190, "uuid": "1a818119-a283-4b39-b5a4-f065af8e8998", "comment": "Malware payload", "value": "c8ec06be2cea7cfe3b7df6f06922c5c3c85c0562", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279190, "uuid": "1ed0c672-965a-4710-8d74-b2e4868b256a", "comment": "Malware payload", "value": "9124bb22e5a8f002a1c99f24e2cb8e948f8598a2cd60b93d5d5efcd648e3ae90e24a493e9a22557f5b7a5cf26bd8be56", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279190, "uuid": "717ad020-489a-4555-bce3-cdc93d46f199", "value": "T1B93723164E485DBF5CB862C469760FCECEB4CD0116447DD6E7AA2E9B04ADF0321DA38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279190, "uuid": "05a29e66-37d5-42e5-b43c-e2f9ea829704", "value": "49152:GUwaCVvUwaCV4UwaCVlUwaCVdUwaCVSUwaCVIUwaCVaUwaCVqUwaCV3UwaCVYUwo:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279190, "uuid": "b6ae872a-610d-4481-aeca-1841971dbf75", "value": 23424198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279190, "uuid": "69b59b44-fcb9-4171-8618-fb440fec8abd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279190, "uuid": "3faaf185-5c81-4c8a-b46a-afb8e64ad4ac", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33c218b-421e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283585, "uuid": "b0af93f2-597a-4196-b6ee-666cfb0a98a2", "comment": "Malware payload", "value": "19da43945ba83a2d6ba05e3a21014407", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283585, "uuid": "a63d573a-4266-4a56-bb9d-0bafece9930d", "comment": "Malware payload", "value": "f0c487d652e2837d8a40a4267297e51b9b608192501c72271559562bebc1a146", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283585, "uuid": "4d99d5d7-2a88-4d0a-acbf-dd72828297e4", "comment": "Malware payload", "value": "f0a6396f645a7e6dcbb896d34f2b6e4d87bdb1b0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283585, "uuid": "5f5de6ec-bbbe-495c-9530-b767344435ba", "comment": "Malware payload", "value": "04debd9796864359fb275a46536f6d7ddcceae1d7b2d6875c7d55d1bc7519924013029f12dc233cccd3e9c5c39759ba6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283585, "uuid": "58d4de36-3244-433b-ba33-7b0b1e27cabe", "value": "T1253723118BFD6B7F871C1039156ECACF0EB9834514218EA273EFA01DA286F5550A7B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283585, "uuid": "b2fe871a-f8a5-4e6d-bd0d-0531eaeea475", "value": "49152:LLl7wLl7iLl7lLl7wLl7WLl70Ll7RLl7yLl7nLl77Ll7sLl7f9oDdLl7hLl7RLlO:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283585, "uuid": "b377e163-c3b5-4042-b043-9a78683ca7ae", "value": 22383682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283585, "uuid": "586ca1db-6b80-404a-a28d-911b5d92bd6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283585, "uuid": "1ab325cc-561d-40e0-9319-bd587b7f2253", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60ff565-4210-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777277577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277577, "uuid": "29ffb8f8-0b80-4ff9-96c8-4c254f4a5197", "comment": "Malware payload (AsyncRAT)", "value": "a72e2bd9f50ac87d0549f6ccbf1745dc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277577, "uuid": "32ce1cda-0625-4789-89b1-d414ea271848", "comment": "Malware payload (AsyncRAT)", "value": "f16deb705d44a9b8bf1ac09128951b660d74bbce751c04293e5988f1bd1192be", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277577, "uuid": "ab797dc6-c3f3-44b4-9f85-5d70ea1f9dc2", "comment": "Malware payload (AsyncRAT)", "value": "64cf7be6a45e1ff374a61e13819df15c41372355", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277577, "uuid": "a2e0828f-9c44-4384-a26f-025bece0dda9", "comment": "Malware payload (AsyncRAT)", "value": "7c48240f0a3a13dd7b3e8e781f358c293c060133fda4d74d06e4ef9a00df3fbd6242373c5c7424fa14adab35f68ec536", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277577, "uuid": "6d292c27-def2-4034-a37d-7677c8768a00", "value": "T1C2057C06A3E416B4E63BC278CBA64233E6B6B8450774ADCF1255D6152F33ED06B3B325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277577, "uuid": "2998f7d5-9668-40b4-9b18-dba0d3a1fd3a", "value": "7d315419a8bf8d007177384cc586ea3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277577, "uuid": "fc105a04-13a7-4063-b4eb-0589e0cfab4d", "value": "24576:DmaUsUEwGxU+xvVC2+KucckBgf/D4jkWBhY:DmacEJxUeucckBasjn3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277577, "uuid": "e59e413e-fdb4-4305-bd67-efe29e1e3145", "value": 801464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277577, "uuid": "cc356d20-224a-4d88-a450-e8565484bd97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277577, "uuid": "c4b41ea5-c3f1-4388-8453-69ce84426f81", "value": "RFQ - ALFA POWER - 09787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce58cd5-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276407, "uuid": "cef56dfa-0f63-46c8-ba04-6fc2cd9f39e8", "comment": "Malware payload", "value": "9af4a59d35e8151015edd22335ff1132", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276407, "uuid": "d2ad7b42-a66a-43e5-9be6-a43c790208f9", "comment": "Malware payload", "value": "f20ea871ba82d9a29c5fa5513106401e324fac4ab4fa57d791055b2989c8ec66", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276407, "uuid": "1c3ed964-ce29-4a47-a9f0-fe4e70fe8c79", "comment": "Malware payload", "value": "a01eccd86a31f01b19cc77aa016dec2cd0bdcdbc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276407, "uuid": "2eee40fd-fa29-4c0e-89bb-636d060f44a8", "comment": "Malware payload", "value": "ef63550a8ecae6b3d56314435d2d685676c4b1ee48d135e5ef02d661edc22eba986c7493a2b0d6c3c8bab0835966b647", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276407, "uuid": "b25b887b-4fc2-483a-815d-6e2678609f6c", "value": "T134372353EB3BDE6C5BBDB62803DF2A0A12C15F43126C8E3AA3651D53471ED241B661EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276407, "uuid": "0e58b17e-e2b2-4b27-ae3a-cc6f15761fd9", "value": "49152:lbrXHVTYbrXHVTebrXHVTlbrXHVTobrXHVTKbrXHVT4brXHVTVbrXHVT8brXHVT6:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276407, "uuid": "b3023673-5de8-48f1-975d-3f3aeb0adb89", "value": 24204584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276407, "uuid": "04f59881-3680-4d5b-930d-db5d914e9c25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276407, "uuid": "7e0e9eec-39cb-4b96-8ad6-33ed42ee51bf", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff231e9-4217-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280546, "uuid": "e184b0b3-0b5e-4492-9897-b80651d1d4e1", "comment": "Malware payload", "value": "12f8012348fc7ca3a0f573ca945c252c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280546, "uuid": "0f943582-db26-4de9-a460-dbe9fb0593f8", "comment": "Malware payload", "value": "f235970754f34e546ae09cd6da52d7aee970f81b5098f6aafb8f6e1cfa6d6061", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280546, "uuid": "98d0e1c2-4df6-4668-aa25-49c0d9eefa5e", "comment": "Malware payload", "value": "a78aa3ff35b2cbe2aeda467bd765870ec69a35b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280546, "uuid": "e311bb52-2d5e-43ba-aac3-9d6f562ee5b4", "comment": "Malware payload", "value": "e44f7f6ceedda1c9e9a454b0c9b1f8927013f000a560009243291ae30de112d279d7808f22895e3961581b44894bd8eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280546, "uuid": "aba63e3c-267a-4a0e-bce8-dce71f30e0c3", "value": "T17537230E4D6E7E7B1D6D639828EF1A4905BC4E18C03970937672AF05E95FA183A1FB34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280546, "uuid": "2d9157e1-a469-49e2-b6dc-1d550c6bbdca", "value": "49152:Z7EsGrdkRGmLqx84pRKaxx8tKJXT0Ql9cyoS+rx8/x8Ne+Ix887qzT6ip5NTR0Le:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280546, "uuid": "55eeb124-2398-4520-900a-50c2d30dddac", "value": 22643798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280546, "uuid": "beca6b34-3e9f-41df-abb6-ca14b1c64718", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280546, "uuid": "56e92298-ca34-47c0-86d6-59eb9d45f3d2", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df566923-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276706, "uuid": "11eb6dee-92d3-4caf-b6fb-145a1230b65e", "comment": "Malware payload", "value": "e5eb2c038db6a2aeb485531dc61d2a0b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276706, "uuid": "7d6fa966-10a5-4b62-be49-b1913ed98930", "comment": "Malware payload", "value": "f246e855d8c767aa1d7380791b75d2870f1f31dfbff2fca54ebc87d24bb2ce2b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276706, "uuid": "651380b1-07e9-4b49-a3f2-978bf774277c", "comment": "Malware payload", "value": "42b83eca995152666886881e00723b55acc4245a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276706, "uuid": "beb45495-7b8c-4136-b2cb-962d33fc6f42", "comment": "Malware payload", "value": "afb75ede861388479bd86b60a19bfce897ef0b240edf70b9c158091c082088613d988a98086fbcbf76a2b56d6eb622db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276706, "uuid": "b647f4c8-626f-4695-bcc5-ece323eb6ecd", "value": "T1CD3723499F044ABF0BD075F8143E095F89B99FC041BD36FB93647BE5292CB5C06B62A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276706, "uuid": "914d4759-b3d7-4e62-95f5-2c86e2858449", "value": "49152:zA3NwA3NRA3NCA3NwA3NNA3NPA3NpA3N6A3NcA3NPA3NAA3N/A3N5A3N7A3NeA3q:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276706, "uuid": "d369ccd1-7753-4dad-833a-a442ce0c8272", "value": 22643811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276706, "uuid": "c0f677dc-8b6f-431b-afbd-686113e28605", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276706, "uuid": "dc4dcb65-0641-4448-9c94-ea849bcb968e", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74dab982-423d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777296714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296714, "uuid": "8200bb48-2fb0-4348-ba8a-be8b1e3ad51d", "comment": "Malware payload (Mirai)", "value": "5cc3c2d3bbbfb2d547c8de4af39dcefb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296714, "uuid": "f71d2200-bd5d-4909-a9aa-0f985e7f2239", "comment": "Malware payload (Mirai)", "value": "f33a0a58d8b7409d78bd8589dcedd58003f0fa26e8935430d7176391421487af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296714, "uuid": "903e301b-412f-4783-9368-865ed5300ed9", "comment": "Malware payload (Mirai)", "value": "0e63f925cbe1aef19d5c45ab58c3ab9a4bb0ae0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777296714, "uuid": "3ce4f286-5ba9-4d9f-88a5-ce23076cf689", "comment": "Malware payload (Mirai)", "value": "f6a2fbdf164d7f97d23f840a68a38d7b215d83c6f40c685c72dc56253a350aa21b4143b23cf0dd4d5753d193b2793e45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296714, "uuid": "a7af0dab-5f59-4afc-9b99-82791ac7ccac", "value": "T15FE33A07F8C184FDC496C1744BAEF63BED31B09D523CB26B27D4AB222D49E205E1DA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296714, "uuid": "4c01ed6f-0720-4b44-97ff-645a45daa458", "value": "3072:vAS4OxU5lG2w/9BRAbNuaP0bO1z9Y4rUKa4oAvF4xTGB1MARMM8PMwMMMMMMMMM8:vAS4OxSlG2EI9LK4poXk1MARMM8PMwMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777296714, "uuid": "57233300-b069-438f-a10d-5baed818d3b8", "value": 151448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777296714, "uuid": "687e4036-06e2-47d6-8de8-21677a27353c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777296714, "uuid": "1beb4287-79e8-4082-b90e-628af72730cd", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50751502-4292-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777333160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333160, "uuid": "f698acfc-169d-4816-b8db-7dbc56b08269", "comment": "Malware payload (Mirai)", "value": "fb10f4ba581a98c7f5f2cd5949da54ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333160, "uuid": "abf5679c-66b6-4098-a8ee-cb80df5a6cff", "comment": "Malware payload (Mirai)", "value": "f3b7b3749f2db75afd0818dfd2b0f6c2265248526a8d63d5b9cdf1ab1ccb28b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333160, "uuid": "4fe30f2e-d5c5-442f-9907-1ffb447a334e", "comment": "Malware payload (Mirai)", "value": "4cfe31c8ba466cfa0dd1eb2cdbcd5ebf42b903c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777333160, "uuid": "0050e074-f27b-427e-a280-b02857cd1cc0", "comment": "Malware payload (Mirai)", "value": "9623dd9c3b6821826f30dcd7de58651cd0040598be3d6ece0f9219fb52b5b3b72231fbbc86412027b9c6112e2a6cbb95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333160, "uuid": "000443e7-e923-4810-a7de-57b37712532c", "value": "T12703E0278B8AF5519C243C75C4E083A2460CEEFCD8BBB1B21798898DEE913171FB4187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333160, "uuid": "ee060f00-336e-4f24-a66f-db8367512ad7", "value": "768:exfWzSk14PeI7Y74bwh6P9D7FBoCPlH+VvF1FmtTQ9q3UELr:wk14PegDK6PhkCtezTSlLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777333160, "uuid": "73fc0a0d-2b8c-461a-bff4-6da6b6238320", "value": 38036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777333160, "uuid": "051817da-4521-4dca-b2ee-18c899a1b1fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777333160, "uuid": "8767591f-16be-4d88-b65a-c2006e5f5834", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ecd981-422f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1777290804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777290804, "uuid": "1b6d53b4-e28a-4973-baac-eb324b1d4c8e", "comment": "Malware payload (Gh0stRAT)", "value": "6946861754578ceda1696262642f8b3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "pcrat", "colour": "#89992F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777290804, "uuid": "08453c26-b865-400b-8acd-450dd1fd68ad", "comment": "Malware payload (Gh0stRAT)", "value": "f403d1c1cadfab40589863ee6dca058f4bd694c1a16b5481841e5c7d74d705d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "pcrat", "colour": "#89992F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777290804, "uuid": "13baeb6a-de80-484e-9ba9-62e596c075a1", "comment": "Malware payload (Gh0stRAT)", "value": "b78f853885b7175e6ca8c5cc05ca97a8ef3c1299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "pcrat", "colour": "#89992F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777290804, "uuid": "824acca3-ad79-4638-8f46-02b25e4f052f", "comment": "Malware payload (Gh0stRAT)", "value": "c83ff63c8fb29282f53cca1fdb3baa73efc983f7dc013ba92c140e421ed1cab7f055dfc65041996f232f56f30572cb55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "pcrat", "colour": "#89992F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777290804, "uuid": "24e978f5-1240-422e-83da-81d33bb0afc6", "value": "T111048C02BBC740FAEA68113C14BB3776963BAD986B095FD3A318EE755833151E633247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777290804, "uuid": "dfd5e195-c59d-40aa-a213-c11727239c08", "value": "b7f39532728ce325dc91e2c72b9d27ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777290804, "uuid": "e57e36ef-f86d-48e6-90f2-dae31431b7e2", "value": "3072:VJuGnYhTbK80khbOW1oWOQ1f9xHwm1PXBmXZFeA28pMGEdePl9dehiv80P80CnpZ:VJueTk1OwoWOQ3dwaWB28adeP/deUv8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777290804, "uuid": "98a2ec8a-4a7f-46c9-af76-ec0111dad68a", "value": 179181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777290804, "uuid": "d8807d00-507b-43c4-8bdd-78d4a678610b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777290804, "uuid": "798abfb3-e6f4-4e90-9cd9-677df6b27280", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01f0385-4228-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777287901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287901, "uuid": "672182f8-d9b5-4d9e-83eb-5915a9ffadba", "comment": "Malware payload", "value": "1a9880cc5cf5a9301377e1734d211c38", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287901, "uuid": "0a3a4fef-86f6-4f85-9e6b-a40e384fc849", "comment": "Malware payload", "value": "f4c87a1df04274b7497cbf9a4619b946c915cf5210b6e2eaa2fee1629f4ff196", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287901, "uuid": "fbbacdd5-3850-4da1-9a28-101ae871f1ba", "comment": "Malware payload", "value": "ad564329de735b1a29ad772bc5bd62ff720cc6b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287901, "uuid": "74a2c929-db52-4655-8666-fb8e5b30bfe2", "comment": "Malware payload", "value": "22a438daa3e7470d39def3c7da6b682e9f2bfb836535c0134321926f845b63714cd15fe30574ecfee92d84286d3ea202", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287901, "uuid": "e61d9b5f-edcc-4e48-aba6-491f145c74dc", "value": "T1A8953A57BCA108F9C0AE9631896691527A61BC450F3223D73FA0B77C2FB3BD19A79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287901, "uuid": "1b1e3be9-47dc-43cd-bbdc-30c7da2af69a", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287901, "uuid": "f890026a-739a-4d9a-946d-bdc2499703c1", "value": "24576:/PTPTJIv7vjILJ4IOqA+HxzfWEJnQsoGyyXGUZ:/7Tyvb8LJvOGwMXGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777287901, "uuid": "b17e3640-af17-48c9-987c-d1637cf158de", "value": 1947136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777287901, "uuid": "ea657e2f-d183-4d2a-9859-5adea7eb1590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287901, "uuid": "8b584f00-1626-4eed-80b8-ae87d392b50f", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bd97ba-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278950, "uuid": "3b688ea2-8f6d-4ada-a0a4-d0e3f02a97a6", "comment": "Malware payload", "value": "51f2a739c3ef5f5f6ee8cfaaa672ac4b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278950, "uuid": "8f55ff5d-780c-4744-a49d-00b776c88748", "comment": "Malware payload", "value": "f4fc0fd252eb0f25fc3d65f8b72100d114baa10ede77bb4a6a94c0d3a44c0b13", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278950, "uuid": "2b426bbe-30fd-40ea-b866-7991820d36ca", "comment": "Malware payload", "value": "635f640811e1ab8c632144101b575d8e7ba50dc0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278950, "uuid": "2a204903-0859-4a08-ae62-8e2a5e682d3e", "comment": "Malware payload", "value": "96a092df9a961831be2381fcb27856ebd338ad641caff21f7c05348e55fa12c610c2fe7193a1e7d893347131909d9ac6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278950, "uuid": "3fe4ce7a-61d4-4aaf-8152-05fe3dd428ec", "value": "T1003722468817DEFE4D78A06E25F2CD8BDBE18FA4056DECC993C86819469FF141F0A06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278950, "uuid": "a261f5e8-a741-4660-8b35-4a0961ce76e1", "value": "49152:V99I99Y99U99b99v99h99999I99G99T99W99KrB2QyqQ99B99b99+99W99ZrB2QY:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278950, "uuid": "9dd3b7e9-cea3-4947-b307-d34f0c8cd053", "value": 22903945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278950, "uuid": "4ef14489-4eb4-4c8b-9a31-cc75647b42a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278950, "uuid": "22a14987-ebda-4dc2-9bd8-006070065b38", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0582b434-4218-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280636, "uuid": "6afb3c48-c483-4499-9f2d-abcfdffd19b1", "comment": "Malware payload", "value": "e85b12c0ba58b312df05367d82d24701", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280636, "uuid": "b52bb541-8fb0-4255-a506-b1a66fba71d4", "comment": "Malware payload", "value": "f57219062f60633d6b4b8429613561ce6969382dab6a437428744ce946964348", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280636, "uuid": "d807a915-1de2-4d61-a507-c5fec2cf6d36", "comment": "Malware payload", "value": "5824f9e09be584d05e679b37b7ee230c70ef82ae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280636, "uuid": "af9707fd-2207-4ba2-ab90-df6948722a53", "comment": "Malware payload", "value": "4b64b3b5eff7c7726772f1f11d38e63c819430b6136ce0009e226eace6603c46ad49b9cd82cb2cd78ed68280263ed1c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280636, "uuid": "bfa842eb-1d5a-44e2-a9a4-9ef8a4fe8db6", "value": "T1813723014EA5CCA50A7D6249241F459B2AD5DCDC9D08BEE71B8EEC2DF8160E87F8364F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280636, "uuid": "380edf17-9c5e-46e4-bc51-e73950421d92", "value": "49152:GTdSuCTdSuzTdSu5TdSuTTdSuATdSumTdSuDTdSu7TdSufTdSuBTdSuRTdSuCTdN:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280636, "uuid": "d26bf6ca-64c6-4d30-9ea4-a500a572b5a2", "value": 22903947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280636, "uuid": "face3b29-e9e6-4824-aef0-0a5dbf8c6b36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280636, "uuid": "fd889ca0-9720-40e1-a2e9-3f5dfb8bc974", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23e92d4-4223-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777285650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285650, "uuid": "bdb5d560-9cbf-4126-bd35-84de082976d6", "comment": "Malware payload", "value": "0d4ff2a3d40122fc39380aa519154fd7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285650, "uuid": "4370d536-9f3f-4758-8c29-17de0ba6f9c1", "comment": "Malware payload", "value": "f57c7373d7b19b7c33903029ecfebdd01877b2ca382f7235fe39e1e82cec7916", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285650, "uuid": "19328f94-4e56-4a23-ab93-f0204a994b31", "comment": "Malware payload", "value": "c16d44bec1d493433acc22b732fb2b876631f9b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777285650, "uuid": "4889c36f-ec03-4cda-a0f9-78bc172e2324", "comment": "Malware payload", "value": "182109bd5883d377312b7a9424500065ff4d028d306d28929fb90a987a3179466be9b49535d0db21b98f01eb9b81cc11", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285650, "uuid": "2378abd4-52d9-4b75-aacf-544ac735349f", "value": "T1FE2723BA8F48AE9E65381E5D22BE1B4519D09444446870C5D7333AC76F8EBA3380F9FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285650, "uuid": "5adab9a9-59a6-495f-aae6-8089cc1a027e", "value": "49152:w1Y1E1O1B1Z1P1l1T1w1T1x1g1s1Q1P1X171Y141m1L131N1X1h1w1h1T1a1n1qE:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777285650, "uuid": "1217f32f-938b-431e-8951-d558abe56ab5", "value": 22123545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777285650, "uuid": "ed9ac8b8-f2e0-4e62-83df-88d783092be8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777285650, "uuid": "73cc1400-2044-48c2-b5be-6f403c6992de", "value": "invoice-1645080830.pdf (58).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6d48f9-421e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283605, "uuid": "0c76c482-1e0b-4a7b-b22b-fc33806aec51", "comment": "Malware payload", "value": "648ea53ccd7f991ddd414eec83479dbc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283605, "uuid": "121cbc4c-b7cc-45fe-a53f-5fef3d7da9b3", "comment": "Malware payload", "value": "f5c2b4b491ca829054d45f07a2e767cf289c38e50297d45f0d4696948604c031", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283605, "uuid": "f1cade28-582c-44c6-9e8a-dacc94fa1d7a", "comment": "Malware payload", "value": "1f29d94ae6f2925d264d11bf84f58497105c8d37", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283605, "uuid": "55208902-993f-441a-a32d-3cf2926c31c1", "comment": "Malware payload", "value": "6d040849df69dd1ebf00e2121cf30452c27e91353484e94c80083b5a7cdd6dcc7bdf5bb581b73fd7187d307104708334", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283605, "uuid": "ea990cae-5546-42d7-967e-6b56c24c467f", "value": "T1263723028F20AF6E619032DC24FF0F5623D4DA764A25B95687F2389D46CFF2942ED46D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283605, "uuid": "8f52225d-f2a1-49af-9f67-0777ad585025", "value": "49152:Qg2txeg2tx0g2txMg2txIg2txTg2txlg2txVg2txjg2txug2txjg2txpg2txzgZj:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283605, "uuid": "32f14041-2d4c-4712-9c01-373c7e3e8b4f", "value": 23424193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283605, "uuid": "c7e55a68-2aad-436d-9d1c-35105043dfba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283605, "uuid": "a11fc004-d5ef-40bd-848a-ea1b490fc0ec", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e30c4e1-4249-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777301776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301776, "uuid": "42fdfc99-fd82-4b49-bafe-0727b82b5215", "comment": "Malware payload (RustyStealer)", "value": "99486ad40d5d9eeaafe604b21a051bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301776, "uuid": "b0a4b7e6-805d-427f-9715-283b98293489", "comment": "Malware payload (RustyStealer)", "value": "f5d060371b578b82b64d4c97dc921ac39bfd40813e09cdaf8fc60822c2bfe707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301776, "uuid": "9f094332-6a57-4fcf-a8fc-d59430a633aa", "comment": "Malware payload (RustyStealer)", "value": "f1802979a1ffc2ff985b19bb8ac047ba602161e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777301776, "uuid": "fd44c48f-0643-4c55-9a4f-70d6c9b6692f", "comment": "Malware payload (RustyStealer)", "value": "0fff8c98457eaf59e603159aee081e19824ca2d6b665be5ecac43dbe7a99b4727d7971d3c70bce4196bf3210f5eb93bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301776, "uuid": "688dbc75-b927-44e0-abee-5aac8bd647da", "value": "T18BC45C03B65225ECE0FAC139A386B933BDB3789501247EFF06D45A332F54A226B6D355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301776, "uuid": "e185bd50-d6cb-4f2f-b0e3-f1e601292938", "value": "a4b5e63c44404961d147e176b9e63525", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301776, "uuid": "28478a02-48ad-4355-a878-2f7b7f57e912", "value": "6144:ApZpwh7lCHYxMJ6dmdNk+4qTasqQERwiDNOOLSVdkl8cE5gkZi9NoxIKgMKFD2i2:GZp14xMMdGXesqQE6uEOLPlJh9cNgJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777301776, "uuid": "7ec5dfb8-73b8-4a9b-a651-4dd9e020e8d9", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777301776, "uuid": "925c1ad5-3f7a-4eec-9248-133415ed1a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777301776, "uuid": "bb5f1b2f-f115-4ed5-a11d-a872858c3050", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u89c4\u8fdd\u7eaa\u4eba\u5458\u540d\u5355\u4fe1\u606fpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa343cb8-421e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283623, "uuid": "36d970e2-f865-46f7-9aaf-c4ea9072607b", "comment": "Malware payload", "value": "9998d8b88b46354f2592749898517472", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283623, "uuid": "0ccc2cfc-1d01-419f-bc22-32463fd43e37", "comment": "Malware payload", "value": "f616d2d786b47f4af7802a53e84df3c1c80f122d4e7855a851890493b74f538c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283623, "uuid": "e64a1424-32bd-4ce5-b3ef-c0ba2feff001", "comment": "Malware payload", "value": "0a05f9bb173d2894a04537592933863e58403fad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283623, "uuid": "b56d9465-c06b-4d3d-9c23-60aad35eda6f", "comment": "Malware payload", "value": "398ec985c6a6fc2575ec25acf330d56b56bddea605943c795881bec3b9b874ff117ca49b23006f714d26528f0645fb59", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283623, "uuid": "7fe23a21-c1cd-437a-ac93-21be1fa132d3", "value": "T105372319823D4E3F0A6A0151B0BE4B7FC78DCE084D54EAA6D481DE8BCB6DF39A477119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283623, "uuid": "331b9985-9d08-4ecd-b5b4-f8d831bc1f0a", "value": "49152:rkoGfkoG1koG1koG+koGGkoG8koGAkoGtkoG3koGmkoGPkoG6L6koG5koGBkoGKd:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283623, "uuid": "fd02036a-c3dc-4150-a2f7-6766a8f16f42", "value": 24204601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283623, "uuid": "9aef9659-16dc-4e76-8372-57daf604a7a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283623, "uuid": "8a3f23a8-6da1-481f-911e-1e0dc2882aa7", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6216b6d0-4235-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777293247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777293247, "uuid": "9713969a-cf06-47b3-a233-ca5f9fe4f8ca", "comment": "Malware payload (AgentTesla)", "value": "49fb4c624c73ee5ef0345862b5b54c00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777293247, "uuid": "8440bbbc-3fc1-4d95-8d3a-2a206e8a435b", "comment": "Malware payload (AgentTesla)", "value": "f6406442b5f50aead5e165685ffc499bf008087d63577bd225f942c2b01ecc70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777293247, "uuid": "833ad2cb-2123-4bcc-83f4-7792752f47b5", "comment": "Malware payload (AgentTesla)", "value": "6e3a35ec45673766df4c9d5ff90e41e04a5d7377", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777293247, "uuid": "1c06675a-d481-4c9e-a44f-494550a36002", "comment": "Malware payload (AgentTesla)", "value": "9ccceb3039e43fe3bf3c7d1889525f1a2e29cb805cbe49091f9f16e252f5481353e14028f35e4f3b6c3009265a28d5a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777293247, "uuid": "59034c9d-59ab-4367-b0b7-f32e98c97ee5", "value": "T10C550200D6C43FB49BA91B2D51BE250BE3E04ECE2015658BEB66FD49BFF7A0495072B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777293247, "uuid": "246272c7-a1d4-4eba-abad-e0ed12627568", "value": "24576:rvJiwSePY+2PgJoe2X9UaxPuABnGpYLz6GfBePdFWRfTtxgl:rswCe2N/PnEuzlTD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777293247, "uuid": "c938cc6d-8f70-44d6-87b0-f6960bd95c8d", "value": 1402756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777293247, "uuid": "7e7955ba-970f-4a2a-8169-3a2a4f7a2980", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777293247, "uuid": "1f7b2242-f90b-4c82-946c-f8c70cab5731", "value": "BANKTRANSFER 04272026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf4dbbd-4216-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280060, "uuid": "85b43072-f775-4d6c-9959-b6df9791d8d3", "comment": "Malware payload", "value": "20aacc7193179c8312fc76861bdbf9dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280060, "uuid": "8006a6d0-b80a-41a8-bab3-3d2effff833c", "comment": "Malware payload", "value": "f6d1f7f6d9fe1e9624fe9c6366e24f539e6f1034262aa0a6dbf6c9919fe25190", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280060, "uuid": "f0c5bd89-c7f6-4d50-9e1b-2e7227063765", "comment": "Malware payload", "value": "2edc3357c23d095fa62e1716d0c5a030cfb3f0d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280060, "uuid": "b2c2aa36-409c-4492-8b7b-acce7b97a47b", "comment": "Malware payload", "value": "c670b5fe1f08c2bc8a7212ee617a9dc39569fd0c95d8ea1636e8b52eda2bf1b994d775367065d77a068a725b163a9a38", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280060, "uuid": "1b3e1747-850b-496e-93c4-db04269987f9", "value": "T166C1830307006A76C4954776306F2DA3EA3F09245FE709CB5B6EFA2475726F52E74A10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280060, "uuid": "b2bd0d22-213f-4df0-bee1-41943cc96ed5", "value": "48:vpgbhJHT2yGZ9OUjwDPzd2aoS7lQOs5NZVsPJCzahwfH1HnG7:BsJit9KBxoGlQO2VsEzewfH1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280060, "uuid": "6c0174ed-4f2f-497a-b58c-9da7e20fec92", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280060, "uuid": "ec77f1ac-583a-4646-8541-a29f9eee2f81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280060, "uuid": "05ea65d1-eb2b-4890-96ee-e4a8b7a5ffaf", "value": "Avk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f9ead5-4207-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777273622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273622, "uuid": "0b875f39-9172-45e5-ad9a-9757a5b7be5e", "comment": "Malware payload", "value": "93ba92f7b0db882763ff9217a414e5a9", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273622, "uuid": "2e0f256f-9c1f-4395-9e57-56e227f42d2e", "comment": "Malware payload", "value": "f6de004780e949e2c09a0777670b82ab08602f18e4186ff30d801882f9248113", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273622, "uuid": "a060b89c-7515-4655-95bb-0d84cf03c8df", "comment": "Malware payload", "value": "f5479a4cf651f49d60a82e4ba76de1890fd3b959", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777273622, "uuid": "b1b55b0f-1b6c-435e-a2be-76c6e7ed789a", "comment": "Malware payload", "value": "c0bf5ad424caf47e4177c6b83fb924c18bf8248176b5508007cb573de200dc7073d889c74dcf0fe7fb483b9738ae8905", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273622, "uuid": "87b2174f-1ac4-4c2c-ad1e-1925ab99f351", "value": "T1DC42F152FAA9D415F1EA4AB24C77DBA58D5BBC214F12471B32907F1E1E30680FD70E92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273622, "uuid": "1a16c5d5-e931-423a-bb40-5d9280d46f50", "value": "eeccb33316508ee49bc362aca84da5ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273622, "uuid": "cbd98699-88b7-4e58-bc72-7d48aff35f31", "value": "96:a3asUoRMQvQW0ANunjqn76nE1fHXzt9NI31E0U2:iaodj5u+7Xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777273622, "uuid": "82050704-a10b-4bf7-b7d6-a90fa8c55682", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777273622, "uuid": "890b9af6-5b0e-4a88-9bb2-e2570e7f8a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777273622, "uuid": "72a126d1-265f-4034-a8e9-8298a107e2f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7241270c-4290-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777332358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332358, "uuid": "a6fb64ab-0c80-46a5-9b7e-7c7e15d6d819", "comment": "Malware payload (Mirai)", "value": "df5af44acfbdb375b3cefbcd003b939d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332358, "uuid": "08283302-f1a8-44ab-8d4c-e87835b34203", "comment": "Malware payload (Mirai)", "value": "f6f3320dfa7959aa40c10cddff5b638902edd7bb2d96b22e699c75c1e922ac8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332358, "uuid": "8e5f2237-045c-4ef8-9ed2-7f7c828953af", "comment": "Malware payload (Mirai)", "value": "4a299624cf436844416b274ad3ed9ccdcfe950b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777332358, "uuid": "20fcf771-9321-4c49-831a-080367c9fa6c", "comment": "Malware payload (Mirai)", "value": "e67d79a9d255a5ff5863c776415144ae51dda075481018bc84f952161a34e325dc6d9df301b02d39d685eb8d8262e627", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332358, "uuid": "b4ab69f7-ec12-418b-9d2c-192b795123b2", "value": "T178532995FC414B12CAC151BBFF5E428D772B076CE2FA32039E269F203B8B55A0E3A555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332358, "uuid": "8c7fb39d-be1e-4498-9d88-f4c562f8fa32", "value": "1536:30UXgRjoBC0OdCuoHbKpwMoJsnBwEvIcLp:rXgWB/hKbGi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777332358, "uuid": "b35fc1c1-2222-4e17-adfb-f0f867548e9c", "value": 63624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777332358, "uuid": "716bc09a-5e75-41b2-b584-192543bb81cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777332358, "uuid": "d9fea94e-728a-49ff-9388-f7466ae96c16", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69fef57-421e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283537, "uuid": "4f632a0c-ce0f-4caa-a546-709ec9f8b2e6", "comment": "Malware payload", "value": "5e2f02592cb43b15229a97f0a5069b1c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283537, "uuid": "4cf9f829-aa03-4e0b-bae9-b951c988683c", "comment": "Malware payload", "value": "f70aea8dc1eb5c77d035cf160b76e6d510c70a850e67f25ff74923fcf8a3655a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283537, "uuid": "5cd78c70-78dd-4a6a-9a88-044edae93b45", "comment": "Malware payload", "value": "72dd9e4b7540a0d4a6d6c1a15d0bcffd347f53e9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283537, "uuid": "6555483f-bbdf-4bb0-b6cd-16cf8679e792", "comment": "Malware payload", "value": "8916350dfad6a3643a7e75c2f772a673a8c3ba1e6d4e43b023f42004a373cbe6f0fcff149d22636ba069811c8949965a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283537, "uuid": "529b223c-1c52-4a21-b417-2b4f4baf85ef", "value": "T140372271065DC92E09BC9982487E078A3B0C4741D122A7F7C6D96DAF93CEFA5367B80D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283537, "uuid": "99671253-9651-4514-8a01-ee1df4dbef81", "value": "49152:8cIIdI3/qcIIdI3/kcIIdI3/zcIIdI3/mcIIdI3/YcIIdI3/qcIIdI3/gcIIdI38:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283537, "uuid": "f764d7a0-0e0c-489f-a644-764634184bdd", "value": 22643799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283537, "uuid": "161490d5-34ed-4581-8ead-d43c36a5b265", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283537, "uuid": "eb45a1ce-8386-434a-9e43-896ad410a35a", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de44c641-4231-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777291737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291737, "uuid": "d182f760-ac41-4d11-af83-5517ea5d8e0d", "comment": "Malware payload (Mirai)", "value": "c6009eb087f9b2aa591f0d0781798230", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291737, "uuid": "bb2e01cc-6496-469a-b570-8f8a3e2f9570", "comment": "Malware payload (Mirai)", "value": "f7cfe580b06dff8a480aac4be279d52309a3671ba559b0fe147f02f881949a95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291737, "uuid": "7edad1f3-8c24-486e-bef4-01623adce069", "comment": "Malware payload (Mirai)", "value": "6504c97178e848cf6ab31aeecf56e61bf4d1902d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777291737, "uuid": "d34900d1-05c3-4200-8d1a-c3c26f904eef", "comment": "Malware payload (Mirai)", "value": "6f4ff5a764a892ed0db69f5b0b773bc182bdf8661e160ac17d1c233ed678c3bb7fd9e392a07258999e5957a814db0045", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291737, "uuid": "24638aba-db3f-42d3-8f6f-d504d9757f8a", "value": "T132E30A45F8818F16C5D112BAFE1D128E37131BB8E2DE72129D206F747B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291737, "uuid": "313b0ade-ba5e-4459-879e-e0f31c6cb8a3", "value": "3072:/oqCsO4upd0xafbHNvXqdGaaDJ+CHDPena0LperdAX:/oqCsO4updEafblXfBDJ1DPena0UdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777291737, "uuid": "364282c5-83c1-4616-b17a-cb26383253c7", "value": 154876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777291737, "uuid": "31e4fbfb-8f0c-4048-9901-2e2738de838f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777291737, "uuid": "755e4d02-9bf0-48b7-aea5-8f0c5aded065", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb07c677-427a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777323112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323112, "uuid": "52a17e20-02c7-4857-b8a3-23e7cc2925cd", "comment": "Malware payload (Mirai)", "value": "b7fdbe18b19c26b2fb7d2663b9e80a48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323112, "uuid": "9c702923-afd4-47ef-be18-97ad6f570fee", "comment": "Malware payload (Mirai)", "value": "f82f0d8443a1f645f60c14d93ecaf2c1fa4d9513e9ee84052c4640c3602b2885", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323112, "uuid": "bd93b1dd-4d75-4469-a3cf-cdb9da33976b", "comment": "Malware payload (Mirai)", "value": "d856d77b58634aa2fb344ec39c1753742076a23f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777323112, "uuid": "00053996-4d73-4224-87bd-350ea1f4ce48", "comment": "Malware payload (Mirai)", "value": "80e1c73d2a8c4a359d2c0cca05fd0440418154ef4f67edf9db475a22343ecb7e3277698aa82c4b53cc50e353dcb8249e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323112, "uuid": "e71e9555-7dcf-4de5-9870-2f6f65efe779", "value": "T1C0B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323112, "uuid": "d5634af4-77d9-4997-8ae8-a34482793505", "value": "3072:qd5b7djS5HECmfBjmThRhFczcmVRh865Ud:qdh7djS5ECnTozcmVROd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777323112, "uuid": "cee8fd18-bac4-4d0a-a111-618144acf401", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777323112, "uuid": "869c9b7b-e9b5-4a90-be48-9c333b192b24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777323112, "uuid": "cd9ef5c6-8ae5-4e46-901c-1d6bdaf09c62", "value": "vaxstresser.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354d7bd4-4205-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777272556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777272556, "uuid": "c7acc82f-4748-4be3-82fe-726b9279829a", "comment": "Malware payload", "value": "af6d5a883ec618ce9caefddba7ba21a3", "object_relation": "md5", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "himachaly17aplr-blogspot-com", "colour": "#C71484", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777272556, "uuid": "9b44bcf5-74b3-41ba-9ad1-2b78284f565d", "comment": "Malware payload", "value": "f842498fb82cf860a181f7b140aa8b92afac00c2126d9625d4da99811f23f71d", "object_relation": "sha256", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "himachaly17aplr-blogspot-com", "colour": "#C71484", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777272556, "uuid": "b6221353-3b1c-448e-8dee-cf5b05c9a729", "comment": "Malware payload", "value": "0c9daa1093f23df2c8431ae4bb0f40ad057a665e", "object_relation": "sha1", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "himachaly17aplr-blogspot-com", "colour": "#C71484", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777272556, "uuid": "43ee6931-853b-44c7-9005-7375e8ed826d", "comment": "Malware payload", "value": "9081f0a092fef139c5ee2f2882fe0b080ad3a0eef3bafb275c71f30a39e284a95f01f5ebc3306889e80510c48df6cc72", "object_relation": "sha3-384", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "himachaly17aplr-blogspot-com", "colour": "#C71484", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777272556, "uuid": "ee289679-dd4a-4aaa-98a5-a17529eb71d7", "value": "T1B9857EE9DB449358F1C02A2DB236021373FEB9A9A6F6A383D233673A355E047550935F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777272556, "uuid": "3d900a61-7b68-4f8c-9ed7-6544aca3e2d0", "value": "12288:vgpVw0OuTvFzVw0OuTvFzVw0OuTvFzVw0OuTvFzVw0OuTvFmaj0GlAMSvc+i:4pVwAVwAVwAVwAVwAjFlAMSvc+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777272556, "uuid": "c9004935-37fa-4c87-937d-fb3c4337d89d", "value": 1800099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777272556, "uuid": "e6c04c27-0cf0-4548-a0bd-de8ac0a4b998", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777272556, "uuid": "6c75fac1-c716-4f6c-83ec-962fd4413fef", "value": "f842498fb82cf860a181f7b140aa8b92afac00c2126d9625d4da99811f23f71d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5fbc1e-421f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777283894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283894, "uuid": "b36f627c-ec69-4150-af46-6977fd14bd35", "comment": "Malware payload", "value": "29d0e9907ee2e81c033cd2293c971093", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283894, "uuid": "73fd0353-12f5-44bf-9c5b-18062ed00b35", "comment": "Malware payload", "value": "f8605488d30ac3f0d74698baf1f6c51300a75e61d08f89670fb67c51901cde9a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283894, "uuid": "68ae23cc-3a01-4491-bd56-9aa8d46da3eb", "comment": "Malware payload", "value": "cd691839832aa68b45877541452330360a5451a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777283894, "uuid": "45138488-0bd3-4735-9c08-161ff336c1cb", "comment": "Malware payload", "value": "730e116c884a19811d429df1d943dbecfce45eb8fcd9d947791f6f3071ceb061eaca9cab0eff426c2983f558d776325f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283894, "uuid": "e57f3548-59f6-4e3d-9b9b-3362e66595bb", "value": "T1C837230C4C2E1E77972836BA347D0F8AE7D85F645095BB63763F5CAE5A8D930282712C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283894, "uuid": "193b08ef-ad2b-4788-b9e2-ecb602f3c5ce", "value": "49152:RP+IK2wP+IK2EP+IK2gP+IK2JP+IK2dP+IK2HP+IK2aP+IK2WP+IK2uP+IK2gP+2:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777283894, "uuid": "681b260b-3a33-4f29-964e-606a5a561312", "value": 23684330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777283894, "uuid": "cdf8418f-454a-45fa-b6e0-8fc09f336348", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777283894, "uuid": "565747a7-3fbf-4ab4-88ce-e337f22125c7", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0de1dc0-41d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777253489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253489, "uuid": "5c029ba6-171e-4d07-ba99-79f8bef79a2d", "comment": "Malware payload", "value": "e7aa8079786234da508a04c9e0694950", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253489, "uuid": "3b688451-6894-422b-bb53-1e1e3210b603", "comment": "Malware payload", "value": "f8e648e6340a0466cc1502fc1bdf9574be058757d3278143e3d80dbbf481b12f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253489, "uuid": "853ae2fe-666c-447d-9c31-284a95fb9b43", "comment": "Malware payload", "value": "bf524ebe1baeec77e897b1344cba58d9d416deba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777253489, "uuid": "902adb56-6f48-4ffa-8c10-d91144933638", "comment": "Malware payload", "value": "d1dacb971af4d3ca16b28a72ded8c8fec353a0b08713037a024f12787d2d3818c61b40dd65fc1ceecadf1586aef8cb31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253489, "uuid": "0964180e-556b-4aac-aa9c-5a1f29b297b1", "value": "T1D7F6AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253489, "uuid": "0c489b5b-34aa-4452-9948-8b14bc962b0e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQZ:cqYUQuVDt0TZEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777253489, "uuid": "5b2c8253-7641-4ea3-a091-275a322d7876", "value": 16154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777253489, "uuid": "2c64c9df-bfa0-4b42-b109-0e85eb7ed3fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777253489, "uuid": "86dba289-2b90-4675-8d8d-acbb4c039d2f", "value": "f8e648e6340a0466cc1502fc1bdf9574be058757d3278143e3d80dbbf481b12f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a93b4f7-420e-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1777276537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276537, "uuid": "9c32ceb6-2599-4fe2-8965-c585a440c4bb", "comment": "Malware payload (Stealc)", "value": "aa83fef9e1896705a2ddc95ffadaa8ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276537, "uuid": "81ab02a3-bfce-408d-86d2-f0cdbfc4099f", "comment": "Malware payload (Stealc)", "value": "f8e7c3df513d88989ccad1b2a17f88c7effff717e8038cf9a88e7fee7be7ef5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276537, "uuid": "8e3880c4-cbc2-474d-9245-396a930c45a8", "comment": "Malware payload (Stealc)", "value": "ebc077ca107d87d87c9ed29937e306e84dc278cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276537, "uuid": "a52ef4fe-5c58-49f1-aba0-05b6777fe647", "comment": "Malware payload (Stealc)", "value": "de2e77d7782c7a706460ac7d4aaf76af75094eb51f74e0496bcd37d9a6087c70461770199f7d90fb4a20d7db803111f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276537, "uuid": "164f3324-0ca3-4bfb-8ba7-19f9c7a5e38c", "value": "T128745B55B6A40CF9E967823CC9A34A06DBB2BC560771E7CF03A046964F277D09E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276537, "uuid": "8db6e46d-c2b5-4812-b459-992a8f15e755", "value": "d04feef9f2f0dd0a18187fe3826aaf2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276537, "uuid": "1fffc272-e05c-4d57-a9d4-fb6006589b47", "value": "6144:uJHT55FH7YlvSzzcvgY+MFbnHTfXDt12CKNNHQB/a:urGIcFHFbnHj72tFQha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276537, "uuid": "5fcd992b-26e3-441c-b342-16aa04807514", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276537, "uuid": "ea74602b-2dee-4f8a-a0d7-5f6c0be53311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276537, "uuid": "05a7d61c-bbea-4810-964d-91b41d145465", "value": "aa83fef9e1896705a2ddc95ffadaa8ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ccb9d3-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777277138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277138, "uuid": "680917d3-9c0c-44c8-aba4-f76753c882df", "comment": "Malware payload", "value": "3c0e7aa86cba9cdc6c4da23d85745a2a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277138, "uuid": "68c29453-bf2d-41fe-8359-99e9150dd7fe", "comment": "Malware payload", "value": "f931bee4d3ec9fb606ff3f84ff71f1d1be7406817fb531aea6120cdb406490a2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277138, "uuid": "2b2df217-ede5-4c8c-ab8e-7a6dc22b6840", "comment": "Malware payload", "value": "f226e3514336696c5551e312894ef7ac034583ad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777277138, "uuid": "c1e64baa-5b21-41dc-8228-b643647317d5", "comment": "Malware payload", "value": "09aac29cecc490d29c6ebb19a5cfe535413e03436e32f9ceb0ba25fccb2a398c3eefcda05262b6c357e47790286d07ec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277138, "uuid": "a11b055c-d588-4e9d-a7a9-42b790df7fa2", "value": "T1693723060C69DB6782D4A6281CCF3E7D0959ACC26DAC1CCD0B77C49FA3AE6587EC3459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277138, "uuid": "87dac17d-27a8-441c-a9ca-51247e625fe4", "value": "49152:KmgX+wq2hBcjQ4iB7o0I84iIwUlj3oKjaVrV6G4i64iIL8u4itg3O/qCdR5VhJFU:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777277138, "uuid": "05532478-6079-4f25-bd21-85b06db20b33", "value": 23164083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777277138, "uuid": "5df010e3-da63-47bf-81d1-4c1163a060a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777277138, "uuid": "89fabee4-4809-4936-9026-49ebd0b63675", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fd424a-4216-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777280078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280078, "uuid": "29a190c9-ada6-45e4-85b0-f64cb789214a", "comment": "Malware payload", "value": "69ea03fa269b15aba3600fc8ad04225b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280078, "uuid": "6514263b-a3d0-4e99-89d5-48c2a61c19c4", "comment": "Malware payload", "value": "f93923341c3e4b43015a2a1ca0b21ec115035447f2398eaea1aff1377f6d9d5d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280078, "uuid": "87c0e6f7-4f2f-45a7-902d-f252cfb5d500", "comment": "Malware payload", "value": "78e3851b12c80c11de8fb6079f621f92b9525d49", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777280078, "uuid": "7c45c696-f645-43d1-b240-fe790d017317", "comment": "Malware payload", "value": "b3adf84ac500c61c8cc0ce410e9992be98b28630c2c892fd87ab51e584acad3237c2db68841d3e7bd93b50f1492e072f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280078, "uuid": "a004a5a3-44e9-43b7-82d4-101c8a2f9577", "value": "T1E1938D0076D1D175EA7E1A3D1434D6A18B3EBC20DEA0DDA727A606BD4F702C0DE35E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280078, "uuid": "1fbe9f68-52c5-401c-896e-184f33eebda2", "value": "72e71b666d5c764a80f4f705ed843ea4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280078, "uuid": "a4bd1bfb-e390-4437-ad57-045c6fa8cbca", "value": "1536:Wn2kCJDIzdW1VQ+BSFD+3XBNcjB73meCSyjNsWZ1cdy9WNu:Wn2kCyRW1VoD+3AmeCVjmy9WNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777280078, "uuid": "b1fea5e6-40c8-4df8-987e-fa92ba5f224b", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777280078, "uuid": "00820897-8ae5-4dc5-836e-fdd6cab3ce9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777280078, "uuid": "d51212b2-062d-4993-aba5-1100e1ed0978", "value": "CNCLID.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0c3d91-420e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276679, "uuid": "39504ca6-a44a-4575-a33f-4317b911b524", "comment": "Malware payload", "value": "7b19ba433843a45c028ec0bd5a1dc357", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276679, "uuid": "e08dff8e-9fc4-45bf-bfd5-5d06a4c698ef", "comment": "Malware payload", "value": "f99fadf198828a5a9f88d07483e555e2739f1a47b9ae94c52fac24942293d53a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276679, "uuid": "b4a2b4f3-2197-4cd1-bd3f-20e2c89eff85", "comment": "Malware payload", "value": "7920bc984e1a5d9e67967ee0c8dafd2e2565e30f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276679, "uuid": "253ddb87-1960-4b26-9e23-42e62fad4ff5", "comment": "Malware payload", "value": "6ed53a44b71614ce8cfff856574f12051f3f2d4abe3d6380d0d338a1fa8e0e921f7b532423b0a9c4b457e8b2b09a1363", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276679, "uuid": "7a48be20-d8d9-4993-89b7-40dba55e9d3e", "value": "T18E3723A5AB264F9F842E167C34AF0D573F4148C40068BE9EF3A97C9F066574B21EB14E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276679, "uuid": "ee177b4a-2fb6-4a43-b8ff-55a5cb975d13", "value": "49152:rQEPQEgQEQQEpQEvQEZQE/QEvQEWQEhQEVQEdN6/QEqQE4QE5QE9QErN6iQE0QEb:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276679, "uuid": "d3d77b8a-83c1-42ff-b035-3d0b85bca452", "value": 23944478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276679, "uuid": "feb921e6-de48-4a66-ba8b-44c601005cda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276679, "uuid": "41ef0c3c-979d-4236-959d-e48cf81ae65e", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a843be0f-428e-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1777331590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331590, "uuid": "010bb028-1c66-4809-b9e8-2fdc0aa9ac47", "comment": "Malware payload (njrat)", "value": "3c7c4c996b6729344d564de7a8b208ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331590, "uuid": "89053502-6a79-453e-8e71-af2d2136e4d8", "comment": "Malware payload (njrat)", "value": "fa44c0f77382a593c1b789b05ddc544abb598f5750309035c52f30afb7c2215e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331590, "uuid": "f405bf75-0366-45f3-9638-101ed7a6ebac", "comment": "Malware payload (njrat)", "value": "22d85bfbba40b0da4f9f34a7e99f6484b3e13429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777331590, "uuid": "259a92bf-f6c3-4b43-8da0-30e43e404eee", "comment": "Malware payload (njrat)", "value": "d43891562f3f7da3963a8f17d63e56b0421fb251ad88319e93ceee08f2bfd25ab63d4d7d30919bab772037e7c96f2fe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331590, "uuid": "67889b19-f763-49a4-93e5-305aee524693", "value": "T1DF431744BFEA5A05E2BC8F3468F545150A74AA23F532EB1E8CD668DB17327C58C40FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331590, "uuid": "39ce7236-1336-4692-a1c6-6ed942e47b46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331590, "uuid": "6424944d-802d-49f3-9d52-e4c7abcb86f9", "value": "1536:iPKADnRZNqidpvcD6wsNMDWXExI3pm5m:JADnsYVcD6wsNMDWXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777331590, "uuid": "60c1b087-2eef-4006-a1f1-056695a7c7ce", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777331590, "uuid": "e1a334ac-1206-4c6e-8145-10998dc60be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777331590, "uuid": "4300a6cb-812a-447b-a454-285a035691b1", "value": "e2dbddf68e6569a064140332bdc372e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879c335e-420f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777276989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276989, "uuid": "bcd129a7-6b29-457b-b130-575fc793a673", "comment": "Malware payload", "value": "e168f7cab28f3c504e116c74c1e4a0e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276989, "uuid": "10fbb0e7-df7a-4b4f-83b6-91b703ddd660", "comment": "Malware payload", "value": "fc2f9be23bf0b4e188ed50d3b97efc0b4f24088388b5f9662e568fad61d6811f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276989, "uuid": "fe947660-4995-446c-9805-4c0b0cab9034", "comment": "Malware payload", "value": "4e1f1bc5828e5c8237b6146f69dec72f6327964a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777276989, "uuid": "7ef3329c-de6d-49f1-87d8-101eb4676316", "comment": "Malware payload", "value": "d10e2f049ad3db65a7564d5499151b5bf5d8ed912b7a5cdb14267b54e9c7443161e1efe7814898a02cc254af25b03e78", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276989, "uuid": "f1b5a7fe-e491-49b1-abf7-cbef1008ca54", "value": "T169372349DFAE842D527DE5440C9F7DC94A849B4184E899E857F0FCFB4F2C62068EA43E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276989, "uuid": "1afe9d3a-8dba-409f-8d63-0d4158819143", "value": "49152:GG+Q0FBG+Q0FiG+Q0F3G+Q0FFG+Q0FYG+Q0FWG+Q0FbG+Q0FxG+Q0FlG+Q0FBG+z:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777276989, "uuid": "7c6b83be-8a25-48a8-981a-14996a93af76", "value": 23684349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777276989, "uuid": "ab7a218f-ca99-43b9-8b88-5e2f09d59494", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777276989, "uuid": "d32b0ed3-6920-43fa-999e-64b2af2cf24f", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784fc9d1-41fb-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777268373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268373, "uuid": "94e92736-bbf5-4a5b-a190-25f72958fdcf", "comment": "Malware payload (MassLogger)", "value": "c083093efd79e5c76d04b994f326ab36", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268373, "uuid": "f29a1ce8-82fb-4533-a90b-a30c30c31691", "comment": "Malware payload (MassLogger)", "value": "fca4414079dd2c991fced7febaa597556a8950e94c43a787f90e0ad3176f7eea", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268373, "uuid": "57251a42-6657-44b7-a9d7-6814c1fa3bc3", "comment": "Malware payload (MassLogger)", "value": "7e1d221acfafb66331dfa06796402bb2e2481351", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777268373, "uuid": "4e4931a4-e159-4c60-a9f4-d3927a2672bd", "comment": "Malware payload (MassLogger)", "value": "f407fdf282f9f8f0434bcfdd8b9f7f0084edae074b77aa2c9845fd7de5157c8a5a3f8f18c88cfd465cb55d419e7bf7a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268373, "uuid": "7a889d99-14ac-4ab0-bff9-8f1f3a36925f", "value": "T1E67501118AC43FA48F9E5B1950BE2249E3F14ECF6419568AEB23FD45BFF3A0452171B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268373, "uuid": "bdb1eddc-0452-41bd-9ae5-8c2cefcd8a46", "value": "24576:kLMf6e/vvtUJNOksfmefHhGgbAp/yMSBdFq2T9I3E49bIWHak1:6SttHAgkzSBCC9ITbIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777268373, "uuid": "342b4cf0-278c-4143-9818-4dcb36ce17d5", "value": 1584554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777268373, "uuid": "edbd4521-b10a-4e6b-bdb3-f50a992796ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777268373, "uuid": "666ef295-6f53-4b31-9bfa-44e6a4344960", "value": "file27.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3dd7bb7-4228-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777287854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287854, "uuid": "cf370102-6bc5-4f1c-af18-fc59217daf68", "comment": "Malware payload", "value": "a2baad151034951068e20dfdd742b36e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287854, "uuid": "b5a21970-3ebd-4497-8fd7-5630e24d492d", "comment": "Malware payload", "value": "fdf0fae99d3b8ddd21aac288c2b38b6ac8a0e0eff99706b82ed5e921db9ddb0e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287854, "uuid": "5eeb0920-74b9-4aa9-9b40-521a0f1fc647", "comment": "Malware payload", "value": "42234e5190e0e25a2893797754864299983642c0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777287854, "uuid": "3fe04627-df45-4295-bdab-ec535c891cef", "comment": "Malware payload", "value": "865f53b2dfb7caa3eff6dc240b94c9c048b59696a4680cc98ff6947cfd15538f4231c9c05e267401b06b4f4c8ef14f34", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287854, "uuid": "56165075-60e7-41ea-abe5-a5ca4f9ee953", "value": "T100953A57BCA148F9C4AE963289669152BA61BC440F3223D73F90F7BC2F72BD05A79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287854, "uuid": "428e5188-73ef-4207-82ba-0343a9e1195b", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287854, "uuid": "667a73c3-4fb8-42de-9a7b-628c20af42eb", "value": "24576:SCDumtopAKI+ehiGG/dvaYdzfTJJnQsn9jywoHS2A:qmWpAd+ehDG/VQNHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777287854, "uuid": "319691dc-b5e8-4873-95d2-12646f3ebcd4", "value": 1945088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777287854, "uuid": "1689c910-eb83-4025-ab05-d652c2570b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777287854, "uuid": "471dc17d-f3c2-4878-ba49-250b0abe80db", "value": "assa161_new.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ac388a-4214-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777279071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279071, "uuid": "9099ee93-3ffe-4237-99c5-871aea365f7a", "comment": "Malware payload", "value": "4d89a7d511cb8f9b5762a0fb86cd359e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279071, "uuid": "734af256-fcf5-40f5-8118-5d0037701d65", "comment": "Malware payload", "value": "fea9350e953f38b35a07735705a20f4cf260217f719e0671ac8b5fdf57da4265", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279071, "uuid": "683ac746-5d73-4c7a-83c5-2af79846e64b", "comment": "Malware payload", "value": "669a900da7eb3d951830f2b3fc9ed5ae6b814968", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777279071, "uuid": "2196bf13-875d-429a-9d0c-63a6c2cdf6b6", "comment": "Malware payload", "value": "71f7e7fa2cd2fbecba8195866735152b62ad62eda02291f5d4c2fc8460cf2ffa5eead54fd9b6470a359e34093e627744", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279071, "uuid": "a686cee9-eb91-45eb-8323-a3fbcc72a023", "value": "T1DF3723829E811FAF4178A31724BE4F8F3C196B04E45270E6F7E73C66975122944EBD2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279071, "uuid": "c180ab21-6204-423d-ad61-d077863a2606", "value": "49152:5PfP8PYPGPdPLPzPKPyPZPQPpOTIP+PePbP3PqOTrPkPgPgPzPePOPgPbPoPEPCL:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777279071, "uuid": "982fbb70-89b4-4d8b-aaf1-41baa8d0c141", "value": 22903946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777279071, "uuid": "5e06f515-71b3-48b5-a86c-de63796f0f04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777279071, "uuid": "c77b79f5-f8fe-4b4b-bc78-4a546d639e48", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88594db0-41eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777261528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261528, "uuid": "77696433-231c-44a4-8c34-90fbe08d3087", "comment": "Malware payload (Mirai)", "value": "c03515c6f4769fcc609763499e021228", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261528, "uuid": "efad64dc-fba9-414b-ae6d-b493b4bb74eb", "comment": "Malware payload (Mirai)", "value": "fef6f104e874807680af743c6869f305b14699c3974830a26142666b77aeb6dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261528, "uuid": "e3aceb07-509d-4df9-b844-7bee4c8903f2", "comment": "Malware payload (Mirai)", "value": "c2af99b325a9a46c1f5a3c06ebd843965258b2d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777261528, "uuid": "5b0b9672-4576-4f1a-9bf0-ea82ef6d7e4a", "comment": "Malware payload (Mirai)", "value": "813487fa81788f79a82023e92fcd984ec35c36ab1aeb2ba479acbef5d8a6f42134129aa575c79dbafc6871966fb0b25e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777261528, "uuid": "5a144a9f-994b-4711-8528-268488278ad2", "value": "T12793D884FE19971AC3D272FBFB4D028D7B3A0FA9A3E6711699315E9133C5EA0653D120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777261528, "uuid": "08d2d5c1-8f1d-4331-90df-9f126fa62bb3", "value": "1536:YQ66en2XaG3vP+Sigao8PeiZmUaK1CsOLnAeiP6ujJZDneLkJ+okxoCYsXjU1Qt3:J66e2L3n+Sigao8PeBU1OzpiSqeQJfLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777261528, "uuid": "d1fc1788-b460-4238-a6d4-f4323e642878", "value": 94464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777261528, "uuid": "8effa1d1-ef3c-4080-8f4b-266282483ceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777261528, "uuid": "f6f10569-fd2a-4f05-aedb-831b057f067e", "value": "xdf.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d408acb6-4213-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777278835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278835, "uuid": "4be3caec-c0b6-4960-8638-2ecfb1573fc7", "comment": "Malware payload", "value": "74cb615da288a61c0bd91029dab9fd56", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278835, "uuid": "cefbfb79-41e0-477f-ad87-8e5918fd7d91", "comment": "Malware payload", "value": "fef83f81a1f20940c3e203b12e0731cec6369fa7e49b1bda105b78667e0bae19", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278835, "uuid": "bdda4355-534b-436f-bfcd-c93e829672e0", "comment": "Malware payload", "value": "6ca18188ee03bdf8fc42f22e808843b8f76305b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777278835, "uuid": "a68a05d7-9720-49c7-bc8e-b737d5cc6f62", "comment": "Malware payload", "value": "7d04de3b6cd04acfb3fd3d009ca012b3c221a6c5a1e300c2d9bb2cbc2e10aa4a92ed140eb9ed477d2207bb0fed4ad2fe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278835, "uuid": "011860b2-21aa-4912-afd0-f26499f477c7", "value": "T182372331ADC5E32A9BA4319A5C7C1B2D3ACACF881E77DD05D3A917D4C24F93C79121A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278835, "uuid": "d6fd3270-4269-437a-a43b-ff783d5c1623", "value": "49152:2VEgVEQVE7VExVEoVEGVENVEZVEJVEbVEHVEwQhQVEjVErVEwVEMVErQhFVEsVEY:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777278835, "uuid": "98fbd586-2c6b-4442-941e-d6d63ed5867b", "value": 23684312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777278835, "uuid": "23b8c19c-c85c-4078-959c-7c846142ffd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777278835, "uuid": "d94645ea-9bc5-44b9-a217-f8e3350de3f5", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932f7bfa-4220-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777284310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284310, "uuid": "1c1df2e5-c5fc-40ca-84ec-7cdeac7613d1", "comment": "Malware payload", "value": "218828f5624bae497de33fe29cf7aaa9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284310, "uuid": "1c1d6f45-833c-4654-b713-62e527ca3efb", "comment": "Malware payload", "value": "ff9e3a65c1925b0e8f1627488ee8b1f92e4f2dbc9d20a10edfd1b034e1a9d30a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284310, "uuid": "9fec1910-f927-4c37-83e2-909bb0480201", "comment": "Malware payload", "value": "06c2e0aacd60539a7d9913f844e92c4a60231fe9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777284310, "uuid": "fc8deff6-4835-4760-9ada-367f5d941867", "comment": "Malware payload", "value": "14d09721ced5ba54d734a088d4914588c04ec9cbf1f8f074c7c9f0a4282988d712f3e2a78f97059c7681d7d1a98daa51", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284310, "uuid": "a0c91ca3-f79e-49c6-abea-6769c84383f8", "value": "T14F215113F48293334131CCA1DF967C88F5801A83112CAD16BF0C8AA52F799A79FF055E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284310, "uuid": "97e8643f-dfa0-4d8b-a571-ffad3b262fe9", "value": "24:7AQBw17rDL+qEUAyFSA+SvDo1XAM/yJUvyzgA+CVHKUsEq2o/iOZVhHP+r8Osnhs:7A8AvXaUAXAFbgA6yJUqEAnU7/pZrvk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777284310, "uuid": "771ce943-2eed-443d-9508-3b4185dcac3b", "value": 1238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777284310, "uuid": "46dd6d00-8d7e-4594-9d57-e2e6d6cd968d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777284310, "uuid": "2046ed13-2d7c-423e-a4b7-e7d7d7a20713", "value": "Screen_Shot_1253_246469384693746_2469724.jpg.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }