{ "Event": { "published": true, "date": "2026-04-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-21", "timestamp": 1776816181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e122c961-ef29-4334-8f8b-19d29dbf09e0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e388330-3dc3-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776804473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804473, "uuid": "721dbb27-3a7c-41e4-9228-091c48874c6b", "comment": "Malware payload (CoinMiner)", "value": "e58a4a8bed24df371f7bc7f4267ce687", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804473, "uuid": "7e54aaee-9501-4859-b9c1-2397402df185", "comment": "Malware payload (CoinMiner)", "value": "00ad2d7a4e9bec38ac628326a53c196c7f8d396588a1235d9d5c3921c6d9ecfe", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804473, "uuid": "050ec514-abcd-4ba3-82e5-ff672a4aa9cc", "comment": "Malware payload (CoinMiner)", "value": "66862757fe6c0bc55ffb8f2a98356a709c118649", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804473, "uuid": "9c19d1a1-b34e-4985-96f9-1f6b39324954", "comment": "Malware payload (CoinMiner)", "value": "36d8724b00549e6bac3dc99e698520f948ab0c25163aed519fc538fa2de2471718a0f857909f8809eced0568197260ef", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804473, "uuid": "ecf560fc-fb5f-4cac-a411-d8457ac42ff6", "value": "T15B32C41E2A474321ED5049B0F6B18A4A553D0EE33346FEEBE633D1CB0AD6E4584C16AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804473, "uuid": "94148976-0496-42ac-9726-b98132cc1ecc", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804473, "uuid": "536cb5a8-0149-44bd-be64-40d17ca2badd", "value": "96:adfsoGYz/9PYz/aor1AuOBbidSzTDr7xyQ79zLD6/hPFJxGE9mZ2FFhfC7tCEmcx:5o1WdrOBb/xymLGPFJxTEZmFhkmcgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776804473, "uuid": "60ca8236-6902-4674-938e-9c9345d8cda7", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776804473, "uuid": "20df7bc3-8922-4827-a32d-9485f35ad159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804473, "uuid": "1efd3f61-9d1c-4b5d-a3c9-394e8a189c7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfc81ab-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776801894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801894, "uuid": "868a7896-238c-4e31-bc47-7c9a16083807", "comment": "Malware payload (WeedHack)", "value": "da1be7b0f7e3ee8747b51acd2d55f43d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801894, "uuid": "dc715365-605a-4b32-b52f-0b739b63b58b", "comment": "Malware payload (WeedHack)", "value": "018c129e0c9fb1bfdf842c297e63c7ed0b473fc876d617c3403499d3141216d4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801894, "uuid": "c305549c-7e0f-4466-93b9-81f76eb00bb7", "comment": "Malware payload (WeedHack)", "value": "13f061b7e7f8ec3b678c5145e0ea19ffd5c5659e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801894, "uuid": "118f3ba0-4854-4d07-aa39-a63e9542c1e8", "comment": "Malware payload (WeedHack)", "value": "327f90fb570c042e2abcf2ca2a3b0249a3b0464e03e840f6c1adf63a9071efd116005d470d7c2aaaa2340d2019c9c88a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801894, "uuid": "78fb4667-670a-41f5-80b9-bd65aa04d47b", "value": "T1686533B1713FC84A11FF313DAAD85DD12ECB9B0305C19C726C786E694F6A4A7097A386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801894, "uuid": "d29b958d-7de2-43f7-abd4-c7b3a99f22c6", "value": "24576:jK+UoZB/La0KRcQCObrRircMnaEhqx+BFoIlCUe94KhTiOlPP43x:/9a0KRPNrHalqABFHlCUgh2gA3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776801894, "uuid": "c6103345-43ad-4062-8971-ecc4e221b397", "value": 1510866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776801894, "uuid": "ea467090-8ef5-436e-8d4c-156569b9a9ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801894, "uuid": "3f36a173-207a-4856-a101-6ef746c4d8ba", "value": "Dupe_Mod-2.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62edceeb-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809205, "uuid": "e121d856-9a01-44d1-9050-20b9ad1a4086", "comment": "Malware payload", "value": "0994c3449e6e833cd07c0b668b1dbced", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809205, "uuid": "9334898c-ca0f-4616-93f9-02921bb3a923", "comment": "Malware payload", "value": "01cd84c99cc026cfe9147dd611e7cba5d3e7bc6c6eed31c59b21ab8119279fce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809205, "uuid": "47ce093e-35ce-4645-ae7e-d515b7a32bb1", "comment": "Malware payload", "value": "5f5dfc8b34ea729d6779d5df264aa4d3df9f4e1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809205, "uuid": "95a78657-7c72-4f51-8b53-1cb34fa2c051", "comment": "Malware payload", "value": "cb9de9ca7b9f8f713b81e2497c08e6fd7d99e670a846d4e0a05a36d219b4209554121097644d87af0f7ff7a58145bc1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809205, "uuid": "3b69cfaf-f38d-4cef-8d5e-794c1264d9da", "value": "T1555608C1E9A1D24AC63D6D31EFE6EFD8D3272E315D885A4AC9C4F33E1CB214580B59A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809205, "uuid": "5c771686-e70a-4169-93ac-47024fa2d5f0", "value": "49152:841oe4TQ0RxrjXGiXNNNr42SDCAfPF+85PhnGomkqiHxwt5Eg:841oe4T3R5jfdNeNZ1RwjEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809205, "uuid": "0c3e333d-221e-44ce-b121-f00f28788907", "value": 6422712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809205, "uuid": "a4e8d758-026d-4ffc-8ba9-c880ffe66ac3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809205, "uuid": "f5a784cb-8322-4d97-87de-c222f8033f15", "value": "h2rapidreset.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c3a8ae-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806311, "uuid": "98cb75f4-6ef8-4b8a-9534-c9c0abe75515", "comment": "Malware payload (Mirai)", "value": "741cb90c0bf217e7b1c1090d5de6f1d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806311, "uuid": "fbd61b8d-44c5-4213-9a69-4728c44c6768", "comment": "Malware payload (Mirai)", "value": "025b1e0b3aa59cc650e8fe94fa83fce437234779aff0ce1e69f17b4a442eae34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806311, "uuid": "c89fc4c6-f30a-4735-8a7b-1347739809fc", "comment": "Malware payload (Mirai)", "value": "68eeddb485f51661d661ae52562a386be44815f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806311, "uuid": "432ffef6-cf2a-4ace-b6f7-81e548fda863", "comment": "Malware payload (Mirai)", "value": "c325995a8b6e6eafe2dc5430449c15fc515b050318e6c5de4cd6fa81b0437f05fd8fea0f67e5b5c82c60bc0ed1f2998b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806311, "uuid": "8ffc95dd-1f37-4f8f-8759-7dc9a7126d40", "value": "T15F03F11C034A7DB6CBE268B2E46006CF37335FBD922D281B358958ACE6E65420EFD542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806311, "uuid": "66418d23-9121-4e05-89b2-cb4c0bd2e82e", "value": "768:qmBpd1EMjlcb03/69xKtGKK9ozhGSN0cbacboAv9q3UELA1:qopd1XBcoPcFf9mhG9eacboAeLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806311, "uuid": "12ea7500-b96d-4980-88be-02f1d60df815", "value": 40500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806311, "uuid": "d614579e-9eae-4dee-8631-c8297c0eb57a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806311, "uuid": "383910cb-8c2f-4cc5-af30-ba865edc5523", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebf87f5-3d72-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776769550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776769550, "uuid": "9398ed5e-dba9-417e-a840-6775664c2132", "comment": "Malware payload (Vidar)", "value": "4bd3020f292a3c775157627c506f18c7", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776769550, "uuid": "cf7321cc-3958-4a1d-a25e-ca5abaf8cb43", "comment": "Malware payload (Vidar)", "value": "041901d48e60fd648354b30d6d258541bba80f334d68aa200c3af829f07bec31", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776769550, "uuid": "1607f1c3-23ac-4f67-b589-e3c73aaafcd9", "comment": "Malware payload (Vidar)", "value": "47f7394cd771059c00ab30805838a36ef41a248c", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776769550, "uuid": "b0dffae0-a885-4a0e-9fbc-5804ee88f7bf", "comment": "Malware payload (Vidar)", "value": "308317ce8f3a93201b4f1752be084c5f94fed3a5c56d9bd18646d8bf45ddf05d57b2dfc38e368053ecb5a4eaf4d03626", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776769550, "uuid": "31153471-15ff-4ed1-afc1-4ec4488e890a", "value": "T140D50727BADCFB24B015DE2FFFA9802271F52F14F29BAA0907509B8595C7107979D0AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776769550, "uuid": "082301ec-c3bc-40a3-8177-392e62a0ac7c", "value": "913897f0f186de4f52c303877b5048ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776769550, "uuid": "fe9b7612-d123-4ced-9a34-c4afbbcbbbc6", "value": "49152:CjjEVWgtwvKZezaDfguHpqL+B5ZnHqOAv:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776769550, "uuid": "e2c2d446-ef7c-485c-8dfc-ccc25e3e8c55", "value": 2863616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776769550, "uuid": "b8602919-d950-46cc-9dbf-6a0a3f1a3d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776769550, "uuid": "8ae6cb8c-e2db-4ae5-b1a6-ec5e9857a4e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d510a67-3d84-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1776777333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776777333, "uuid": "52e2a276-f108-4f0c-963e-320f54d42531", "comment": "Malware payload (Joker)", "value": "9c684fd4bdef2a36a252bd112fe35f56", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776777333, "uuid": "4f5e730c-f670-43cb-883c-908476613705", "comment": "Malware payload (Joker)", "value": "04b51788f706f2307163282ced895fbd689cf7a4d7386606161f9274126d5198", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776777333, "uuid": "e283af84-a215-4fb7-8581-936dc71d27f5", "comment": "Malware payload (Joker)", "value": "a02a81498cd490bc7fceadb456ffd662508ce374", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776777333, "uuid": "6a56f0d6-989f-4cbd-aa4d-309fa5a26054", "comment": "Malware payload (Joker)", "value": "8c5d06c0e1f2ac937ad17e787889b3de32298a656acece7e4d657562f12b3253d4a191a0d7dedfd1c8e6c364fb8eba50", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776777333, "uuid": "e87f2b8e-9094-4d27-ab67-6d5d08274d98", "value": "T15D67CF43B7D26E32D0BE47312AF2A3143B337D667B538B4A1541F1686EBBAC56F44284", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776777333, "uuid": "dd001873-ffa7-475b-987a-179703f3bc13", "value": "786432:qyrLDZyIiAIbyLpnbcUbOaQZ2cvg0TJ9fPG:ZLZyIiAIbopVOvVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776777333, "uuid": "ae9741a1-1d86-48ee-ae93-177b0d36804b", "value": 31895759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776777333, "uuid": "f63dc388-2504-4844-a2ff-11257689360b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776777333, "uuid": "0264b69e-3f52-4577-a626-6edfbba237e0", "value": "com.wallaper.artist.collections_1.0.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc3be88-3d32-11f1-a769-42010a9c0008", "comment": "Malware payload (VioletWorm)", "timestamp": 1776742360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776742360, "uuid": "13c1a303-617e-4dff-9da7-4a3146f850bb", "comment": "Malware payload (VioletWorm)", "value": "a8c264f3e5be5e136dbee01c4a98de95", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776742360, "uuid": "3f179243-abef-4201-a9f5-5f27990bcb24", "comment": "Malware payload (VioletWorm)", "value": "04c55a8c15f15b4de910bb025f75210a8917714c88381be8de58506c65086985", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776742360, "uuid": "fe6d8baa-b310-4534-a52e-399afc60abe0", "comment": "Malware payload (VioletWorm)", "value": "219ac32697b696cf5cfd9f587eadf9334fee19b7", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776742360, "uuid": "ef29f801-5717-48d6-a123-8019209707b2", "comment": "Malware payload (VioletWorm)", "value": "5bfc8e27650ac7274001c7f3a75c19156afe238963cbfa245a470962ab5e918b8557eb24117eb4c2e86fbf1198c9e25a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776742360, "uuid": "458482ff-d949-4d68-aaaf-187b4e39e1c2", "value": "T192F39E19A3A210F9C15AC17556D797B3F8B3F8311331AEBF5368CE351FA4D506B2A224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776742360, "uuid": "5908ea30-0d34-4c0e-b6c5-5129c6138784", "value": "ee1afa4b09fdd59b5d9ae15e0afbc8f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776742360, "uuid": "70f3d0b1-0071-4b7e-a59a-53d672207696", "value": "3072:xuygmgT6MlbYirhhWZ0p/b9hswzqlAAD6ZD3QgKaFK:gy0T3lbYirhhe0ypAAqsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776742360, "uuid": "e194d5d8-5154-4d37-800c-80d3bca2452b", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776742360, "uuid": "abb1d73f-3e85-425c-b58f-0013f8abdcd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776742360, "uuid": "55e739e5-8fb4-4557-9f39-139577cf22e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbeb9ae-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775052, "uuid": "106f1ff4-43e0-4804-91fa-86910a9613d2", "comment": "Malware payload (WeedHack)", "value": "6b6dd6480354ed3e06cac4e2a2b2c807", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775052, "uuid": "d5b0db2d-3856-4c5c-bbe4-c6394e5c595b", "comment": "Malware payload (WeedHack)", "value": "08759820cb1ec46a50ce8288ce1e5b83ff5c8af7b3ec0c092e5e4fe6bb54774b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775052, "uuid": "6fbfaef9-68a3-4e76-87d0-9e730fac5460", "comment": "Malware payload (WeedHack)", "value": "41360b98c2b5b3f930592cad48de81b8bab6be6d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775052, "uuid": "00583f37-facf-4296-a01c-0b1af03db6ac", "comment": "Malware payload (WeedHack)", "value": "7eef19b54a227c81da488ba875842fde494c19a30a21300db6ad25b1f6f94a8113e2b2a267eddf46611952c565432614", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775052, "uuid": "6c805c94-4d88-4d37-8089-51c34d49d1ab", "value": "T1F7D433368E17AF13DE0943BA50C4CA4167B9CA61356D153C2DF7BA2B24D4871E23717A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775052, "uuid": "bcde030e-ff68-4bd0-a8cc-1afbc9976111", "value": "12288:gDxzE23hf2/zOLzJomudOMKjvsbJtSOoRYql5fWLsTQ4F0nUfzCA2PkyCaE5c30:am2xf2a3Wmu8pvaKOoRYqlNQmLCjwa30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775052, "uuid": "3219d58b-8863-40d8-9f85-c7316ec56d5c", "value": 640320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775052, "uuid": "9974aa21-7b3a-4f44-a9b1-53f59c88247d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775052, "uuid": "62458fe7-7a24-4719-81ff-9da31947cb03", "value": "donutsmpduper-1.5.2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a69840-3d73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770052, "uuid": "1815a2e3-b853-418d-b079-6a3b4d822dcc", "comment": "Malware payload", "value": "f7c187e0f646a8899cec4f8ffb53c07a", "object_relation": "md5", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770052, "uuid": "bc18c3f5-b63d-4220-a17a-23a31b93db75", "comment": "Malware payload", "value": "08804ee949d204981bead6c54d202542a6eb0c441332fee91798222ad73a0507", "object_relation": "sha256", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770052, "uuid": "9ec645c5-3be5-4383-9eb0-b049ab4b4520", "comment": "Malware payload", "value": "957e07518bb2d8375f2217b22a8c90f53c644847", "object_relation": "sha1", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770052, "uuid": "2dd6acb0-471b-4423-9bfa-2da075405f2c", "comment": "Malware payload", "value": "9264856b11cc59dffae0369fad32fbd0b95893774dda1046527d6fd7e6983a592324d65e406539df35b5b3601c81230d", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770052, "uuid": "759819f5-08f5-4c53-a5b6-f7156ce92a47", "value": "T16321B66F7017C79817CB2607B7EB864CF420C83804DA26E1B81F038563959745EED524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770052, "uuid": "9c065372-d8e2-43b1-a462-c679446c3a83", "value": "24:Po7SVS+DmhiPfABA6d1YCMnnpNGsJvICnDysLKrCaHZ0ni0+fABogX1Y:e09CuGennFJtDyqKuajm1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770052, "uuid": "be0d9f2c-d409-4953-9321-9bfde62be2d1", "value": 1374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770052, "uuid": "1d3b41a8-7c98-409f-a6d8-0ecb1c786e3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770052, "uuid": "3e53ff14-fe0b-45cf-9ae4-f9ee0447043a", "value": "08804ee949d204981bead6c54d202542a6eb0c441332fee91798222ad73a0507.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0d6261-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776774918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774918, "uuid": "9de4e4ef-b95f-443c-afe3-208801d88125", "comment": "Malware payload (WeedHack)", "value": "536ee8b6dbc49528803dd04be543e573", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774918, "uuid": "028b9f90-22ba-4418-899f-c9e2648575f3", "comment": "Malware payload (WeedHack)", "value": "092a5b6301cdb325dd1253554dbdf586f841eb496899677acacce9c5c9bdbc1e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774918, "uuid": "48a5ece9-40d4-4840-b07a-78960dcc5b35", "comment": "Malware payload (WeedHack)", "value": "121870b494dd77c1ddf4fa82a1e94703d73d1ca5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774918, "uuid": "2d066761-3894-4038-ad65-c1c4b720d790", "comment": "Malware payload (WeedHack)", "value": "027aa1ae24580b1cfd618b1835d85619e74c0fc3fe0288c8f69f4204432e0698f96a00cc8ce1e16c6e88e8d41b624b53", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774918, "uuid": "aec8defe-2e86-48d2-b517-c400b2d35df4", "value": "T1BA8423B1DA8EE852C90F94769B413AB8374C2540F6673CABA4853152CFE6313DD3B617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774918, "uuid": "1fa2d8f8-e540-4ef3-bfd2-899a60bbe3b3", "value": "6144:JwK8hKBViI5NrUj+MS8hQn/mAfjndjYXA2bAIKX/XKc8:QkBlCxSYW/XbdjYXtA3X/6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776774918, "uuid": "967a2793-bb40-4d21-b1e1-97bf002c99e6", "value": 378683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776774918, "uuid": "3ad9a5bd-8258-4769-b3e4-84ed8f28caef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774918, "uuid": "253a3ba6-c68f-4fe9-9c60-5e991169eb44", "value": "092a5b6301cdb325dd1253554dbdf586f841eb496899677acacce9c5c9bdbc1e.file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744cef2e-3d2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776739656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776739656, "uuid": "db12083f-a0ec-455d-a870-5df63da7e783", "comment": "Malware payload (Mirai)", "value": "f7c3496459201d55f3b3e697220c81ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776739656, "uuid": "51a83d4f-2cfb-4e26-b246-4bb68746cfe5", "comment": "Malware payload (Mirai)", "value": "09d57b8f45e25f9f161470dc2853ed2a41986721ee7b919a7d33c8286dc30c75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776739656, "uuid": "beadc6b6-352f-405a-a69d-6b90b0960b62", "comment": "Malware payload (Mirai)", "value": "6fd9773275e39f8c9406083ed2d95ff09ed41792", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776739656, "uuid": "b1b3eb85-c417-4ae1-90de-3ba2cf9cd806", "comment": "Malware payload (Mirai)", "value": "fe7eb35b6f33a61b31a866da7069baa35c3b8b7c97d9d70c9114040a0eb3539beb79f061b20f7a0376b885e57f7dafeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776739656, "uuid": "0834d63a-27e5-41dd-a2be-9e7e6a3b566a", "value": "T14F3317C4E903D9FDDC5619712137EB328772F13B1029EA87E7ACAA22AC46B41D44729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776739656, "uuid": "e5d85512-a140-4896-acc2-bd76a933913c", "value": "1536:O13kynNjv6czSEZeLmI37KNCgoT9poQzWxS2RAfah5jQ:AUyntv6cuEZ437KAgohpoeiSi1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776739656, "uuid": "2576f60c-51f2-4a43-84f4-247fc3088002", "value": 54864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776739656, "uuid": "565fe0f9-e65a-453d-9789-017d8700942c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776739656, "uuid": "1fb2296c-71ff-47ee-bf46-e35a7f1ae1a0", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c955e1-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754714, "uuid": "6c540b49-9475-46d6-beb4-548c92175f35", "comment": "Malware payload (Mirai)", "value": "620e715bc0d1f91fea2a992ccb10db47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754714, "uuid": "8112affa-35d6-41b9-9b67-0907e51bae2a", "comment": "Malware payload (Mirai)", "value": "09e0f144fc215441f6ff4f8ff76c2be3b7f604041801b745284fdc1ddd2e5265", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754714, "uuid": "de8d4160-6955-450f-bed4-cee199a6ebd3", "comment": "Malware payload (Mirai)", "value": "aa6cab1a1c58e10d09f388c44d365e83ebe14c1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754714, "uuid": "a4da257c-798b-4318-95f3-ae7a4ddaedb4", "comment": "Malware payload (Mirai)", "value": "15d0663705bde602db4b6c29f1d63ef2462f25696cf6a16a5415887c990c1013af4825785116c21f0b39f41bb2af97a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754714, "uuid": "29f62cb0-8cc9-42dc-88cf-c4901262a913", "value": "T139732985B8809F14C6C5177BFA2F108E330297ACE2DEB3539D145B6477CAC2B0E36A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754714, "uuid": "d83b66fc-e34c-459e-b003-e9d1ed52f99f", "value": "1536:NkniCvLhqvSs6w2SiEyEtRCqq/BsoLmpMguHcUNVUHalw7WuuH0hsfC2ermQ4Wmr:+LhkSfwXXTCqjoLmpMguHcUNVUHalw7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754714, "uuid": "73013f32-d3b1-4c4c-8a75-d7645a5a2bbe", "value": 79896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754714, "uuid": "5d448b8d-3b47-4949-a64e-5661265c12c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754714, "uuid": "cc6bf814-cf6c-430c-9c3e-e43fbf438ab9", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232179df-3dca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776807380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807380, "uuid": "94e2145f-5263-4bc2-83d6-cbcb3c536e4f", "comment": "Malware payload", "value": "f5bd6072161a05f483fbbcd7b2ee1052", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807380, "uuid": "daad97a6-d4e9-47cf-84ef-bd4fc22ecbdc", "comment": "Malware payload", "value": "0a22b2662e6f8c5b3024ea5f64a789b66c711ba5d6debafa288177295d1510e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807380, "uuid": "fa40d6ca-dfaa-44e2-a36d-f5fdb210d3f1", "comment": "Malware payload", "value": "d48fce1638a1ee74464bd12f4b751ec91b4f0930", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807380, "uuid": "f830e14e-5808-486c-924d-a18bfa752ee6", "comment": "Malware payload", "value": "fd5345e65670a1e200705f43ae5dbeab331cc7477121e3ca76ecacc56c9b659bb3d7fb79ad3679f24b7955643afd3c09", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807380, "uuid": "c1b0d12c-f9da-4e6a-b78f-a826635b7dd1", "value": "T1E44104BAB4628E30336DC5BD75C9654CA7578AAF491A2E74F043743C27BC32470746A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807380, "uuid": "b8abdd88-115e-45d1-ac7b-b7fd655bc5a2", "value": "48:vkwvpihneZZn1oBydX8JtonmzEvJGU6ljiPq2MTCki:vkwYheZZK8s2mzIj6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807380, "uuid": "09078d9d-adef-468b-9be5-1b77cef089e2", "value": 2083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807380, "uuid": "cf496f5f-cb1f-40e1-9462-95aadc8e703f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807380, "uuid": "a46daddb-5c90-471e-84cf-7704ed715310", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f37bf6-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776784003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784003, "uuid": "13563f45-73a8-497a-8490-0aadc447f86d", "comment": "Malware payload (NanoCore)", "value": "bb1d3346dc40e0f93bc20d47cc45249a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784003, "uuid": "de569d63-1752-415a-b298-3fae999e2761", "comment": "Malware payload (NanoCore)", "value": "0a326c130fb55d6f158b793d4c1373aac4c5280bcd9d57f97d10ff7c4d2bd3c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784003, "uuid": "7edd1b68-8d5e-45bc-8db3-3964cac29d69", "comment": "Malware payload (NanoCore)", "value": "2d3c7dbeb7bae49475df29cfa1d94a975072439c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784003, "uuid": "d30ec238-ebda-450d-ad2e-62250a955dfe", "comment": "Malware payload (NanoCore)", "value": "f484b6005d85b2b98db67c5501f4c4a11c8b43f14b052c2ae48dbada4a47307045ce68a1927b47a163fa3e9c29c16ed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784003, "uuid": "9c43951d-e90a-4d5c-a45e-74ae3a0ad2d1", "value": "T1ED14CF167BA84A2FD2CE8678741202138379C2E399C3F7EE6CE455B75B527E5060B1E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784003, "uuid": "a6cab31b-1544-4bd2-a24c-898877fe937e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784003, "uuid": "ec930ebc-6b5b-4e2f-9c0f-183e48d69ab1", "value": "6144:gLV6Bta6dtJmakIM532bTnvHbLOupQe4li2+f:gLV6BtpmkWizzLVpEs2+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776784003, "uuid": "501ee3f7-756d-4376-b936-2e563e624b07", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776784003, "uuid": "63c526f0-4aff-4cb9-9553-5259536a63ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784003, "uuid": "5d757f45-d947-446a-8aba-fb4af841129b", "value": "pipalpay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8756a1-3dd2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776811017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811017, "uuid": "6f577ec5-7198-43dc-8e4c-4678de24767b", "comment": "Malware payload", "value": "cedf2351bc6259bb12f596528434ea9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811017, "uuid": "04dad44f-26a1-4340-a6cd-417b392ea22e", "comment": "Malware payload", "value": "0aaf7ad7e875cf3a4596df0a24678bb024cb960c4ca9a26fe5fd6ed76e287beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811017, "uuid": "630c93ba-0bf6-4290-ba71-2a7bddd0a5c1", "comment": "Malware payload", "value": "364ed35275aa8d821b25daa6e9f323d6185e2727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811017, "uuid": "939170e8-e09d-4ad2-ae0f-f4911c721734", "comment": "Malware payload", "value": "c4e42da6304ecc6923cfdc93be52c27365c37b0381b7ba5b662f8d1d6bc16b5f0d00ba2b1b4abf532dbc0794abee7400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811017, "uuid": "a5d5c2ac-750f-47d0-9893-80e925458074", "value": "T146163307B9393D8E857BE272E247DD3120D84F5F6AA86534E6FC8E15E230B142B63635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811017, "uuid": "df06e0f3-28df-4141-a352-43039b73017b", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811017, "uuid": "3ce4e902-8c21-4dfd-8be4-dd9a95392d9e", "value": "98304:KOL6ePt2D6ItzGskQL5fMHnm6+lcxRuNj4EiKEpnlMDZ:KOLv2DyQLGV+lcxRFZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776811017, "uuid": "56477ad1-224f-4e01-9ec8-4f25052e5552", "value": 4098560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776811017, "uuid": "3504f7e4-cf71-4ee8-bf12-69b58c33404e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811017, "uuid": "add6604a-44aa-4668-902a-779f832df5c9", "value": "DiscordSelfBotJJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f835951e-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808597, "uuid": "a36679ee-a2e7-4584-8780-4980b43ab26a", "comment": "Malware payload", "value": "c8d3d9e029c92a2260e7b98792b17f3c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808597, "uuid": "1e7da880-a1e3-4153-abea-b0e602dbbf30", "comment": "Malware payload", "value": "0ac8ef75974a1e69c74855aea131206598a060feab1790282b8ca1c431058fe0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808597, "uuid": "0ee7e71b-72c1-4240-9214-ff4008d58311", "comment": "Malware payload", "value": "b1b243bc7bf7e280d531b9c0b0c4434c400050f8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808597, "uuid": "0875ac6f-1743-4ee0-a727-ce298ab753e3", "comment": "Malware payload", "value": "8ee78b847f6963c3dce8b0399c1adf3a415c5e01ed4f97425eb238b815fd6838684267fb696d4445719bfa74db92a551", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808597, "uuid": "27737204-992b-461e-b350-0ebda86f588c", "value": "T1EDB633302E3D7DAD0A5CC77A74BF7F2E0FA14E50C868E2CA56A36193545F9811A3BC61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808597, "uuid": "93c73eed-383f-48b2-8965-b6f762ec2407", "value": "49152:yySugX1D64nfuAXZIWxwdsP8lyS5+3Hcsp8D2cHCmopYDKbOD8oV6DKjB2CsbgV2:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808597, "uuid": "a233dfdf-7895-4a17-889a-0899beb5af35", "value": 11165653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808597, "uuid": "3e33d983-d424-42f0-bac8-584ee8079429", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808597, "uuid": "85964729-7ece-4eed-996d-2ae196851416", "value": "WD.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead790c7-3d61-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776762618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762618, "uuid": "c27c5473-31b0-42ee-8d90-073adf485c25", "comment": "Malware payload (PhantomStealer)", "value": "22b3d581e9cf32b658e38236a960bcc3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762618, "uuid": "3b77c181-b615-4b5c-afde-67eede263ee4", "comment": "Malware payload (PhantomStealer)", "value": "0b6fba80681ba970600ba61090ee389bd6aade34d408a4bc6de9a412781f14a5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762618, "uuid": "a1b4a60e-e9eb-4937-88c2-b26966885d70", "comment": "Malware payload (PhantomStealer)", "value": "578aef0f698f5f7d23b8459c3c0ff49312d923a6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762618, "uuid": "5cea9007-b5bc-4cbd-a38b-1581f310c30d", "comment": "Malware payload (PhantomStealer)", "value": "f0c463011ed984e22ae726d3bceef9c7091d151ea1676c31efe263d849db44ab53161639617aec784580418e1089ad68", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762618, "uuid": "cdfdaeed-add1-4c6a-97bc-359ec3612a66", "value": "T17D740338AAFA0019B1B3EF54AFE47493D96FBB633B0E985C1091034A4623D45EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762618, "uuid": "6e98e5c9-ca5f-4560-8233-3c272582aaec", "value": "6144:auPphfm/yFZLFj+9oF6/mNC3aZvHA1xNAPgBHqRieE4vZzUmncEgLxXhh6:awphfmKrLFj+9oFpNCqZvHA1LuwHqgen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776762618, "uuid": "69a10c46-9040-4a01-80a5-7a65c93d52bd", "value": 339198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776762618, "uuid": "d945d313-7fdb-4783-9eba-1609cd82255d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762618, "uuid": "e6674bfd-9aa2-48ae-a211-d7ed8ce001a3", "value": "TT COPY 8410122904 AND STATEMENT OF ACCOUNT FOR APRIL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af119733-3dd7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776813198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813198, "uuid": "1406dae6-aa00-4df8-95f4-57f4dbf2bf5a", "comment": "Malware payload", "value": "fa29bbbf983ffda4e177e5ab493ebdd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813198, "uuid": "5bb910fb-739c-4358-ac8f-885ebbf8be45", "comment": "Malware payload", "value": "0b84eb02038088181afabfd21487aa9010a300eeae2aa3324a07fe28e690e9c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813198, "uuid": "7cabf0b5-80a7-45f5-829e-f3570b2e27ad", "comment": "Malware payload", "value": "e673ecd0f5c995c4f13efeb962e8836860762494", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813198, "uuid": "c64fdb26-58ec-4ca7-b906-3063d52605e2", "comment": "Malware payload", "value": "c442108b36c781464a7b34547d419c417b256fced48fb4c5c9314b51ed91f4733cd31ea486a3d597a5c20283db252caa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813198, "uuid": "dad085f1-eec2-4a87-9610-6095f7e543c3", "value": "T104530223D3269DACEEFB41F38D09A5D51F75AA9153D2DCC1F3EB4B911431263A100AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813198, "uuid": "75da2f9b-9f11-4cc3-9bce-0a1638b80409", "value": "1536:hO02HBibG4orju2tX42xfeUOz1eOt31BSjcU5G4u+qgw06WX8:Y7hVS2hxWUQ1eM31BSjcqG4u+qgwXWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776813198, "uuid": "b93b9b55-129a-4458-b63c-483cd53cde79", "value": 61708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776813198, "uuid": "bb0b210d-1c12-4d74-9ba7-dc66c1756d95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813198, "uuid": "53d7b896-3198-48c1-8ec8-3fc93bd73bcf", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5eb629d-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806338, "uuid": "47661466-6bd5-458c-b450-c4b04979c8bf", "comment": "Malware payload (Mirai)", "value": "863842764f797a68b70efbc7e7b078a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806338, "uuid": "cfbf1823-8375-4639-acb0-74b7a60b3af2", "comment": "Malware payload (Mirai)", "value": "0b9b6144e9a92924ca083af3f23dd41077f160c5b32f7a27952b3d9cdb744a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806338, "uuid": "5cf18eca-2abb-42e3-9361-20f080f8ebe2", "comment": "Malware payload (Mirai)", "value": "11b2ce4bb3f2b8c62b8680a0b90bc8cb58a111f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806338, "uuid": "84d26694-69ff-4e5c-b489-c17a84375310", "comment": "Malware payload (Mirai)", "value": "513f3004230ba6e38aaa5e76b26e13a2967508ffd86e5222e4d943790c3ba057d5e7a77619479ef4d652931b7355a1e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806338, "uuid": "8d209c5c-9467-4855-a6ad-d7b99ad7197b", "value": "T197F2E1ADD1492C87DB3DE9711443F7C823719E1BA3D5CDA1D261EF85008AC237DA9AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806338, "uuid": "359fe4d2-07d4-47dc-b5a9-cf051162a7d5", "value": "768:dPe5sqv+4bjW2zpBszQSX4c9W41uImZmMB+4uVcqgw09v:JH4bjW2qkIh5SXB+4u+qgw09v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806338, "uuid": "117a26ab-948d-4298-a67d-d0fc0a216cfb", "value": 35308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806338, "uuid": "cf4724fa-a70a-440d-8425-c63ce1bfaf5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806338, "uuid": "58f8ec9c-d731-465e-be58-2a5d480b9044", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b9773d-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776733489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733489, "uuid": "b75e9495-e3f1-4c66-9159-caba285aa955", "comment": "Malware payload (Gafgyt)", "value": "1b692fb32f88cd2e2f3698b00c973ad0", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733489, "uuid": "9e5572b1-9f8e-47b8-a55f-2f03364f27e2", "comment": "Malware payload (Gafgyt)", "value": "0c232d56b05aa12dab59feb94212832a21dd3c8ca0a434ba8d34ee42e8c5065e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733489, "uuid": "b6e1c83f-1c89-47c5-8a5a-c601606e2d10", "comment": "Malware payload (Gafgyt)", "value": "3da8a327be281b3bdbf06acb410bdd5622a5044c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733489, "uuid": "c57111b2-b813-4a6b-97f7-b96eec9522c5", "comment": "Malware payload (Gafgyt)", "value": "20ba522d50d3f4640b452e6f35f9be8b24011cebc6fe6151a011a8faeada3b9139660e18b25f29f4d18c4e32fabc4262", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733489, "uuid": "7baa99ee-4c37-49f8-8d57-c446b3a7f595", "value": "T128932A05F8454B13C2C327B6B6CF47493B266BB95BEB3302A6346EF02BC5B991D25960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733489, "uuid": "a2ecac16-bed3-4dd6-8069-d717c8b48938", "value": "1536:iudkeuUpfVIesFnU/DrRTO065hiwK9XE6Y8mRxqQEqn/lJXfPe:3ussarE5hiwKq6nmRxqQEqn9JXfPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733489, "uuid": "e6ca1180-3f54-4df1-83dd-9faee502e28d", "value": 96196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733489, "uuid": "d93d77e1-7c62-4e9a-87f2-e40869cb08b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733489, "uuid": "f5be0772-39bb-4ab4-94aa-b50910149b6b", "value": "assailant.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b012b495-3d74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770680, "uuid": "dec2ab44-26bb-4f9c-b62f-fa798ce697e3", "comment": "Malware payload", "value": "c22955244010cf2f405cdf9ea7511ba3", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770680, "uuid": "1409b2ad-1cf1-41ac-b022-dbfeaf6fe979", "comment": "Malware payload", "value": "0c3d64b1310fe9ce85aae9f250dcb9bca38141dfa7b0f17e0408c6a204dc1846", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770680, "uuid": "fead979e-967e-4709-a01a-e783227e12d5", "comment": "Malware payload", "value": "737b4969163d0a28de37b47df8ca905a1128535e", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770680, "uuid": "be33303c-877c-41d6-9f72-244dbb2db484", "comment": "Malware payload", "value": "3207ff596841ee2664e6202c7231bfefeefd8519b489b17e18c130cd99322acb33a9fd60920390ab0d8ea0718796a32e", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770680, "uuid": "6e0dd682-f053-4656-adf6-26bb30a9cbfb", "value": "T1A541F1101FF60338EBF74B35E8B96216A6217906EB219F5F02D4429844F5120E8A5F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770680, "uuid": "977569ee-e1f5-4a40-83c2-8a5b40440a0a", "value": "24:86KdmGjMDvSwjKUaWU3AcPWkp+/CWophvEJcdc44wZcvr4I0WK6c/6Cab7Oa7m:8vmeKpUQAA44wivUIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770680, "uuid": "c383fbc6-f340-4ce8-a374-4becc247843c", "value": 1887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770680, "uuid": "a79930b7-7262-4020-914c-228e15582bc0", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770680, "uuid": "4e7d7a87-e957-4319-85b2-d2ceadfa2ca0", "value": "IMG-285912218 lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ec171c-3d91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776783196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783196, "uuid": "7e0506cd-896e-48b7-8ecd-37a5de22dd11", "comment": "Malware payload", "value": "92c108900b84bbf4dd857deef9b48001", "object_relation": "md5", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783196, "uuid": "2600e3fd-a5ef-45c1-934b-3cae4bf3afdf", "comment": "Malware payload", "value": "0d9f37e5ada1fcfc7a97501506ef6dd7b76b9e4621988cea0ce51645c38739df", "object_relation": "sha256", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783196, "uuid": "33212d12-4c8e-44b7-8a73-c67a551f8e3f", "comment": "Malware payload", "value": "28a8fbbd93931ef72a85c14b6b342710996318aa", "object_relation": "sha1", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783196, "uuid": "e98213c4-1753-4af0-9cf1-653a3916a590", "comment": "Malware payload", "value": "8a805aee4d24cef86381721acbc0aa2d97d75c8c141615d1f9051acd126db7018ae1d59d059e28026e749639e0f0760c", "object_relation": "sha3-384", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783196, "uuid": "4deae5dd-05f0-49bd-9413-79ffd5ae2681", "value": "T1A9862222B38B8622E75D0277F92DEE6E14397E63073001E777E57D494C748C267BAA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783196, "uuid": "1ef0ba9f-9a91-42b6-b280-919c1cee1239", "value": "196608:/xFJFKJa9ldx2sfeyaBJ2mg6VlJfUdSqDevVadC9:TJFKi3ErdBJbVnQjDevf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783196, "uuid": "9bd5fff1-672d-458c-ad1b-39aac09e288b", "value": 8484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783196, "uuid": "804e34b0-55c4-4228-807d-cd890265dce8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783196, "uuid": "1ca16afa-5bbf-4c9e-b6c0-977b2070ccd6", "value": "0d9f37e5ada1fcfc7a97501506ef6dd7b76b9e4621988cea0ce51645c38739df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb25599-3d76-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776771644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771644, "uuid": "359607d2-a3cd-4e3d-ada0-76989ec63f20", "comment": "Malware payload (ValleyRAT)", "value": "fa55e12f8d16d1146715776972f9244c", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771644, "uuid": "7c3afb17-beeb-4f40-8630-dfc74257802b", "comment": "Malware payload (ValleyRAT)", "value": "0db9dd9882f27357be88527b19240b86495cf5fef5c9fccfdb8776485b091c08", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771644, "uuid": "ada90de8-8d4c-4197-8bd2-905ed26edacc", "comment": "Malware payload (ValleyRAT)", "value": "e72b93bd1fab02ed893c866be331933707bc6d6f", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771644, "uuid": "0b904bce-747f-4b83-a838-af6454bea5ef", "comment": "Malware payload (ValleyRAT)", "value": "27f3cea0a8f295ae6d3ec71b63c4a242d741b127ec0b13b7ab27cf0c4f763cecc337cbf0d9be5a2f20d81d24eddfc49d", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771644, "uuid": "4c66ec76-13c9-4bf0-b0a3-de4d2a8818c1", "value": "T1132833726BC4F847D39ADD73EE411D9ACC766813D280752B86C435DCAAF6502CB39AB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771644, "uuid": "648e6396-0646-41d6-a4d5-2ca489c85e24", "value": "b484b52df60e8d823b647a09bb1e39f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771644, "uuid": "fc9dfa0f-e61d-44ce-97dc-f3c7dabb0f38", "value": "1572864:f6TNu+Ov1zPENSL09SktUXnARViC+17XUrKCvgX62SWEwu0iLxkz9Fg6n:f6TNu+EpPENbTf1AX+K+gK+upLxS9Ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776771644, "uuid": "4b2a8dd5-4756-48cb-a38a-02eab94575ba", "value": 93425527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776771644, "uuid": "6e391959-5f35-48fb-b2a9-0264793417c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771644, "uuid": "cd923e87-33a9-4381-97a7-cbd39f56b8b2", "value": "88-ije.oo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6df4451-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808514, "uuid": "ac03c568-5922-4585-9b98-e994f6c8f041", "comment": "Malware payload", "value": "5101bb295942a5381bb5feaa07b70b4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808514, "uuid": "550e614c-2eb4-4b0a-a1bc-2cb987184a63", "comment": "Malware payload", "value": "0dccce596271bce0c01b23ba4e1aadf14703578e50dec2e74e274dc1af928abb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808514, "uuid": "c273bf76-1690-4611-96b0-3dbdda23a7e3", "comment": "Malware payload", "value": "df72fb379a9d970036090530432ab332917c49ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808514, "uuid": "e349a1f5-8ce7-4510-a80b-ab335a89194e", "comment": "Malware payload", "value": "b2a0c6ddfd458f059abd3dfb187484939bccce462d0851e4adf152ad068e8ddbbbef8a3704bb6b6e9d2b5f3b6607fb56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808514, "uuid": "4a0a245c-94ea-49c3-8fd2-87756e1b5614", "value": "T184562887B8D24942C5E43637B9BE80C433635EBA9B8752566D05FE3C3ABE1D90E35708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808514, "uuid": "5b9a5f3a-1dfc-4046-9f9e-3c080e03677f", "value": "49152:2WykElbTtqR6ARLnLVSrG1ocbZGrDuDkNbOdC9S5Ez:2WyPTtY6WVArDzVOQ9oEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808514, "uuid": "7acf0418-50a0-4ebf-a794-a6236926f93b", "value": 6095032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808514, "uuid": "acc3b3f3-e976-4510-9cec-6beb53b5adbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808514, "uuid": "c2a3f5e5-9b21-4d48-8dc2-18a39400bbcd", "value": "h2rapidreset.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2a5600-3d44-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776750167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750167, "uuid": "2725c3b8-6f63-4dcc-a202-c09b005ffad1", "comment": "Malware payload (Gafgyt)", "value": "c8629d7a9c1d68cc241a73e8711f42bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750167, "uuid": "d10f9302-4fc4-44bd-bd4c-b1373a936200", "comment": "Malware payload (Gafgyt)", "value": "0e470852686590b66f18846c93d5d4ee4a12c920270a495b96439406e79c8e40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750167, "uuid": "5549bd5f-2d24-494d-9a24-6d43cf293c57", "comment": "Malware payload (Gafgyt)", "value": "1c32b35aee02bd12a80be7d01777e15c291514b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750167, "uuid": "e9d96d4a-998f-4d7d-8345-65557ee765c3", "comment": "Malware payload (Gafgyt)", "value": "9387d7905b5b82522cedfb4dc5e8798c2af236d7ad533fb576587a40f24d3be6a97f219b1d2e486bf00802ef8a34f331", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750167, "uuid": "956953d3-854b-4dbb-be89-0025de098d12", "value": "T10FB33B86EA02C9B3C08306F51BBB5B155A71F8B60E1BCE42E36D7CF49E51089711AF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750167, "uuid": "9588d9d4-ac1d-41b1-90f3-0b086b9bdfb4", "value": "3072:Z7oOdI23uGtQVnuZrBLEiYJ3WZJnwfDkdnh9m5lfnkKzIUnAi8:ie3uGCWhEiYJ3SnEkT9m5lfnkKcUnAi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776750167, "uuid": "c960480b-cc69-4bb6-838e-1207251ac378", "value": 117276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776750167, "uuid": "6c7dac42-3a00-434a-b8ab-dbc11bfb03b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750167, "uuid": "95485022-7853-43ca-8589-54bffeaf50e8", "value": "FBI.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ad963d-3dac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776794582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794582, "uuid": "c73ab978-6a01-46f7-80d1-68c432034258", "comment": "Malware payload", "value": "b1f2fb42ab2f4ad0adfb05288b094bd9", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794582, "uuid": "361bbb1c-1869-4840-8721-e6b7ce1981f1", "comment": "Malware payload", "value": "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794582, "uuid": "e9a64730-8ba2-41d8-968e-6c62c4decc44", "comment": "Malware payload", "value": "8a9a52bf8b084bb220e1658dca828929afa12498", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794582, "uuid": "45b6c4a1-2943-4901-baf7-b4ba824fef52", "comment": "Malware payload", "value": "0b38a3ebe9583e38ca8ff23d60176e5ba6922525d03b0b9d7a346e2bc39a0cc30ca7e472c156d947ea8ab0f8f9fdcde8", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794582, "uuid": "5b8c32b5-f0f4-4f5b-9ecd-705445ccb287", "value": "T18C16E1C20E5F9658F1D2A6B7D3814E82C01FB1549158ADED71B0FE09A9CBB6971083FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794582, "uuid": "b118b64a-a82b-44d2-9a72-a9bb312c0d96", "value": "49152:zsvqA0ngA7jS0+dRK5a1HJNx909gJ0OBQ5y:zwlAMkI1pT909QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776794582, "uuid": "1894389b-d9b6-4f7a-8f19-9baf6c570921", "value": 4096160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776794582, "uuid": "48cee440-5291-42ac-96de-4bba8e42fa7a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794582, "uuid": "1474e1b2-8820-49be-a88a-c5d92e3cbf46", "value": "D1YrHRTg.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee57ee50-3ddc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776815452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815452, "uuid": "5bb069aa-a54e-4a72-989f-5458ef4e5c7b", "comment": "Malware payload", "value": "2c4b3bd6592761261c6e5d0c1923563f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815452, "uuid": "570a455b-5304-49d1-9bb7-af8e42ddc9ff", "comment": "Malware payload", "value": "0f57fcfff65c2576fafdbb9ee33b32aecd2d570dc4d9fbd5add55bf67cc5a310", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815452, "uuid": "bf8ab847-ae94-4e4e-9d90-b42aa96540d7", "comment": "Malware payload", "value": "d03c2b5bb55c49937789c2b534af1c461f9bf256", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815452, "uuid": "71189629-b376-4c98-b1ed-c52c4bc31181", "comment": "Malware payload", "value": "144ba3de8f8140a97829e3233f2036e7fa0c5d1c9633ed06d31f1368882760f16970a4ad6e0a13ab699744d091b1bc4a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815452, "uuid": "995a0508-3ab9-4133-b71f-fc376ad38e42", "value": "T1B0137D6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815452, "uuid": "a39a81de-5a1c-4fda-8fd2-eae0adf408b8", "value": "768:bPGXRWNGxVe9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bKlx9cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776815452, "uuid": "f5122021-2b5d-4b28-8d71-b6b4e99c6ba4", "value": 45515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776815452, "uuid": "daff4a91-c07e-4bcf-a6a0-3bcd6c046820", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815452, "uuid": "d9ab78ec-367c-44b9-ba72-667491a6318d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8896bf5e-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806262, "uuid": "ee0160e1-f445-49e2-9bae-ec1a162fa680", "comment": "Malware payload (Mirai)", "value": "8188bfd58f5a38884415fee36c799091", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806262, "uuid": "3c63379e-9614-449b-a121-1dc2f0967512", "comment": "Malware payload (Mirai)", "value": "10074a5e704b836b16d980098bad7388f4f1979cb81972df3faa3481ecad88c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806262, "uuid": "c72a65ea-fbd4-4fbd-861f-5742277e8289", "comment": "Malware payload (Mirai)", "value": "7bf8d71d736534accf9a60ffe87a42fe2dcdcb52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806262, "uuid": "260a4722-5c75-4f1d-a6f4-4d3a7359b17b", "comment": "Malware payload (Mirai)", "value": "94c9796b511453ef438daa8e02587e893fa7c628ee9d3755850dd4f65605d40d4991f18a9426850952f17b38033bfcef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806262, "uuid": "d4c000dd-5812-4028-bf9d-18b8fdeed31b", "value": "T1C4F2F19A78BCDAD1EC6560B45F7C741F1585B128B4C880755DCCA237C7EBBD1362830A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806262, "uuid": "6e816fd0-9814-4bb5-b95f-c5b56380f70a", "value": "768:ZljX756mRPU4GEHt/NRbgzi7NfNzSe0x0VtnbcuyD7UHQRjt:ZNr5HRPU4GE/zzGmnouy8Hyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806262, "uuid": "7ce6071d-d345-49bb-80c0-877018d23f42", "value": 36028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806262, "uuid": "395d6ee1-2f3c-4423-83f4-e363ef2e150a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806262, "uuid": "55c04f78-a16a-4a7a-b13b-8f56878f23cf", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ebcbfc-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776801931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801931, "uuid": "f8d57e6e-6411-425a-b1d0-0791317ec16c", "comment": "Malware payload (WeedHack)", "value": "3e0371e0a8204d5850c386d630c09298", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801931, "uuid": "a71b5918-487d-4672-8718-8203f3a9cc4c", "comment": "Malware payload (WeedHack)", "value": "10d756841e065dbf33b50cab5fc564a11c824e160ffb30baca0c9eecbb50495e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801931, "uuid": "c78c31da-df87-4438-9fda-04216d581ec4", "comment": "Malware payload (WeedHack)", "value": "bc4a060fbdf4089e963f7489193e2c260f35dc2f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801931, "uuid": "93e8749f-3e83-40c6-b3f3-f75c8439e681", "comment": "Malware payload (WeedHack)", "value": "18ba16bc84209b13124b279448428a7c120c6725def4c4bc5089082de716f01f57e30043632850e0134f3e3d81921cb1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801931, "uuid": "4925b85b-df4c-48d1-8b58-42dd4dc29be5", "value": "T1BF95338737A02646C9DBE0B735884D2653E68BF5B49ECF83B765BD46F9205B4E40032D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801931, "uuid": "10314388-ba24-479b-a4c1-b78415cb831e", "value": "49152:IUvTmgi+d9IpAoSFFkc3xZ/I4fiKYy4aXxU5ucwOzl:1r2pBc3zXbdmsOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776801931, "uuid": "85470307-199f-4f1f-bff2-62809d569ada", "value": 2043526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776801931, "uuid": "d325f4c1-6309-4308-a6aa-03959e8814a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801931, "uuid": "314a4f77-7f83-460f-8bc0-5af2cbc4449a", "value": "dupe-1.21.111.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcf5799-3d89-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1776779753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779753, "uuid": "ab0e7630-9a93-4ad4-9192-e1dba4e376a8", "comment": "Malware payload (Meterpreter)", "value": "afa19256a8cead70e904ea6a4392ac61", "object_relation": "md5", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779753, "uuid": "19052b64-11c9-491b-9c98-56f27b79a24e", "comment": "Malware payload (Meterpreter)", "value": "115ce69b837e48342bd33072673c1bd2c28a7840a99f90785dad932f3b1518c6", "object_relation": "sha256", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779753, "uuid": "f54b3d53-34b8-4cd4-9e21-c4ef641e074f", "comment": "Malware payload (Meterpreter)", "value": "098ebfa2b5ea8177fb70dbf8d2948d1331c0185f", "object_relation": "sha1", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779753, "uuid": "c6e663b1-0fc2-4166-a80a-1366b1757196", "comment": "Malware payload (Meterpreter)", "value": "a1e6e922510778e9ec19c5c737fb6326004cd002ea0a2580eefe10a7aaafa98dcf014a61fa47d101b1249a2541a405a4", "object_relation": "sha3-384", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779753, "uuid": "23793fc8-01da-4fef-a127-06c37aae1eee", "value": "T143252A4BE2A355E8C52BC07447679772BA70B46642347E6E1AD4C7322F31E609F2EB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779753, "uuid": "f6e9cd03-4b5c-45e0-a9b8-76f605183647", "value": "8e4007c511e964bc07aac760e1494346", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779753, "uuid": "51db06a2-9010-4ee4-a9ef-cafe44c4a24a", "value": "24576:w64qL1xJmdG1kJPIkxuRBDP9t6ylv40JDtUD:w64qpR1kJPITzDqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776779753, "uuid": "657f8d10-b35c-45e9-b784-761632fbecb6", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776779753, "uuid": "fd3fcf9a-15b7-4940-9d40-1312f972ba41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779753, "uuid": "0e47a499-fb78-47e2-a2c0-e4aa7c62740b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cbb829-3d67-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776765180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765180, "uuid": "d6462595-5fbd-43cc-ad99-b997f9e1ce02", "comment": "Malware payload (Smoke Loader)", "value": "42ecfcda9202c73f35ba0405f314eae2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765180, "uuid": "54d8bd34-d00b-414a-a740-952276e27522", "comment": "Malware payload (Smoke Loader)", "value": "1321e3918a1ce8f9db14582fc6a4caaed26ec3b798026c67c28a6ca3ad235c59", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765180, "uuid": "684ed485-586b-421b-9ebc-b02ec2968ca2", "comment": "Malware payload (Smoke Loader)", "value": "6ea2ce7e1bc7ceafb440f25c67c0228ba5c8fb5f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765180, "uuid": "82c65324-cf11-4605-b2e3-2a096f8e5fc4", "comment": "Malware payload (Smoke Loader)", "value": "875b41ebd82f8ebfbb8e7d735fb588a5c91267a7f795c59edb59eb41dda1dce45d0d72d901ce0d93b98ff244445dd5a0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765180, "uuid": "7be2cc01-008c-4eae-95f3-fbbdf8783016", "value": "T10BC57B467CE410EDC49E7A3249F375557A78B88A0B3223C31A866E787E37BC10D7671A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765180, "uuid": "30c54406-e6f2-40e9-9765-a045411f62d5", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765180, "uuid": "652b5e26-d54e-4d7f-b9d9-8b78320ae587", "value": "49152:TrgWEkzFUUFOMtxCbOwy33TvLO/Qa1Ore03qWr57rsZ2moRT2NIGPVWAU2hRE/t+:TrhpRFtxCb7y33TvLO/QRetg8Wa1Q79w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776765180, "uuid": "8597c11e-feba-4aeb-aa75-c1cc18967d73", "value": 2608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776765180, "uuid": "0bc8229e-04ef-46aa-b1b9-de592b3139b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765180, "uuid": "958a1d35-a63d-4e5c-9f92-e8094111fca3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729bcba9-3dd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776811379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811379, "uuid": "c42d625a-fa57-4495-9409-ad274b201ed8", "comment": "Malware payload", "value": "85c3f6e2a6488aa17718b3687f8ac094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811379, "uuid": "090c5041-9dfe-428b-bf24-256398dcaa5c", "comment": "Malware payload", "value": "13af144a88b47447440f8bdb778e52c7798e048dd5a6a92b073835001eb3dbb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811379, "uuid": "428b111b-cf06-43bf-9d85-872392b81f5c", "comment": "Malware payload", "value": "0d30b1bd7d31feff7b341a5278274bce1161024c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811379, "uuid": "def79992-e811-4190-81b6-a525eae917a9", "comment": "Malware payload", "value": "c9bc2f538afc2ce53ea87fcd818a5f037b93096e5fe57250fd589eb0ad472aab2edf667c9a72070fa9b7e4cf314373cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811379, "uuid": "61b6571b-8dbc-4e3c-8f38-01c29f290f2f", "value": "T174630846B9828F03C5C261F6BBEF42AD371267EDD5EB3207D925BFA03B464D60D26510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811379, "uuid": "4ef34468-ee01-46ce-8070-cd0db4c71fb0", "value": "1536:0Jjy7MfX2F8nOoujNOnFKeNumWcr4wvnpO:0hy7Q2F8nOouTeN4enpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776811379, "uuid": "2e9a9265-d4fe-4462-bb83-0b5eaf6fb08c", "value": 67256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776811379, "uuid": "baf3d3a8-bced-4ef2-bc1e-8a48fa271480", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811379, "uuid": "1f19ec3f-561c-4cd8-be8b-226efaefc0a5", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c861f7-3d77-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776771770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771770, "uuid": "dd204bbe-6039-4259-8c9b-4f6e8e9529e9", "comment": "Malware payload", "value": "9986a383e5a23c481906e68f6dfc4025", "object_relation": "md5", "Tag": [ { "name": "portstringpge-space", "colour": "#E2CC18", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771770, "uuid": "28951273-924a-4ff7-a92d-825e39133e96", "comment": "Malware payload", "value": "1419313eec614bdb0fdfab3b6f7b068542007dd5cbfc3b8b6a50a440c28d0a07", "object_relation": "sha256", "Tag": [ { "name": "portstringpge-space", "colour": "#E2CC18", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771770, "uuid": "bddfb007-fc30-495c-a540-552e60b2d161", "comment": "Malware payload", "value": "dc7ca31aa4cc01ada12e12778ed911867498eeb2", "object_relation": "sha1", "Tag": [ { "name": "portstringpge-space", "colour": "#E2CC18", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771770, "uuid": "192b082f-c2e3-4309-ae0f-20a6a0b7626f", "comment": "Malware payload", "value": "7470315adcbae01567a449f7874c163bae1669eb75b22f4f359a3374c36b1effb50883cc33c13e2404b11f9ae35000e6", "object_relation": "sha3-384", "Tag": [ { "name": "portstringpge-space", "colour": "#E2CC18", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771770, "uuid": "6376dc00-cc5a-477e-9807-d3f85f7fe899", "value": "T1014108B406FA7EDFE819616EE40B59985ED016B7419128C226A4F2F32BD8792EE10950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771770, "uuid": "d8023607-df56-4292-a28c-c13e0504b844", "value": "48:Zr0vLuaRd6JZT3VS8xk6JR77O4SQNkgn5Pd60y:Zr0DDL6J/VzB7BjNkWL60y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776771770, "uuid": "5182b0f5-f508-48b6-81e9-029c15b037af", "value": 2024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776771770, "uuid": "c3325714-8b80-46cf-b5ff-24a6741b0843", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771770, "uuid": "16a1970d-b816-418e-a08a-82a0cf0acd52", "value": "$UI7zmK5S2OC = '4be1ce25420efcb8166.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e038aa87-3d92-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776783646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783646, "uuid": "e7ad8568-11a0-4b82-9111-8f6130f0ef39", "comment": "Malware payload (Formbook)", "value": "8e835de6f8d48f853396a3f4020383dd", "object_relation": "md5", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783646, "uuid": "a1168640-e183-42b0-a59e-58dcb42d9e52", "comment": "Malware payload (Formbook)", "value": "1476b66b2534df2e8202d45493622117d147bbf891a13787b2f5277d78d93e5f", "object_relation": "sha256", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783646, "uuid": "9a285840-3512-4922-bb4c-4e6c38f68b00", "comment": "Malware payload (Formbook)", "value": "b46142ff35e85f93a2b451a9d301c42e08a5ff1e", "object_relation": "sha1", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783646, "uuid": "f64dbd3b-144f-40c0-93f7-172f43b70702", "comment": "Malware payload (Formbook)", "value": "25788847a45a06854b72ffb1af296548e7206bc2edd0283c3eaa00b831d1f9e920a3bf1364cc7d73d23fb599b73e0afa", "object_relation": "sha3-384", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783646, "uuid": "e8bb4c73-ae47-482c-bc8a-b4d897f6de1f", "value": "T1A0A218DC77D44B7DC596AB3A06A3469806B0D402B943E7474AE4D03D6ED3BDE3483A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783646, "uuid": "e8b4a41a-02b0-47ac-b637-c3d5fcdef386", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783646, "uuid": "2a9199f0-73a2-4828-af87-425e2986b3bd", "value": "384:aExKC1Phn5fPeisCy4D3TYXspY/eIEgiGHUTdGc5GWMhMaciegGcoRf5:aEpR5neHCy4aegjpvBBegGcoRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783646, "uuid": "1ffa9051-cfe4-410b-9c3b-cbaae95ccfc7", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783646, "uuid": "8e1f70e7-3cd7-47d2-ad90-f123b27f2557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783646, "uuid": "b526e079-f192-46b9-998e-3bf65c7f84e6", "value": "1476b66b2534df2e8202d45493622117d147bbf891a13787b2f5277d78d93e5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75dbba1f-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809237, "uuid": "6e69a787-c454-4783-abb1-2ced4f721a1b", "comment": "Malware payload", "value": "48560a27b2eaeb0cd6d6199999790efd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809237, "uuid": "903ce306-f169-48df-b4f5-2d5ceb6b0c8e", "comment": "Malware payload", "value": "15089e2ea4154b4361180e737d38fd66d3c85951dafa534a121101dc97d29b55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809237, "uuid": "7bda4fc3-e9a1-43c9-9859-d7f92b8ff065", "comment": "Malware payload", "value": "ab5f28c70d5682927afdd38af6840f61b840f61b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809237, "uuid": "d54631c7-0982-4685-b3e0-65f31a200298", "comment": "Malware payload", "value": "94f48f6ac3f50befddf43ac957529eb64e5d2c18d6a6720232a46f162837627563354f33541294638cda9a611ea87067", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809237, "uuid": "2e11cfd6-33f6-4cc3-b024-f020afd418e6", "value": "T1278618C1E991D28AC63D6D72EFE5EFD8E2672E315C885A4AC9C4F33E1CB314484B5960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809237, "uuid": "e208266a-dfb1-48e5-9c66-e73309d94d8b", "value": "49152:P1kMdZ8f7wux2yq3ZMSlU6MyaVpqFa9KssG8I0CPw+wXeCYTIvMSrP361vp5uFJ9:P1kMdZ8fE2RqL1R9MqRwjEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809237, "uuid": "57189b24-849f-4401-8186-2dee2b212b1c", "value": 7930040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809237, "uuid": "76b3822b-fa7c-46fc-b4d8-d3b0da6a734b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809237, "uuid": "c3673212-2c1f-49d2-b193-a87c3bf12b4a", "value": "h3flood.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b772ed-3d92-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776783623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783623, "uuid": "862b648b-293a-4880-81f6-f5fec2e458df", "comment": "Malware payload (NanoCore)", "value": "be6e0aa792bc963fc1cbbcf7597077b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783623, "uuid": "1f1a12c1-1ec8-4a46-add9-44e7a22b3352", "comment": "Malware payload (NanoCore)", "value": "15887b4ba9168d51b22e75cf00a801787578e9d3d62064bd19bb8aed0afa3b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783623, "uuid": "8b59c579-3226-4e6b-ae58-1035865ff03b", "comment": "Malware payload (NanoCore)", "value": "56c345aa14a86af51eb14462cb2fdfc8042f83ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783623, "uuid": "12b202d0-341c-4cee-8751-46d4038bfbf2", "comment": "Malware payload (NanoCore)", "value": "81347986c7cbee52ec8cff0c1466ccc38eb93c85379522aeaf3163c1e97af4a154a3f285d534d20b0779b829a447c8d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783623, "uuid": "7216f536-aa39-41bb-9b0f-adc2caa1014c", "value": "T10C14CF5677A84A2FE2DE8679612252028339C2E3ECC3F3DE28D455B75F667E4060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783623, "uuid": "c879e8d5-687b-4cc7-a69d-31204f3b2be1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783623, "uuid": "b74aaf75-51e9-4cde-a9c4-79d9f5febbcb", "value": "3072:YzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HItnT9cx77B7aqetQ0XdeMBma18:YLV6Bta6dtJmakIM51x79PEQ8QVPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783623, "uuid": "6d913075-bf76-4b1f-9e38-249dc590b5e7", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783623, "uuid": "71dbfaac-7480-4297-a5b9-93d6a8bf1a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783623, "uuid": "579f809d-9340-4dda-942d-01f928387e42", "value": "tmtgrondi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82878dc1-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808399, "uuid": "06d36115-41f8-4394-b54a-8ecfc36e371b", "comment": "Malware payload", "value": "6eb2a942e5e4ce3f19de8248aab3a25c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808399, "uuid": "cf1bae26-c1cc-4435-8b3a-e581fc13d690", "comment": "Malware payload", "value": "1651711a0d430b7089a5281314ffb35877c6e593c53e9cb8ce1bef2091486a1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808399, "uuid": "c56df985-45d0-47a9-9d3c-f1c143ec7e59", "comment": "Malware payload", "value": "5c5c924cd967cdf4f7692a86a0c5d4f3589cdcc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808399, "uuid": "da426861-9a5c-44c4-9456-66844f196f78", "comment": "Malware payload", "value": "dac10ee3d676403b99c6fd87188ed0316e58866cfa54e03652952b3ed0d4be7f6455aad0dffa1ee8be47d92697e96095", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808399, "uuid": "780768c0-ee9b-4f3a-94f3-3344a19e546a", "value": "T12665D002FF816FEBC06FCD30892EC31711E9D98656D1622A71FC4B9CBA5D25A0BD7588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808399, "uuid": "0f837004-4c35-44ea-bd87-8e31acf4a0e2", "value": "24576:ZYnr5PrLsOf860KhwVfLeyxtD4fXNOUGC9DOWQyRe8OuZANRDUFtVXsAWku/bXZY:ZIrLyrVTT0f8UBJQxf2tGFH/rK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808399, "uuid": "195fbae5-1950-426b-aa5d-b9f56479a8d4", "value": 1527747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808399, "uuid": "560de1d3-f36f-4d3b-b1c5-c456482293cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808399, "uuid": "1a1636c0-e37c-4ffc-a7ed-b19263962e16", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377ac681-3d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1776773484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776773484, "uuid": "be82ef84-5403-45e2-968f-4a9d269cf28c", "comment": "Malware payload (ParallaxRAT)", "value": "1a75bcfb588114e83eb90be58635d7ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776773484, "uuid": "ae306550-55cf-44a3-89de-ce97c9ad243c", "comment": "Malware payload (ParallaxRAT)", "value": "16aa1ccfd99b90ee17e5e676b6927e8d3eac06fa2c0cefd0f84e4cb9f6b744a5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776773484, "uuid": "63bc712b-d6c3-4f9e-b387-f10bddbc9f65", "comment": "Malware payload (ParallaxRAT)", "value": "b106882ec3ae790941600e9ddf23429f1fb51ad7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776773484, "uuid": "96d25cd3-5950-4db8-9041-bbf3dd374f79", "comment": "Malware payload (ParallaxRAT)", "value": "32d07905d983fc4bf976ec6e6a41b577356722cc2248246baac1ec8642c14669b077cedf458e772218f3a193a6a4adeb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776773484, "uuid": "a0c4b594-b3fe-4da4-bb0b-cc072cc5afeb", "value": "T121A5054D87340AEB605B7025DBF8B81F5AE51F1E108EB1F866D54B553EB9F031888EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776773484, "uuid": "2720c120-7973-45a9-bc23-0a4a4f15f4a7", "value": "12288:qEyQZaX4X4X4XBoK5IlyhFuX8s9zlmxjUX4X4X4XHxhMfWQ8QNZwhexUe4ttCGwP:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776773484, "uuid": "983ead7d-7e0a-4fc9-a756-9d062cf82f0f", "value": 2238063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776773484, "uuid": "9418b012-b0b3-4f40-a535-d568760a6eef", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776773484, "uuid": "24817ea4-87bb-432a-8c15-77c6f33e8138", "value": "hyULMFzuSE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fa2d00-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809148, "uuid": "ccfb25a1-135b-4452-8ed1-30014b08cc1d", "comment": "Malware payload", "value": "297e0fef966395441ad57a4d56d00b43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809148, "uuid": "e8c94945-cbd6-499d-9581-7f700e1cf038", "comment": "Malware payload", "value": "19b80dade9c98594a3fad9a7dc3a5bcb074b66c5ec5e91fdf0d8e075ee3bc0ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809148, "uuid": "41012280-ea78-4070-a3f4-a5b78f0120f4", "comment": "Malware payload", "value": "d2f7e7d285a45e08d361812f7ba5ed3db17f3aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809148, "uuid": "523fa53f-d884-4546-b14b-9c32420c262e", "comment": "Malware payload", "value": "41876a55f515fc60c3e161e5f2cb45852174a8463a4b500bfaaa390e113f7461ed27cd21c83352b6c15682a50284dd96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809148, "uuid": "2eb3b644-d0e7-46c0-9572-8e68e718779b", "value": "T166566C81F708A126D95A0E324CA30F74A3506D82C2E8CD7F5609F76F45B1AF66A4FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809148, "uuid": "3dde359c-a9e5-4a70-ab90-a4b7b81ccab0", "value": "98304:OlEXA5vHkaeJ/Gdk3/DVGtRAyr9KwMsERjrABPBRvjEH:MedGobVVPjEhBR4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809148, "uuid": "5426e4c8-9e31-4f2e-8bd6-0c66d2935f4b", "value": 6029496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809148, "uuid": "a8ada3ac-9ee2-48e3-a3ea-6c4686d6046f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809148, "uuid": "b2d9b6d7-901f-4063-8d0e-f2358ff0e3b4", "value": "h2rapidreset.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af514e0-3d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775181, "uuid": "5cadeb51-4929-40c6-a073-084add34e0d3", "comment": "Malware payload (WeedHack)", "value": "99dded025404ba04a5566c076282a0d6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775181, "uuid": "48e80f85-7c62-40bb-9de5-7562bd979752", "comment": "Malware payload (WeedHack)", "value": "1a6007307eec998d554df1e2696a2d3e9bbea28a8a0c28768fa72f6ea909b9cd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775181, "uuid": "572aead6-ee94-42e6-9766-a615b1aa1067", "comment": "Malware payload (WeedHack)", "value": "3cca0c0e6ed67d29b7660178a0f1c6b23587f991", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775181, "uuid": "efa1c064-3611-40ed-b67f-0b0c6b7cfeb9", "comment": "Malware payload (WeedHack)", "value": "3b0066bb137685266e0f27086054a933e6f6b9a3963a495ef76f1f5b7a72d442c30aa33cc2b8eb4bb058e0bc6c8945ca", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775181, "uuid": "e6565794-5de8-42cb-8527-0414fa66ddc2", "value": "T1B6B2C037E42682E6E44EEE7522CA98777488127281D6262F1AA82F078DE3DCF57146C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775181, "uuid": "4d636295-906a-4ce4-a0ca-1fd27ea616a7", "value": "384:iE3w9gntqg9XmhpHqh6RQYOgDPAlkxeMKdrxnO2857nBxyOP9h7hfA3Kur19s:x9nL2hpKKPAVMKVrMtxyOP9hlXUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775181, "uuid": "9b2505ae-3c58-4fab-91f7-d70debbb34b2", "value": 25634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775181, "uuid": "dd94cb31-524d-47dd-a4bb-91588d70cc3e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775181, "uuid": "50f394c0-6885-449f-a592-7cd002028e30", "value": "Sigmatrix-1.21.111.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddd22b2-3d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1776781602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781602, "uuid": "8f13f65a-92a2-40a1-9fbb-6ea81adff89a", "comment": "Malware payload (DCRat)", "value": "3c3f3afaec1d4885f5521c8944d32fe0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781602, "uuid": "5519328a-72a5-48bc-a375-f4789560f820", "comment": "Malware payload (DCRat)", "value": "1ca676cf77bf3d8d1f69b16016a3f722d501072c5d4111ddd8e0c96dc6a23608", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781602, "uuid": "c603b03a-e6b8-4499-bee5-be37d786ad53", "comment": "Malware payload (DCRat)", "value": "70baa749af79b7fed486c4a753e535a830e1edd9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781602, "uuid": "88970014-10d6-488b-af2c-d2cb759a76f7", "comment": "Malware payload (DCRat)", "value": "cab497c6841c6c167fdd9e209dd1445ccd4bda495cb178ba23b8398438856f5fa0d4fa9d87e6d52fc61b981c379cfdd0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781602, "uuid": "f7d9cc9c-0f4b-4008-9ff4-efd2e8544639", "value": "T1AB636B003799C926E59D8AB4BCF2554106B5C63B2102DA0F7CC850DB9BAFFC64A427FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781602, "uuid": "4fda0d17-00ef-4f8f-a2a5-6fdbfcb8c36d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781602, "uuid": "6806a58f-c019-4ddf-ba3d-9f86dc5cf1a9", "value": "1536:LnRDMYMGN3PA4F74kYld+l9wTaY5wGbc19SV1bbsXxmT2/WpdoKN+as+SpqKmY7:LnJqGh447O1bbsX4hdlNK+xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776781602, "uuid": "2a66d36b-baa0-47bf-bcc3-8b4724e6acaf", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776781602, "uuid": "cf3be3f3-3a42-44df-ade5-f875c3c60c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781602, "uuid": "5ec60c2c-d6a4-49ca-be5e-2752656c0668", "value": "ctfmon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d8143e-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806345, "uuid": "b39f6e7b-aa09-4754-bc66-e2e111cead7e", "comment": "Malware payload (Mirai)", "value": "4312b5b863148d3cd58223c9a0a6bbb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806345, "uuid": "1e1b6aff-777b-4669-9a25-f2e7aee4a2dd", "comment": "Malware payload (Mirai)", "value": "1d032ee58df836c1a769ec51c86a57904c1e68a86e7ee479c92c3826998353c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806345, "uuid": "7efc5cab-5c83-437a-a277-30800cc2146f", "comment": "Malware payload (Mirai)", "value": "4ea0843790f8e79cae3d9ab960364077f54c4dfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806345, "uuid": "ca92d6b5-d133-4351-acf6-3decbca535b5", "comment": "Malware payload (Mirai)", "value": "aea626fa345b02c91ea1282ca4e6c55a2b7bd9ce70141311c39896baab78c0ab551ba0707ee8f49afd0499cd2b9c2fb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806345, "uuid": "1f0a4de3-afd4-4467-bfc7-4f4dfc9d6442", "value": "T1ADF2E16A21EEE57CC276E7BB025DAF1084983D079E03876F918831FE6DDB6387A18550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806345, "uuid": "e9f1e30e-d55b-4044-a19f-305041325d2b", "value": "768:4VLqaBByUVHThFjAfYsgzNQ2K/YVx+L4qLTpfZtX5x0gn:24UPCfGzNACx+L4qvNpDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806345, "uuid": "c639573b-8e50-4242-b350-ebcef0cce7a7", "value": 37044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806345, "uuid": "34ff706e-441c-462e-b6f5-3148f4ab40b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806345, "uuid": "8463a883-8213-4569-9f66-e74843d59480", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad85ba14-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806324, "uuid": "7165a1e8-96e6-4ea3-8fb9-265c8aeeaa5e", "comment": "Malware payload (Mirai)", "value": "cedcb6140fc7ed39d01717e0c5f25158", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806324, "uuid": "4cb5375d-2d65-4ab2-8683-d75f7fdb342d", "comment": "Malware payload (Mirai)", "value": "1d54d370e145facc9ae7b457909cce7c9cf558e56083c19aa7294d72a9ac311b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806324, "uuid": "fb6640f6-af74-4269-a745-8e09037acfd4", "comment": "Malware payload (Mirai)", "value": "2a15b337d85f132ecbd6d231fdbfbce2a381ec95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806324, "uuid": "3fdfb149-4c45-491f-a14d-63e5e43e0421", "comment": "Malware payload (Mirai)", "value": "c1d53a503b5b86731076a0c8de26585e65b0a4f232754b66c6dd524baf0cda91873b73389a03cd77b6c242357b0031f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806324, "uuid": "169d0749-62ea-48a5-bb74-e644b3312bf4", "value": "T142639E56CC250919C28A45B470EC8E3B1F23A5C063877DF716AAC3B9A467E9DF406FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806324, "uuid": "adb82f3a-9b76-4771-84c7-32845a621889", "value": "1536:m/ELeLiNaAQAgp4KbCV+7BuIzzCwZKEieMe:mIe2NDlgp/b9IIzzJhdMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806324, "uuid": "8f135692-ada3-4e18-a648-63366db1516f", "value": 67372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806324, "uuid": "23bd6b4f-357c-435b-87f4-abb3e426a64d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806324, "uuid": "38f1e5fd-f52a-4054-a650-eaed6518e3ba", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7159d089-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809229, "uuid": "f03fac8b-b63e-4306-86f6-493a9a2ccf46", "comment": "Malware payload", "value": "731a53982e00429aeae2eb428f69f8ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809229, "uuid": "f9eb8003-790e-486e-8c5c-82b5c00e53d6", "comment": "Malware payload", "value": "1db448d9c7ecaeb880c6ece94bc0b5aa3544648c7199dfe9e300af62b0c08dc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809229, "uuid": "f417320f-2720-4495-b954-d2c39f792eda", "comment": "Malware payload", "value": "81162ce4a5a004ec060cc530456537aa2b8ed776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809229, "uuid": "83490e7b-6e86-46ee-8377-4e1c5398d25b", "comment": "Malware payload", "value": "f6e36eaf954989bcb47b381311d56a8d7e2eb738b08d054cc16bee9d1cdb046df962aa61352d51336f80b06c956e92fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809229, "uuid": "7e2ee083-2cb8-4910-8b46-6a4eb23f8c92", "value": "T1B6562797B8924942C5E43637B9BE81C433635EBA9B8B52566D04FE3C3EBE1D90E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809229, "uuid": "3e5cc7a4-ef72-4e70-bde6-8c15d342a811", "value": "49152:xnslP6tvkK9Ezp0Le+R/Xu4bk6h+9hbFv5r4j5Ex:xnsstL9Ezp0pftaJFgEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809229, "uuid": "783481cc-2c42-44a0-a7a8-3adb0bd23b33", "value": 6095032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809229, "uuid": "ac4ca667-2919-4e39-9b48-f0735747240b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809229, "uuid": "a5630ab3-7aa7-4835-a9ed-cfff246838e4", "value": "h2stream.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946d378a-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776774929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774929, "uuid": "1a547ce5-73fe-446f-93b9-101c5b8089b6", "comment": "Malware payload (WeedHack)", "value": "671b0921b3c6c9cea13696fc6f48ad53", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774929, "uuid": "b67fe80c-95b3-45e3-8194-0927a0d56084", "comment": "Malware payload (WeedHack)", "value": "1e54245582aae4b4adff604459877d65fbbbf10a0e7eb1276976ffa6820f56cf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774929, "uuid": "ad8b6ec4-a3df-480c-bbe4-7d02a8716910", "comment": "Malware payload (WeedHack)", "value": "b04adf7c1b64bd9064a354cc70ce701d2f94fc31", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774929, "uuid": "c9292236-261a-4f58-839f-2d078e39e0aa", "comment": "Malware payload (WeedHack)", "value": "115dc16a563fdf6ad96c97f069ecc6acf530a19836f319291f47072e95ddd6b57cba99306153d072fdbca709cbca8dce", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774929, "uuid": "4d566fbd-cfe7-4ea4-8bfb-c421ec9e736c", "value": "T11434D024735E44B3E82F8232EE01AD3E1D3D58DFBE4A29E250DC1847525B8A4E35679F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774929, "uuid": "bca2ea64-bed8-456c-81d8-41ce64de0572", "value": "6144:RH3TpI3TaL9zWdCUNsr0GpbcooTPsfBTQ4RL13oWI:RXTp209zWdCUNsr7pbZmKpo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776774929, "uuid": "b4fd646b-47c1-4c21-ad74-4392db4acc99", "value": 248653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776774929, "uuid": "ff2ba71d-5e52-4ea9-b369-bd8db63bfc3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774929, "uuid": "55bd7d84-7ec4-4c2e-9dd9-c6a5f35d6743", "value": "1e54245582aae4b4adff604459877d65fbbbf10a0e7eb1276976ffa6820f56cf.file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03de3e55-3d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775116, "uuid": "dd18cb94-8c85-4e73-b6df-79f94c4c512b", "comment": "Malware payload (WeedHack)", "value": "636dd41b6da05ad7d465377139095e64", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775116, "uuid": "b5d4113a-50eb-4e8a-88ab-6e41d979ec2d", "comment": "Malware payload (WeedHack)", "value": "1f5abca3590f9ab8f5932d70e907e02b882844652db1cfa0a06baa492443d658", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775116, "uuid": "d6963788-8794-4ef3-8d2e-995496569e6e", "comment": "Malware payload (WeedHack)", "value": "09c2072221216e2f34777e7cc653e095e2aec050", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775116, "uuid": "87cdd840-8284-4c16-8e6d-cfadd29341f0", "comment": "Malware payload (WeedHack)", "value": "717c765e01694bfda133b01425cbe601327cd06eded531edcfd12bbeb9eb074ed238b8f3d7075892a2a73576cb6babfb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775116, "uuid": "c9569cdf-f17f-47b6-9c77-c472abfd1407", "value": "T14626F121D65E0032F913EF33E073B5A034FFEE92530BB4653A69194F582AA91C7BE516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775116, "uuid": "b690e8b5-6099-43ad-af43-3c3c533da729", "value": "98304:K1p2SKrw/PM0YTe8kkcEXf5b+KSFEzDcKKn1ihyrh:up2OHbocA5b+T6PCn1ihyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775116, "uuid": "c1c0af3e-aecf-45f5-9f4f-26a07bcfcbea", "value": 4770010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775116, "uuid": "fdc3e7a2-a22c-4796-adef-971fd3612521", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775116, "uuid": "1cd07a0a-0933-4eee-9ae4-0f0afbfbd0f5", "value": "Krypton-Client_1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7b213c-3dd2-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776810916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776810916, "uuid": "5e3e0b20-71cd-45f5-99ec-f1a7c5143796", "comment": "Malware payload (GuLoader)", "value": "1e00cdfab8f0c96ff7c511d3dbaf2c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776810916, "uuid": "819d6cb3-006c-4a3a-855d-d5ebf5a380d6", "comment": "Malware payload (GuLoader)", "value": "1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776810916, "uuid": "32cafdad-0138-42f2-9043-1598b0ef1803", "comment": "Malware payload (GuLoader)", "value": "e913d3ea7d8289c02d2c111043d93d9a539711fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776810916, "uuid": "ea33bd35-2144-4e6a-8792-d6aebe7fad81", "comment": "Malware payload (GuLoader)", "value": "37967983808114d6ba445c2bcd494e5d67cc9cdfb70b9105c926072140839b30f7c18bb5471ae097993b2526f2d2f106", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776810916, "uuid": "e48542b1-412c-4d01-88db-38f4d43aa279", "value": "T159B422111391D079CD52227952367BFDAEF53C606435970F6BE03E2A3AB0B42ED1EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776810916, "uuid": "2e54d4e8-fb9d-4c53-b7c2-666f6b4f5743", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776810916, "uuid": "61df5d6e-2eba-41e6-8c4f-b1320853db24", "value": "12288:5TA+Q4ew5hJduOwhDvTdU1EpDaY+6Vt0SGZNu49ezMgIa:5TAP4ea8N7haY+kuu8eAgIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776810916, "uuid": "7877d99f-0d14-41e3-9453-0c5df8e487e0", "value": 507594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776810916, "uuid": "0015c59b-8dc6-444e-83c5-ad6f6863d656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776810916, "uuid": "37fe0d20-1e31-4f7d-be41-87f0a414f3c5", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daea9355-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806400, "uuid": "165b3397-bca7-4482-a2a8-4278afb36b39", "comment": "Malware payload (Mirai)", "value": "1864ff350eca0429c472d58fcd4aa8eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806400, "uuid": "1eaee2f3-d88a-4da7-9de0-8cd6036ad6d0", "comment": "Malware payload (Mirai)", "value": "1f776690b5528c229fd0dcd991dc8a0a66a4421cd7afa83dd7ea6eb685322dd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806400, "uuid": "c3e321bf-ecb7-449d-af66-d90cf6c40ba8", "comment": "Malware payload (Mirai)", "value": "4bdba5eebfdc38221182155d9783cb836e412f66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806400, "uuid": "50b5e478-137c-40d5-a0fa-41ff091832e6", "comment": "Malware payload (Mirai)", "value": "06d8af16443e89433bb4fc01d87992d62cd1035fb9453d304581a2f69febd19b1a9f1146a5483c45fd6c4eca1115a6c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806400, "uuid": "4d173528-137b-4a5d-a951-4624114b4c14", "value": "T12FA3B509BF510EBBD8AFCC3709AD1B4228CD655722A93B797634C528B64B24F29D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806400, "uuid": "e34f6881-cc30-4295-9e51-2f99a6c20924", "value": "1536:Gg91m3p7NsU78JXbDKJMLJgwDlUwqH6qZ49XYT9yPbKnJLA7:x91Op7NsJj5DlUwqaqxaqLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806400, "uuid": "7330979e-1d66-4f07-bec2-670384421360", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806400, "uuid": "e9b52155-b978-449a-9cb2-00f35ee2f214", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806400, "uuid": "93b55fde-d170-4c34-aab3-75c55a28f1fd", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8945ebd-3ddc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776815442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815442, "uuid": "5d169501-2a20-4979-9527-b1cae1b48fd2", "comment": "Malware payload", "value": "ac23a106ffc45383f98a871c25388610", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815442, "uuid": "3326eabf-3961-4b31-982e-c0d60a9d7d73", "comment": "Malware payload", "value": "217db70a30b60d6f855d9347251889c5c18ef895057619fb8480a31882c53ebe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815442, "uuid": "134992d4-fbd2-4a7e-aaa0-3a03b4a2ddef", "comment": "Malware payload", "value": "7f19f92d426aa329dc43f3679b56c1100e6f305c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815442, "uuid": "390d61df-028e-4dde-87ab-4277f83dbe45", "comment": "Malware payload", "value": "6bc872983974eca811a887cfe2513b2eb00112c0a5f02eb0ff723e24c2254fad650e3e59245cdfe10719daa19507805f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815442, "uuid": "2cef4256-a987-4667-8fff-324933b34cbe", "value": "T14943015BA20BF335CD2221B110550345FA7D544F626AD76B055CA7EB4CE76CB28F0FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815442, "uuid": "7c45cec8-917d-485e-9e48-434e4740e23a", "value": "1536:CpYH1ZnTj9AxhzAgr/Y1ftey8WCRhlLYlN1dUFuO:EYH7nQhzrwLqGMuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776815442, "uuid": "e04f7699-c0e5-4d2a-9e26-d96983f988d7", "value": 59692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776815442, "uuid": "bc268259-359a-4dcf-a2f2-2b5f3cdd6775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815442, "uuid": "3189a1ab-c284-40ab-b675-7bbf03afaae9", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b994c41b-3d6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776768548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768548, "uuid": "09efcecc-a312-450d-bcd3-1651389c59fd", "comment": "Malware payload", "value": "af5a96da4846f37af9b38e2997b44c63", "object_relation": "md5", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768548, "uuid": "eff3d932-e24a-4aa7-8995-188c65ee4456", "comment": "Malware payload", "value": "22374d7c9634ab4e35c6860ad77c7137fb3553004a86a50ee120b665ee81f1b2", "object_relation": "sha256", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768548, "uuid": "2f4e2aed-134a-49db-a05e-5979c6a7d8cf", "comment": "Malware payload", "value": "0bbe67db858b4d948687a67d3b84bf991a6b7990", "object_relation": "sha1", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768548, "uuid": "95cb6961-b30e-4a21-b66d-34983a9c5173", "comment": "Malware payload", "value": "f1891010492905c101c9d1849024a2c1bb45591a31db2573a67e2c06eac38e24087db13beb4cf0a29af990981a7d1421", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768548, "uuid": "5858c9ed-f358-4977-98b3-d43be4564d06", "value": "T17F72EB41A2E46204E177BE3B98B67B410877B8E8FE61C70D47A0B81D15F1A20CC35F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768548, "uuid": "7168cb47-2de8-4e77-95dd-a429f5c96619", "value": "48:bEAtsjwL2LAJiYyGhYaR25B8ZkYtbHTO/7/0Iw:QAtWwqGib+YaRA3az/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776768548, "uuid": "383e0862-560a-4251-af1f-5185436a6987", "value": 17255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776768548, "uuid": "dcd2dbe8-c97e-4f30-a4bc-2c799a17b993", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768548, "uuid": "bbbed4fd-817b-4627-aade-9dd9b8a7c150", "value": "spisokszch.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88095f2-3dab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776794397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794397, "uuid": "8a577854-b8c8-426f-b5b4-bbc92555f2a7", "comment": "Malware payload", "value": "211571fe53a767e37428005a5db04e6f", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794397, "uuid": "7fdd1081-c8bb-4191-ae95-f90c29a4c834", "comment": "Malware payload", "value": "24af069b8899893cfc7347a4e5b46d717d77994a4b140d58de0be029dba686c9", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794397, "uuid": "b7c543fa-6157-41f3-a014-9411bd8c5da8", "comment": "Malware payload", "value": "b0c5cc36fa9132379186b1cccb55da67f78e8c53", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794397, "uuid": "bbd4fd74-019c-4a3f-9641-d1d8adf3bef6", "comment": "Malware payload", "value": "51b04fd539a7b3884222fedb0aa9f54418a4b01d4af47400af504ce86a813e242482361f13575037e3a4b36fd36ffbd0", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794397, "uuid": "5b34a487-372a-4cbe-977a-1a19e1759ac0", "value": "T10EC533B897C2A081D98542771A8A71CC840B690EC86F1E5B69D671E3E3FF3CD6347E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794397, "uuid": "75c484a8-22ba-46d8-9720-02d83a1c0df4", "value": "49152:tbAYD2r/uSozF48yTQMVLvF37kTPC4/RvfIg36o8Rpr2BIPwEXJvp:tFeuSDZZtLOPC4/RIyvsLp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776794397, "uuid": "4c7e9315-c9d0-44bd-98bc-4f9030bf8e0a", "value": 2531772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776794397, "uuid": "60557c67-312b-4169-ad57-464b261a9640", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794397, "uuid": "25b43312-c679-40cc-85a3-e5aa6c8b0d6f", "value": "ZoomApp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8aaf4f-3ddc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776815447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815447, "uuid": "e278ef0d-2f4e-4661-b79f-09b775581baf", "comment": "Malware payload", "value": "9a0bd5ce500eae789ff9a625149c25a5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815447, "uuid": "c538a674-a95d-4d4d-a9fb-3a58b12e8f3a", "comment": "Malware payload", "value": "252a16b81e9747194e978f19df8ac0f59fadaed886531b8409408ee4625c7e26", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815447, "uuid": "271bbf39-ce90-48cf-b723-31e2e4bb3376", "comment": "Malware payload", "value": "73c1e66d253c7b6b749a79717c9ea366925d0365", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815447, "uuid": "f75d92cb-ff6a-427f-a1d4-f6fd8069aa2e", "comment": "Malware payload", "value": "5f90fd14cc42954021f3e365eb66d801e753b289974f8acdc57e0fdf86788ff4f790750414a8c0e9a7c3b45bca8fb44d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815447, "uuid": "790d4378-9245-4cba-b394-244735136162", "value": "T15D52893721F08B32D7D061C8A2671B614F72A60B456724B8F4FE5B259F2DA0370EBB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815447, "uuid": "36585f28-abc8-4948-a0e0-af0e818e1938", "value": "192:cCupK6p4hvZ5mN9oKNpivvV6PFITVaHvhF:sp4hvZ5mN9oKNpivvQPFITVaHvhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776815447, "uuid": "1b20930a-d47f-4b2c-9c09-1b8832b0e2bb", "value": 13571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776815447, "uuid": "e0264b27-9dad-4afe-aac4-7be1da114aef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815447, "uuid": "0f04d24a-d67a-4e72-8c6e-56b012950a3d", "value": "252a16b81e9747194e978f19df8ac0f59fadaed886531b8409408ee4625c7e26.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c02424-3d46-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776750961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750961, "uuid": "e871266a-8c25-4a7b-9a2f-328bd5b1b715", "comment": "Malware payload", "value": "53da987a0e5e07d21746380ab4b5ec3e", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750961, "uuid": "6524ebd1-1262-4982-83f5-6f39720efc92", "comment": "Malware payload", "value": "262f2c3f4df6beed37924ce9899d7950ce5b2bc5837aabaf1c9c79631873ffdd", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750961, "uuid": "4044bf72-45ee-4178-bbda-8ef1e857be4d", "comment": "Malware payload", "value": "9bb4354f3d6a450c9aee6c51df37472b3bf2ea1f", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750961, "uuid": "9afdf984-d407-44c9-97e2-369042be1dba", "comment": "Malware payload", "value": "48a7c9cb0a075db996ba4bcc5dd76d81f7ac16d39be5a82a1d0dd75334fc808ce58ac9c8e87e716aa9deb4f9c5def098", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750961, "uuid": "36f7b0af-9018-49ea-82ec-a629372040cd", "value": "T1FA630907EA4261E9C85AC17DC2526632FB717C020361DBEF57847B362EA57D02F3998E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750961, "uuid": "4915043c-e1e7-4289-a1fa-9d93e137e19a", "value": "91a4d86b004d49986f2fce3383dbbdb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750961, "uuid": "fcc31dbd-bc9a-4949-8423-a6b182d3d070", "value": "768:kAvv4H15M+AmehWQ2bO/M2hjy7vo43umLX+eA8upMWkWx8tJLu39r1ggggggggg0:CM+lIWQfjyUdqX+eAjM+oJ4/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776750961, "uuid": "3f3e5c30-4d5b-4b0a-af25-cd4964f628c1", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776750961, "uuid": "2c0e2c1a-b3f0-42de-b5a0-d4092b32d430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750961, "uuid": "a6e7834f-1c83-4485-b193-6db189a9b48a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5447992a-3db2-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1776797155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797155, "uuid": "fd4cb182-d80e-4bac-92da-cf566590ca36", "comment": "Malware payload (KongTuke)", "value": "67bba14e16706bdcb9387d7435fc56ab", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797155, "uuid": "a7902bf2-dd9e-4c67-9ba8-aa6a2118dcba", "comment": "Malware payload (KongTuke)", "value": "26afa0db1b0b97811f1011eeb6e1ed5185ae44f83d4f2fad6776fbf0d3264d9c", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797155, "uuid": "e3fd398a-7285-45f5-b246-6d3bd0b2ad00", "comment": "Malware payload (KongTuke)", "value": "f34447dd8597708a2a3c82bdec0164f83859359c", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797155, "uuid": "21377849-20fe-4e80-83eb-da8f35447254", "comment": "Malware payload (KongTuke)", "value": "4c739882fd57d046ee22d475b4b28f1294a8cb2a96d3d8b7c899b27853961ce7c32820d57292ccd2375a1a41d4cb4201", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776797155, "uuid": "24f224f9-3a02-49b4-8c59-71cb66f01ecd", "value": "T1E6F47D7BD8F2236D9F94D39F54ACAE72A2E37708E3938D1C149433864AA59CD0F511B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776797155, "uuid": "de33ac78-7cd4-42f6-8eda-d2789099cbe3", "value": "24576:wKj2nMsHV30fW8UFRzbWhQ/sRyPnvHcV3oTEZkJJ:wKj2nMsHV30fW8UFRzbWhQ/sRyPnvHce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776797155, "uuid": "82dcf32c-dfc8-404e-8b6a-9355ec22d07c", "value": 793084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776797155, "uuid": "d2473942-ff6b-48e1-a72d-cc45e519a446", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776797155, "uuid": "a561d04c-b854-4a05-8fb5-5c4bf5e33919", "value": "update.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7abb86-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754922, "uuid": "c704db6d-46a5-44e2-9ab6-ef1d5e8c9288", "comment": "Malware payload (Mirai)", "value": "6b5311abbab07600042081f37f1355e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754922, "uuid": "f7509595-7cb7-4394-b25d-414204827bf8", "comment": "Malware payload (Mirai)", "value": "26c923ffa4f40b3f99f58d4421ad96af2152a22ef2cb2e8d17ecf9ec1993b595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754922, "uuid": "a4848515-e671-4612-b25b-2171fe37042e", "comment": "Malware payload (Mirai)", "value": "0884181f78be058445d8817237bce7af63273d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754922, "uuid": "0c92e9d8-c858-45d1-98ef-9ef7c3ffda02", "comment": "Malware payload (Mirai)", "value": "3c83e0fcae2affb039c770f428157492ffa84ee1309f68dcd46ee3803cca40329ffdc9a9411bcde2ef7ab41a1a707ac2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754922, "uuid": "ec9d8dda-50f3-418c-99c5-889d2dcc5406", "value": "T1E0D2E0B91B0B4ADFDEABC8F9C3E413A025650E129903FD4A71ACD7435B5B4C4A117ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754922, "uuid": "0fbbff00-81f3-464a-90e0-55836fb58432", "value": "768:3xMWBhAHuLegF1aF4NscfOl8liV7YJgGlzDpbuR1Jt:3xdBGuLea19acfjliJYVJuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754922, "uuid": "e80e5856-6946-4307-9d37-92a108fbbf87", "value": 29420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754922, "uuid": "089a71d9-12fa-4622-972c-cf2297f147ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754922, "uuid": "7e77966b-3d78-4606-8946-54bfa1bf28d6", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b572947b-3d21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776735041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776735041, "uuid": "04795411-7c97-46e9-9285-3304efbee495", "comment": "Malware payload", "value": "083b2746b0e5e608fe419ab7872ba8a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776735041, "uuid": "02febf07-e2a4-4193-85b6-b4a220ebced5", "comment": "Malware payload", "value": "2782475af3287809eabfe279a25a1171a6d71df0f00ddec707c605b4f28021b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776735041, "uuid": "85c15cc2-defa-4ff4-82cd-86b62c69abdd", "comment": "Malware payload", "value": "b78dd2c8612f42b6dee96a992dac9971a9d2724c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776735041, "uuid": "fbcbfd37-e50a-4f3e-8ed1-6c690b959027", "comment": "Malware payload", "value": "607c19ac5176cde9e5cd4b53c273f303e8a3869ffedca7afd7907cbe0b1999633060db05b1723237a435e21f5d613f70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776735041, "uuid": "38135c32-a320-4610-b239-25d47fd9bcaa", "value": "T1A907AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776735041, "uuid": "9acbcc16-bd47-42b9-b442-079930eadc3c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQe:cqYUQuVDt0TZEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776735041, "uuid": "c73ee3e5-454e-4f16-8dcf-b67bf87e8a37", "value": 17727488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776735041, "uuid": "07163073-37b6-48f7-a74d-63c89dfcff76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776735041, "uuid": "9d2cdaf2-9aa9-4546-895d-15c91d60e66c", "value": "2782475af3287809eabfe279a25a1171a6d71df0f00ddec707c605b4f28021b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17241f59-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776783738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783738, "uuid": "e9d2a960-f2af-4f57-b41b-d02037eeffd6", "comment": "Malware payload (Formbook)", "value": "3912d425845b3a1ac327aa01085e462b", "object_relation": "md5", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783738, "uuid": "bdd517c3-6bbb-4d32-9236-c22eaa2e315b", "comment": "Malware payload (Formbook)", "value": "2788fb910102febe17d62a3d5b95d631b88bf69c934787cabc83e83db35b7a38", "object_relation": "sha256", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783738, "uuid": "0b082f0f-99e8-4bb0-ab90-727a5df58137", "comment": "Malware payload (Formbook)", "value": "1c90edb020d523afeee44c9e08f13581c759c3c0", "object_relation": "sha1", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783738, "uuid": "1999807c-30b7-4f3d-ae82-35884a22b229", "comment": "Malware payload (Formbook)", "value": "0316f9155bb864e8a51536efc892b5cbdc142b714f9d32b71be6cccfe1af9d853fb80824955302b85d48ce156f92cc60", "object_relation": "sha3-384", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783738, "uuid": "dff33468-a6ff-4bd9-8652-ef0f8c96c344", "value": "T134542279D3EEE013EC2AA7B9F243946BC6CDCC211956104BA74A973D7BE42CD6908247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783738, "uuid": "040920b2-7294-443e-860a-262659ebbcd4", "value": "6144:ZEDuVGynb4/l6asduILuKiruLTVxQGXTwdcZIbiYjO+qg:cuVhY7sduSuKirubLEqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783738, "uuid": "5568d1c9-ad08-4c1f-b07b-744ffbfa51c8", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783738, "uuid": "90f04206-d6e5-4a8a-9b5c-cb1e9b24a11b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783738, "uuid": "b1b5c150-30ae-4906-91b8-9e1bab6e028e", "value": "2788fb910102febe17d62a3d5b95d631b88bf69c934787cabc83e83db35b7a38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0b3b48-3d76-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776771588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771588, "uuid": "232c599e-45bc-4326-b2b5-476714dada51", "comment": "Malware payload (Mirai)", "value": "e22d95e46cda6492714988e34b288f3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771588, "uuid": "5ba7b95f-68fb-4838-a7ae-376ef0842b9a", "comment": "Malware payload (Mirai)", "value": "27d397f799ed511deb733e025207ce26c33673abd8bc20625d0d0b756ff1a8b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771588, "uuid": "b10d73b3-d971-448d-8ecf-0c8fbffbe7ee", "comment": "Malware payload (Mirai)", "value": "09093eab42acbdaf6f0689459eaec5ac8628e673", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771588, "uuid": "49df8a1c-541b-4534-b5b2-75009fcbc0ff", "comment": "Malware payload (Mirai)", "value": "799c420140d7f3312e168f15d9a4c1540c49e791bebf186e9bc89291d6e2c45a4ba7265c59120b802b179be40260676b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771588, "uuid": "2fb65468-446a-4b16-a12d-1b5a003d652c", "value": "T1673318C4E903D9FDDC5619712137EB328772F13B1029EA87E7ACAA22BC46B41D44729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771588, "uuid": "f46ae0f1-76dd-48aa-8238-6d17f2424f20", "value": "1536:m13kynNjv6czSEZeLmI37KNCgoT9poQzWxS2RAfah5jQ:YUyntv6cuEZ437KAgohpoeiSi1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776771588, "uuid": "ee00e046-4c60-46ef-a274-80f9feb06b67", "value": 54964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776771588, "uuid": "76026853-db9f-475f-a8cd-9cd8d0d4d8fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771588, "uuid": "139a6308-865c-483f-827e-35ef3a0c6c41", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778dc425-3d4b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776752976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752976, "uuid": "4e20a313-adb8-4abe-bc88-e9caf97bf899", "comment": "Malware payload", "value": "6ebfe405700022fa34f963d23ced77d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752976, "uuid": "77509529-a1e1-4cba-9f9a-f9491034a0df", "comment": "Malware payload", "value": "286d2911db3ae69f3f7ece727ec111692c0102a4d033df87f8541771afcfc447", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752976, "uuid": "88fd034b-7388-4408-a7c9-7b64124ec424", "comment": "Malware payload", "value": "7b22dbdf12f3eaa1ef52894baf0dfdd98c098106", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752976, "uuid": "30d2b02f-0ecb-4c41-9f50-cf97c2f0c148", "comment": "Malware payload", "value": "45d3756beacdd312d72a78885d17a8007dc1c796162738deb814de5454c487b16e90ef91a8e3905ab95055124d47768a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752976, "uuid": "161f9c55-691a-449b-8207-bc9e04ebc6ee", "value": "T113565C03EC9555E9C1AEE1308A729253BA717C586B3123D32FA0F7786F72BD06A79350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752976, "uuid": "b0205f30-f93f-4614-a258-0d0544248004", "value": "49152:mU4GuNK7mYhXk6mGSmWDW1nI0KhS/GjNxsONaLQLmAMjipiUVirEpjai4yaPKOKJ:mUndO6nIBhS/GQUasL734x7rSEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776752976, "uuid": "2c072ead-f5b1-4846-bacf-bd0a50b83a6c", "value": 5984440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776752976, "uuid": "cabf55c1-af22-4254-bfde-507fbece5c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752976, "uuid": "029e5b13-8d2f-4aac-b5b9-6432f3fa090c", "value": "vps-agent-linux-amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62003359-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776801902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801902, "uuid": "ecf764eb-e913-4967-8e54-f85ab2a7a264", "comment": "Malware payload (WeedHack)", "value": "5b07df8ec032f8934b510861a5f3578f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801902, "uuid": "ac74e385-0728-4662-8d4b-643df324a536", "comment": "Malware payload (WeedHack)", "value": "2893bbe03a0914e86900e23713ad503519bb35da5813d19020404e963c78580a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801902, "uuid": "b43d15e0-69ca-4ab2-b606-54da6c8fecdb", "comment": "Malware payload (WeedHack)", "value": "2a635ea48627637565fb3c3f411b047654e3991c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801902, "uuid": "ef3b8f52-7869-49e2-84d7-dd949b676032", "comment": "Malware payload (WeedHack)", "value": "9d4ce81b9b9dd7e99d988016a10dd7b96cd7958d45cae4fe9838df0cef114e78ee44091f2fc9c21ec89ca81d7f9df28c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801902, "uuid": "8348edaa-2c5e-4b8e-9948-f49ecbd2e9fa", "value": "T15F43F166C1F9C480D1564F3EA4838F6D5CFF50C179EBDDA03D6502BA86EA78843EE861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801902, "uuid": "03f194e3-10b7-473b-b7a6-29a9c1d0efb6", "value": "768:N9nlbdjUghSUToN+6hBWL5HauzCF1gMf3m0O9PTh6JzkYmQiXkt2O+dKjp+:0g7J6hocuzCFWM+0KV6JIYPiXkt7MkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776801902, "uuid": "b49e7213-0f84-456d-95aa-0faecf681538", "value": 56444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776801902, "uuid": "2289a98b-2f21-459a-85af-ebef1b5243f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801902, "uuid": "28f4178a-c7ed-4bf5-90ac-e908cff2912f", "value": "dupe-1.21.11..jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc3f77b-3d89-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776779746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779746, "uuid": "8c930902-a5bc-4e78-8e88-00bbf88325bc", "comment": "Malware payload", "value": "aa5634ff5927a0387a2680a8b9861b20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779746, "uuid": "92a153c7-e60f-415e-9ef7-0fa7726e103f", "comment": "Malware payload", "value": "292ea9dbc5a1d15b769edb5df1602418931122455223081064ad7ea4e8ab6821", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779746, "uuid": "8235dff2-a93c-44e5-88e5-1f1dba14bf79", "comment": "Malware payload", "value": "2d6a94770b7dc25280d07a2fb66e5230e16710fd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779746, "uuid": "6a9ff088-f7f7-4684-b419-38d58d6ac377", "comment": "Malware payload", "value": "3b782f16f65dc44a9e8318ca4a34b176b0ec44ef662cb6d483db6940b7059402b42ebdbb7da0014a735563b3403dd0c0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779746, "uuid": "3e9b007e-34f0-4f79-9ad4-b39dc757e952", "value": "T1E471B00B97E88227F06B47345EE303676271FD609A72975E5D80122CAC911245E31FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779746, "uuid": "14367f46-0def-4d74-8330-8ee283826dab", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779746, "uuid": "cffc4517-30ee-4448-ab07-6882e38123d7", "value": "24:etGSLM2WR2/VTZ1Rqa1IetkZfs8u5KLXI+ZHUC2WI+ycuZhNjxakSo2PNnq:6R3VpVCRJshaXII0G1ulFa3Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776779746, "uuid": "211ff5af-4693-46af-884d-e78679778fc5", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776779746, "uuid": "fee958c6-9b9d-459c-a98d-a85e25c26f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779746, "uuid": "929075bf-1346-40ee-9704-70ec97828c98", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f02995f-3d92-11f1-a769-42010a9c0008", "comment": "Malware payload (Grandoreiro)", "timestamp": 1776783429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783429, "uuid": "da5f2f18-ca53-43d4-91b6-b0569a73ab55", "comment": "Malware payload (Grandoreiro)", "value": "ef5e7bd3e63467c9d08b5b69c9e371b5", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "goldsymbol09394002-dvrcam-info", "colour": "#AB147C", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783429, "uuid": "8d50ee58-b1bc-4f9f-ae1f-7fc8d61272f4", "comment": "Malware payload (Grandoreiro)", "value": "2a088e4f8d69b23ec7c554c753b1554c8bc7a86023eab3710b3e34c8e75ca8dc", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "goldsymbol09394002-dvrcam-info", "colour": "#AB147C", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783429, "uuid": "0eb3a9a5-aa9b-4719-91fa-299df3383f1f", "comment": "Malware payload (Grandoreiro)", "value": "4769de9c607e5f54f9b4b6967aa8dc0e1f85de37", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "goldsymbol09394002-dvrcam-info", "colour": "#AB147C", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783429, "uuid": "be9347ef-7bc1-4c96-af14-e5b462217f81", "comment": "Malware payload (Grandoreiro)", "value": "d850ab1967fa75804698823d3c6d993c8aae173453b80f1e1e945c882785de8787360a6d15afaa1fc83e9ce2519cadfc", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "goldsymbol09394002-dvrcam-info", "colour": "#AB147C", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783429, "uuid": "a2baf021-bcdc-4593-bc82-05be133059c1", "value": "T127563332AA458C3AC79043F4701F6B2A6E7DEB43875851D7395CA0861B6FFD0E53E0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783429, "uuid": "66bfb43e-080f-4d62-869c-c85c007a07cd", "value": "49152:57LMvLE63ikzoA71if9kzA9Ycr1JVj17377Nu1+GfcAteEReHJWhpL2PDJSiKAee:w1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783429, "uuid": "b7eee32c-97b4-4d94-859d-34c13f89c79f", "value": 6346752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783429, "uuid": "a18d382a-40ec-4e1b-bc45-3fded5b8a2b5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783429, "uuid": "816497c7-f2ac-437d-83fc-73f5728b17b8", "value": "2a088e4f8d69b23ec7c554c753b1554c8bc7a86023eab3710b3e34c8e75ca8dc.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3085dd-3d21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776735050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776735050, "uuid": "e185b89b-4d5e-4532-bde5-a87e783fb67e", "comment": "Malware payload", "value": "7da7633d6472bf249da39e994ecfc776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776735050, "uuid": "ecfb1984-cb9f-42a7-bbf4-325deccf22bb", "comment": "Malware payload", "value": "2a23549e3b73111d473e87fbc1f43e45e8576018af325b96891b6046cadcb3e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776735050, "uuid": "71bab27c-9587-4010-a5e1-bfbac4bd6f2b", "comment": "Malware payload", "value": "49a40eeaa8b885d7a6d138bd7dab59ca58ef8cdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776735050, "uuid": "df5bae82-dc4d-4280-91a0-4a691c33fd43", "comment": "Malware payload", "value": "a231fd2491956c0215365f264b12b3cb19d3d77e4391f15498fd985448734d84a560f823bbb45079a8b26aec380a8f01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776735050, "uuid": "44e96571-0b6e-4464-9e0b-e7dd4e1a76bd", "value": "T1C917BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776735050, "uuid": "7a12042b-95ca-46fd-adb0-bbc4314a6ca7", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQr:cqYUQuVDt0TZE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776735050, "uuid": "6a8aed2d-f306-4ea4-834e-746c741fd603", "value": 19922944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776735050, "uuid": "576ac7be-edab-444b-b9af-b82a5f819dda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776735050, "uuid": "cc48b361-c1f1-4baf-af50-252aaf24bda5", "value": "2a23549e3b73111d473e87fbc1f43e45e8576018af325b96891b6046cadcb3e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16cb3913-3d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776767846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776767846, "uuid": "d5c8904e-3830-44c0-a824-6c3c1446ea8a", "comment": "Malware payload (CoinMiner)", "value": "c083d481eca414760d8f09a4f0fe986a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776767846, "uuid": "83352ac5-9a5e-4e7c-9e95-fb033b3d0cda", "comment": "Malware payload (CoinMiner)", "value": "2b0f9c3d1b8a565237d1f60852931589f1f24c53ca63f44b211baa60005cfd23", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776767846, "uuid": "9d64acb7-416a-4ac3-b801-3a7b00a982b6", "comment": "Malware payload (CoinMiner)", "value": "a4a98de6ee96285d55de331d79cd7e91a6516428", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776767846, "uuid": "742466de-ef96-4080-acdc-a69886b203d3", "comment": "Malware payload (CoinMiner)", "value": "b1b8ff68066f290aa545c05bac2282e389208c8b5b95abd1f770c44d519da279360c0ffa5a9d3692ef7a8583a752e1e5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776767846, "uuid": "2c314351-53e3-447e-b7d1-09e0450a559b", "value": "T182222A2B7E890131E3E089F412B58B8E667C45736787B3DBF373D5590FA92448440BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776767846, "uuid": "051f90f2-50b2-4a9e-83ed-b245562efb37", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776767846, "uuid": "0544b19b-dc22-44d9-bd4a-1b2ef7901e6b", "value": "192:X15oJEWtW5BCx+etGPFJxTEZmFhSmc732:l5oJUWwdPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776767846, "uuid": "10231804-5b71-4411-842f-ac76a49a351f", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776767846, "uuid": "7bdf33ef-3446-4af7-8d86-8e0ee87a6742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776767846, "uuid": "9b20ac5f-beb7-489e-9727-d3ffe129d4c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8066e49-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775096, "uuid": "18826212-576f-409e-9ab5-88f7dd703ee2", "comment": "Malware payload (WeedHack)", "value": "42b9230179ad0f813622d427e971a922", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775096, "uuid": "05b409bf-4f1c-4249-8cb2-a7fb62f3e452", "comment": "Malware payload (WeedHack)", "value": "2b1ad169f9d8c198f80549c3f2544a0c4f4f43768cc0d5a9b3c5cf5b15dc33da", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775096, "uuid": "431d1a90-afb3-4fbd-a266-e7c0a54ed497", "comment": "Malware payload (WeedHack)", "value": "28965ad61879baca34bc2c0575312c8ffe6813c5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775096, "uuid": "53564d0b-0e4f-4347-b474-8db135977a84", "comment": "Malware payload (WeedHack)", "value": "4e0cd34300d20842fb862e1c22971965dfde2fdf5712372d49d342e8494f5ba89135326cee43b8b8f653d087aae9e439", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775096, "uuid": "4f5bc5e9-7c80-486d-8619-6805ff353845", "value": "T14A8533888143FBC491C5BF1C97C98D1C82365A9CDBBB3CBA4635B3C675699D6B882483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775096, "uuid": "688dba1b-953e-4d96-bbbb-03602b5634f7", "value": "24576:kpl5a7nIW553MfIfUUdGLjGBEuGNMFcOD1RqFsAvTt6jaRIKYNk9Dl/sQr:kp67555qI3do6BErNkJqFsA7hYWplkQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775096, "uuid": "d9d2a0ef-46e2-460f-b0de-42e0a804fff3", "value": 1777290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775096, "uuid": "72899402-b00f-4278-b297-20197489f0bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775096, "uuid": "c94c31c9-ae36-4231-8756-ffe3e705b43a", "value": "Krypton-1.21.11 (3)(2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad8ac37-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776808386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808386, "uuid": "4c69a62a-dedf-48b8-9140-1cf97a445607", "comment": "Malware payload (Mirai)", "value": "13ae0c2999e127fe768daf229719525d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808386, "uuid": "57a945d7-087a-4283-9202-4db2ded0b622", "comment": "Malware payload (Mirai)", "value": "2b526373f453242404ac5781e69784292b5d37ee5f136d5ab740224fc8567910", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808386, "uuid": "bceecdb8-3b88-44e1-826b-3934721a22c5", "comment": "Malware payload (Mirai)", "value": "5de333534eb2ce513582aefb293c3e88fddbb3ea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808386, "uuid": "601d48e9-6290-4a36-b15e-5df8b42c8841", "comment": "Malware payload (Mirai)", "value": "85da4071bd9f8811e5f85250f13f6289d269443b3d4dac80862f9ee64fda8e1cf3cacc59868c505509d64660deafba7a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808386, "uuid": "e2e57bff-d158-44ed-9475-e0e098912013", "value": "T1E7018CCD54E9A502C0B9DAC23B658A10D208DFC265ED7F3AECD42972C5EC924B425F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808386, "uuid": "6b19c370-5709-41bd-9489-568238d9b52b", "value": "12:+fFSviLfFSDa9BgfFeyPufFeDSZZfFeFe59XeoFmfFeFUyX09FRZfF/2fFUx7QfP:qFHLFkwkFerFeupFeFerecSFeFj03Rp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808386, "uuid": "a15f852f-3d86-4aa1-8df4-9c7ae871b5c2", "value": 765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808386, "uuid": "c95d4d68-47eb-4771-b523-ff828791708b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808386, "uuid": "219edbe7-3621-4f92-8553-a5bb6bd8a8e5", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7948a680-3dd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776811390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811390, "uuid": "e8c3256e-9e65-4293-a92c-aedc050c2321", "comment": "Malware payload (Mirai)", "value": "f7459bc26baf2db287c39770f6a1e19c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811390, "uuid": "785d3cc9-bffe-4c0b-9a16-57fca8c5b499", "comment": "Malware payload (Mirai)", "value": "2e6ff09733af439cf1b67b91d5919942527efe946729e36c096413a44c37d024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811390, "uuid": "c31412cb-0891-4aba-ba97-4282094ecb91", "comment": "Malware payload (Mirai)", "value": "393b5316b386ef91208e37a49d89fba91a38dba7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811390, "uuid": "7c51b924-eaec-40e1-a723-a968544d408f", "comment": "Malware payload (Mirai)", "value": "6f7106c5a55dd40cce779db838e85a5320798ef096e67316c7d1c6fc1cec8576410ffee39ba29de487f101871751d521", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811390, "uuid": "0f87dcf3-2529-4b2d-86fb-229a1f2dc4b9", "value": "T176830803EA41C47DC097D1704BEF9536D6A7B8BE033231196794FFA12F16AA0EE79285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811390, "uuid": "d74eac65-cce2-4362-83e1-4e960beef681", "value": "1536:YSMgYM5XAfMSvNRtvxDbzzFXJMZ8j65nUliINjwbpAii5jy:9zuB/88pQbLi5jy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776811390, "uuid": "8791dbb7-935e-4a12-87fd-3ad7807c2bfc", "value": 82376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776811390, "uuid": "99e95b0f-fbad-42bb-858e-7c62a59ee087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811390, "uuid": "a6a08b4f-7f95-47d6-8ff8-e1227fc16f81", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f832be3-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754707, "uuid": "592e12b8-9b8b-4701-8ca4-d0911fc33aad", "comment": "Malware payload (Mirai)", "value": "d9e93fb41a40db0cb7a5ba19ac951302", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754707, "uuid": "46cfd86e-093e-425e-b05a-a8aceda31954", "comment": "Malware payload (Mirai)", "value": "2f594939c4eba15b882a5f42753ad500af55c9abbd16b5d003c0ac538133b046", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754707, "uuid": "f437ff52-e81d-44d5-8890-a71e78f9bfc5", "comment": "Malware payload (Mirai)", "value": "6331ff011ef45390b9e7c990fdcb8ef6c810ebab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754707, "uuid": "72ae4242-4756-4983-8ca3-ba78e4113b40", "comment": "Malware payload (Mirai)", "value": "f4c1767381406e5df417ab268ed19ef0b0b6145ee735e6676e4f234424292d1948fa02e6b3f000bcaadfc378b53968c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754707, "uuid": "90ef5ddb-6611-4040-a73a-6397b2e436aa", "value": "T18D536DC6B4119E7DF5CBE7BE44220D0EB821626150931B27BB6FFC83BD721A48956E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754707, "uuid": "4009b4cb-5543-45a8-9ca7-5081ff1853ce", "value": "1536:kPqRg0FZTbSX5xZLepSGossFpxhOx2X/ZOqc/yA8C:p5ofF8I9cKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754707, "uuid": "65e8c15b-a217-4b89-9066-80750d97164d", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754707, "uuid": "1dd02fe5-b86c-4899-b599-89ca96d84582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754707, "uuid": "a2de014c-762b-4cc1-b5ed-57140be38984", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4c64bd-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754700, "uuid": "9c76b5c1-a8bb-411f-a10b-0ee1cf473fde", "comment": "Malware payload (Mirai)", "value": "4e380f5ebb2fa33e2691daa6e183d05a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754700, "uuid": "ee25162c-f7d2-4b3b-a410-5182bfc92736", "comment": "Malware payload (Mirai)", "value": "2f933ed96fab4c6f8fcc022593c482a20004657afd260a4d3b0b127631f395fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754700, "uuid": "e7bf8b25-f68a-4751-b6d2-600a1c1456b3", "comment": "Malware payload (Mirai)", "value": "df21bae7fa7e1478f77437f150af2858245efce9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754700, "uuid": "e48d5711-f189-4d3e-862b-ac5b1f8fc671", "comment": "Malware payload (Mirai)", "value": "11bb273cf069db5823dea684388abf76cdace9b8cf6fb4bdbfec9d3230c43bd2c4afd563cb4d27f6aef7a68f0fabb36b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754700, "uuid": "9e752cb0-b441-4796-8062-77d6d2f4d29a", "value": "T138B2D1A487A15706C2B0F475A77C8F925A3B15E4D6F63D331B2092ACDA4149632FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754700, "uuid": "5982eee4-62a9-4b16-a97f-2db7c5b7d0d9", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+Bu8HxrqqhymdGUop5hu7p:4GHKQFH0rs3zWoDDRsjt7LB9U+Bu8Hx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754700, "uuid": "38d85c0f-9ee7-4e51-8c03-9460a31b9fb9", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754700, "uuid": "76a52a85-6bae-4ae0-a242-70a1c5b20613", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754700, "uuid": "02e5c3db-1849-4da3-8e9f-0cb41747b8bc", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e9e72b-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776807897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807897, "uuid": "6e5b90e4-168f-4484-8cd4-f07e6ad11d74", "comment": "Malware payload (Gafgyt)", "value": "c131af6741d3553a5d1dd3742e806b7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807897, "uuid": "99539c0c-1ff8-4a15-bca3-e2cbb6ae050d", "comment": "Malware payload (Gafgyt)", "value": "30adc0c04f1ae53154acad8f09cb4182e55aed1539e9f08ee875122bb96eb503", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807897, "uuid": "69494f5c-a778-4136-a821-17aae1bbbf0f", "comment": "Malware payload (Gafgyt)", "value": "4269ddf251ad3637a433dbb589a2a2945c9f929c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807897, "uuid": "243804e8-20ff-4143-8004-5c6a8710b721", "comment": "Malware payload (Gafgyt)", "value": "afb6e443f8f731fba171a25f1c7ca408e2c46830c96cbdc56f14a0abe45d4a144da6d09b58e71d84c699c7957a340639", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807897, "uuid": "10b23979-dd0e-46ba-8b99-bc85bde730fc", "value": "T161F2E201674970178BA22DB6D96C8B525669076CF287B150CF6C0339BBC9CF373AAAC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807897, "uuid": "332b5623-c9f2-4b9d-b2a7-5b686fcb7999", "value": "768:D/ZGdlMRnOqJvuVMinFMJ+HfLrDkLuSKwwe0Zbrsb3UaF:D/8dlnydK1HfLrDkLuUwFZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807897, "uuid": "5317afcf-1e87-4224-9fde-ff145cf66bd5", "value": 37440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807897, "uuid": "90fc51ec-bf65-470d-9ea9-e4d03526b255", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807897, "uuid": "4746e382-8637-476e-8b31-e0027e005748", "value": "ARMV4L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42d410f-3d58-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776758634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776758634, "uuid": "c233d958-1fbf-4fc7-bdce-b9d2493db201", "comment": "Malware payload", "value": "68fb52b33313ee800548cca389407ad1", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "UNC6384", "colour": "#8BFD9F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776758634, "uuid": "6a4ae218-36a9-4c03-bbe1-db383a868c66", "comment": "Malware payload", "value": "30f2a49ddba3f7a1b76124c112b6d01da4d440754f63441e12b1e30672a7ec0c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "UNC6384", "colour": "#8BFD9F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776758634, "uuid": "7dd58a63-788d-4ed5-b7c6-6c449d962221", "comment": "Malware payload", "value": "62e4f702c3a88a17377507a8f27775a7b6bdea6f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "UNC6384", "colour": "#8BFD9F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776758634, "uuid": "88b1d5a9-4a49-4b84-9cfb-550f2e1b7cf6", "comment": "Malware payload", "value": "e8e84a002a44c8a4e3f41fa843d5e8a66d035e391967d647f735411edaefcd5d7ae7a15ad0aed731fe1e3c5620854dad", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "UNC6384", "colour": "#8BFD9F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776758634, "uuid": "64f3c9b5-1cf6-4a0d-b97b-302564594a1f", "value": "T119E4CF40B2B3D9A2E1AF113491A297685E2C7C768FB495CB77855BCF6E703C0DA34B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776758634, "uuid": "1f4f0086-0c9e-40bb-adff-46ec00654e94", "value": "12288:oGRXbdq0bEP9WXuGEmp0FSt7M7h2uRflhzSZ1s7rR04bqDY001b7undDGH:oGRrdqhP9guG7p0FSt72h1s/s3R04bCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776758634, "uuid": "035be08a-8962-406e-beae-0d7460dd81a1", "value": 687850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776758634, "uuid": "b5795573-cd86-4992-8fbc-bbb45c2ef220", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776758634, "uuid": "dd9d88a9-7610-451b-a691-aeb8345ccece", "value": "Tin A5 ch\u00e0o x\u00e3 giao Ch\u1ee7 t\u1ecbch Hun Sen.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6b5b0e-3d79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776772603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772603, "uuid": "8a190a59-21d3-4a61-84cf-258af6aaa392", "comment": "Malware payload", "value": "ef0cbd1b10fa00f7fb67dfa8c72b2073", "object_relation": "md5", "Tag": [ { "name": "94-156-114-250", "colour": "#29E8FF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772603, "uuid": "90012ceb-f3cd-4e1b-b743-1c43f84e6420", "comment": "Malware payload", "value": "31cac83991d59b05ebf59fee63a398e5eac9d47b06ae16b1512fca39c8fc4339", "object_relation": "sha256", "Tag": [ { "name": "94-156-114-250", "colour": "#29E8FF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772603, "uuid": "f3f776d0-fbe2-4752-a565-4fbf51acb9ba", "comment": "Malware payload", "value": "cade596a6e6721c8a4e181a4c89862eb97ad52f3", "object_relation": "sha1", "Tag": [ { "name": "94-156-114-250", "colour": "#29E8FF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772603, "uuid": "15463186-66c5-453d-bbf3-908c309e588e", "comment": "Malware payload", "value": "8652ca7b51fb0b32711646b556e98ca96cac5c02275f3d83efadd48949eb52c3ae6faa9969eb5069342eafa97c112d50", "object_relation": "sha3-384", "Tag": [ { "name": "94-156-114-250", "colour": "#29E8FF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772603, "uuid": "bb4d5b8e-5b82-45bd-a423-eb43981b0907", "value": "T1ED34F94C678E70CD117ABE7766237043B67AD8C2B60C8064F9D7759FFCA432A8499E24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772603, "uuid": "e81ec732-92fe-4b3a-a739-d48516e37eb3", "value": "6144:Il5YTutWmIDeIuXYtf+RfNK7KbRKbH/OOoYx00RePJA:Il5YTutWmIDeIuWfofNK7KbRw2OoGHR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776772603, "uuid": "d0c1b5ba-53d0-42a3-9d85-68fb0aeecb14", "value": 238190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776772603, "uuid": "8d44e89b-7ae4-4d65-9cca-815180bdb23b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772603, "uuid": "1080ff52-26c9-4ca2-9eb8-10296135fc03", "value": "31cac83991d59b05ebf59fee63a398e5eac9d47b06ae16b1512fca39c8fc4339.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3297c43c-3d7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776773046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776773046, "uuid": "2b5ecb0a-ef75-4bbb-8e11-41e8571fc209", "comment": "Malware payload", "value": "1e7250f188433605b8744af14ad86f6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776773046, "uuid": "04804b6a-9e95-45e5-ad03-d51b04046c8f", "comment": "Malware payload", "value": "33eca311773db8873040af1c4806b8c1fcb3bdd5bbc60011eb6f59bfc4917f3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776773046, "uuid": "b0894d57-4dcb-4b84-8edb-44803cc5bcfc", "comment": "Malware payload", "value": "68d158116e160c68ff7eebe63c30941c1d3e35a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776773046, "uuid": "a030dffc-b5ee-4c31-abf4-704991f815fd", "comment": "Malware payload", "value": "71caaa3d14a4e932cd7ff999e9aa7e285bd55134ed02fa45c92b711e8011a3b613cc405400b16a96df3769be2d78bb2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776773046, "uuid": "3261a886-9871-409e-954f-dc258f26a62e", "value": "T11DD52A13FCA559EBC0AEA23189669153BA71BC482B3023D72B90F77C2F727C059B9754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776773046, "uuid": "ccbffa54-6ecb-4d1f-9e91-2602c01e6ecb", "value": "49152:cILQMjJfsq+UpTOATow9oODWf9Oaa1oVu:cevJrMeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776773046, "uuid": "e5976508-c48d-4c0d-8ece-c751c8d6af72", "value": 2937016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776773046, "uuid": "20c14e9e-bad4-43ac-b14e-c7f26f915a9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776773046, "uuid": "8c423b33-6a36-45b2-a4cf-1fb35f3cc92b", "value": "vps-agent-linux-amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2244daf8-3d58-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776758416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776758416, "uuid": "fa375ef7-93f9-4c56-bf6a-0472f538f2d6", "comment": "Malware payload (AsyncRAT)", "value": "a0eba195bef0cb949f8f5e7359e7595f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776758416, "uuid": "1cb53a1b-4693-4ce5-9d0a-3b3915d00a94", "comment": "Malware payload (AsyncRAT)", "value": "346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776758416, "uuid": "0f158e3f-795f-4ad8-8d1e-3a507ba51214", "comment": "Malware payload (AsyncRAT)", "value": "65c13adfffd73473f400a933175f236a890dcd1c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776758416, "uuid": "71b5772c-0622-4c80-b4f9-2465013fa7ad", "comment": "Malware payload (AsyncRAT)", "value": "f45e28a83ad10e774254574773fb1062a0c9fafe78f885fe0fecebf68d4fada109b7802c2d2fc0a601238289e1e8f35b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776758416, "uuid": "c607afbf-7108-40af-bde4-e2a98b8e83a8", "value": "T1AC1501183629DA07D8955BF80A73F27117B82DDE9921D70A9FD9ACEFB976F104C04283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776758416, "uuid": "a117dbe2-9edc-4deb-8d37-b74b3cf20e7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776758416, "uuid": "07169a42-8df3-419e-92e2-446832a64048", "value": "12288:gdhCswvtx3lJ0PtwZBfyDtS5aj2ZmrYS+bonWmtsQHseGKk/oGEJGKWzxpJldT:Phtx3g6a9YSKon5tjk9KWlbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776758416, "uuid": "a5a1024a-d187-40de-bbc1-e148708bc9dd", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776758416, "uuid": "a264ffe7-82d7-46ff-bab4-4fd0c96a9073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776758416, "uuid": "4d72bb01-050c-4375-a716-407d7addbb65", "value": "z1scan_copy_3486180358.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a209af-3db8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776799653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776799653, "uuid": "500b2e2f-7f86-4bd1-95a5-e9371b08ef28", "comment": "Malware payload", "value": "c2214c97922f88dc2a362947393f7798", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776799653, "uuid": "f267cc1f-bd14-4dc0-91d2-262e3789c82c", "comment": "Malware payload", "value": "34b7d8e96a8156c53299589e69aa8b4e353ac9554f7ea109b3c652e805f74f97", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776799653, "uuid": "93360c44-89e0-4ccb-a384-aa3682884df2", "comment": "Malware payload", "value": "0acd29447316aad5c04f7cdcd9a6f6beaa86b3d3", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776799653, "uuid": "64cc6fa6-ae9f-4b79-ac71-5254e0ebce05", "comment": "Malware payload", "value": "dc20f5fef30a3c910acf9ec91afda045cb401e995f9c0d90ee9066e616522d42ec43d734d67a029796f955d3aabf7a02", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776799653, "uuid": "8d88cb79-13fd-4c75-9429-4228d6c3010b", "value": "T136958D0B7CD108B6C46AA33288F691D2BB72F8190B3133D72F94A6782F7A7D15979354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776799653, "uuid": "591530e9-adf7-400e-beed-efa4e58b6a16", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776799653, "uuid": "a94d9e8b-f5f7-4804-b943-a533aef672bc", "value": "24576:HHXYFOCQkkHTF/3xj5ZOeoR7pkHm7TiV2B7AP/2mGFWPHhWi:HHoFO5ZPshdKS1uB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776799653, "uuid": "9aff2524-142b-44e7-9881-f1dbc63b64a9", "value": 1975496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776799653, "uuid": "055e1883-9dcc-4836-bbed-15a54ee091aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776799653, "uuid": "4254b0c4-d32c-41ea-b6c1-972786cdf03c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a2511c-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809186, "uuid": "1fd69194-30e1-46dd-8907-9b1eb13704f4", "comment": "Malware payload", "value": "d8e11b8b48e111f44767287a4badc7a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809186, "uuid": "ecd10718-6ee8-44b7-a8bf-4617fb6a2f9c", "comment": "Malware payload", "value": "35547c58761e8dde31f28728cae0893354e595a68910dd1372fefb36b474ac90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809186, "uuid": "b9a57067-2543-43d5-bdac-47cd45462037", "comment": "Malware payload", "value": "d3068ab47a8f1db4a9d832a959aa84fe5278c309", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809186, "uuid": "4ce8e156-1f12-4293-9405-83cc8af873eb", "comment": "Malware payload", "value": "d0f26be4fc3cdcd63d439a4be572626c615b614ebc4a721b1ba13101f552978c4f130e7a9db7342bffd26218728861b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809186, "uuid": "b4f68b19-a1c7-48af-b0d3-8bd037d01a70", "value": "T1D0565B43FCA555E9C0EAA1308A629253BA717C495F3163D32FA0F3386F72BD06AB5750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809186, "uuid": "b142b1a7-00c8-459d-9ddc-88581157866a", "value": "49152:JSCfQ74hVT4GcAU8Ake6EHfj72139Fok0wXdzDIGVX8D3oq2tMVGzbG6vM8R5OHz:JE8fFa656kvXdvHqoq0MWbRTOkvmCEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809186, "uuid": "8761ca58-c5a6-49f4-9ad5-a12fcf04dec3", "value": 6168868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809186, "uuid": "9e064a4d-8c79-41b8-af0c-ecef4b95b062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809186, "uuid": "9e56f8fc-7058-435f-8435-8dfcd6eacb44", "value": "h2rapidreset.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7130ecc9-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754683, "uuid": "8f394a28-929a-4af8-b6c4-d612fd5e4161", "comment": "Malware payload (Mirai)", "value": "62bf49f0dc251e31e8302f4e4a5dbb55", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754683, "uuid": "6509ed4f-b70e-410f-9110-d0a08fa10280", "comment": "Malware payload (Mirai)", "value": "36815f60a710bcce0aacfbda8c764ebeae2c7f605ee76bd7ea8cc86814323c74", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754683, "uuid": "65443fe9-54e4-4d23-9d39-e61cc7a87128", "comment": "Malware payload (Mirai)", "value": "ea616d6f603b6eb7213a2d453dd25a8a9428052d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754683, "uuid": "279e1198-dce3-45b7-8755-bd915935ccea", "comment": "Malware payload (Mirai)", "value": "f77ab8e87d730ae3768659e1ef3e9ea44d2669c825515658a3bbd8bda057fc41f8229c14e75820cce335392e346cb69c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754683, "uuid": "9d87f087-f05a-4840-8757-3c579eff9e6b", "value": "T113539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754683, "uuid": "5efec340-d8bf-48ca-a006-622bdc929153", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754683, "uuid": "a0b6a58d-657c-4924-a9ad-5ec48ebf5178", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754683, "uuid": "af3545c9-9452-4a43-a6a1-d8b771e94a39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754683, "uuid": "5cc2588a-56c2-4a5b-89ea-c0ec5a780c12", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2612e189-3dae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776795359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776795359, "uuid": "6ecf96ac-f384-4e1f-860e-9b855a3c0946", "comment": "Malware payload", "value": "02d41e7ece79aa38804d314cae2a4ce1", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776795359, "uuid": "7429d0a2-d23c-4527-ab56-8f4697dbb95e", "comment": "Malware payload", "value": "3775b4109f0ac247a443746e2a0c67a6810a5c47b1b7fe1c5c6b1d7460a2a149", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776795359, "uuid": "b36ba4fe-d67b-43b4-b2c8-4bf4cf4c001c", "comment": "Malware payload", "value": "ea1eb649ff8b0d72182b88cb99e8721196c83df4", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776795359, "uuid": "c4fdadd2-0c20-40c8-b8e9-ca6ed29f9f58", "comment": "Malware payload", "value": "1c1bf5642a40786ab0575710fd5bc91036b99b61426b1ba1c4d917a9269e5fd252bebbff2a20a376dd5678d2baa8b77b", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776795359, "uuid": "780cb83d-1654-419d-ad3d-32c20deb8fee", "value": "T113C341CA8EAE84FD861AF83446EF9D4397CAC21B194EC592B78FE4403F37C15906A5D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776795359, "uuid": "8c2565fb-7f78-4620-9f1e-0abdad84bf5f", "value": "1536:vlulFTQrDqDpOXAdCFbWMasvNKsluwY7n0SlrZ8TKnH/cN/++:9ulFce7flWToYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776795359, "uuid": "bc7bc509-c8a1-4e7e-ba57-a7ae699a5b74", "value": 127219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776795359, "uuid": "1365a0e4-e4b5-4c3a-bc96-c87a62d7c14c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776795359, "uuid": "85147e79-3144-4045-b900-ab3bac21f40a", "value": "Marketing_Z_Template_109.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fdad7d-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808536, "uuid": "6abeb4e8-cbc7-4f47-9fe6-3240c76ee801", "comment": "Malware payload", "value": "9aa2e0c29a598a73989e38791cb5535c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808536, "uuid": "e0a0e352-b7fc-4cfe-84af-f48a35b3d0bf", "comment": "Malware payload", "value": "37b8a46b96ad5a561548b96e123f3fcfb5f97cd4ccf2d66f0d7cda99c29b5a7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808536, "uuid": "90526c56-f5fd-4fca-8ad1-c85b70441a33", "comment": "Malware payload", "value": "3a06f0bfd4450966a96ae3d0feaf72bbe94c3088", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808536, "uuid": "3619c741-8f72-4b8f-af68-7b85fd8cf6f2", "comment": "Malware payload", "value": "f0bb268cdebd38a23297dda7a430413cc5235316464c9ca75710fe8f739d2639a64a423be11b0a7b4af227b3ad4b5b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808536, "uuid": "82e94e55-95bc-46bc-b185-7993ddf2f6e5", "value": "T1DA86F905BCC92BF7C41C4A3444EEC99212B46D144AF1566A66A4FBA9FC77239BF07C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808536, "uuid": "64e09ab5-6d41-410c-aa47-137acbd90726", "value": "49152:daBeW559Kx0fjxRoi6HDatgNqB8/OassG8I0FP5m8S+kHPbGDq5Ep:yA5HDyCPBwPb1Ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808536, "uuid": "24513857-341a-49bf-a533-a934556b9ebe", "value": 8323287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808536, "uuid": "b0eb352a-003f-4d98-a56c-a9c2b6067f08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808536, "uuid": "60cafc24-d96d-4838-9f59-dc6336131f8b", "value": "h3flood.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c83864-3dc8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776806559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806559, "uuid": "ed1b5033-bd10-42a8-854f-1c36e1570c6a", "comment": "Malware payload", "value": "f3a078a143fa26df721365241662d3aa", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806559, "uuid": "f921d4f3-260c-42d0-be96-6cca043ef913", "comment": "Malware payload", "value": "37c1e24ac80c592d6cbe653ded5cf6e23d5407e9ab16b5803fee11de9d0e631f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806559, "uuid": "387043d9-71ee-4485-9dcd-996268f2f834", "comment": "Malware payload", "value": "ed67560fb1285fd2ae9fec914e02d284c7bad1a0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806559, "uuid": "5f473abc-c81e-47b2-99b5-120dab4aa250", "comment": "Malware payload", "value": "7c2ea8e3db4508b835da634a7e90aec56a7ae05e1ffc991434cc4fcb6313761d1c8c2a5abdcd2dfb07e4cf6c1e4303c2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806559, "uuid": "3036788d-2af3-49f3-b28b-6a9af5911d5f", "value": "T14711B81AC21C1E03E723C4A7CA2762CB1DCDD202002028F9EBE85FDE3414C786EE8474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806559, "uuid": "eff089a3-a952-4f90-acdd-036460307196", "value": "24:ZG2iv6rHDrCMNmgbamlwLdMGDmwIPDMruXIbKHDCA++LS:w2iv6jDrpNNaBCLD6IIbKjCA+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806559, "uuid": "33da90e4-5dfd-4bc2-8dc4-575eef78c1b0", "value": 1077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806559, "uuid": "115c0375-b012-412d-a42f-00915d2adf5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806559, "uuid": "b478f3cb-a2be-4b33-8031-4accbf2e05e4", "value": "MasonClient.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b906a0c2-3dd2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776811068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811068, "uuid": "24823526-6e6b-45f5-8ffa-92da0768baf3", "comment": "Malware payload", "value": "9733f278bffc00eeff6efdb8e08af0b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811068, "uuid": "bac1e6fd-0625-4c55-8742-e2f3bfa569e6", "comment": "Malware payload", "value": "37ca608bfebb8673911723cac3366c7fdf3ac6fe4595622a334baa51e6782fad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811068, "uuid": "2e23dcf5-8bb1-4e00-95f4-2c1cebe5f203", "comment": "Malware payload", "value": "2f2983e2a17fc4382dde817d46f31f9a6caf56ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811068, "uuid": "1934ff5a-5b16-4517-9779-8d341588c0d9", "comment": "Malware payload", "value": "6a5d6763ea5623644629660bcc874c386d6ce85e5df06d9ac41982709fd4e0be248d9e9d0338cf6006b347fdd92f87a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811068, "uuid": "8274ea13-e69d-4210-8c26-64fbb33ba0e1", "value": "T165B63957EDA551E4C1AE8175CA269622BB713C884B3063D76B60FB342F37BD0AE79340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811068, "uuid": "9879789a-6b1e-409d-bb28-10104d508b89", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811068, "uuid": "60a15a86-0999-42a1-8383-dd6d5fb3405c", "value": "98304:O8L3jip38HwLltoG1fu3sU8AdtK3ADOQ+umvBh8huT8Evve:OomZyqfu3J8Adttq1vve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776811068, "uuid": "0cb8bc24-7a63-4b4c-9be6-33f7b670a711", "value": 11090944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776811068, "uuid": "02e7d4f7-dffd-49da-a217-8fc06ada2003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811068, "uuid": "d32cfa76-518f-49b9-aa3d-67bb1c68751b", "value": "DiscordSelfBotJJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee947ef-3d73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770061, "uuid": "072d025f-6f5d-46a6-99aa-bbb1e1e7400c", "comment": "Malware payload", "value": "4c29b9ae88194f0d8bf528dcb8f96748", "object_relation": "md5", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770061, "uuid": "1a3b9bbc-96ea-4180-b376-d8cb8c4a8b11", "comment": "Malware payload", "value": "37f83b7c6fe7a85df19a63ad4934b00ab45c4223a9117a5d8359bc4cf65f5f14", "object_relation": "sha256", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770061, "uuid": "822bf585-fec5-4455-87eb-76288b76e087", "comment": "Malware payload", "value": "def88335f76c98f92569c895ceff1751b4ac189c", "object_relation": "sha1", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770061, "uuid": "8419aa36-8210-4f35-affe-f4ae488573b8", "comment": "Malware payload", "value": "2d3867dedf566a227a5a47ba70d49cd2f42df130454e6ca8ed266848c5b22020cc3fb0543883e576ffde194ef4a999a4", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770061, "uuid": "d2f655d6-17f7-4d2a-9ed7-7d1a8affd62f", "value": "T183422A6EFA0EE965B383E25EEBC89904FA5607F846295C587CCCC7D86392054C7A07B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770061, "uuid": "161eabd3-f931-464b-b5dd-f69fec9843ef", "value": "384:TIinQ0eI39busHJL7szhf20VxBVE/yvFcf5LVQuHvA7c:EinQ0eItb+zhf2gmNquHvmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770061, "uuid": "faa08ed6-0b1d-49c5-97bd-43e912769eae", "value": 12340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770061, "uuid": "ea1768ec-968a-4acc-a135-9346520db2bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770061, "uuid": "9b91ea8d-7406-4094-9986-1f1bc6824683", "value": "37f83b7c6fe7a85df19a63ad4934b00ab45c4223a9117a5d8359bc4cf65f5f14.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c24c6bb-3dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776804979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804979, "uuid": "c61ab84b-0933-467d-8eed-f132ac58b0f3", "comment": "Malware payload (RustyStealer)", "value": "62e0f9c763895b9fd22ce2f34b2ac162", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804979, "uuid": "7480f117-c81a-4f6d-97c4-0d6852fb2a2d", "comment": "Malware payload (RustyStealer)", "value": "385df6b70271107d434da7f106add743d90e4a2847a4d40f0e35ae3d69937013", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804979, "uuid": "a23f3400-fbed-4817-8ece-e1e9a23a5666", "comment": "Malware payload (RustyStealer)", "value": "e672e235e7375244151f091becc1411d5bf8b42e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804979, "uuid": "d161613f-c842-4365-ad88-df54be9f969c", "comment": "Malware payload (RustyStealer)", "value": "5791fcc5c3bcdd0db685061e72526bdf110a6c9aa4cf60308107774fec25fbea06e05370f99324ef66aab8d466ae697d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804979, "uuid": "6e80f025-0fa6-4147-bd26-e6bed9b9bd9d", "value": "T134969D03E39181ECC45AC1748367AB33EA73F8894634B2AB5BD85B212F66F905F0D759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804979, "uuid": "935fd524-dd2e-4916-ad1e-241fe77323ce", "value": "be9db20a0a086f6fcf0e952dc3183a39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804979, "uuid": "5470ba7d-abcc-4c43-93c2-b077430a0bb7", "value": "98304:iT1fllfu/h3BflpgjHiCmu0Yi8IMfEicdDkArixbt+s:OB8ngGC+jjDri7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776804979, "uuid": "a6b204da-6e4b-47ae-a04d-22c5c5b1bdf4", "value": 8946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776804979, "uuid": "38bec809-65c9-4a0b-9807-d00425a57621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804979, "uuid": "99766f22-99c6-4300-9019-f936d8565f29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2494de9-3dc0-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776803379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776803379, "uuid": "1898a89e-e190-4776-94b6-1da1f2bb86ef", "comment": "Malware payload (WeedHack)", "value": "5ecb2809b71d4dbf5ffe1f7768594572", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776803379, "uuid": "d2704f27-b707-4f75-87aa-2ede221c89bd", "comment": "Malware payload (WeedHack)", "value": "390d4139fda592af4e6553a4f1344d8dfbe6eb5adc243cc12e82e8053cd47ab1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776803379, "uuid": "161a552b-77c8-49d4-9540-cc529079ebf8", "comment": "Malware payload (WeedHack)", "value": "c8e300e812dd2d8f6687881e0abd997971e45c50", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776803379, "uuid": "db708486-d4aa-4e0a-95a0-67ab2c7658d8", "comment": "Malware payload (WeedHack)", "value": "fe056b3d315e6569169808a183188a7559e4d0e97bdcb797a3438c1abf5c8fc72282a90d2df2d90fbdb7997dacd2ae0e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776803379, "uuid": "384915dd-2449-4c45-b8cb-9a54a79c7f65", "value": "T152B2D03E5692C900F6CB6B74B9019FBF682983B1E2077C0A2970559D8F67E7D87A4306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776803379, "uuid": "8c1a90bc-2c65-4061-9f17-6595a4410647", "value": "384:Rme3w9gnt5n5g0aUeDR8LQdw5RX7M2N99THhYHyDgjGAKlXcpRRVHroMPhYXw3ES:B9nL5gtLgh7bDhYygulIJPF7XCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776803379, "uuid": "d406076b-9b0e-419d-b9be-8b6fa086f471", "value": 25642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776803379, "uuid": "b53e394c-68dd-46c0-b814-c5222ab5043e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776803379, "uuid": "1dc0e444-fcdd-4132-a960-ac91f941935b", "value": "TheBoiledOne_1.21-1.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8cd047-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776774994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774994, "uuid": "4ef8cf6f-c770-4dc7-9edb-d9063f69bb1b", "comment": "Malware payload (WeedHack)", "value": "a1a68c61bca6a08f1cf86a30d7c267a2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774994, "uuid": "05bd5ed1-4284-4266-8e44-0dedb58ee7ae", "comment": "Malware payload (WeedHack)", "value": "396abb8d354dcea8d20082efb88cafbcc17ba0556d18b4d7539d433081a49433", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774994, "uuid": "b835a8a7-fd44-4131-ac90-dd3f1ded1f6b", "comment": "Malware payload (WeedHack)", "value": "d79de53edbf91a0d903c1275e8932bc605582dc5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774994, "uuid": "b47e215e-3b64-4b92-a38b-f28a45626881", "comment": "Malware payload (WeedHack)", "value": "5dc79ab244a421eda596a0605d91102779dd2dfb51b497fe7ccca7e4f3549b796119b9aa94ae31734b3ef410dd60f065", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774994, "uuid": "a54cdc8e-97c7-4840-a732-e0499a350ff8", "value": "T126F2E133A1B25C48C74386B4AA994CB33C6F746349C1B42BA4B2193B93DFD9BDE85584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774994, "uuid": "6ef4f862-86c4-4e8f-8a5a-1b19028585d3", "value": "768:x9neyDkgYUuerCIe1nC676N2ie9F7LXKfdtLO2vXV0hsz1:ayDkgnJe1nC676NU9FkLO2Pqhsz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776774994, "uuid": "5495fe7f-374a-4bab-bdd1-6634f24ac8e3", "value": 36030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776774994, "uuid": "94a13ab4-979a-4c67-96fb-2d894e0b0965", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774994, "uuid": "7c10be41-ee85-435a-8512-2eb106ca5e32", "value": "Ban_bypass-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8139a0-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806378, "uuid": "bc08127d-15aa-4cd5-a253-2f6336aa2504", "comment": "Malware payload (Mirai)", "value": "45feef46e17f506884581ca3f2fed7b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806378, "uuid": "0982ab98-2e40-4933-8ddc-a7c62d720708", "comment": "Malware payload (Mirai)", "value": "3dd4a2d6f414da3cabd1193f94e5fc9109840236cc3fcd8c6857f244234f9dbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806378, "uuid": "ee999269-b372-49da-a892-73fde9e002c8", "comment": "Malware payload (Mirai)", "value": "690f3fecab2b829b3344e390ebb513fd73e95202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806378, "uuid": "15df34d5-edbd-4c19-b21f-0ff65250a161", "comment": "Malware payload (Mirai)", "value": "a2fbe498d7662c5db9ae489269bdc69ddee58189062e056941c80bc43a4eac7165113b9e6b7c8799fdb4294a57b01f19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806378, "uuid": "c5ad9351-5764-4d6c-9731-a70e63e9608f", "value": "T1EC13288AFCC24A2BC1C01379E6AF6A4D3720E3E4D2CB761BCE585B2176C650F1D5AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806378, "uuid": "30c0aac8-521d-421c-9b34-8966c902ed3c", "value": "768:bi2HuIbMaJs+9fTQiYXLpxkUHZQBfHybpPfZoeBNuw+oO8:brbMHCQieLpF5M/iPfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806378, "uuid": "249ffb56-d364-463b-8d1d-1e85eb6b287f", "value": 43000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806378, "uuid": "a0a66e26-b3c6-4a17-a92d-40bd00cb2b41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806378, "uuid": "d4f8d4dc-b8eb-4209-ab9a-89b6fd3abf16", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5aebdf8-3d74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770663, "uuid": "e761b78f-1adf-4cfa-846f-9a5620101381", "comment": "Malware payload", "value": "701152463cf81f308331f545fe6b7659", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770663, "uuid": "f6b4e1c0-e932-4f08-b8ca-f468c8907bd2", "comment": "Malware payload", "value": "3f8bdb976ddfc6a0a6021482ebec30b3543180f69d6481aff8d4e5ffb87fd8c8", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770663, "uuid": "6b759c0b-a222-456a-8bb7-6a5b31e53241", "comment": "Malware payload", "value": "19e9304e0c7423674a547abf7eaa70030b72ae55", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770663, "uuid": "1cddcba2-f540-4c8a-aa09-835e45a708de", "comment": "Malware payload", "value": "3341c2e8dc5ec370b3ae3e2c39691a97ba841dbe93a85beebf47fd85fcfb20ed75b8e274444b1700f7c24474d4e73f54", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770663, "uuid": "8c6591bb-2f3b-42d9-b18b-1e7f46f5f4ab", "value": "T18B51DC16A3E8466BE4770730AFF3076777B4F8548FB6576D19800229AC20B546E31BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770663, "uuid": "ca27c7d0-5035-41bd-bad6-b0bcc3471bf9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770663, "uuid": "0eec77b1-52fe-4228-8f2d-b92017dfba70", "value": "24:etGS+E/BepOEl/d8d7itodltkZfFRAZWpMHUWI+ycuZhNSakSaPNnq:6+bMUuMtodQJFRAceH31ulSa3Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770663, "uuid": "f0c27d1c-5bdd-41dc-8375-0191f1c2d235", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770663, "uuid": "369e1178-3f25-49c5-969e-b154e1106fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770663, "uuid": "545a6cf2-ba9e-4e14-9793-a26e94e6bc1c", "value": "5ccu5ega.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35767979-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776807840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807840, "uuid": "71d71873-e110-44a7-afc2-962e16a3a0f8", "comment": "Malware payload", "value": "9dfa61734c957816b69d055e1786280b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807840, "uuid": "bd263794-0f51-4e8d-b4bb-db09604ebb78", "comment": "Malware payload", "value": "3fd8b9308a02a57667ccd70556803a3d0c983f868ed83f1503c275293e721ac9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807840, "uuid": "af0dba16-3ce6-4795-9e37-765790310f11", "comment": "Malware payload", "value": "c4c4d2cedcc5ddf5b458e05599cd0e6ec52b110b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807840, "uuid": "f8a6b9f2-42bd-4dda-abd2-c3e75eece8ca", "comment": "Malware payload", "value": "605870775aa6b9feb265a2dfefd3fab22cb7947dde73f698491d2ccf0909ba74fe4ff8445dbbb2ef669c9f686db301d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807840, "uuid": "4429aaa4-f13d-446c-bab4-2fdf57ac422c", "value": "T10003E17D0ADA1EF0D967CDB5E304EBB218318F6F2919994F00A4D5F38D4207AA8CAB45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807840, "uuid": "339c15ae-ec47-40b2-8930-986f610f09a3", "value": "768:cftx1jZUj9mKZciJja3CvXtisn4DmPtKrmlbjZRfSMCyJgGlzDpxYsEI:clXCfZZ8SvX4s4DKzE2VrYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807840, "uuid": "77724684-16e9-47f4-a96e-e37141672520", "value": 41000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807840, "uuid": "8c57cec4-6cfa-4155-90d5-f7c1c4f06dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807840, "uuid": "5ed7c6b0-ed37-462e-9247-bcadf64d5fe7", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c1239b-3d70-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776768810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768810, "uuid": "987e62c3-971e-4a89-80a7-79beb215c098", "comment": "Malware payload (MassLogger)", "value": "062916e318db8a0660dfcf9443aa90af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768810, "uuid": "6ad44820-64a6-49a3-9206-2ec4a8015b8f", "comment": "Malware payload (MassLogger)", "value": "40003c0707a0d639b8e27d01ac0a31b73579d5e7a79077002f8005932b94e836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768810, "uuid": "90cd6c36-9167-4952-bf91-b800d54c88f4", "comment": "Malware payload (MassLogger)", "value": "d7b87855638334eb1a3729a4a058797543a6fe91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768810, "uuid": "d47c7ab8-3a2c-451d-bf7f-70f0d33529f5", "comment": "Malware payload (MassLogger)", "value": "e2565756422882041963e5c33d538de576dc6da87ce5032d6831b4a494ee4359feaeb2a2a75e81f9c448daac8099141b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768810, "uuid": "2d4301f9-796a-4d11-9571-42f88e241016", "value": "T1CD2502027BC080B2D47229314AB697606A3C7D312F61C9DF23E07EAE5A715D1D636FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768810, "uuid": "dc0f3e83-c715-4843-87e0-81e67a75094c", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768810, "uuid": "1cfc752b-f91c-49c6-a17d-c357dae07a98", "value": "24576:iN/BUBb+tYjBFHk+//Kt+Irqsj2QxrX1zJ54D+qN5a:CpUlRhkI/Kt+Irqw2OX1zJ5w+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776768810, "uuid": "eb37e9ef-4ba7-4eb7-9405-aeb8d969417e", "value": 1042240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776768810, "uuid": "cea40e70-c93d-44b8-9fe9-1ee12526e644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768810, "uuid": "2c933ea9-3fbb-4e45-ab7e-bdc87aef5ac5", "value": "REB0000002400.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fe7be8-3d59-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1776759043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776759043, "uuid": "fe5093ef-301e-465a-b501-1018bfc45a14", "comment": "Malware payload (Meterpreter)", "value": "c561b8757a5782086dc0a195297c28f5", "object_relation": "md5", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776759043, "uuid": "f7bab729-209d-4d8a-89e4-3b8a65c3281d", "comment": "Malware payload (Meterpreter)", "value": "4016c65aa176fb5099eb0e40221e540a052d65e24b7798eda94298e919a4419b", "object_relation": "sha256", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776759043, "uuid": "e7a5d8f8-1790-47ae-93a4-1415ee4f8cdd", "comment": "Malware payload (Meterpreter)", "value": "15a40d3c9f50bc10ac723e55c841320a49908a5e", "object_relation": "sha1", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776759043, "uuid": "d14a1987-c596-48a6-9ad6-dd7f1c06697e", "comment": "Malware payload (Meterpreter)", "value": "99327da2a1313d9228383b9aea461d5e12e00a82f31e620f97c5788a9341906a2cb3da5984d75a6ac4f320dc33f9fa75", "object_relation": "sha3-384", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776759043, "uuid": "66e72be5-16d3-440c-9f40-cb2571dad5f1", "value": "T1F6D64B43778B4DEADCC22BB4A59F23395730ED329E690F2B694C81355C532DCAD1AB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776759043, "uuid": "7019b42a-c13d-4616-9dcc-3a013f0b28a9", "value": "c7014acd906fb59d56d364615d4803f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776759043, "uuid": "f1a6b9eb-98b5-4b84-a3c8-ca40bb244a70", "value": "98304:cqgCRvhGn4kdrcT2wtQcvsztbSqPx/Ym+ieIrsU/F3A5xan1I4LJVf:dvonRdYT2wtQcvsztb1Px/p1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776759043, "uuid": "ed80afa2-94fb-4ef4-a773-2c8ada1fff1a", "value": 12723580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776759043, "uuid": "6fee0bf2-ef73-4036-9e30-8c2bf27f4428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776759043, "uuid": "1b0bbfed-fc52-4983-9036-b92dbb9d9afb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c1b2a5-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1776733461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733461, "uuid": "dc37022a-a111-4a10-9498-239f92f65c5b", "comment": "Malware payload (Hajime)", "value": "668b7f18d9b6621bd513c90bcc44a0f8", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733461, "uuid": "c8538ead-ec76-4dd6-b2bf-4af31ee6863e", "comment": "Malware payload (Hajime)", "value": "40400f751e3cce7d479fc6de1e081219905f206f2ba0505ed41b52325eb4cc69", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733461, "uuid": "8d98e7ab-680b-4af0-abc7-98380ab7e11c", "comment": "Malware payload (Hajime)", "value": "9b5272c78fe813beda4f6e98243d7d33617aa3f0", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733461, "uuid": "19116884-0796-4695-bd3f-4d833f74ec92", "comment": "Malware payload (Hajime)", "value": "ae04022778977c7dc7be2f6d6b85211cf7d3e94ba69959a846c4231f225d67848e332c917bee1b119c785c7d5126d0cd", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733461, "uuid": "097ef36b-17c0-4137-9b32-ad9e69060a88", "value": "T11F7312E017B516CC1371A8353BED205E9124323972AE35302E97528DF957703BAB2DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733461, "uuid": "5d26905a-4079-41b9-bba6-ca638b77ca4a", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht6:8D+CAXFYQChaAUk5ljnQssg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733461, "uuid": "99a63ac1-42bd-448d-93a2-dbf11619f374", "value": 80178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733461, "uuid": "b986a35c-b1a4-4feb-9c96-5514ba2a25c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733461, "uuid": "4595d3c3-47f8-4513-a45b-657c05ef3d2c", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762d1a6c-3dd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776811385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811385, "uuid": "c99dc708-e21a-4060-b9bf-e3e7baf3d05d", "comment": "Malware payload (Mirai)", "value": "29ee5ae4ac935fcb6dd47d9f8a5aa8e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811385, "uuid": "29ad32fc-71f5-4f09-8a6a-6b7e0c1e9747", "comment": "Malware payload (Mirai)", "value": "404407084230856208e5d1ab6ce7bdcd36addc5b05759fe4edc65238a01823f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811385, "uuid": "89db42e5-8f18-402d-b1bd-6841b753df98", "comment": "Malware payload (Mirai)", "value": "d9592924ab11ea923abc8267a113730a9ca26986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811385, "uuid": "ec3db12f-03d8-4170-8e27-bf3be421ff91", "comment": "Malware payload (Mirai)", "value": "3e89e44b070b52534d7a71ce3574910214ea6c82180bf0b1851e70e6cd51aad4f36337e76c428fc3027c088ca3e28c39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811385, "uuid": "7c40681f-e03d-41a0-801b-d8b460d69b08", "value": "T146839606BF214FF7D8ABCD7746F90712349CA91621A83BB5B534E468B34A18F05D39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811385, "uuid": "0be731a9-9c0f-480b-989c-0efff4a19684", "value": "1536:cOuEFa6pStRCKVyJwNmuKmIO/O7vv9u6glcZam7DZ0XAV:cf/tR0JE4O/a9JamPyXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776811385, "uuid": "4e54033c-58bb-4d5f-81d9-31fb572c160d", "value": 87668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776811385, "uuid": "50441fd9-3c8d-469f-8bdc-2d64dc9e3031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811385, "uuid": "8d8751dd-275a-40fa-b3d5-07d07e80de6a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b9e024-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806279, "uuid": "ecffed4f-396c-46c9-b289-30a8e5804852", "comment": "Malware payload (Mirai)", "value": "4d7bd478c14a33ee0ad4a06a50191140", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806279, "uuid": "e8b5cf44-08ba-419e-ad97-680ca81ea363", "comment": "Malware payload (Mirai)", "value": "40ab56ff8c9cbcb06f85444c39b44bff6b3eecdb5ecfe5a75d46ed2374fa6da5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806279, "uuid": "80c0f345-a016-44d6-bce9-b9091fb18cde", "comment": "Malware payload (Mirai)", "value": "3a0ffd39f5778cbdad009ad9960c1815452db2d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806279, "uuid": "7225a63a-c1bf-47b2-9995-67b43ef15e44", "comment": "Malware payload (Mirai)", "value": "55564f3dac5e3bae86e84c6bc2281ebbfb60830a704d285a841d7981760d15034eeb03040cfda14bdf8104f167840f9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806279, "uuid": "afa238d6-e61f-4e08-ae49-279fab9e22ae", "value": "T1A183199AF800DD7DF80FD7BB4463490EB930E3910A931A3777A7B993AC721B54816E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806279, "uuid": "95a4024b-89fc-4328-bb92-66a47695ca9e", "value": "1536:KRftiNZM0JRGdhkQ+73rIgDPrD0qVy7g8B4IQnHhON+h1HQohu1xgZq2PspVV:KReM73hMlwqVy70ZOchpGgZqBpVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806279, "uuid": "7b431884-c14c-4326-ad2d-98a79114ee92", "value": 85108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806279, "uuid": "9674ab62-0ec1-40fd-bf44-2a87558494ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806279, "uuid": "700d0662-d937-4679-a343-84812b98a4a4", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26345290-3d42-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776748974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776748974, "uuid": "0cbab8c4-3fbc-4a46-9780-3d689edc748d", "comment": "Malware payload (Gafgyt)", "value": "9b876b8cf540a871da2b7e69badb0f48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776748974, "uuid": "6f1b7963-992d-4d6f-aaba-b17982ed3410", "comment": "Malware payload (Gafgyt)", "value": "40ad10af89ecb3fb4d0e9032596d6865a5e1b3a05de8905b6978d3676ad6d041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776748974, "uuid": "16ddb7c7-1b5d-46eb-92f3-c29d32c9b6a4", "comment": "Malware payload (Gafgyt)", "value": "af4f6d6637c51857316c0c71ddab909f0c2ee9a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776748974, "uuid": "4fd0122a-a0b6-4eb9-9498-2146b6d16037", "comment": "Malware payload (Gafgyt)", "value": "944533cddf74faa7fd85023041c7e3780c5292f26c826cc7d0cbdd9f45888318a1a8a5204ed9fa333490c80901b6f5a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776748974, "uuid": "7ce5bd9f-d6ab-4fc4-9b19-d37df4a9f356", "value": "T168E34C02B5518A53C1C60B7ABB5F964537236BF8D3DB33029D18BFB42F4269E0E2E951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776748974, "uuid": "0dc8e547-34af-4609-bce2-fce42d180868", "value": "3072:Rk0yxMAjfaz1uoqMRU38v0aDzM5hQplMGQk+s7CsJxmhQLCphpRjr:Rk0OMAfaz1bqMmPa/M5h6MG9JxmhQLCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776748974, "uuid": "112cb637-e718-4250-85e4-72f63023af53", "value": 156818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776748974, "uuid": "803b27f9-ca13-458c-a395-311899a2cb24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776748974, "uuid": "40b51461-3344-45c3-b87e-f8b8732c0a32", "value": "FBI.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c98c8e-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776801878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801878, "uuid": "3d8a2636-4947-4d58-8edc-fdc48a398476", "comment": "Malware payload (WeedHack)", "value": "9f9fba2f10ad87d36363ae9aeefae148", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801878, "uuid": "0b4a052f-2241-4314-91cd-36c8e041de03", "comment": "Malware payload (WeedHack)", "value": "41562ba705fcb2d52e4c04b27a0aab15df7a83aadd832a5c9cf6e7588ffdc521", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801878, "uuid": "dab84ec5-fedc-4d5b-a5df-5ac2e0542831", "comment": "Malware payload (WeedHack)", "value": "b9f7ff04d04983cbc55e9c4151e9aab64a28074e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801878, "uuid": "adee17b3-b113-4202-8133-cf73c301b3b0", "comment": "Malware payload (WeedHack)", "value": "5c0544d5e1daa8e379d31a18b916a2e1e5db43c1142e28ef92276b9fa6276f35efcbedf45d85033a04015872b4045201", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801878, "uuid": "20550c2d-6b5b-4c43-bab4-53f426b7c763", "value": "T1573633250ECADA34F4A881D3FFA05B09C8E75DC0F452BD5C4165BB8B63AD1D16B62B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801878, "uuid": "21556f83-eefc-4bce-878e-678310fd4168", "value": "98304:waZ7Kbsz624bWva/R+Wk1UnlJV8e8D8n+51n8+vBILAof2mWbBh:wa9Kbsz624bdJMolf+Yn8n8+7of2vb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776801878, "uuid": "d903e168-ece4-4da0-b9f9-8394b9ed6541", "value": 5022966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776801878, "uuid": "b4240181-8cf9-4da3-aa7b-1532c72874e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801878, "uuid": "0a347db4-ff76-40d8-ad2c-0cc08b216c40", "value": "donut-dupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7a65a3-3dc3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776804547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804547, "uuid": "5783cb60-a190-4136-8ab2-0ddc7dc8b472", "comment": "Malware payload", "value": "35d25de87b9152f3667e213215b42b67", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804547, "uuid": "924a4056-3dc4-4d51-aa05-c74ddcee8604", "comment": "Malware payload", "value": "4240e0476d0e56b79230db1cd3244a3366db86a4111f1db97f36b16aa8e79810", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804547, "uuid": "b265dda9-a1e3-4523-8fea-9cd0e39b3021", "comment": "Malware payload", "value": "efad071b85f25776ca4a028e90289df052825b8d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804547, "uuid": "ac5fe429-760f-4ed0-9088-c0a3af5e8f0e", "comment": "Malware payload", "value": "12d5fa9a7f06a36cdc19bd13b00cbe39de2840911bcd386b9c46db7b6ac64e03e079f2e538e67d87c1209624111908ce", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804547, "uuid": "1dbcf8e2-b774-480e-8605-c326f90cd0d5", "value": "T1A34402678C3EB0A0E99BE138F664E7F3396C38ED98C11196061253F2B5E46C268D35DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804547, "uuid": "941082c9-b719-4daf-90c4-f678c091824c", "value": "6144:8u68A3u68AOu68ARu68AMu68AYucX+G/43mhO87Y:8ueuVuMununP+G/4WswY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776804547, "uuid": "534a7af9-a7e7-4c59-ade4-43ac2d5a48ac", "value": 259068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776804547, "uuid": "a14d813f-a4ec-47f1-919b-99511b4ca733", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804547, "uuid": "ce4ae8b2-5f46-45d0-850c-9542e64f9155", "value": "Play Protection.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af820a7f-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776802032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802032, "uuid": "e351db9a-1768-485d-8452-2ecea6560941", "comment": "Malware payload (WeedHack)", "value": "ba4bfe85873574c47b0164fefc1c4a8e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802032, "uuid": "77399e61-c4d2-40e0-80ab-d93825f0cf2c", "comment": "Malware payload (WeedHack)", "value": "441fc6422c94aa00f4967d6e2a9325eda974d3825b552d5bee9cea05106fd319", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802032, "uuid": "20fe3cd7-04a2-49f7-992d-a4807c6d571b", "comment": "Malware payload (WeedHack)", "value": "f1b33eabe44e53d5d12fe73b0ab1e1541c12fd2e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802032, "uuid": "4f3b7433-0a1a-451c-b7b2-3d50e07fb14b", "comment": "Malware payload (WeedHack)", "value": "5b47c7b00a84e144a5e316e499b09ae3ef90c8204ea3531d52d3053a1b431badeb44d69ea58143bd66b93e35450efcb2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802032, "uuid": "35d56797-1b56-4ff4-91a8-bac9abef3244", "value": "T1C6B63327A08D3074DD535678931DEC0A68E9839BC18E7841EDF493474E2BBC94BAE376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802032, "uuid": "057d4d06-c6e0-472a-82f8-ec0ce719342b", "value": "196608:ukODvygFWFReObqpgt25Y/1hi14zgWJ9NHCWwK2rD12MTSWAbwC:ukODvh0TeOFUY/LT5J9VCWwK2n12MTSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776802032, "uuid": "0b0abbc6-d824-4b39-b5e9-5e33f2feccb4", "value": 10438261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776802032, "uuid": "b356d6cc-28cf-4d6b-a968-66a8b17616d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802032, "uuid": "4ba4c9a5-a765-4211-a2dd-b836d5e53db8", "value": "Radium-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90293418-3d5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Trigona)", "timestamp": 1776760748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776760748, "uuid": "3b16472d-abae-4def-8d7a-398f2d51affc", "comment": "Malware payload (Trigona)", "value": "54c6baa3308fcbd9a51facab9786d333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trigona", "colour": "#782C0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776760748, "uuid": "b0e79f77-f628-461d-a03a-cc4dfb87b96c", "comment": "Malware payload (Trigona)", "value": "48877a3a4c72c1daf3a80e3c034b56a04cec7ce3856887fed73e645e53c76b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trigona", "colour": "#782C0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776760748, "uuid": "f7eb67f1-b000-41f4-a754-4ee90862b43e", "comment": "Malware payload (Trigona)", "value": "9550ea6658940e884f704305a7f6e0a79605f5cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trigona", "colour": "#782C0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776760748, "uuid": "68cdae27-b112-4d0d-8a9b-a43fa689bdf2", "comment": "Malware payload (Trigona)", "value": "d668e084238f911c1468794cc77226ce37b0931a641608b677d9207dd4e246b4c365a28ea79ca6e07330a88838a27906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trigona", "colour": "#782C0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776760748, "uuid": "47f67291-2fdf-47ae-9534-9f5f260a1daf", "value": "T127B43B2E71F48B6CD06AC17588964B6195327C6C873583FF1880C2A5DF91BD2AF3ABD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776760748, "uuid": "84912f65-f0fc-4fd6-b8c1-1ffbd4da5337", "value": "ae0f828d879d9ce7b01501d761b46023", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776760748, "uuid": "2f7a14eb-baf5-4a27-90fe-cb4a5f895574", "value": "6144:NUDWXIRWj1X+B3cElsaXrg0Iacqpcm+lvO+ivKsoyrqqDLuKr236cJQp:NKRWQNvb5cqpcrRO/uqnuKG+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776760748, "uuid": "a4e4dbb4-25eb-42e2-80ef-e38c091446ec", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776760748, "uuid": "fbc2b0f8-2e7e-403e-bd73-041770d92752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776760748, "uuid": "9b35fa9e-e093-4b74-84fc-298d2c964ebc", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b809904f-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776802047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802047, "uuid": "d4b73a4a-86e2-4a26-a3f2-b060e1621d04", "comment": "Malware payload (WeedHack)", "value": "5af2c3fefb418fac9166b1af5d2e74b2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802047, "uuid": "1ee86a64-5844-4759-9289-07657dc46f0d", "comment": "Malware payload (WeedHack)", "value": "489b4596db8c328548ad0ba45becf28026b8f6f823775c929baf9ff8722f46ea", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802047, "uuid": "335490e4-4362-4011-9e8f-7e54a6954a61", "comment": "Malware payload (WeedHack)", "value": "9f9c3bd18b9cbf2493aa41884b7b34b7197203c2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802047, "uuid": "b2da3707-9d39-4d37-bfa6-12b68052cf28", "comment": "Malware payload (WeedHack)", "value": "c468dfb6e78387e58f4c6b6cdc876b990ae6b2ad73ebdaea1a16e52aeb8e3521ca0b65b4ce0ebea0add96e2ebb17cc21", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802047, "uuid": "a5f1d716-84b9-4c07-ad78-e1f47a94346e", "value": "T10095334E7B8A8273FD3D4733ECBB4640F7FEB23C2AB04555F91466989C6BA540A8C914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802047, "uuid": "ead378b3-3310-4d11-8958-932cc366e491", "value": "49152:4ya5RD4T/8ulSf7/kIcuVWeO0gb7z3tf+JW4ly6zav:4D08yS7kINBO0gb/tfCWZOav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776802047, "uuid": "806840df-d307-4513-8741-600db0802f13", "value": 2043724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776802047, "uuid": "7f143919-8a93-49bd-b905-cff79e8b4e06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802047, "uuid": "ade60452-f2b6-4261-a42e-2efbf69e0fac", "value": "sodium-plus-5.8.2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9eaff5-3d77-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776771778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771778, "uuid": "995d2e1f-e6a7-40a5-a343-1359d6bb9513", "comment": "Malware payload", "value": "cd55628e8a06294dcbe5b63ada63d507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771778, "uuid": "ae110a46-a2ec-47f1-9176-d60574604d37", "comment": "Malware payload", "value": "4a3751f3be8528d61c738a511c799bf64e38a3ee5d72ac1d98d63e26d97c1488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771778, "uuid": "b7fd15b2-15ce-40a3-b75d-0a58f448800b", "comment": "Malware payload", "value": "88437ed8b6aa81174dc4879859d60724db5a7326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771778, "uuid": "9e98f801-e85b-4774-bb22-64cb360655af", "comment": "Malware payload", "value": "63cb3ab47414d3bf6121f52e00247addc28ef38631a4f49c3e7dbff12b4c7189b4bff30fba9ef5f57f33e93365939f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771778, "uuid": "09d4c09c-7f0a-422f-a10c-81ab4b07349c", "value": "T1C7A412BE70D323FCD87EE2355A872095F873B89156349EA7A31091293D32E94583EF58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771778, "uuid": "94c35e77-ae2c-4637-aae0-93144646e3d3", "value": "ff187e9c33ca1d4e71b2277cca5c4e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771778, "uuid": "172880cb-c0e4-469a-a1cd-46d00dc86524", "value": "6144:hWFSs+Y4UTGtCssm2n70xIH2tDs2r8OjBo8eNglrEv4oOAH1aj7alpYaU6eQAtoN:W4dtJAuu2r8mo8/rEvfOoswbU6qtohL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776771778, "uuid": "36fe343f-e75a-4643-9e7d-92d74f7e130d", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776771778, "uuid": "45460b8f-442c-453e-b516-1aa2a2bf9578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771778, "uuid": "d63b0c10-3009-4d35-ba78-fe2428a9bb8b", "value": "4a3751f3be8528d61c738a511c799bf64e38a3ee5d72ac1d98d63e26d97c1488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883efd01-3dac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776794665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794665, "uuid": "0fb23264-88f8-45d2-b3c3-4af58e678a62", "comment": "Malware payload", "value": "2724ac6399fb10c64f39999373894a9f", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794665, "uuid": "7ec31739-d03f-4f15-be05-0478e57e09c6", "comment": "Malware payload", "value": "4b08a9e221a20b8024cf778d113732b3e12d363250231e78bae13b1f1dc1495b", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794665, "uuid": "1e3c211a-6af9-479c-9817-3f69bb009411", "comment": "Malware payload", "value": "bbf1cae7aea5561e4ea2775c8f369c23f4f00f57", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794665, "uuid": "341daf5c-be1e-40dc-a130-e3f7340419da", "comment": "Malware payload", "value": "7dd3ade12210f292190e3aa1a7d9b4cf7438d65cfe1c3cf22c26f603e9e4f4c151f6dd35c36b005b771ca1890d0a4f03", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794665, "uuid": "13fe89d6-4334-4db0-ad3e-7b1d31aaa3f9", "value": "T15CD34213126B6B13D8CA77B46B8B7369E314FE413DE499F9AD9183C08FE564B6823740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794665, "uuid": "08691de7-fb40-40ca-80b2-1e917fa012e7", "value": "1536:yjgynM0Vsv2IDlwSJr9jg6K8rVDVg0ZXATTX5:G0woxDVxZXATTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776794665, "uuid": "e972563d-fab0-4db5-9f4c-4cc4a18809e6", "value": 140184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776794665, "uuid": "609b7f5e-351b-48bd-a2ea-970fb98df99a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794665, "uuid": "18c7e400-cc76-48db-9d8c-17d90836ac81", "value": "minst2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8d7405-3d30-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776741577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776741577, "uuid": "62951e95-9206-4743-b4c1-d4994d6fd0cb", "comment": "Malware payload (RustyStealer)", "value": "a6353d7acbc9b79e21571f47175719d9", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776741577, "uuid": "634ce2e0-dcb2-4817-96ba-71eb79abaa79", "comment": "Malware payload (RustyStealer)", "value": "4c89f868fbf17b932ae775b2c3dd51f7f4cd1b7b72a5b2cd059f82a97f13290b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776741577, "uuid": "62733436-708d-48a4-b3fa-0c345c699a9b", "comment": "Malware payload (RustyStealer)", "value": "5942634af764a332fc18a09e746c60082f6b7d39", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776741577, "uuid": "84e57bbd-44e7-42c6-bb2e-42d516496954", "comment": "Malware payload (RustyStealer)", "value": "635889e2e8689a8a1df6549e7db466997701bc0eae4fe5a64e0bfab276f625db2cf81923e9c6d458e4f316e77e73fd9d", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776741577, "uuid": "c1923c45-9b1d-419c-b007-2470f4e7551d", "value": "T172E4E132FB5545F8E126C07BC6410A66B6F270850B32A9FF036451752F6BAE96F3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776741577, "uuid": "7c1eaf87-635e-4c57-b65d-d6936acccdc2", "value": "79735c5314849429cfb710dc0e8f5c6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776741577, "uuid": "5f70cb05-0717-4d84-9e2f-fe70bcceb335", "value": "12288:xNuoyW0L9wIp2+8Xrzm5tOSC9ZshhGBtuPT/:3uoytBp2xr7SC0hhWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776741577, "uuid": "0a9b2060-7f3f-4719-8283-88ef19b996dd", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776741577, "uuid": "8e3f65e5-c9a0-4350-848d-2b01d81f0b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776741577, "uuid": "d6462e3c-d42e-4c9d-bc57-53d091751535", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592c725d-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776783849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783849, "uuid": "01df28ad-4625-4fef-bb48-c4ddd26d54dc", "comment": "Malware payload (ValleyRAT)", "value": "1b87d9511ce3cf5f851c6ef2ec443058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783849, "uuid": "b9f5ef36-c099-44bc-977b-8cb645680c44", "comment": "Malware payload (ValleyRAT)", "value": "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783849, "uuid": "88d04d48-e329-41cc-9b7c-88dee3758b4d", "comment": "Malware payload (ValleyRAT)", "value": "df355270eb6befc014c03ead61c66d26f9518545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783849, "uuid": "737e24f2-dc03-4a82-8785-70ae637c2282", "comment": "Malware payload (ValleyRAT)", "value": "33ceaf8797f24681d6de812e5e0ccc79838dba1e0c7bb86459765b36ad8c141be527d6c93363c7b8d361e4643b58c9c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783849, "uuid": "ec6dde3b-5a3f-4369-bda2-3564923ff4c7", "value": "T1EA44D042B7E188B0D99614779C78E76ADB3EB9210F31EEE763900986CE342D05736E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783849, "uuid": "1b4e69ef-345a-48ae-ba3d-1e73038d7c0e", "value": "b5e7f43ea908268ca06dda2fb070eae9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783849, "uuid": "2889dee7-e0e3-4eca-ac9e-2a4e0e40ce3c", "value": "6144:qpMKGDSyi/gVemUHs0C1EedtlMwVTX71HWAjjR:6CSynUHs+KHmYjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783849, "uuid": "61fadae1-31a8-45cd-a181-55c02fbd7e69", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783849, "uuid": "7c2d0f1b-b4fd-4ae5-af30-bfd8c3da0462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783849, "uuid": "6d68f09a-4ef0-4b71-8255-08157a808f0a", "value": "1b87d9511ce3cf5f851c6ef2ec443058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb5a64d-3dd1-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776810616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776810616, "uuid": "b2602e56-8468-4abf-9c4c-a9f9bdd7889b", "comment": "Malware payload (GuLoader)", "value": "1a97f4c3c5e0ed82a7005e98df08aa81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776810616, "uuid": "ad1aa45e-ba4f-4dc6-be32-658b0b80cbae", "comment": "Malware payload (GuLoader)", "value": "4db60c88de6ae375433dc71b8fde1ff323ff5bc5425903a77324a321ac85029c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776810616, "uuid": "b4be1cd0-b598-4bb4-9f2a-b41bf6035602", "comment": "Malware payload (GuLoader)", "value": "a8db9b76bff170d1af341474ac60778454c706fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776810616, "uuid": "1593940c-ed37-4a6d-9e0a-cd6864f84e6f", "comment": "Malware payload (GuLoader)", "value": "0c08cd9cff8363726df711fa7a062deb5c0f4b2a1b3c7d958b3226446f057cf8539b3fa0f5b4233e84b740e96ab9f675", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776810616, "uuid": "b2859131-1977-42ef-98dd-a801fe531fe0", "value": "T1BDB42220A35DE031D89312351E3667EE9EFA7C902562675B03A07F1F3E60B81D69EE12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776810616, "uuid": "adbdac12-e1c3-4427-a3b4-f083e5c6fed8", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776810616, "uuid": "39f4b78e-4486-4710-8e81-a705c1c50295", "value": "12288:5TA+Q4/GU1Wx3xgjbruLyYF/UsdSBv+6Vt0SGZNu49ezMgIC:5TAP4/GU1Whxgjbw7FZev+kuu8eAgIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776810616, "uuid": "f8903695-1a4d-4582-9d9a-9d57c9ee9534", "value": 528182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776810616, "uuid": "754b0162-ad6e-4629-9be4-d775fc180e77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776810616, "uuid": "322bea41-43fb-4bca-bd45-2f9e043d5786", "value": "rORIGINALINVOICECOAU7230734290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a4a108-3d78-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776772241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772241, "uuid": "f61ec81d-4361-4136-8c2e-5cc8b844d38d", "comment": "Malware payload (ValleyRAT)", "value": "1308d7885ba5e5b1126ee49a80a33266", "object_relation": "md5", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772241, "uuid": "ed954587-9a89-4ea7-a056-06e106d9c000", "comment": "Malware payload (ValleyRAT)", "value": "4e589736ab51d2e27fe19fc7559178914dbd10d29a9e51da946502d6828d41bb", "object_relation": "sha256", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772241, "uuid": "78124800-c67a-47cc-9260-c854b00050df", "comment": "Malware payload (ValleyRAT)", "value": "95610ee359044c2e1e732bb08dfa13f06515fe9c", "object_relation": "sha1", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772241, "uuid": "1bf4baf6-7c77-4d7b-989a-b12a45ec5d9b", "comment": "Malware payload (ValleyRAT)", "value": "72ec9e44bdd611e7b9b71466d8fa90afe491ebdc8c09f0b235f709ad1752eb83f9c11ec5e2bd298e692aec2f15edbd9e", "object_relation": "sha3-384", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772241, "uuid": "f1d0abbb-a2f8-4197-a2ce-79e9222ba820", "value": "T1198733F4BB9C5A8AE02C263D7D15F5176191A1FCB899C84C7A4454EB0CF6F83CA28DD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772241, "uuid": "d2ce0453-2b94-4cff-9738-a11b12ca8428", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772241, "uuid": "ec863ca0-8c78-4041-8654-de15824c3148", "value": "786432:w0392l00roTCT9I0dQHEug/WQ4tjPRYCA8wH+3yBDtIrUb89rhV+B5j8JQ0:4lFo+I0Hug/W1RKCA8w0yHiH9rCB5gQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776772241, "uuid": "cbdfd840-4fe3-4675-9d96-e9811267811c", "value": 39437900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776772241, "uuid": "5be65193-ffd8-4cec-a78b-4473b809b106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772241, "uuid": "2b6132d8-842c-4677-a60e-d31cf91fd672", "value": "firrefox-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac19aa40-3dbf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776802886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802886, "uuid": "6109e532-f4ef-4a34-9c21-a11087f7dbd8", "comment": "Malware payload", "value": "b7f3734964635d53b7f64985c44178c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802886, "uuid": "987c5284-de0c-43f1-89ef-88a63ac590a4", "comment": "Malware payload", "value": "500ec9421f2967b06e55fd7db81c8c84134f6a4472925655552ba4d299b26fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802886, "uuid": "462e9b43-f3da-45ee-9162-9216eb70a76a", "comment": "Malware payload", "value": "b85ab30829604001bfe0d90c43e3215ad8f74b1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802886, "uuid": "d8ea7bac-3814-4266-9909-9cc9da474129", "comment": "Malware payload", "value": "0444039c9d503c93b6b980d888c37c69b2dac498f7985fefecd31ffc277df44ce300bfc887f6a2003eaf69392e675426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802886, "uuid": "4fc1b076-fef5-4661-b171-068076867346", "value": "T1370833DBEB0F89F5D746EA716B160C3824149028BF8E45AA20EDE05DFC233575BB8476", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802886, "uuid": "f383e75a-60cb-4771-a35d-50979d36a5c2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802886, "uuid": "bafac068-252f-4961-ac9b-f20651530200", "value": "1572864:tLdkhqXUS0omHl1NCJN9oSh17UTDmKkK+lSYQFJoCAF49PniCat47:t2hPtF1NCJ3Bh1gFkK+lSduF0Pni+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776802886, "uuid": "cbc50aee-eaec-46ff-a945-7da9d0fd6536", "value": 82000996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776802886, "uuid": "c945656b-c0c9-44d6-9ae9-6a327e94bac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802886, "uuid": "18cf6049-6bb5-4ad0-9d89-d569cb818a65", "value": "Chilloutvrmod_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a6cc25-3d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776781673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781673, "uuid": "1de99806-571c-4e0c-b4b4-8d3b18bddbca", "comment": "Malware payload (PureHVNC)", "value": "73034521fb7975de8dd1ccd27073d5c6", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781673, "uuid": "ae051154-95be-4bc1-9093-22041f6d2cdb", "comment": "Malware payload (PureHVNC)", "value": "50db96d4a084d4da31cf7fde801b1f086d488cbbb831bbb780edc55eaae95347", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781673, "uuid": "89ef43c7-6013-4e3e-9979-40b37270dc73", "comment": "Malware payload (PureHVNC)", "value": "034ded6a671f8d0e34fa4141f068f2f8545b6dae", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781673, "uuid": "423783dc-d075-4ad9-a101-df260aba9360", "comment": "Malware payload (PureHVNC)", "value": "1d974c2bbc9a44f9c1163018447951c36b7ec0bf1c7e64d16e89fb16fb896f3d66d95ff17acb10e0be5f3214d7ecf8fe", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781673, "uuid": "4afb5f73-c1f7-4c97-8067-7f440cf68b2a", "value": "T163663336F56C89CAE86BD6BEA1601A8183D2330EE183D47D91F17DF071E27CA45CD25A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781673, "uuid": "032f7c44-77b7-4214-89be-7391573856da", "value": "196608:+ZftHRrdls5S2B0uU+HB/OGUElH6XU8YYlbHXUS:+B/rdW5S2BrU+h/PUEl0U8YYlbES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776781673, "uuid": "59e9d144-ff70-412b-8156-7971ba8089c7", "value": 6481118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776781673, "uuid": "6a0d14b1-ed19-4104-952e-5d2ca9891642", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781673, "uuid": "fb8a9702-d487-4b03-8ca5-41d06807b119", "value": "erzurumyoresel.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7931fab2-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754697, "uuid": "5e89b97d-f0da-4742-881e-a504e9f868db", "comment": "Malware payload (Mirai)", "value": "9d542a60ade60f895c1d750ae2aedd5d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754697, "uuid": "de4ebf06-0573-4463-8c55-df5c51e6405f", "comment": "Malware payload (Mirai)", "value": "51ca545ea4c1b659cd713f2e928bffe25922b4b61beaebc85e92da96d96d3fcf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754697, "uuid": "0e29cbbf-cc3c-440f-a108-cf9a6fdd0d84", "comment": "Malware payload (Mirai)", "value": "ead4deb4c37ed5f09ad44a2ab007cf383aef2d83", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754697, "uuid": "a413431a-88b5-4efa-85de-6c67f2b61db4", "comment": "Malware payload (Mirai)", "value": "e70d5abebcb0abd2dc194e8efda34f4167bbcf4e427def4c30b7bf557b2d75a2b762e22594754d249c953943ef685116", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754697, "uuid": "0e258e06-e310-46d8-a8cd-24f8d05db7d1", "value": "T166C2E1E67E7B799BDF3500397499CE3696B0E021C7AAA6639240920C20071BDB7319DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754697, "uuid": "3afdc994-9217-4628-a79b-e98be44858e3", "value": "384:MG1DMwk8JPyGYhDZREXVZVBy6sIye1iWLRYh4Sw4cGJYeRzOFGBzd8QNYTL8EeRo:HMwKDZOFbBy6sSHRYfeAxdd8yUn0NI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754697, "uuid": "bffad021-ce5a-4e55-a7ee-6cfcaef42335", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754697, "uuid": "9161e075-8d78-4daf-ad24-c022baaacf69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754697, "uuid": "f79a63d2-b4ca-4d20-bcba-0167992a5226", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d8c367-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808453, "uuid": "e5033850-072b-4605-9fd5-4086d8b8f914", "comment": "Malware payload", "value": "29732be2ac7a7cfb627921b4cfbf277c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808453, "uuid": "2a36e9d1-8846-4bf2-a956-62b35531d811", "comment": "Malware payload", "value": "53b231d04fb3c24d2c5e11e75079c452b6828edcee200d50fcb609c0d4dc723b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808453, "uuid": "d29c760a-3d27-4118-8bdc-58ed5a9ff5c2", "comment": "Malware payload", "value": "1fcfb55613bc1cab86f26768749c0fc653693d59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808453, "uuid": "dfd359ee-e6d1-4315-b1c6-d9d734c3239d", "comment": "Malware payload", "value": "fd880f773ffc789077cf7b707e87d70fd92b0431e8a2b8c4b31fa2222b352e26fa080d0b7735abc78f46cbe0694f04be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808453, "uuid": "65fb27b2-eee5-4a4d-b927-70c8ac8ba15b", "value": "T1B2564951FECB54F6EA030E3145ABA22F53315D048F25EBE7EA407F2AF9776A11932109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808453, "uuid": "d966a785-d3f8-4275-94d7-2553025d5bc9", "value": "49152:D179WD9y8cDBBH4Ymp7YQ8Y3Ie56uXT50YhkFqE3jRoB5Er:hJWoxH4Ye/j5ljY8Er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808453, "uuid": "1e07b3d7-b660-458b-8f97-b16c1bf5d827", "value": 5959864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808453, "uuid": "ec0b934e-ef6f-4d54-8ce2-d548525fc871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808453, "uuid": "019bbd71-2cf9-4fa8-a7f9-4be9e176aa20", "value": "h2stream.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3993541d-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776783796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783796, "uuid": "dc498cba-a9a3-4fb8-9477-59dd964497f2", "comment": "Malware payload (RemcosRAT)", "value": "1083fc5be87e6446ddd750730f0dccbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783796, "uuid": "c8143771-4681-4b8a-ac2b-e72c47e36281", "comment": "Malware payload (RemcosRAT)", "value": "543379e43bf62ccb4e702b46a5d37edc93ffe7fbc3c9a01efeb7ceee0ac96127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783796, "uuid": "8b2b7fc1-503f-4ead-b310-f8fb0cbdece0", "comment": "Malware payload (RemcosRAT)", "value": "df74f5c23e69e39687b0c1fa8295d14e421ccae6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783796, "uuid": "9ba4004b-0a2b-4017-8232-2435b3e21da5", "comment": "Malware payload (RemcosRAT)", "value": "c62882629eee4c935ecab601d9bfaee80971306873924e45698766f713325c6b0a2f6cca5f4e9a516efeeaff7cac23e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783796, "uuid": "cd32115e-5439-4829-9828-f8c956b9bc1d", "value": "T1C416335FB6D420A6D13A67315AE206835F797C136B3125FFA2C594B60C326C816B2FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783796, "uuid": "af8a8bf2-eeed-4e84-8d40-5c0f942349e6", "value": "9da7080b9b697496fd4f41997e8bd436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783796, "uuid": "99825d55-9716-4c07-89fa-17b311a968ee", "value": "98304:GO+EV69sA+X6NMohwLUvRrhC/1UeQUC8wpfvH:b+E/A+X6NDwLUvR9C/eR8Mv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783796, "uuid": "09949156-2a99-4a40-8ad8-5f4d2bcd1338", "value": 4202496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783796, "uuid": "a5119815-bca1-4fe3-b22e-bcbcb06eb669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783796, "uuid": "5ee06947-27b0-4efd-8175-0c96c8fe47e8", "value": "1083fc5be87e6446ddd750730f0dccbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92af556-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808464, "uuid": "0ea59d58-6587-4fa6-8759-dcf6dda3f05d", "comment": "Malware payload", "value": "c4323a0d866e0382e1cd108f98ff9ade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808464, "uuid": "1a3f796c-3139-4aad-a2b8-5bdc4326dc33", "comment": "Malware payload", "value": "5579321dc5c6cd7c448dbdb5d863a503cbad8d5a92242d1d5b5c858ec6f8a9ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808464, "uuid": "1c6e7db1-eb85-4840-bbfa-415b7337cb43", "comment": "Malware payload", "value": "30a57fa69801524cb30daa844d977b0a57bce879", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808464, "uuid": "68209d65-2a42-4b00-94c8-7ab70b37b185", "comment": "Malware payload", "value": "1acc06f3efdf962d2c27c999ce65c32c4aca7d43172956482311f64cec678ffb7fb672b1e5b483d69f0ee5bb6d44ae16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808464, "uuid": "5bd1ca49-8733-4568-bec2-1b0db473886c", "value": "T1B1465B96BC5DA462D6C976742F3612D43339BC448F82C3272A24B73DFAF63588F12661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808464, "uuid": "86f28af1-2760-4b00-a5de-67da3729b2ca", "value": "49152:e00hbX0/kBX2kpOGtov71dhsbXKATuU1wqS+GW62V3dxW0CuDyx5ET:e0COWov71kbXKcuU1Y+GvnHET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808464, "uuid": "c1b524cf-ce39-4a72-8d24-8dbfd55a6787", "value": 5767352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808464, "uuid": "6a1bbc38-9f5d-4ad5-80df-7a9338e45c6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808464, "uuid": "f33d7bd4-4a37-43bb-9ce2-4402d5fe831e", "value": "h2stream.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de60efb-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776802003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802003, "uuid": "38b24606-0f25-4088-a6d1-de44789ccb87", "comment": "Malware payload (WeedHack)", "value": "7c20345b47153be1480671c8037c268f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802003, "uuid": "b0a9ee83-1bd3-461e-879d-ba15b91d6d96", "comment": "Malware payload (WeedHack)", "value": "56cacbaf7ec4b3b3ec7d66d7da3aa0be41a1211720a27c3ec136031c8686ec79", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802003, "uuid": "b0f54f28-554b-4242-b273-67f315bbda18", "comment": "Malware payload (WeedHack)", "value": "108d757e7bc1721c0eeae4713bcec29be32e0679", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802003, "uuid": "92f338ad-980d-4fa1-a394-16c4518633f0", "comment": "Malware payload (WeedHack)", "value": "15945adffbb7b526c6b5e8de522c30996d8c7ba5591d77e27e4cdbcaa05f8b3cb7ae266c64e94d44996030acb41fe11a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802003, "uuid": "04043ecd-6249-4af9-b527-993657e25108", "value": "T18CD4F127F23CC466ED1FC53BD01098123CEDA8D1E857722B957A599B04B7ADC9B083B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802003, "uuid": "8b66aa3e-e895-4e5d-bb87-766ccb31e664", "value": "12288:B0Jx8/nH7wJmVeDtVPMJ++/T01L6/OnC0A6c69Cmph8dqoWR:KInMJmYnPMJN/T0I/Hz89CCOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776802003, "uuid": "844aefb4-934b-4f7a-9818-d61dbed399c9", "value": 650053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776802003, "uuid": "778eb625-880d-4ec0-9a28-0d7dd52f5a60", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802003, "uuid": "070e1169-ba92-4b4e-b161-9982a327fe23", "value": "Niepotwierdzony921690.crdownload.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4476bb8f-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809154, "uuid": "d4c0b4ea-1852-4355-8d90-c4cc060cc38e", "comment": "Malware payload", "value": "3cf6a3a30a8343f9aa08f5e37241d757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809154, "uuid": "6fa58184-9d78-4b35-a3ad-dfcca707404d", "comment": "Malware payload", "value": "578544a94acd0df2d6fd479536f4ca3ee0355c01cfae6402d5f8b841568367f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809154, "uuid": "7243ce73-18b6-47b4-9000-e7c0df943689", "comment": "Malware payload", "value": "7567090530545f4e013c92586a92b59f7cdc62c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809154, "uuid": "4f25ab62-0876-40a4-aef7-061ac4a06d68", "comment": "Malware payload", "value": "71dfef86ca7cc36095ca76f3f357c85805c3d6716b08e4fcd67c46ffe644dbb1df80291c49ab3089ceb521a454de765f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809154, "uuid": "6654b547-6e02-4409-9a21-13041e0b92ec", "value": "T1BC660955BDC32F66C19C137445EE625662603E454B92433327A8EBFC3A7773CAF4A888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809154, "uuid": "41c6ed1e-3b68-4a63-aaf8-99ad11e54f5b", "value": "24576:mmBNK5/eVD+fkW0X6MzuvGtlaEbOdWkQ/iDpX69d0rAwi3O5FfqOW7vgi/YkZrzD:M5sD2sKvGyE8696eYuvguYkZfuikP5En", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809154, "uuid": "eb5c37bd-2475-47d3-baff-0c45b0f7b1c1", "value": 6750392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809154, "uuid": "a8e5e53e-cd54-4030-ad32-9c953e62ac76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809154, "uuid": "073bc0f6-5bbf-47f6-a5dc-95b1676b2764", "value": "h2stream.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4c7786-3d76-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776771402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771402, "uuid": "3d21bc61-c5b5-495a-b247-bf7ca0c2d7df", "comment": "Malware payload", "value": "c39857ecbd9e5690d58e1035b34c7d43", "object_relation": "md5", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771402, "uuid": "9e0f196f-b8de-4663-beab-01ae42049fc4", "comment": "Malware payload", "value": "5abfb6052893bff10b57555bca11c3a68d37c9fef6f7d066904c2b8bc18249f4", "object_relation": "sha256", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771402, "uuid": "304ca523-7849-4952-9547-90cad80c3da1", "comment": "Malware payload", "value": "fd3a39c141d9046e1db50bc322f6f2710add640e", "object_relation": "sha1", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771402, "uuid": "2b708eb0-041d-4ca3-9584-79f31c37c214", "comment": "Malware payload", "value": "bd0af5cb1cdf7b8ae0182629b49fdf8b442f63479acdfa39c71f63e5b30af85cc01a8c3cc3ef69818d548cc546c4670e", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771402, "uuid": "09a1ec60-2eb4-4797-bf1a-5dbf6c064553", "value": "T17EE0EB1C922682B3230280ECAA28CC10E2CAC3F190C6DE1F9B00D4979801331928C1EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771402, "uuid": "8a96dea9-1a01-4105-a2cb-d93fe3274888", "value": "6:Rjj9K1tFEHsa+9U/y/CdjVAjlsWygDFThFqPMMRdAUzTx:pBK1HEHAU/ao+ls8Dd2ddAUzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776771402, "uuid": "aecb9f39-6a12-4646-85d1-82ac865c5821", "value": 292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776771402, "uuid": "231d6828-f4f4-4aa4-9383-5d4a2073de21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771402, "uuid": "54467ac2-6fe3-45ec-b704-1fb4b9952857", "value": "5abfb6052893bff10b57555bca11c3a68d37c9fef6f7d066904c2b8bc18249f4.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa91429-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808493, "uuid": "d921737e-b5ad-4493-bf96-e7c5d2f27ea8", "comment": "Malware payload", "value": "bde13c59c0439e17936ffb83506fd6be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808493, "uuid": "f1a8fdf4-9c13-42ed-b7a3-76bbdd095997", "comment": "Malware payload", "value": "5ae7438169237848bf4d59fc3c34716f3986c7bff6962825803fe3322a30b07d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808493, "uuid": "d308c9e5-a4ed-4715-96ee-90b74b43c2b1", "comment": "Malware payload", "value": "db8d73a49c58c1aa748502fa33d5a426e4839c44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808493, "uuid": "7d4281ef-7329-48b8-b0f8-1126fb2a5896", "comment": "Malware payload", "value": "bf31505e2567d9eff1bffb8711d06e35d65f4dd553d18ee6bc0475ce47973dbb13ad7e35c55194399d2c84dc8d7af9e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808493, "uuid": "f29e0016-748a-4338-9808-c903fab40372", "value": "T1726628137A28EB0EC26821344CB1CA942B7A2C4942D79517B791F729F9F20AC5D6FDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808493, "uuid": "8a67e827-034a-40d1-956c-0f8ccb5270dc", "value": "49152:Z/RDTmU0X/62rwAyyTiW4tMcEtal/XHiaW5gQl0jbx2b8l+VPlWvQfNijHxvt5EN:y4K/gQl0/+8CTfNijRvjEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808493, "uuid": "7be396a6-b0c6-472a-9733-ee7aa73ad81a", "value": 6881495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808493, "uuid": "247b802f-017a-4abf-a794-4c3514ce693e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808493, "uuid": "0c4e2a54-3f7b-466e-a182-fd60f3462e62", "value": "h2rapidreset.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fda84b-3dc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776804164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804164, "uuid": "0655da69-0dee-4fcd-91b2-a097b75bf9eb", "comment": "Malware payload", "value": "94ab686e90347182a5844457fc956504", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804164, "uuid": "a1b366ed-c563-49e2-a4e8-2d5e0e4186a1", "comment": "Malware payload", "value": "5e11cd423bded5b799272bfdc0d0d53cf10cc62cd8217160b1ae4df0398f64e7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804164, "uuid": "99113d3b-b8b5-4a58-90d5-125f8f7d9fe5", "comment": "Malware payload", "value": "3490c4c345c829b8e16d0239a91275e6aa19f672", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804164, "uuid": "11ea7e5f-812e-41d6-8e2d-1f4539b73a79", "comment": "Malware payload", "value": "377bfec09f1d249ae1fac925d02277ca09fd6f08a7f0f338a46dbb06d69472c7b7d14eb46e018ea7ab13e008532d89e2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804164, "uuid": "aba43249-5873-4260-b158-6aec625abf2a", "value": "T1F232D51E2A474321DD5048B0F2B18A8A553D4EE37342FEDBE633D1CB0AD6E4584C1AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804164, "uuid": "3466cfb2-5ad8-4df4-803a-d418e5c514ab", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804164, "uuid": "2cc46cbe-9302-42b4-bdbb-be7514d8b2ea", "value": "192:xdoJEWd3MOB7MxymLmPFJxTEZmFhkmc732:noJO7MfPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776804164, "uuid": "f9e3e2c9-dd58-48bc-9176-b6cd424ab2d2", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776804164, "uuid": "cd350c3b-cdf4-4b63-966f-711ee23df329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804164, "uuid": "062d16c8-b927-40ff-b799-bf98d5c57ad0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911867e5-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754737, "uuid": "6930545f-7a4e-4034-b4e8-454f21e0b316", "comment": "Malware payload (Mirai)", "value": "8a17eabe6c370b81db461608061aafc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754737, "uuid": "68457ebb-bdac-40df-a99b-145d549a34df", "comment": "Malware payload (Mirai)", "value": "5e2f8f4983d9ace01d1138af7b8805dc5135fdce05db4cace48e1c78edcd5c39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754737, "uuid": "d699b7d3-f009-497b-a478-7775b49411d6", "comment": "Malware payload (Mirai)", "value": "53685c926e9176b637bd7bda7ce26d27f5366742", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754737, "uuid": "bd64e854-6d7f-4461-8c67-ba3ab9e89914", "comment": "Malware payload (Mirai)", "value": "5b0c39f4adf724913fd29cf6fe0b37d4c922631254af0310fd1dfb43105af9ee4f4466a9c761eb1ad322a526263d0207", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754737, "uuid": "abaa2104-3c7a-4a30-90b5-c77a10911dc2", "value": "T1FE83D60ABB604EF7ECABDC3745EA1706209D552A30A96F75B534D918F14F20F2AD3934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754737, "uuid": "19dd90a3-4785-4437-8d8e-6fcc0e420a73", "value": "1536:W1XW3UTVavjqVQywbPxPP/wwb9lT2TiUeL6SZJizKzC:W1XW25VYnUjSGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754737, "uuid": "87b836d7-3f84-4e85-8b15-14abed0d2755", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754737, "uuid": "02db7d12-9701-4811-adc9-68301ea23a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754737, "uuid": "66cc697a-f908-41f0-911c-dbf5fa916f68", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5801c1af-3dda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776814341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814341, "uuid": "90a1291e-916b-40a8-9f3c-a36b0288240e", "comment": "Malware payload", "value": "5dbef27e9ac3fe5be934095c41ffe006", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814341, "uuid": "e713188c-ef40-4fcd-a5ac-f179e292d052", "comment": "Malware payload", "value": "5f3db8567269f88bdb43212a014644a90c4ac68a842f5d565a1c208890991cad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814341, "uuid": "5a390557-08ff-447b-be9b-daad2a9abef9", "comment": "Malware payload", "value": "0195d15328fafd0ebc4c60ab93589c303632a1fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814341, "uuid": "c7c04c19-bc50-4331-8553-3342c44771d3", "comment": "Malware payload", "value": "f5fdb3524f94025d00c0e3aaa1de36026ba9ee2a044c8f276cb3970a397382143f66da2fe3d6c4981ac89f7f032b883e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776814341, "uuid": "c7dcfb07-34a0-453b-b780-3e6f0c5d82c4", "value": "T1BF43F171C4630744E599927A189BBD03A410CF4C4521A3F881F53BA9E6B7FFC1B9CAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776814341, "uuid": "cf875548-0532-4c7b-9070-4bdafe750fa7", "value": "1536:OAscKnkFF2yepSSiQ3LzoUcSAdD06uWwdbsicOqAtGt0RMQpenouy8bqG:icHT2y4SSiQ3LzkSAjuWwpUAtGGR/p+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776814341, "uuid": "4ac5fa4d-0fa8-4964-b782-d7c478923203", "value": 60272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776814341, "uuid": "b23d104b-fcdc-4b17-ad73-af379cb05607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776814341, "uuid": "34c9f4d1-2d49-4951-963b-bc1dd81cd1ae", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c3ffaf-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809255, "uuid": "31526b18-4cd5-4482-873d-4f1ca57e5b0b", "comment": "Malware payload", "value": "dc471ca4d6780a8fb3c7e4f5375aa735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809255, "uuid": "74c9e4b5-2af5-49ac-b733-74d9c234f204", "comment": "Malware payload", "value": "60ac99f762e7d6608544e75c4bb3b545d70f3bde8f46259d2615639440e3662c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809255, "uuid": "d74c01aa-f8a0-406c-b460-d6123f002e7d", "comment": "Malware payload", "value": "42d6ab7d061da874bad88e09af0d8130db1fb86d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809255, "uuid": "c92340e0-adc1-4ff0-88e5-e1d14cca858b", "comment": "Malware payload", "value": "615b15fc0c2739dae16207d3d13d178942671142285b6c6bfb0f3069c9b064b224f4d07312177ab399226f33bf603a62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809255, "uuid": "2d21e1b6-889f-4615-a715-55df89b92bfd", "value": "T18E761997B8824952C5E83A37BCBE80D433631EB99B8652166D04FE3C7EBE5D90E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809255, "uuid": "c37f1930-fd90-47d2-b31a-2e5fdce86617", "value": "49152:2slYDmlif5BDXSzZkgkPV5gNHKX4ZlassG8I09LMNcSFIUTVyeq5ERl:2sli155XSzZkgjELWcuxkEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809255, "uuid": "1a60340d-f92f-4984-bffd-4249b6150783", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809255, "uuid": "17bec82a-c415-468a-85ee-07978fce627a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809255, "uuid": "c9c5382f-1c90-43b8-810a-2749efbf58bf", "value": "h3flood.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999393f5-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776774937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774937, "uuid": "a3c9e9ea-c37d-48d9-907d-6c38d019b55e", "comment": "Malware payload (WeedHack)", "value": "5bff76a39143eb931c2b016878280732", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774937, "uuid": "a15976e9-986a-44bc-94f0-3a70053ddd11", "comment": "Malware payload (WeedHack)", "value": "6198f5b7f901e64c4a122dd16e45d512521ccd171548deb5a19042b3e6a66087", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774937, "uuid": "b2c97ef1-760d-45e7-a677-c0761c0a8a13", "comment": "Malware payload (WeedHack)", "value": "1d177b6da8ad8ce9fb695b7b6c91365750bf9a23", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774937, "uuid": "bd43e56b-6a73-4bbc-9fde-0108011d155a", "comment": "Malware payload (WeedHack)", "value": "d5e3c12e2964829970907d90f00c6c3a0667a6a91181b4e52c2521c951b2a567fe73320f258ed0a5fe092ae0d9a5cb46", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774937, "uuid": "b9634222-111b-4738-b453-7775da01a833", "value": "T1D134D024735D0673DA2F8733DE04AD3D583D48EBFE0A29E250DC08CA524B865D79979B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774937, "uuid": "3c227b4c-bcb1-410f-92d6-5ad6516e5caf", "value": "6144:o1NwVhxDq4zWory0nMeG+/ko0r/E7t/MU1v13om2gq:ofwzc4zWory0nMx+/F2a9oFgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776774937, "uuid": "4b029780-87d6-4a04-a625-376053d79dba", "value": 248604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776774937, "uuid": "c3cfe03b-3ffe-4ef5-81e7-10bd183643b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774937, "uuid": "fbab8617-6b85-4147-b046-5495c7495048", "value": "6198f5b7f901e64c4a122dd16e45d512521ccd171548deb5a19042b3e6a66087.file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c2a46a-3d68-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776765554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765554, "uuid": "d5099739-01f1-495e-856a-a6784c76d549", "comment": "Malware payload (ConnectWise)", "value": "4c1ea694b68bc703535d571b2f4a3944", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765554, "uuid": "9f8cc917-2469-4d68-adcb-90edc6956508", "comment": "Malware payload (ConnectWise)", "value": "6380418228eeb94248b850f1baa05be12104120dc0e8ef0c50d72891318ab04d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765554, "uuid": "84e4fb16-f201-4c2c-b112-61e1d271b03f", "comment": "Malware payload (ConnectWise)", "value": "0479d0357b9aa921610dff5a1cba1fa2795980b7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765554, "uuid": "19e49753-7860-414a-bafb-254f35d42f9e", "comment": "Malware payload (ConnectWise)", "value": "15b87b5ad6728fbab2e8cc70e1137d4b03bcea4c8b66b641218e6a5ffdd27951478b977f5936a78099ece401b3fd83a0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765554, "uuid": "075a4ade-ee96-4b3e-88ab-629d3e152c3a", "value": "T139C61201B3E565B5E0BF0A38E87A42656A75BC049712C2BF5394B96D3D32BC08E32773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765554, "uuid": "4ec1b3b7-b229-47b5-9801-795e1ac99d20", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765554, "uuid": "deed01ff-6e7c-40ec-ab32-2c46f9cf60a3", "value": "196608:nfefPngHm9R0AbJZpHm9R0AXHm9R0A/Hm9R0Aw:QdZAmuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776765554, "uuid": "5965a9a8-00a6-4c5c-ba7b-f4f39c83e4e8", "value": 11904056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776765554, "uuid": "3e8c7ff6-3ba6-4dec-8ad7-8eb22161baaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765554, "uuid": "db0af6c0-d12f-4de0-be2a-bff7b27b6da0", "value": "6380418228eeb94248b850f1baa05be12104120dc0e8ef0c50d72891318ab04d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c10975-3d9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776787116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776787116, "uuid": "0201194d-bc0c-4aee-8fb6-862eb056c44f", "comment": "Malware payload (Phorpiex)", "value": "667f0f30c6460db621fc921629548a1e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776787116, "uuid": "c08c4b23-f089-421a-998c-8c56cc9d2a3f", "comment": "Malware payload (Phorpiex)", "value": "639253caa407233e9947509a4d1be95d05855c2262c35a50eda5aa6adcc5a61b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776787116, "uuid": "e593ea5b-3a49-4496-ab07-41f55b594102", "comment": "Malware payload (Phorpiex)", "value": "174837480c73f0dcfcd8eb6b395327880f3b733c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776787116, "uuid": "8fee7983-e0dd-4e33-9e02-ffad1f81c147", "comment": "Malware payload (Phorpiex)", "value": "a7350f60d51d8421b5c7b43d780d37efa4e5b7361a5882afa5e256276c600a7f4acb0784418a71e9bc47158fa2de6319", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776787116, "uuid": "086cf806-aa67-482a-a810-d3ca9c25016a", "value": "T188224B2E6E8A0131E3E189B056B18A4D557C467363D6B3EBF333D9890FA92449441AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776787116, "uuid": "f932e4da-d02a-42f0-8f6b-2ea13bede889", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776787116, "uuid": "c1f8d1f8-0929-4ba7-820c-f030bf7bc85a", "value": "192:FMco+Wc+WgBatex+et48tPFJxTEZmFhSmcAGF:FXoVWswN8tPFwZvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776787116, "uuid": "cc557bf2-2690-41e8-9e0f-bbff33593921", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776787116, "uuid": "64f38b0c-ea47-4a55-baac-842ce81f3d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776787116, "uuid": "8bd6e164-38c9-44bf-85d9-da7318946f20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772cb204-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754693, "uuid": "faf65626-22b8-4d13-b018-33a200438d8b", "comment": "Malware payload (Mirai)", "value": "65e472a60f56036241614be42ea83128", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754693, "uuid": "fc8d3eba-9b8b-4eb2-9ab5-266aab3efc68", "comment": "Malware payload (Mirai)", "value": "63e476ac8c537dcf90705d87a267d88ea4c4046fb9f5ac8a63adb1687b563b90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754693, "uuid": "12099a5c-a7c4-4dc1-b329-506b3b3beb2f", "comment": "Malware payload (Mirai)", "value": "2165b2de032dc0472898c79b8fbca6b2f1738ad0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754693, "uuid": "89df04f8-4f75-42e4-86f3-1cb0169cccfd", "comment": "Malware payload (Mirai)", "value": "5b377d7c3b7900fcea938cc3b6347b9e2fe7ba90037f180f9a9628e8f9d0cc0a52a8f8fa3b1e5c74b04ccc8884761fe9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754693, "uuid": "0c2e421c-7d0c-436c-958e-db4708493bdb", "value": "T12AD2F18D76D3A3FA8C99C5BE721F0036309A34A9B2B29317B306D4434776181E686D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754693, "uuid": "f948ad0c-b560-4c85-b3ab-a560655c934b", "value": "384:MPd/PxEDLd2TwM4zb6lowYcEaqsU9lcC450LQixBfE4jdlz0lewZ9W0raoAr2Nyv:0lxKd294CxEnsU96IHE4RlY99W02Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754693, "uuid": "ac503ecc-127d-402f-bf3a-738e3cd698c9", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754693, "uuid": "7cbba1e9-2619-4434-b35a-bb6707eb14f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754693, "uuid": "a0b77320-8087-4d36-9270-46b34d7ba933", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41fa112-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806308, "uuid": "27dab9b4-f2fe-4faf-97c8-aa43cc600ea7", "comment": "Malware payload (Mirai)", "value": "d12443ca765a8c3980649e982aa35d24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806308, "uuid": "4e7200a1-7a16-4804-9c1e-c58c0970864d", "comment": "Malware payload (Mirai)", "value": "653f4ad9c250db1b2dbfe38eb60c1326c2cfcc262fe72dd38ba81c0819c0a85a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806308, "uuid": "7e003e45-29e9-40fc-a1aa-615e9ec8b9cc", "comment": "Malware payload (Mirai)", "value": "a8bbfae43cbee708f05916f6b12d57b6ec9d08e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806308, "uuid": "91a2c395-ccff-4d5a-9844-c97bd1fa5ddb", "comment": "Malware payload (Mirai)", "value": "1add34fb9059eed06c653c370df122b80fc26012850ed8f0da07178ae114f3ee28ba115ab76547d8cea696971e08ec4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806308, "uuid": "f3b8e11e-7857-440b-944b-92fbc3bc82a1", "value": "T1B6634BC9F983D4F6F856093010B7BF6799B2D6BF3168CA03C3A855369D22503E412EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806308, "uuid": "8c823d57-ee27-4661-9e18-c0ac59c609d7", "value": "1536:eOX1oBjKGIsnnF7gbvDhWs8Zq3phZSJfS:eOXmjKGxnFEbvlf8ZqifS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806308, "uuid": "a9ccb12d-aefe-45f3-9cb5-10522dae9c60", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806308, "uuid": "85fcb79d-76a3-4364-8349-d0d2870bf3cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806308, "uuid": "e48b56f2-68cd-4fd1-b22d-2a80970bd155", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1710121f-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776733487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733487, "uuid": "198b1a4f-1df0-4261-99ff-3cec61801cd1", "comment": "Malware payload", "value": "cfac9f8b58212bb5ba25412252859501", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733487, "uuid": "0152dd3b-3f67-4d68-b452-204b974903d4", "comment": "Malware payload", "value": "6566396768d73a29b7e878f0b189f365d261338257485c32b7e82413678d5d4e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733487, "uuid": "6e486cd0-0101-448a-8103-463cd2e204dd", "comment": "Malware payload", "value": "5bae7701a24c5c5d0ec1f4f32640eec5800ba2b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733487, "uuid": "401c92db-6aaf-4289-94c2-deb4d1f69899", "comment": "Malware payload", "value": "537a57255f7c42a2acd8014d69ae32a2b8949eaa6a14c61f55566a67ef501fd5c420ef7340347d40d9bc68a561e6e8ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733487, "uuid": "8dd2bab0-95e7-479a-ad82-ce07dac5f78b", "value": "T15E272A57B8D71441C8E43A73B8BC40D532622FBE9B87532A2D06EA387F7E4C90A79751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733487, "uuid": "8293b860-41d1-4142-a412-fbec5bc4831c", "value": "196608:l4ryqNvu0nZYg71ak9G8iYVxoiFyfaHY/LVhz:lerZYisfOoXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733487, "uuid": "8036de3c-ed2b-45ac-a66e-71c16cc534c4", "value": 20643966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733487, "uuid": "de011d05-9f8a-4aff-aaf6-8cff806ba4b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733487, "uuid": "0003ca4d-b0aa-4df7-9a2f-134e8cc73296", "value": "agent-linux-armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce6429b-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776733496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733496, "uuid": "356b06b3-d185-4c78-b696-8fecbe896d8b", "comment": "Malware payload (Gafgyt)", "value": "2d73ac96f95c29b308d97c8089d0e392", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733496, "uuid": "51e1967e-a0db-438e-bd49-59998ff1b0ee", "comment": "Malware payload (Gafgyt)", "value": "65fb9be7301516082d5f306913cdcf7ac8bf6a1d5255a41239d0093ef18e42f0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733496, "uuid": "44d683fa-d479-46b0-b9c0-26e99e723cf6", "comment": "Malware payload (Gafgyt)", "value": "df4ed806cc7c244d4d95ad5a2259b96f2e7efe16", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733496, "uuid": "2439c47a-2742-4a52-84dc-278eddeedd69", "comment": "Malware payload (Gafgyt)", "value": "5d02236641f494e2ca6dbd864bb3673bbceb3a37a3778bac319385eb033c90a0132a48c15f39b95c5c725d7f9daff9f3", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733496, "uuid": "fc7bd061-d766-410b-af75-48f2fb505263", "value": "T115E34C49F6404B57C0D32776B6CF420633239BA5A3DB331A9924AFF43FC27A94E62945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733496, "uuid": "ca78453c-dfb8-4ccc-9ed4-f77450a1199f", "value": "3072:bdRtUa3OvK+Ua9WHD2zV5hDJGSmnSM/9Ntc0cImcwTsL/QMyn:JjUa3OvhUHD2Z5hDJGSmSM/97VZmcwTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733496, "uuid": "a38fbe6d-41eb-4876-97fb-d2024e0967c3", "value": 156176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733496, "uuid": "d81fa9a8-ca5a-47ac-a5f2-bb19e3509558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733496, "uuid": "702984af-aaff-4adb-be7f-156636a4491c", "value": "assailant.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0624b64-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808476, "uuid": "9c2f94bf-5c8d-42d8-b728-d427f499cd33", "comment": "Malware payload", "value": "62d9b1b28b77452ca9b9925106eea4b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808476, "uuid": "cbfc6ab4-de06-400b-9722-81aa7679ff95", "comment": "Malware payload", "value": "663c88ca9c3d9779010c9fd7d6316b2692c1ec95e16b745ef39305713f4bd616", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808476, "uuid": "d2d0505f-13e0-4bf9-a3bf-76d2522c76bd", "comment": "Malware payload", "value": "46b0abeb50a65711643f18c89f10fcda82ca5686", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808476, "uuid": "9a4560cf-b90e-4bae-9be6-b8b10af639c7", "comment": "Malware payload", "value": "1306cac79a953732137b55e2824dcac06c1b20354d70938249a87d231429753fd617f0f84697d50a86df9b6ec67b6625", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808476, "uuid": "b8cacd5f-b233-4ebb-a42a-04aaa67a5a84", "value": "T1F9565B43FCA455E9C1AAA13186629253BB717C486F3163D32FA0F3386F72BD06AB5750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808476, "uuid": "aae89510-de3c-40b2-9664-123ec07abff3", "value": "49152:223K19EYQ/CoU02GmSOf6X832VsOwR4zJWXjISsIkZQ+9kMA/9xrraryOQ3bM8hp:2dqDF5mETz0ISs3QZ/9Rm/qTtkXE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808476, "uuid": "44b5926e-4d84-472f-95c7-684a9859c0dc", "value": 6172964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808476, "uuid": "ed44e853-8f03-457d-8cbd-2e9006eb09c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808476, "uuid": "bab06fa1-7047-4ef3-8120-3b0567c95c24", "value": "h2stream.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e15aa24-3d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776781682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781682, "uuid": "fc0e4377-a013-433b-9f28-dce420c8f796", "comment": "Malware payload (PureHVNC)", "value": "f189f8ce6b294b9836f94b7365532368", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781682, "uuid": "84be17cc-7b10-4741-a27b-2fce39e0f307", "comment": "Malware payload (PureHVNC)", "value": "66cc3503b7b649002f659c029df861b735e030f5495d5d499c7220533515e9b7", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781682, "uuid": "f2cfd9ce-adef-48b5-81b2-1cec1dd5bd49", "comment": "Malware payload (PureHVNC)", "value": "a5d8c36601e993637560854d6ecede05fd7ed9cb", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781682, "uuid": "eef91399-602e-470b-8173-f542057acdb0", "comment": "Malware payload (PureHVNC)", "value": "bb3004e8b5f0c0b0d88641ad0d5d4392cabbf1c5dc59290de57e45ccd298be546be0c33da43080c35a8b34c0bc404e6f", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781682, "uuid": "7d6447cd-4f36-489e-8799-7ba76eab4888", "value": "T1AED58C06A3C45AA6C056DB38CA27D733D2B2BC124775928F1597D70E5E73B918F3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781682, "uuid": "e6cd0078-bdfc-40b8-94d5-41e70356f438", "value": "72f45c31d6fbd2ae6c16ee19d12e94c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781682, "uuid": "a307f3bb-1819-4785-9f36-82e11179d89b", "value": "49152:uZqmoZXAWixuwXpTF3Oi6U71F7CJ9EEuNXVz1icbXwvPChvfU7AEgNXQv42MhNap:gWSqupwvPChvfU7AEgNXQv42MhNaQ+xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776781682, "uuid": "41f42d4e-95ac-438d-9f98-5d4589052332", "value": 2962432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776781682, "uuid": "0eaa3e0c-61f2-4c99-b205-58f54501fda4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781682, "uuid": "99fa3d9d-e2a7-49bc-94d6-fa811824c40f", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11517b25-3d88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776779004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779004, "uuid": "ffa66500-1cc5-4717-98a2-a4c8f8c83c02", "comment": "Malware payload", "value": "cbd608f5e8ba2be3b3703444b604f2e8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779004, "uuid": "b2161de8-f7e0-4614-9455-5e9818c2cebc", "comment": "Malware payload", "value": "6724b7e2e11ceeecce43b61adbce9eb35c4ce6789c7880ca222f8f3b5f0bbd63", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779004, "uuid": "96b8b71e-5ed6-4c19-b5ac-4a029ccbdbb0", "comment": "Malware payload", "value": "fd0a540af491dffefe17c5c59f2d4b54ec9758fc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779004, "uuid": "017243ca-3dda-48e0-a46a-e9acb090594d", "comment": "Malware payload", "value": "aa73df1168001b183890506d756bfd0fdbcc083df3fb08eb8b3aae8d64f8a8082107754ff33022d7d662a5bc8dc236b4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779004, "uuid": "4e8ac501-868b-4921-b924-d532ec47f4ed", "value": "T15AC39C10FAC1C073C49421704469C7B29A3EB4345B3A9AD7BF980BBE5E203D1E67A74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779004, "uuid": "713cca9b-9008-4a33-91df-e4c0ce454c90", "value": "a723a6f6b2d98c01856abbd6624e0063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779004, "uuid": "8e06fade-f861-4517-ae9c-ef33e4d127b9", "value": "3072:qerWaY8rVfVRL5TXynO3LNifWym3jTRjo5b:2n8rVfVRL5mnO3LNsWys5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776779004, "uuid": "4134278b-25a8-47a6-b04a-c0bee0b5d5e0", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776779004, "uuid": "4f1d940e-2e4e-4b78-b49e-a495146fc86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779004, "uuid": "fe4d66cc-0f84-4a9f-9ef1-dd581511b410", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea0efd4-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754732, "uuid": "e267540f-fe50-4a0e-9c14-188437b0dc54", "comment": "Malware payload (Mirai)", "value": "6d4b1932452dcb308cc8a7bb11d06670", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754732, "uuid": "08466a45-d785-4ba5-a28b-63398401aaa3", "comment": "Malware payload (Mirai)", "value": "6764b46bf6bceb4c1a92c225f3b5b6e189927b41883cada1882b7f7083a007c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754732, "uuid": "c574db01-2b84-46a0-89e4-10c031ab74e5", "comment": "Malware payload (Mirai)", "value": "299b4652b93ebad82b91eb89f7e3148dfc6460da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754732, "uuid": "f2cabec7-eee2-4eb5-bff9-3365fee86747", "comment": "Malware payload (Mirai)", "value": "de3fb216ad4a4ac1fceba92614eede04b395a29cb1424901223bd5308936a87b172faac6fdc9fa8efd8ed61ca070bae5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754732, "uuid": "f2643f40-fedb-4f79-8ac6-f27dfe12861d", "value": "T1C543F7817881AA39C7C0577BEA9F104E3314A7DCE0DA7747CC180FA176DA91B0D67B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754732, "uuid": "944dee64-9bbb-42d2-92e5-854500e0efa7", "value": "1536:bmXou1DAd2Gmj+4jbZ92qK0zlKpg7MEhWm5uN:bm5jbZQ0z8pg7vD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754732, "uuid": "a437a4df-f21e-40cf-a95c-34a1cac0a8ca", "value": 60304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754732, "uuid": "dea50855-9176-4e67-8a04-9fe1a9ca2dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754732, "uuid": "0c7b97f8-6f7a-4218-917d-05853ff64d02", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ea69cf-3d17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776730820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776730820, "uuid": "bd5183a6-7e96-4953-be0d-b14aad2e962f", "comment": "Malware payload (Mirai)", "value": "dabe7bd2e876bcbd9864c9cfe9475eff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776730820, "uuid": "ecd22e62-3c5b-43e6-9003-30744bd42bc5", "comment": "Malware payload (Mirai)", "value": "69759effb888f132550e4ed607ae2e80c9c6559ac13799b7741c3cc855c52dec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776730820, "uuid": "deddc70f-63ef-4948-a937-db98ac08d307", "comment": "Malware payload (Mirai)", "value": "5684113774cd93a0ccf158ce6fe77878fc439469", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776730820, "uuid": "35650229-2661-4cb2-8b71-0257fb35a39d", "comment": "Malware payload (Mirai)", "value": "e85983aafe12ce538e2f8fa4167ea36aadc5dc32b8706666c5736325384f8c4ee64b38486c293a7e0a2759cfc5969f18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776730820, "uuid": "ddd80b4f-0405-4ed9-a4bd-9a19f738ba3d", "value": "T1CF142DA6C44DC5C7C922127C61A9AF7BCE3FB2EB1709CD02BED4643089C5E9B7A16D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776730820, "uuid": "50cc834d-acd9-4440-ac5c-0a5076932449", "value": "1536:jycKjTfKQw/AHsxIW/lu9jnrHIHf2CLfiWla38+BkmonTtiK+pK7DKrtwp+Vp+wi:vKjTfKQAs8HfxLq8asXnTIs6Zg7iRVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776730820, "uuid": "0c5be8ca-7f69-4e54-a8c9-ef02427b50b3", "value": 194444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776730820, "uuid": "b655c137-e59c-4a86-9d60-5b5e85d2ef6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776730820, "uuid": "e12f6157-09be-4f24-8921-e20fd2ac430f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0b94c7-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776807878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807878, "uuid": "0c479b99-3188-4f62-9b7b-9da9b016006a", "comment": "Malware payload (Gafgyt)", "value": "f7b8543decf9c5d045b663a079bf3131", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807878, "uuid": "36a46d65-b670-41f3-b811-adb4d578e581", "comment": "Malware payload (Gafgyt)", "value": "6a05a588fdd3306c512a19b62808205a32f018d894fdc1b826816b0c54f6fd30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807878, "uuid": "7d86fb4a-7ef7-4747-af63-4c036dfa6421", "comment": "Malware payload (Gafgyt)", "value": "04b815e71bd0f2bdf7f03c593a81eb3189cbf67c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807878, "uuid": "474cda5c-5084-4913-a874-3128d55b6a6a", "comment": "Malware payload (Gafgyt)", "value": "d7083229367c30eff6bd76ef78590b54eafb777f33cf0d89f93232d17899d69a154d9e1a8d0552fd49a0cf17ede662ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807878, "uuid": "ab77ac59-6ac7-425a-90d8-e07e7fbe513d", "value": "T158F2F15057C4A9A6EFF02E379DF4C987021906B4AB5A78D29F684038ECCB80D577A2D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807878, "uuid": "20744c28-720d-4b56-94b6-5e888dd1a90e", "value": "768:wwp8cQFWVwcL/OL3pt7fuIOOzH3F6dPlkYF96C8eN0rFSwGMe/3Uj:RmcqyPwp9fuIOOzX+dkYH67eNUlem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807878, "uuid": "c51d81cb-49cc-4689-8178-c625864f94ca", "value": 35908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807878, "uuid": "7d6d27d7-38c0-4c4d-8408-b16cbfce9512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807878, "uuid": "a56b3af4-8c24-4923-bdce-6d3b93279b4c", "value": "ARMV5L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b50b6f-3d79-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1776772708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772708, "uuid": "2965f71b-d517-4a0c-9308-fcbd3ac6982e", "comment": "Malware payload (OffLoader)", "value": "6b98333f7af0949969ece72aec6d7c77", "object_relation": "md5", "Tag": [ { "name": "94-156-114-250", "colour": "#29E8FF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772708, "uuid": "d0baf587-9d78-448e-b7bb-f72ba7adcc03", "comment": "Malware payload (OffLoader)", "value": "6a586fea7122c3e02dd8c99c93e8162c065e4ce6ba766854cb0bae3a9ba737ae", "object_relation": "sha256", "Tag": [ { "name": "94-156-114-250", "colour": "#29E8FF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772708, "uuid": "3e45f16d-c461-4f9d-9c84-a4f47b96ad0b", "comment": "Malware payload (OffLoader)", "value": "076b801be2f9a1bceafcc33f46e59c7f48526eb5", "object_relation": "sha1", "Tag": [ { "name": "94-156-114-250", "colour": "#29E8FF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772708, "uuid": "4e858d3d-7494-4329-9813-eded4aadc236", "comment": "Malware payload (OffLoader)", "value": "2573e9bc6707b3036aecb2410cf669d206cecea628c734097486a6e3743f97b96bb90809295033b997cde8976be0bb72", "object_relation": "sha3-384", "Tag": [ { "name": "94-156-114-250", "colour": "#29E8FF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772708, "uuid": "7d8badb2-5ea2-4ed5-9ab1-41a71f352fd4", "value": "T1C2660223B249633DE46A5A3746B1D25C5A3B7A11E41B4C57A6E00CCCFFE90A01E7F276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772708, "uuid": "61df866f-f806-4848-a2c2-45ce6a2a9ede", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772708, "uuid": "ef9dbe1e-5109-4687-9f24-f5de5b18ef2b", "value": "98304:mN6683Rs07BKcmagdysjSYJOFciOGfAN1u4V+MQPSIO:28f7BiaypjSwOF2Gy1nRQPSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776772708, "uuid": "5c2bc4d6-de8f-4f7d-94f4-0b33f8b72dff", "value": 6993557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776772708, "uuid": "e2bc1af3-f596-47b8-a7b0-9b10818183b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772708, "uuid": "0db7a17c-1c8f-4d9f-adfa-d509e7ac3236", "value": "6a586fea7122c3e02dd8c99c93e8162c065e4ce6ba766854cb0bae3a9ba737ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf09971c-3d81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776776289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776776289, "uuid": "b05ac2d0-56c3-4433-8e38-5dfe6ba817e7", "comment": "Malware payload", "value": "398a075076edc9a95234dea2984764f7", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776776289, "uuid": "24a813a4-39a3-4a73-8611-ee529482b484", "comment": "Malware payload", "value": "6a86273f6a1afd02eca1cfc6fd11209a5636e3f1ec0a55b2659d4c9d879fd045", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776776289, "uuid": "d852903a-ac51-4906-b431-2b682c28bf23", "comment": "Malware payload", "value": "bb10b7825f57d84a76d12a3e6159d9ff1a9f3b96", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776776289, "uuid": "0f903754-e68f-4dc3-8a6e-aae038b082a6", "comment": "Malware payload", "value": "0d746053265adf7271855c5b13fb8188e9a759dbfd5c61dce33847f3cc8ca2f775e8abcc65cf63fe9a449f833b307823", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776776289, "uuid": "e1b94f45-09d0-4e67-b9b3-4971604ae184", "value": "T19B939F60AE52AC2A33F709175F8FFB8C74B5DEF6D1D51107C0928BCD25A02A8B496B4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776776289, "uuid": "a3dc0276-d282-4add-a2a8-37dc7172a357", "value": "1536:Jsg+7N/hJ2QVxrSGQgYjY2D/9iFqXcL/ApRic4PRE:+g+761/hSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776776289, "uuid": "400cabc8-2110-42da-bf6d-451032cb1eac", "value": 94364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776776289, "uuid": "b2539b1b-914e-4c34-8c62-27c0183a1b5b", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776776289, "uuid": "a10cfd0b-65e7-4018-8237-5a0335b78e10", "value": "flex-dispatcher-go.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2093a7fe-3d79-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776772587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772587, "uuid": "e906c55a-8866-4bed-8e39-4c43734fdbcc", "comment": "Malware payload (PureHVNC)", "value": "f10457c95180bdd0325290a87bea53fa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772587, "uuid": "e722ad36-bd56-4ce2-8050-8e20bcc1138f", "comment": "Malware payload (PureHVNC)", "value": "6a928dc991d2a39cbf6f3d80b21b18d2bbd7800ed2bbc150a093ae10ec1bd02a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772587, "uuid": "cc06632c-9a3d-4190-b1a0-ef0df22496b8", "comment": "Malware payload (PureHVNC)", "value": "6df9fa2119678d803689ee55d6a48f1201129716", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772587, "uuid": "2c3de0c8-1194-4db2-a1d7-2fabc73b80d5", "comment": "Malware payload (PureHVNC)", "value": "840b53a32cfbe719f23e983b361e57a43efa59ebcbb7dccaf578a4f6eeac359b6e9a11e123cb11b454355224dcb1c705", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772587, "uuid": "0c9ba8ec-f9d5-4daf-965f-320e2cad972e", "value": "T11296F1796984EE0EC735223BB8A673859DDAE5C7FC67CC706579B380CA213306D1C91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772587, "uuid": "27523705-1ddf-4067-b42e-f89730a1b9d9", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772587, "uuid": "a2c9ec1f-d769-448c-ac6e-b16f0bb3ab04", "value": "196608:TlxxwUoEXrDs7ngtvKt/U9vbWeCihtmgPQnrcdqsxQuwsh:Tl3w4UngtvKt/U9vqmhtDa0ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776772587, "uuid": "dd18469e-beca-44bc-82dd-5283c68b56c2", "value": 9323609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776772587, "uuid": "59f71c23-7ab7-4ece-9bd3-7a1ea08ba065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772587, "uuid": "db214ecb-221c-45ab-9fbe-87faf7c76ad8", "value": "Wifvymmj_2026.04.20_03.04.15_SETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c989d5-3d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775141, "uuid": "e0c4115b-3a48-40f1-b0d2-5cce361b8185", "comment": "Malware payload (WeedHack)", "value": "c06de4066a406140651746043c6fcd09", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775141, "uuid": "c18ef45f-5a5a-4f15-9514-3b0f4f70b103", "comment": "Malware payload (WeedHack)", "value": "6ac6d946957be2098d5a09397f5aec036743010bdf4d7eecffbcb08f63f6d3be", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775141, "uuid": "cf3482c9-853d-4782-8410-d782de422952", "comment": "Malware payload (WeedHack)", "value": "77feec3509e3696874a53810c9a43f63ad3e2943", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775141, "uuid": "7f01826d-e1bd-4b41-8c98-0fa121a5c7ce", "comment": "Malware payload (WeedHack)", "value": "d89b54ef5d69af97763ac51157a33bef5ee67748f10b306cbd18c5dfd2f362166b54ad8af08cea84a0269bc325b98adc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775141, "uuid": "a632c70b-7025-45ab-b19f-d0654fe42eda", "value": "T1C1C4236980581271FC45C0F7892F9E27BE8A9EE08E34EF28BC1E78EF755D40C8666341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775141, "uuid": "8287707f-683d-4e10-81fe-6de81c48fa0a", "value": "12288:y1He7PVwxKDLZalGxIRc53xpUuQAwsbcHgpEmfnngxoYNmsWO:ypUkJhChGAwsBemfgxo1rO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775141, "uuid": "afa5e06d-7b42-4419-a5f2-12dd8e903a86", "value": 548248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775141, "uuid": "fcaf9fd5-1666-4bc0-a6c8-46506d16b820", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775141, "uuid": "f1d6741b-ceeb-4d7d-84ff-55fdb6934383", "value": "LiquidBounce-Fabric-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b2922d-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808405, "uuid": "03b573bb-7129-482c-979c-bf9e4f26be26", "comment": "Malware payload", "value": "1e0625800aca399918a891a34003198b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808405, "uuid": "0bea6778-65af-4ecc-91f5-0804ae43dba4", "comment": "Malware payload", "value": "6ac76621c3892075111f6ddec7e7b4ff1085495db4ce51e6fdfda8c1b42f7e1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808405, "uuid": "b26ebd73-a7bb-4b98-9feb-550ce3cef8df", "comment": "Malware payload", "value": "fcbf48b59aa5765694b6e0c4a75330ec3d503846", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808405, "uuid": "dd74d502-8546-49cd-a2e8-485a77977571", "comment": "Malware payload", "value": "f825253bdda22684748099f6d11c27212b0bea4cbf3de5482a5ba3f0abdd86073841bb4754302811b14a7db80d879026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808405, "uuid": "5c17c95a-7a5a-402a-8adb-2ad540cfdf66", "value": "T1B285E082FF184523C9571EF0197F43D5F7617A4341F5A22A270E67672222E3ADAC738A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808405, "uuid": "17e97b24-1810-4b36-9bf2-34fbfa6ce0c5", "value": "49152:xHUcf3MuHMwpsdZXpn3Yl4hEf1ctHr6+9Vb:xHUcf3Muswpsq8vX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808405, "uuid": "eee3afd6-7333-403d-9dae-25099b2f5fc1", "value": 1718222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808405, "uuid": "aa709e31-3a71-4c85-9ab6-c9ac9f679059", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808405, "uuid": "9d632e13-b04d-422c-9a4e-6400ad2428d5", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ae2f15-3d92-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776783656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783656, "uuid": "79445a9d-cf07-4237-9dc7-d3e950f067ce", "comment": "Malware payload (NanoCore)", "value": "67bf76a2be124a2841a33b89d130786d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783656, "uuid": "25d3c224-49ea-4c06-a134-61f65d5aa072", "comment": "Malware payload (NanoCore)", "value": "6e0b19f617dc4d2bec0b9255e2bedede3191ab532849f671b381213d4ef388f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783656, "uuid": "61fc2e5e-441b-404a-8bf6-cf16a2901971", "comment": "Malware payload (NanoCore)", "value": "24e6e48f6f64631e9b38ab67961177576be20306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783656, "uuid": "a80b848e-5d4a-441d-a61d-4677b5272555", "comment": "Malware payload (NanoCore)", "value": "1e54418b73044ba131250eb49c6ecaad06fe79e81580662ca402ba8727faa7dbda699d02727d01ddb805733d79e80a19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783656, "uuid": "9c7dd62e-ee78-4f61-8b45-96c25bf52158", "value": "T14E64BF2533A4B42ED29D467867126172437889D3ACC3E3DA24D872EB7B7EAE105371D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783656, "uuid": "16508bd3-2370-4307-8eea-5358502399bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783656, "uuid": "67032cae-713b-4b76-94c3-7cfa9316be60", "value": "6144:2LV6Bta6dtJmakIM5dprFjYgySEeVYTi9x7p:2LV6Btpmk0x4S93x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783656, "uuid": "d7efb220-4438-4af1-8213-7668a5fc3f74", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783656, "uuid": "f448e0ea-f6aa-4ebd-b5be-55e69cf6862d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783656, "uuid": "6fac5171-4798-40e1-b48f-79808e7de53a", "value": "66d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931bd548-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808427, "uuid": "cffff094-4e51-4b1c-b0a2-b21361c5da10", "comment": "Malware payload", "value": "760c70ccb4880833b7e42fb863a84780", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808427, "uuid": "3f8e1aba-fd99-4cb3-88f7-e50a9496ee22", "comment": "Malware payload", "value": "6e8f32e4975389dfbb3bd3d4a17ca1a42c7a2f6d25da74051da2f5839fed392f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808427, "uuid": "d1f9a3c7-669b-4492-b9c8-7ccf2326711b", "comment": "Malware payload", "value": "eccf6f7df064345befc8c2ceeea3ba0a8b52ee49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808427, "uuid": "038a44c7-e43f-4ecb-ada3-941a761b8aaa", "comment": "Malware payload", "value": "3e5e30b0e7b2ed306704ca42f53d10fa2b506f759d51b242240bbef64a04717010078d93d1e502390de5492aa28daf79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808427, "uuid": "625cd341-95e9-43d6-a2e0-46896964e7e8", "value": "T16175E0A273458563CEA44B7106D38370A7F9392252F3825EE31527381F725AE6D2EDEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808427, "uuid": "084e8abd-5358-4c43-84a7-d2ca5a51ff2e", "value": "24576:TD1HGqhZd4FILjPYubEn206uIOoBqrzRWFXmjHkqBLsn7l803H1eumao1yPsl/:PZYILjP/Eh65qrgFGHkoLsn7FcwIr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808427, "uuid": "64073bc9-3091-486f-ae43-ce484bc722a4", "value": 1666309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808427, "uuid": "3bd71aa3-5ccd-474d-80cc-8fc58f15c7e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808427, "uuid": "e5be78a0-1864-4270-bd86-3f869d4d19d4", "value": "bot.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45ed7d2-3d17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776730825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776730825, "uuid": "c8c241bd-146d-4caf-b802-05e86cf4ff57", "comment": "Malware payload (Mirai)", "value": "92b828190df947bc71aab4021fc90a95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776730825, "uuid": "7fcb73a3-e2b2-4724-99fe-54032ce0a254", "comment": "Malware payload (Mirai)", "value": "6f222e6f9b8b1c1498fe85eb759cd12dcdcc3484af74c7691f9c0bd606ee2fd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776730825, "uuid": "49859592-dc24-4e94-a684-ac8dc09fc876", "comment": "Malware payload (Mirai)", "value": "62f1ec096ff2566f72fcc6db5d3e77f995d85e59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776730825, "uuid": "48885ba7-aebc-45df-929b-2598aa0d2f0c", "comment": "Malware payload (Mirai)", "value": "7175406dc8cc46f41a67242eeedb77999b80d3dda05b7299ddc2375ef1e2295be3091cce5745fb538778825970c7929e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776730825, "uuid": "8a508055-b47e-4335-9f62-738ee1562259", "value": "T1F1140D31B4CCD9C7C426617CA1EDAF7ACD3EF2DA2605DD037ED465314AC9E9A2A0AC41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776730825, "uuid": "47885007-c836-49da-8417-efeaf3b96b37", "value": "1536:j0j4Yy2FevvmP0YM9h9Wcw+0OZ/j/UByTl4iE3qHTkHK+ZK7DKbtgp+Vp+wEiiai:qs7DWA0ONIK4iQqHTJL865fIiu54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776730825, "uuid": "4145a1b5-a275-484b-8901-4ea0e78be1ce", "value": 198056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776730825, "uuid": "c4753542-ba74-4217-8a97-88fc073e82d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776730825, "uuid": "0097ac49-7769-4785-b9cc-3ea5c50c7a87", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a128b72-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806291, "uuid": "0b0aa136-f9d7-4e97-8a17-42f327014e04", "comment": "Malware payload (Mirai)", "value": "85b2ac49ae22736ec9f2e8f5d2408cf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806291, "uuid": "60d9bf62-19f3-4d97-a0b4-d7f7c71143d6", "comment": "Malware payload (Mirai)", "value": "70f7a057900d5285b58fa6dccef784e07db91b44fc676d82e7ede99e79e1caf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806291, "uuid": "eda4b30d-8e83-4101-8e25-ffe67e799cb1", "comment": "Malware payload (Mirai)", "value": "a9e7622291ee4b7cecaae503624d7b67f6bd5264", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806291, "uuid": "3d91741c-b5c8-487b-8c06-0cd0e7dda823", "comment": "Malware payload (Mirai)", "value": "5c601ae8d837fc6e78051f869596a6ee4f4d001fa8929a92da496136e6399161778e4c5f0adccdc5c7f59ded2fe5f13d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806291, "uuid": "7df4f567-24e4-4260-8cbb-29efcc43b1ec", "value": "T13392C0285B551810CFB50A76ED9E53C3F3954A3FD2F931732A080A7CAAD691212F4EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806291, "uuid": "ace400f6-5a81-4a8d-adda-e8d8819b337f", "value": "384:k1IN9A8xScYE9kAvVBdYKO8PaGPvSV5oWx2s9ghhHLyhymdGUop5hKF:keNCHcYEWAvHebVdbg/HLys3UozYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806291, "uuid": "c64d8fca-e8f0-46ef-9a0f-4ce6bbfdb367", "value": 20668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806291, "uuid": "806d2908-c30e-4c22-9372-dcabeec8bffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806291, "uuid": "15827a18-ce5e-4cd0-9800-ff703f9e3388", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203632af-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776733502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733502, "uuid": "26182989-cd4e-499e-a515-661e908e599e", "comment": "Malware payload", "value": "edec19ddff313375e08b5329b8458212", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733502, "uuid": "204416b1-7b1d-4286-94cf-9e39d11d8397", "comment": "Malware payload", "value": "70fc019e06a59aef35242fe5f7781d36e56f17da2b518a05f930b2bb1fde3b27", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733502, "uuid": "5b4dc5bf-5c2c-46fe-97e1-d217e628f10c", "comment": "Malware payload", "value": "23e7103cb6c92a22d29f9b8be856d8188c58248a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733502, "uuid": "6a2db0c9-594c-4750-acf2-6a0733904792", "comment": "Malware payload", "value": "1d378a8e4b423749a171bd0a7735d630a5051ef14a709a0b48b16f2b7df8f66ec16a13a1d3cfffb2301fad5d89377363", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733502, "uuid": "8e6df15b-935a-404d-8e4a-b2e2f7d4cb20", "value": "T1130170D9335605328360BF4CB7514919FC30ADE0E243EE84F8145766EC8A738B0AED94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733502, "uuid": "385059f5-a9d3-4cd2-af3e-31badee63dda", "value": "24:bJqWJqtJjLQzPzGBQuTI5LltcuJ2JNJVULQ8Xk:bJZJOJgzPzGBQuTIDOuJ2JNJV18Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733502, "uuid": "ff32f8da-a04a-4cc7-9bf9-740c559a0d4e", "value": 824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733502, "uuid": "d363154b-8d21-4541-9464-98faa6e7d27c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733502, "uuid": "4f3af68e-e87b-411d-9bba-f2312c64f0ca", "value": "UwU.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea4ca85-3dcd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808849, "uuid": "5e4b78c9-21a4-4682-bb72-f53962f57a26", "comment": "Malware payload", "value": "a4f7a23554993446a32d2a674c934beb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808849, "uuid": "263812e5-ada3-4be3-b55d-d2fd0fe64a34", "comment": "Malware payload", "value": "71871245de9a739534428344e697ffd577351da0342ae2880d09a00cd17998bd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808849, "uuid": "d2d7c380-6f9c-41f9-badd-9bddb5d8a026", "comment": "Malware payload", "value": "a2bd7f5b19d6982a307d7f7253b68ab2123d4da0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808849, "uuid": "72318619-508c-4c74-8371-4960969761a4", "comment": "Malware payload", "value": "cb2f581a90a8079cfb92efe30354a06e47a4ffd259bcbc3e8ea1c3b97a884f7cdd671b162e6f078061030523c7c5fa3f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808849, "uuid": "f4a875f8-3491-4c79-8b27-30843f239fee", "value": "T16FE4B787F1208AC7F44FDE7F14504210AEF0E4704607F2562B6E885A6FEB9C89E657E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808849, "uuid": "d80f9015-6a6e-4929-a22c-13bdc2da6190", "value": "6144:e1eMX5Uh/W94gpr2T8PjhMooq/Nd5vegwayP0HByF40UFW++T/1Vp3x1ZFvso:eVnIaz0Vl/1Xco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808849, "uuid": "45614e87-2c9c-4886-95f3-94ae03dda6e5", "value": 702533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808849, "uuid": "bf82824a-4f90-411b-adaa-7d235926080f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808849, "uuid": "e245d44e-fd25-4e7b-adf7-e745c3d06012", "value": "DuperTrooper-12.9.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2070fb-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808471, "uuid": "f296e425-e13f-4a01-b929-656d32652010", "comment": "Malware payload", "value": "ddd4ae6bb3f79a74e50475ba33c10fe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808471, "uuid": "a78f35ca-079b-4622-b45a-19c2c9016871", "comment": "Malware payload", "value": "7268d7c9e2493144420d4c45bd6b2f884b71f8deb934c99b120a4cdb41e43022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808471, "uuid": "bb5b86be-86dc-4331-82be-5f5127dab059", "comment": "Malware payload", "value": "115920985eee8ee6fed18d995df75b9d2cc76e6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808471, "uuid": "1d5839d5-301a-4733-b968-bd8e1efa2fb1", "comment": "Malware payload", "value": "e358437f14f7283b79bbd1030052aa37a73444c9ed9c27233a119958e36ef24dae89cf9524b51ad65beb408c6e502fa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808471, "uuid": "1ff0e007-7d86-4c75-8213-d9586452f420", "value": "T1D1465B46BC1D6462D6C976742F6612D4733ABC049F82C3272A24FB7DF9F23588F126A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808471, "uuid": "bed7bbc4-9093-4904-830c-73f839d7e028", "value": "49152:J4ztGbX0/kBX2kDZfq0X5Wj4fyaDHsX85lJ+xhPI4kQGTKSW0CGD0RL+v5EJ:J4zqZfD5WEaaDHss1+xdChEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808471, "uuid": "5ac6fd36-f16b-4fde-9125-fcca2bf20d91", "value": 5767352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808471, "uuid": "4956120c-a500-432f-83a1-8eda5e0b4657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808471, "uuid": "bd191b70-c69a-471c-93d2-6197ad0ed8d7", "value": "h2rapidreset.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7228a1c-3d51-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1776755659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776755659, "uuid": "606793c7-c859-4ced-98d3-edb9194c992c", "comment": "Malware payload (Meterpreter)", "value": "0c87beed5874716ef2bd06d0bce6d33b", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776755659, "uuid": "a2843f0f-f8b8-4c72-abe8-01931c9c9ec9", "comment": "Malware payload (Meterpreter)", "value": "752d9ac169bc1c64c941a58d233e3bf7111ccf8985908575f9be198543bbfca4", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776755659, "uuid": "67b6294d-5409-41ac-8645-19295f50029b", "comment": "Malware payload (Meterpreter)", "value": "fec12782d8c99c40a3ae2f5fc1c15aa70beb2d04", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776755659, "uuid": "110c7712-4c42-4c30-9382-22c07bc8eeb5", "comment": "Malware payload (Meterpreter)", "value": "7a113105f2af12b0b6a9b95a3c98959595e3e3917724c97c139d2c298ee18ed6111262858437f501965553eed1493d02", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776755659, "uuid": "f1c6ccb6-82cd-478f-b342-1a88aa63346b", "value": "T1C4957C1ABCD108B6D4AA933288B652A27B71F8190B3233D72F5177793F7A7D05A39344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776755659, "uuid": "fb2020b7-fc25-4992-b1fc-2fa791332ebe", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776755659, "uuid": "5b324f16-f26e-4d77-8aa9-687879892835", "value": "24576:V5Ju2MfrmBykFjHWNSMiD0pklG6vHVyKF8f9GizPtK5lgmX:V58frAy3SMiQqG6vEKF8fLMbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776755659, "uuid": "61c14a38-0906-4cb6-b544-912010b9ac48", "value": 1956992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776755659, "uuid": "9ac71051-960a-488b-b73e-380d513aa4e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776755659, "uuid": "d5b8001f-9891-4c69-9a50-763f3506a86a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5894bc-3da3-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776790860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790860, "uuid": "ecd5bf0c-4991-4651-9b1a-042d53f55eeb", "comment": "Malware payload (Phorpiex)", "value": "9d180b92c8d1a8fedeaca259fe149cab", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790860, "uuid": "88b0152a-39e7-448f-be02-5d33057960b9", "comment": "Malware payload (Phorpiex)", "value": "7548fc98358d15eaaa8cf8e29824af49d5d440ae991fed24ee8810002bf17cbc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790860, "uuid": "5601c870-fa76-4db7-adf8-a11da41581ba", "comment": "Malware payload (Phorpiex)", "value": "52b039e1154c16e2d27bc0b9e2b2618199c59332", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790860, "uuid": "4f39a0c1-13af-4d66-a0a0-581816c192fa", "comment": "Malware payload (Phorpiex)", "value": "b7573289393bbfbbcbf1bddd926ce5d7837f97620ead553856defa493bed721291107aa2d1c960e7b418845436d3d0dc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790860, "uuid": "0303d749-d4d6-472b-b0a9-54f0f22623a8", "value": "T1C2825B0FB942421AD0D100749632867BDAB998B637C810EBFBD08AED1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790860, "uuid": "8e2b0396-fce6-427f-b256-88a31eaa0b7e", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790860, "uuid": "0e4ede4a-cefa-41c6-a50f-2ba5bbd9840e", "value": "384:6I7MVGASM1KwngSZb7u9NHuagRhav8U9cw:vQ8Ub69+ha0U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776790860, "uuid": "a3714476-b7ff-491b-bb59-0b919e077730", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776790860, "uuid": "6016dec7-76d6-446e-9012-be1576d51b20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790860, "uuid": "0c3e064c-30d2-4d0a-a98b-f44526cc6256", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdb5678-3d50-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754969, "uuid": "399cf6c4-e876-4769-a1fd-1098751d9a02", "comment": "Malware payload (Mirai)", "value": "19b66dd7dffb706ab8f217e40c75df85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754969, "uuid": "79651c3a-845d-4027-9ba0-51df6b2509fe", "comment": "Malware payload (Mirai)", "value": "76cddb38dba8d8b77ceb56f363fdf5ccad4b7edecf45ae71c6492bf5706fcc22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754969, "uuid": "d8b6d529-1669-4003-91ed-15833519b7b5", "comment": "Malware payload (Mirai)", "value": "b8b5d97b5e365110f69b959b90e58854662c2d8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754969, "uuid": "81d3114b-b023-4dc1-a1e5-3fad1a56bf83", "comment": "Malware payload (Mirai)", "value": "12a58174d7fac41a8ee897cfeb4c110c1f1ee28814d2b3e2dc81ebe33331a47b5b2af358c667b2973efdfa62d4297917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754969, "uuid": "5aa06acd-e84f-45d5-acfe-89f58a689568", "value": "T11283A44D6F319F7DFBA8C73857B79A506608338A22E1D485D1ACEB060E6024E741FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754969, "uuid": "682f435e-2372-499f-a558-503857d1ebad", "value": "1536:NYxbiIEXLbY+rWU87fvZH0vKJJ56BbFNl1LGKjMiXzG+V:N0bY7lmZH0iL5iNl5GKjVXz3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754969, "uuid": "b6618eef-9a57-496e-bcf0-bb2393805267", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754969, "uuid": "d4622ccd-2ab8-4892-ba90-bd438e485c4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754969, "uuid": "b786de4e-696f-4d79-b041-c01079ba8e25", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce0f0f1-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808417, "uuid": "7ee26a71-9da1-4828-9584-50f5341b4979", "comment": "Malware payload", "value": "db7b24262ac5d54abbf9115b190b3a5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808417, "uuid": "97da15e3-87f8-4259-a6b6-599a2db0e23b", "comment": "Malware payload", "value": "778ca9816558ae85045ad676fd016bb7e0d586ff4b05a80472006c81180b0d4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808417, "uuid": "2591ea38-14a8-4129-bcb5-23a5125a5de9", "comment": "Malware payload", "value": "0394af81b345a4cbbb46116354e9449baa2df867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808417, "uuid": "fd8005fa-042c-4a36-8d65-7b1aa98a83d6", "comment": "Malware payload", "value": "dd6c3be4e1e8f5af65e66b9dd30259e708bb8aa44cb4dcfc4b4546aeb23b5f701a5ca833f79b731cee03055935e98c44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808417, "uuid": "73708795-1cdb-4a2e-a649-c6977d23919e", "value": "T1C975E189F783D8E2F65341F5024FC7E20574A126A057FAF2EB449A7678367922F1632C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808417, "uuid": "f34f5aad-88ac-4e69-848a-84bf61bc82cd", "value": "24576:UaZSKQphYuhMEZ10ObJPFEnPV/wyQBWPBnMwG8k4pPHXm+3IgYAaqDPUXyM0yoyR:FZSKQphYuhMEC9m05+isgYoDUCMdYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808417, "uuid": "e4fb49a8-e3a8-448c-85bd-509e18388af9", "value": 1690286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808417, "uuid": "73f23785-307f-4ee8-aaf9-369b65c1650e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808417, "uuid": "20dcfd7c-8deb-470d-9108-4821aab42f77", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa74bc8b-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754779, "uuid": "9766a2ce-9f10-44fe-97a8-a67f636cfc63", "comment": "Malware payload (Mirai)", "value": "8540b26395607f3d4ca7f697d7b221d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754779, "uuid": "5573b5f6-f4b6-415c-b737-7d08db872651", "comment": "Malware payload (Mirai)", "value": "788cd17336cd3fd0d0c2fa10b3775270e4437bbce45fc78923bd72e8f18ee41e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754779, "uuid": "a3097b6c-9f40-4b17-9470-7f7b3f034de1", "comment": "Malware payload (Mirai)", "value": "17fc757f1ee4226396141a34b7a31c4265b066af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754779, "uuid": "fed271e9-3bd8-49a3-94ff-bb18959ccbac", "comment": "Malware payload (Mirai)", "value": "8d664b7091f6307fbe071fcecf2c2919caa6ca545b97a25d387b495f5a83369759777c477942ca2a95b45483e8b00492", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754779, "uuid": "b588c6ab-e26b-4138-978d-bf99b2a6b760", "value": "T1BDE33B85EA408A13C0D61776FAAF41493322DB55E3DB73079D189FF43FC6A9E0E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754779, "uuid": "22ec939e-5c9e-44b2-a05a-d09871964805", "value": "3072:sqlhEFZBB9qPoLmpMguHcUlVUHalw7WguH0vsfC0XxmjX5Xa/NOL9eXgIncdV52J:sqlhEFZBTqPoLmpMguHcUlVUHalw7WgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754779, "uuid": "09269648-d4f8-4e45-b447-f6533805faf5", "value": 143882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754779, "uuid": "3aff4646-b5ce-40d5-8228-2a53e6ff317f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754779, "uuid": "f7a4298b-0ff6-497e-8151-d7126ab0a9b3", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d565095-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754703, "uuid": "5e17e4ae-a425-4765-9dd3-e86281394bae", "comment": "Malware payload (Mirai)", "value": "bff5cc3aa6b372bb4c9361470191af25", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754703, "uuid": "c94492fe-246e-479e-95d4-966f2082eb0c", "comment": "Malware payload (Mirai)", "value": "791a9c988ac217254c34caf8f5d4d37606f0a0c0c7ea2ce95e54a664258b60c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754703, "uuid": "ef2b3f7c-152b-4f53-ac22-21b012fc7686", "comment": "Malware payload (Mirai)", "value": "b2f293e0fecd8266e5f04b2ccdb553b91915ee51", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754703, "uuid": "e067ec60-f305-4083-a183-c1dc401c17a8", "comment": "Malware payload (Mirai)", "value": "73116e7b1d997141b252b2b09ac6e949669f8e70c7c536f543cce34292c91fdee2c2e2fccfbdad29ce4b2158d0d14fe6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754703, "uuid": "0f14bc10-3867-4535-b90d-bc1aba83e30a", "value": "T1ACD2E02CDA4D7905C6AD3EBA51CE56B53C4C70C0A35DFACE17228458BA1BA9BFC070B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754703, "uuid": "c85decd6-b1cb-4b7b-b92e-b52384a9871e", "value": "768:D1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNPWABJbKWUA:DbDs06t4BEub4sU/MbUP3B+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754703, "uuid": "a16d9e72-3186-439c-ba30-d8c6c5d2df44", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754703, "uuid": "13aca12e-72c3-4ca5-b2c8-dc809408e8eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754703, "uuid": "b6195b60-32ba-4791-94f9-0b7a43dc34f2", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3459c624-3d73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770043, "uuid": "b99a0ead-1635-4dcd-acd6-44ad9838fb5a", "comment": "Malware payload", "value": "ce98f159196dcf705e485783c5b03083", "object_relation": "md5", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770043, "uuid": "77fb3cdd-b8f9-41bb-8816-869a7afd2a1d", "comment": "Malware payload", "value": "7aab9d2efc2e5bd0abaa0f1653f637fa8d3b2dea6bbc98679e58b8beeb506ace", "object_relation": "sha256", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770043, "uuid": "f44c3d8f-9488-4bd9-a735-95048ad72077", "comment": "Malware payload", "value": "61be29772b5afcce099bf2d9efcf0d418c54fc53", "object_relation": "sha1", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770043, "uuid": "998b15ce-c13e-438a-85ea-b411bfb85a15", "comment": "Malware payload", "value": "2414ad96a263d84d284cd76502c0dab081086d6c9fd4e9b03c89f3882dbe699d9fa064e4cadcb03d3ef4f0a5a5696e31", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770043, "uuid": "ad75bdbd-75ac-43d3-a154-5cefde3dce54", "value": "T1C9B144266BF75831E3DB902AAB9F200526258267204CDC403CDDD7818F5B5B4FBF171A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770043, "uuid": "6dd1aa96-02fd-41c1-8448-7ec02afc7f8f", "value": "96:gYxQ45WDlP5OZa34J4jpi3CT75rkKBlh5cVPClXUASCyVfMV/ylXUwiSTROht0go:gYKvP4UagrkmlYVPClXUASCy+V/ylXU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770043, "uuid": "9789c488-dcad-47c6-ab92-dd5a33b029cb", "value": 5213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770043, "uuid": "ae30123d-01b3-4991-94ca-ce4b99931ecc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770043, "uuid": "b5470ffc-ac74-4c1e-ae27-81b6e960540c", "value": "7aab9d2efc2e5bd0abaa0f1653f637fa8d3b2dea6bbc98679e58b8beeb506ace.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa18a43-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808529, "uuid": "6c5a7bd3-073d-4f5f-b216-4e8c775c674d", "comment": "Malware payload", "value": "bcd5b04c157533719c2d632b491be1ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808529, "uuid": "00bb8491-6baa-4fde-9295-f0255834fba3", "comment": "Malware payload", "value": "7bdd81a5d7dbff7d4b6ace5aa4c7a182fece2eb27d5cc09bb918f5c5c80395f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808529, "uuid": "41813f55-ce54-4f96-84cc-5b5f5204dca9", "comment": "Malware payload", "value": "f78ed84c254941edfc34dd5a3663be71418ea0e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808529, "uuid": "925175ae-f862-401b-afb5-88fe26403522", "comment": "Malware payload", "value": "b806978e7bb07699f614f2db67da301d04086c1f01efcfccf13f143d4ff7371563b1d55e9a828981a08e236e631e978a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808529, "uuid": "c15602dc-8065-4897-b74e-e180ff824aa1", "value": "T1B5860A51BE822FA7C5CC037445EE63A522903E454AA2472723B4FBE83E7773C9F56948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808529, "uuid": "54d04647-1f5c-4572-aef7-54531d907923", "value": "49152:9yZSCH4AXN35Bz8eDyca6PssG8I0FJtYZxlBkHf6Xzq5Eq:9mSI4CN35BzNMD0Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808529, "uuid": "949b212a-37a7-4429-a48e-c82f65b9aa56", "value": 8257720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808529, "uuid": "665bb4b3-10bc-4b17-81e2-daa27356e098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808529, "uuid": "6b0ded54-9962-4081-ab84-2b5dbb8b1297", "value": "h3flood.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab83a45-3db2-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776797031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797031, "uuid": "7132ce1b-7066-455d-bd96-fa3d88e02099", "comment": "Malware payload (PhantomStealer)", "value": "f92a6273b4db2b135c7b6447f470599c", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797031, "uuid": "9603689f-d19e-41eb-9f48-3abb4e73eddb", "comment": "Malware payload (PhantomStealer)", "value": "7d1abbdb866dff61ad7cb8c0ba58812b026d29b19a3045bd968bffd72b7e7328", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797031, "uuid": "1853a101-6489-4f2e-8169-4ec819d157b6", "comment": "Malware payload (PhantomStealer)", "value": "70bcd97a8f9b2b906f11b4be14c3ee45b2bcd933", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797031, "uuid": "7bb3842c-4501-475f-a3b0-c057959c0f4e", "comment": "Malware payload (PhantomStealer)", "value": "dcc6d2290d3b14fcee632ddf3adc4d4e9ab71135d7c753aff5622221c365a4cfd2d7fc4e66cbedcb1e428eadb85254f5", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776797031, "uuid": "076cc2a7-050e-430a-a85c-600ce55dca26", "value": "T1FDF2628B35CA747106A234F76B1AE05AE76D8CC0764CC015FDD8AA8EB86DF18D0B55F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776797031, "uuid": "79767ed4-b6f3-455a-8832-cf9f32b1b32c", "value": "768:XeBVdifb9dQKI0wD1haG0bMnQnH1lwFwiRS4aHhqAYQmB0aOG0:XeBniHjwDLaaQnVlywAS4aHo9K7G0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776797031, "uuid": "2462d96e-e7b2-40f4-8703-0e69fbf1731d", "value": 35817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776797031, "uuid": "ba693ea4-aa23-487a-9384-94fbcdac3ce8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776797031, "uuid": "69a5cca9-be97-420f-922d-a8b396040f11", "value": "Rendel\u00e9s_aqualing_2026_22445146200001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f6a8af-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776807835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807835, "uuid": "a6858c30-fe57-4163-b3b4-883f5627875a", "comment": "Malware payload (Mirai)", "value": "acfb0d85941b72fdb977cbbcfcc13c78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807835, "uuid": "76d6481e-cd44-4e8b-8b27-5addd74f5e19", "comment": "Malware payload (Mirai)", "value": "7f61c5fd2e9e4388d2e80ab9acd3495bb9f19c0bcd5be2581b65ff86132e8eee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807835, "uuid": "2854cd2b-bff9-474a-8a77-df303b3d5e90", "comment": "Malware payload (Mirai)", "value": "2fd16e8df438d78f7c52f7d8d109eb30aefe5898", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807835, "uuid": "60bffb2a-d8c8-4bbd-9c83-76711d6824de", "comment": "Malware payload (Mirai)", "value": "b3284de20ad4e722deac9027f65f51f33603f51f4ae060932be411204e4b0e2f2121827dadf892ce9c62ca7e75d49035", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807835, "uuid": "4ceecaad-f784-492a-b694-3da09773e4da", "value": "T1A023F116D484A077ACB87C2FE814C13AB25F2FB880D53412157083B96AFA54A7FFD786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807835, "uuid": "63062372-c724-42d9-af18-2384f0561490", "value": "768:UtDE5rxQJN5g8iOc7HD+bOuX3QM+mGM6f8x4RRabnpnMsAPv5E1iOVBAVb9oq3U+:gKOJYl57j+bDXA46ZRRQpnbqE1iOgp2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807835, "uuid": "26455094-f596-4355-baa1-098833f77467", "value": 47272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807835, "uuid": "dabb5409-34af-45f7-9f5e-99db680cd830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807835, "uuid": "51d8a83c-b17e-4531-9a94-f84bd65c5e65", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d469a0c0-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806389, "uuid": "1efca9c4-5951-4eea-9216-321b09dec66d", "comment": "Malware payload (Mirai)", "value": "f8d2d4bf78784b20a3c939d701c4b2b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806389, "uuid": "7d75cbd8-cc7e-4656-a1ed-293d80984cf0", "comment": "Malware payload (Mirai)", "value": "80edb2c1c9c4f089fd33cad78f5a661b2c1ef751647ac7e3f20621f3cf0448c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806389, "uuid": "e8a12c6e-77ce-4cf4-b1b5-28f0ec90593a", "comment": "Malware payload (Mirai)", "value": "d7daacf673a582ffb343ef83dbcbbce461ab942b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806389, "uuid": "c824ce22-2ffb-459c-b016-06d6c0552e98", "comment": "Malware payload (Mirai)", "value": "c43574f071551ba3bd12377ac5a88cd74d8cf6915970df9bd38eaad798e22d5f9f347ff701e64dcd1421db4376c11b07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806389, "uuid": "26cae0f6-a2a4-4b2e-95df-52f28aa65123", "value": "T1D283285AF9814B21D5C5127AFA1E164E331307F8E3DE72239E24AF3037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806389, "uuid": "18e602f1-201c-4464-801d-588a0e673809", "value": "1536:mpnsM0+4tlAxK5wOTs3824kkbkqkP9aaE8tUcZI4iz2ZIPDrC7LO5LYtR:XM7xGAJMkP9aaEB2ZIPDrCnOJ0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806389, "uuid": "2a56c8e8-c90b-48b1-8c2f-f82d9c0bfcea", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806389, "uuid": "abd075d8-dee0-4d17-a9cd-a3b37056216d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806389, "uuid": "be929e5f-1ff0-4493-bcf1-93371f905bd3", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9556aa2a-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776801988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801988, "uuid": "9e5f8180-1960-449f-a0ec-9083201cfcd6", "comment": "Malware payload", "value": "b850e0af8b7c12d0e64073775e62cb43", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801988, "uuid": "66e513e5-b446-47ef-9b3d-7b4d1bfa1346", "comment": "Malware payload", "value": "81982c5f43b46c3dcb66f849942976dab0fe850ac2b207ef011e6927646d2f53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801988, "uuid": "e6049dec-4454-4e5b-b1df-0832da81bfd0", "comment": "Malware payload", "value": "b0ede9dc3788c46daa4dd9b3672f0d702a76d713", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801988, "uuid": "76cee94c-d178-4bc7-9274-cb89ea7ac92e", "comment": "Malware payload", "value": "6b501eebac4fac679e16d6d013d80b435c81577941717b3cb63feb5dcf6de4fab239f814ccfb3164b391d030bae8b737", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801988, "uuid": "561688f4-55cc-4151-b254-2096d1668ae9", "value": "T17F937C1176D1C575EB7E19351434EAA14B3DBC20DEA0DDAB23990ABE4E302C0DE35E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801988, "uuid": "141f8491-7c95-46fd-977b-0bcce1b859d3", "value": "72e71b666d5c764a80f4f705ed843ea4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801988, "uuid": "8a18413f-fb29-4411-bc39-2aa9506bb3fd", "value": "1536:1lzafbZi/R1O9ulngCiST/e3I9KEIlKa8SK/sWxcdyFJWs1SZ:1lOf9ER16ulnhJ/e3Z8VyyFJWs1SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776801988, "uuid": "c0af91c5-b4b1-456a-9fe3-30dd10e17019", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776801988, "uuid": "36efffd7-15a1-44a3-ac57-73771fd5234a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801988, "uuid": "03afe5bc-5081-4f7d-b8b8-18bd3103f53e", "value": "CNCLID.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e2a1aa-3d62-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776762850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762850, "uuid": "fd65cf99-b58d-4dae-bdfb-ceef75b5c2a6", "comment": "Malware payload (AgentTesla)", "value": "1f5fdcea71e11d2652593aa098862946", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762850, "uuid": "f10aef55-ee23-448d-a14c-7d13a34824e0", "comment": "Malware payload (AgentTesla)", "value": "81f89ff8478a91e083cd62f33a449f0e826b61d68d157c4907c757f853a32c2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762850, "uuid": "e2b5d63e-9ec9-46d1-8d02-d73e14ecd900", "comment": "Malware payload (AgentTesla)", "value": "b065cefa022148185de5137217f15b9ba40aa8cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762850, "uuid": "7cc18d7f-6d42-4693-883f-b830fba1bf13", "comment": "Malware payload (AgentTesla)", "value": "b0d95db10b563ea6ec7c960510f3489abe7407f14868de75fc223e953946d63612f9cd8f78bab620207559be51b5c42c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762850, "uuid": "83044d74-75ee-4521-9e6b-e47731d3f219", "value": "T19C05CFC95E9B2A59C33E6BB8C2534444B3F0C843D3A7C71BAECC55E9AA636E4CE43541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762850, "uuid": "19e5d274-387d-45d4-a158-44bd17a941a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762850, "uuid": "24a6d72f-a5f3-445a-9787-09b62318f786", "value": "12288:yUOM94bJfCvQYFFlCu5ZNR3O/WoGYdyN6NZs:Gs49CIYFFh73O/WoGYd60Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776762850, "uuid": "7d378247-fbf6-4e6f-bf2a-a868bf42696f", "value": 871424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776762850, "uuid": "501662a4-9f51-4fe1-96ed-94ec7025b7d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762850, "uuid": "38fdf696-d521-479a-8cde-3445ed70cd27", "value": "OC____pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a04b38-3da3-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776790706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790706, "uuid": "e3cacee3-a2cc-4016-99bf-2b3ae13f4a5b", "comment": "Malware payload (PureHVNC)", "value": "8f3dba9ac51fd8a524b872c167557061", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790706, "uuid": "10613fe1-f7ba-47fb-8e26-3a99289a81f0", "comment": "Malware payload (PureHVNC)", "value": "82cc7c21e9924c91a37aff292909ef6b142c1b6734eca5b0ea4d12078490fd72", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790706, "uuid": "91716e54-108d-4895-9445-599047acaa85", "comment": "Malware payload (PureHVNC)", "value": "b145730b9de508fb177682382f9ed171c78fd4e2", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790706, "uuid": "a4de82c5-1bd2-4dd4-9c47-ace207f4aa58", "comment": "Malware payload (PureHVNC)", "value": "0972cd6f1d6e804a31189434e9c2d81f86f8c425d774e1c27eab1bb630538cb4449c0cf514cd53f882ad9b9585ddfbb3", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790706, "uuid": "75e0f8aa-65fe-43b6-9163-c9d13301d8bd", "value": "T1CB563337F0691DCAC06BD07AD0712B90C7E7231EE607987995A235E476A37CE88CD257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790706, "uuid": "e7caedb3-8780-4b15-bdbf-1d84847bd949", "value": "196608:+Zft3ChppBYQQDd0uU+HB/OGUElH6XU8YYlbHXUH:+BNyfBYQ2drU+h/PUEl0U8YYlbEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776790706, "uuid": "42b49f63-d100-4e4f-8cb8-4cd5aac56b3d", "value": 6351040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776790706, "uuid": "39ec337d-2ca8-4214-8855-a8f55a4937cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790706, "uuid": "dc34ef50-45fe-48b6-b7fa-6f7e935778c2", "value": "erzurumyoresel.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e7c970-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776807868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807868, "uuid": "65ee9010-0020-4994-8862-dab120213b78", "comment": "Malware payload (Gafgyt)", "value": "1afb8ed24fbc2d494e8d70bfaf5aa3ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807868, "uuid": "72f9ebd1-4165-4b74-ae27-465bc4a345bd", "comment": "Malware payload (Gafgyt)", "value": "83389c8dbaab6ff268d13282cb19e7b28788f9d1c15226f915c1341e05b66552", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807868, "uuid": "b155fc73-f73b-4dd9-9820-2f618112e4c7", "comment": "Malware payload (Gafgyt)", "value": "6f334f27747d5989e5aaa347120b020ed42a02c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807868, "uuid": "525b3d34-5386-4a16-a5f6-5c72ba3d0c4d", "comment": "Malware payload (Gafgyt)", "value": "b523ba46d95eb73ae3e385507b67222a9d0764369c32bcc11430bc0222b182bfdd2958f91701d969dfb765a5e460e051", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807868, "uuid": "54de7149-2d2c-43f4-b4d7-9b62999e0e9f", "value": "T17973298799229FBBC017B4F164F55E740B56BD620E1B0AD97075FAE0427B8CEB00AB74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807868, "uuid": "f591421e-92c8-4fab-a298-36170cef7dd6", "value": "1536:lIL/JqCGZlb3w+XhKRkH77GMbYcdCPOV9qXkthop:lIL/EVxXoRAnbTd1vsGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807868, "uuid": "ca962c14-4629-462e-8e09-1d1a560a0d5c", "value": 80260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807868, "uuid": "0a426aa4-d6c8-43d6-82d4-2af1e5781c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807868, "uuid": "488e1903-49db-46ac-94b8-db9a5e8e96b7", "value": "SH4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373b1599-3d62-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776762746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762746, "uuid": "709ce24a-65d4-42bf-8ed1-588feeac9594", "comment": "Malware payload", "value": "26f2a2fbc5b3194e4ba73fc38caad708", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762746, "uuid": "d32bca07-2f4d-4ced-9933-ea202ba0235d", "comment": "Malware payload", "value": "8391f355eacb8e401672355aa1f58efa83dc8078a9078b714dbbe8d8e44e05ca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762746, "uuid": "b3bf25f2-f5e2-4394-a286-5808e753db16", "comment": "Malware payload", "value": "cdbbc2f77120f82f8e5e6f8aee1678008484d1a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762746, "uuid": "d11ba828-68ab-43d5-87b3-298b67c395ca", "comment": "Malware payload", "value": "7d4d7013ac08eb4c618a74f7649d3f77a1cec40f187e52f9fa861b64d935347804b2f80a03ad2b7a7076b428676952b2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762746, "uuid": "f97e70b4-54b9-42ce-a99d-af543a04e60d", "value": "T187A534DB36B055FDA78E7B9B481F399ACE01139E3A6789391DB046A0036B4DB15F3432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762746, "uuid": "b4f188e7-84da-4031-988a-fc291c36652a", "value": "768:6iQ2U5x/m94nnRmdFjDuIIyXeJMAuyTdepT63O4hHUiNh3Rc0Jwk3b/wXwlH0dKf:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776762746, "uuid": "f86dd83d-0ffa-4850-820d-3619d69d6b0b", "value": 2181287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776762746, "uuid": "1c7f40ce-d6b4-423d-9f4a-10580d583814", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762746, "uuid": "b0352b84-24bc-4165-b1fb-8eba88f132a4", "value": "Request for Quote.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0290db-3d70-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1776768818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768818, "uuid": "e7163f70-dc78-48ee-a507-ef4f54e70d4f", "comment": "Malware payload (SnakeKeylogger)", "value": "fefefe77ee4a51827c1188d523abe855", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768818, "uuid": "e511ca86-7865-47f7-b0df-be2a67762dc0", "comment": "Malware payload (SnakeKeylogger)", "value": "83bbbf8a6bf9ea4459e8b1be75a8ca18f3aa6878373c1dbf8202be56ba585e6c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768818, "uuid": "454f07a7-9773-49a6-872e-8f39e4ba0600", "comment": "Malware payload (SnakeKeylogger)", "value": "a0dfd6504eef6e531330f15325981ef7f05955c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768818, "uuid": "91a21a61-9d2d-4c60-8e6e-1e4dc0076d6b", "comment": "Malware payload (SnakeKeylogger)", "value": "72218d3ec46e1f487bb2ed39ad8bfef85c079db232d5ee55798534b5c2e7840be52330380a6c3a3fe051230493334dab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768818, "uuid": "6d189403-29e4-4aac-bfb7-edaad837818a", "value": "T1F605F1074AC43FB5CB9C572940BD241EA3F14D9A6119A4CDFFB3BE4AFEA2304811B599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768818, "uuid": "2466fee0-4802-4af5-82b2-7eb75ae500e4", "value": "12288:C7zLp6Z/IYEIzrgApRJiKK7XB7m3y70pJdCJ6EpV5NTh3+dN7:C78ZUYfRNKt7Z701CY8q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776768818, "uuid": "7f3b9b42-dbad-4150-9307-ee3479a17c62", "value": 827723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776768818, "uuid": "7320e79b-f6ba-4110-bc26-95d294ca4beb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768818, "uuid": "f8abc1fd-f1e7-447f-87a3-f0540f378455", "value": "RFQ_PURCHASE_ORDER0966789.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ca62d3-3d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775171, "uuid": "d0d6deba-3d1e-4603-8319-16e925dffc0d", "comment": "Malware payload (WeedHack)", "value": "5b99859a019b91cdac0b19d83e1d8c3f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775171, "uuid": "3814fdf5-dbef-4cfe-8fa8-398d705635b3", "comment": "Malware payload (WeedHack)", "value": "83d6ea067b62354130a50ab0a98d035ed488d84a4be9149968b4e8a4ee4ac5c5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775171, "uuid": "41992b9b-1e1d-44f2-86cc-7afc30972d42", "comment": "Malware payload (WeedHack)", "value": "732c491cd0c47eb13d28fd8053c7ca27cee0ccc5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775171, "uuid": "70c4172e-3486-4e4f-b4b0-c373a8100560", "comment": "Malware payload (WeedHack)", "value": "714a146baa310c03a662682ed3692cbd0b40f4ee1bac726567838520c43839fbaa839dd0a7851af6af10a680147fd8a1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775171, "uuid": "2e97db8f-1b74-4d0b-9158-8c1b007cb5e8", "value": "T198E5F1E2BE1C1576DA1BDB72F0048924AD641DC29C473066BD794D0E8C67F891B8F3EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775171, "uuid": "bc7eaae3-01ed-4157-be91-3ff9b4d84712", "value": "49152:RIcOMg45Ac389E9IbCalymM4/bCVSL2moqembbqv5h5QM8R+c1zb+edPLlbEaQDF:RtOws99lyb4b1xrb6buRR+4KkgoxfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775171, "uuid": "18b3651f-7f3d-4b0c-af43-25a242c8bafe", "value": 3247263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775171, "uuid": "daf37faa-f487-40f1-b021-6f908c4e077c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775171, "uuid": "a54d35f9-016d-485d-a3c0-240c4e7b64bd", "value": "Shoreline-1.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f76941b-3d74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770518, "uuid": "9054527a-c0f4-4f44-9486-341d2a6f7c8a", "comment": "Malware payload", "value": "27367fd1d7da40e8a657790b840e51c6", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770518, "uuid": "21111669-706b-4495-ae24-81c2bd8966fc", "comment": "Malware payload", "value": "8407f82d131d71cac6a0e9b21d0cb9b4890dc9cedde3cd15f587598a2f426aa6", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770518, "uuid": "a89ea57e-bfb0-41b6-b911-98470b033f8d", "comment": "Malware payload", "value": "06c7e6f222d610095533a14a34ee859c0840bf11", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770518, "uuid": "e78ada3c-8501-4088-bc64-ff098c8bee6b", "comment": "Malware payload", "value": "27594ba3386d56da56e36efb7009f92779ed664dbb4ea200752ac926c2f19669e415e64a7f5c8da2d01ea81e1830586a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770518, "uuid": "02f3ba8a-89ff-4268-8f83-4bb11ee0c66c", "value": "T134E020047B22131F1FED7453D550C9411055BC1A42C484D4F635A5CE16417E5C1453D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770518, "uuid": "46c899fc-2885-4479-8e59-f0c7af974684", "value": "6:X8AV/jvnHdGUUikuCELOlXO8Xwr/sEnvt++E9yrLTFuWcKz/A98AV/jvLTFuWen:X8AV/jvn3UiBOl+8wbsEnkD9yfhZpzIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770518, "uuid": "c4051e6f-0b20-4321-966e-e4060200fe7e", "value": 329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770518, "uuid": "fdee211c-365d-4fc2-9325-5bfd41510822", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770518, "uuid": "fe8cee28-5815-42aa-865d-7d41ec84c7e9", "value": "bookingps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31a7ef7-3d74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770766, "uuid": "aed48d80-7abd-4874-b37e-521891f9eed4", "comment": "Malware payload", "value": "639da6c8fd3f18d8fbd2e6ad011929df", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770766, "uuid": "e19fd5f5-cdee-4d74-b41e-38d256aa6601", "comment": "Malware payload", "value": "85935099e5616c7c63c6d49c307d15abd1333f8cab69f9c20eb328962f1cb383", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770766, "uuid": "a657196f-b849-4533-b189-54c89c3e9f50", "comment": "Malware payload", "value": "d8e413601c05c2f6065705b6d9e38613479f47a7", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770766, "uuid": "5499a0e9-6514-419e-abef-270d4a4b6791", "comment": "Malware payload", "value": "0768753f5ee199e08beed4ca3b7b03e28adcff08c7619cb645a986fe60cb5764441e65778abcd0b333dcecbb5bc5578b", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770766, "uuid": "d2f08ebe-543f-4771-9122-64a8f21e9d44", "value": "T12041E2241BB10229EBF7CF39D8FD621265217906EB219F8F11D4426894B4110F4A6F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770766, "uuid": "fca8f958-c08e-4983-b77b-f9202cc1fa9d", "value": "24:8VdmGjMDvSwjKUaWU3AcPWkp+/CWNYwpfYlENEfgIuhsBFnW1u/4wZu4r4I0WK6c:8nmeKpUQ1BIN4sC64wZUIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770766, "uuid": "dec154c6-19e4-4988-9f2b-676117a31769", "value": 1885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770766, "uuid": "941d61ee-890c-4495-b12c-93ce53e47bb5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770766, "uuid": "79b84ff4-935d-45b6-9ed5-f0188559a383", "value": "85935099e5616c7c63c6d49c307d15abd1333f8cab69f9c20eb328962f1cb383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01e5dd4-3dac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776794786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794786, "uuid": "ab190259-70fc-416e-a41c-301bada1e7ad", "comment": "Malware payload", "value": "af2aeb81a5680c936b6211d4065ee39f", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794786, "uuid": "d21fef58-12c4-4cec-9995-5ae150aff5be", "comment": "Malware payload", "value": "85bed283ba95d40d99e79437e6a3161336c94ec0acbc0cd38599d0fc9b2e393c", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794786, "uuid": "ac31a90d-7415-42ef-911e-1ec7f518bdb6", "comment": "Malware payload", "value": "8cd45ae9b53a2e9d3f24cfea654c6d6e9716d544", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794786, "uuid": "3398f442-28bf-44c6-900d-87a54e255a69", "comment": "Malware payload", "value": "def71eee75ce0f04877579eafb564bb8c3d5df63653e3f747410445d5190ff24fa49b4cd7f23d242bec5445c4303bf51", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794786, "uuid": "83090190-600e-4cd8-844e-5988c9c7e80b", "value": "T1BF668C46BC1D6562D6C9B5752F6653857239FC448F82C3232A18BB3EFDF23588B23261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794786, "uuid": "51bbf9fb-e353-4c85-b5e6-f6bf214dbd6c", "value": "98304:/FKiB7AFqPxy7HaHB+UhZfjGpHlwEHyTVExsfqn:/9B7AFaWWxZfIFJEVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776794786, "uuid": "f196b3a7-2d2d-4c31-b75c-b91313b1788a", "value": 6522672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776794786, "uuid": "b05736d9-13f5-4f44-876c-f724ffc41cc0", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794786, "uuid": "8679d85f-36ee-48a9-92a7-710631b8fce0", "value": "macrasv2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14677ae1-3db8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776799625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776799625, "uuid": "49b957b4-33a9-4d40-8ef0-92a420dcac22", "comment": "Malware payload (WeedHack)", "value": "8a89e8cdc69ee25c223a4dab1c3e407d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776799625, "uuid": "f10aa698-6211-4c7c-9916-424a6d728272", "comment": "Malware payload (WeedHack)", "value": "861f22e2f945f4d6a066922c1fc34d422e9c25947e10e5ec074d96f9aba68070", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776799625, "uuid": "2ec97abc-d9f5-407a-ade9-31141d092cb8", "comment": "Malware payload (WeedHack)", "value": "98aaad8873bc94a0628d17ddef75de0c30459a39", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776799625, "uuid": "9fe08114-548a-4e80-9a17-59b471f53ab7", "comment": "Malware payload (WeedHack)", "value": "19391886dbd0f58de319e590ab6c59bacfa175b08394d409fd3ac21a8f324e25487c4844a4342b05ae90985d42455c2e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776799625, "uuid": "bda77ed9-a567-4701-ac2c-a441d0a35341", "value": "T185A412A3A06B5A34C91FC9BEF6431973BC2C36B49742282D686455478C5F4B3A3BD31E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776799625, "uuid": "8b05de2b-b347-440e-ba00-3a2d0e453ed5", "value": "12288:BBCw1W8UwBgTBQ1i+WoK/oNm3p0KeNJ2P0o0Ytyg:B8VZjd48HmJc0YIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776799625, "uuid": "e3687ceb-4224-4f47-9747-acbc4084241e", "value": 492658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776799625, "uuid": "8d368bd6-4a82-458a-b33a-62a50d58a061", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776799625, "uuid": "396a9adb-7e32-4737-b57a-12f658aad880", "value": "861f22e2f945f4d6a066922c1fc34d422e9c25947e10e5ec074d96f9aba68070.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6d22dd-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808392, "uuid": "f7485bfa-3aa8-4780-9080-b24ba3183635", "comment": "Malware payload", "value": "ce42faf50fed43e62d29d552e2b271c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808392, "uuid": "d744ba21-18bf-4e55-8d1f-2917f829b0dc", "comment": "Malware payload", "value": "86f665592a65e3efa9eec80de03da12a9cebda9f6a049d3615c8b937ba5028b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808392, "uuid": "51b68042-7dff-49e5-bc74-7c299ddb7a84", "comment": "Malware payload", "value": "f8eb48822bc2d5c6cddd8f6cc74c7543121f52ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808392, "uuid": "5e8ad8e5-a708-4e90-8bc4-19c2df5191e6", "comment": "Malware payload", "value": "60d8f1881c2ea5e99428cb3f5639ebe1c3c12e729aa8da1c9e34f1e5c0da177ec326f648d4c2526a6c22bc0d056e36cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808392, "uuid": "3013b75e-69c1-41ef-93f7-94b57c6548c0", "value": "T11B65E0677711DFA5D314C63005B3C7555AF525A20BE2508AB278C32C7A22A2DAD2FEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808392, "uuid": "9b87b9bd-fb60-4105-904e-956ed3272a0f", "value": "24576:t4CTgOHoJHSTQFzx+J8nVZkpDZmFhJeyxuL7k2Ke5ihTq5Um8skdINYN/OfLihQN:t4CqoQFzxLVZknkzAXxU+MMNYpXh236w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808392, "uuid": "aee53340-508e-487d-8412-ea2c583cab5a", "value": 1519560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808392, "uuid": "40009805-7065-4735-af28-e68ffc8b1cdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808392, "uuid": "8ce743cb-9986-4d4f-a12b-566c72314f88", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be09b2e-3dab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776794268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794268, "uuid": "b3926858-a20f-4943-a3f4-7a7ea0f510f7", "comment": "Malware payload", "value": "0a930f6974b234136c7de1401857f69f", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794268, "uuid": "06683211-f832-4023-b8d4-6a10a5672d64", "comment": "Malware payload", "value": "871d8f92b008a75607c9f1feb4922b9a02ac7bd2ed61b71ca752a5bed5448bf3", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794268, "uuid": "52958595-02b8-4695-9a40-6a6a2d04f8f2", "comment": "Malware payload", "value": "fb05b1eada241c663e70c5f43b98560f5d2c5e80", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794268, "uuid": "efa49bad-3b24-473c-a4fc-022c4640096f", "comment": "Malware payload", "value": "63a8969a60af9fa514061def20c50626516bc0eca1321e25a2698e4ede4d0e02ea6d022118f263aaa9afedf23f04c921", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794268, "uuid": "8f629a6c-84be-4280-8a81-b3756f1e3473", "value": "T15356F1111E6E8A0CF2F32676E6500A4A446F21EC555619EEE0B1FE0A67CBDE9714C3F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794268, "uuid": "5a2b30bd-05d7-455e-94c3-09a681fdada2", "value": "98304:hrZiSFS1M9BO+tPwV/fJ9JBG+1kK3UJOG9mVVQ3TOb:dZdMWzOQPwRfJl9EOVVQD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776794268, "uuid": "8afc1261-2c99-4491-8b2a-de1f7e7eddb8", "value": 5952368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776794268, "uuid": "2bcced5f-f1c3-4cf7-9616-3da5dff71b8a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794268, "uuid": "2db8e61f-3148-4939-9590-c80f71936a6b", "value": "teamsSDK.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029ed49f-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776733452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733452, "uuid": "ec3a9353-75b3-4180-8bcc-dd0e0346e075", "comment": "Malware payload (Gafgyt)", "value": "a1efadc85b2ed7b4548807e43efb885a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733452, "uuid": "4b8d3cce-09b2-458d-aca3-0bc4e7a5bc80", "comment": "Malware payload (Gafgyt)", "value": "87a526c767d24ca9a44db1a378983b6ce985fb15089fb68109c4352737d6a4a9", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733452, "uuid": "0e644769-0d0c-4a45-8920-5aa28e46c7e7", "comment": "Malware payload (Gafgyt)", "value": "a9bd0740d1a6e63451bdfc996438fe6de001d4a3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733452, "uuid": "c4bfa9ad-7cf0-443b-80cb-d1ab5102040c", "comment": "Malware payload (Gafgyt)", "value": "b39f2c869f788b10c2cc84e79e477ee33a8b152387de5dc06aad80ac33e0de74f1fabd347cf345bdc3a1f9020570a439", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733452, "uuid": "4d2582c1-9149-4f01-9727-35aee286e603", "value": "T11A933A03771D0F83C1CB59B129FB27F18769B9E502A36181A91BAED05B33A782523FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733452, "uuid": "369f22c2-a520-45a0-b5aa-40867e1fc8f7", "value": "1536:m347Owvn7JDQ39LC+Ox8J6IfUSIhKh+wD5huj7rz9mQmV6qDjjoflee:moawP7SOv+6IMS9z5huj7rz9mQmV6qD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733452, "uuid": "39fc1003-0284-4034-9ef6-b2142afb1a74", "value": 89920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733452, "uuid": "8e900502-77a3-4e46-a59e-21ee8422afd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733452, "uuid": "005d8ae0-1bc9-429d-9cf8-6cc4f71810d0", "value": "assailant.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec0e528-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776807883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807883, "uuid": "51e373ab-ac65-43de-8fa8-7d24762ae66b", "comment": "Malware payload (Mirai)", "value": "df339a5f01f364057da7185712eea881", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807883, "uuid": "6a5b8ff0-928e-47ac-b997-4ac9bbb99b37", "comment": "Malware payload (Mirai)", "value": "88a6ccb524afdfc7f8f615e8b90edfc2820fccb129ab5172930880c21aa4259e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807883, "uuid": "b297cc60-2401-4a0e-a154-d118688a5d6b", "comment": "Malware payload (Mirai)", "value": "9de5aa2f476d958c4cbf0825024ab662e96ea313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807883, "uuid": "e82fb8cc-7b09-440a-9d82-e11308b8a1cc", "comment": "Malware payload (Mirai)", "value": "cc87d3214e573fb24206804cf270e573b3e2952491c17f711009f19650d1228000f6c922f637dfe153f460a32eac136a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807883, "uuid": "51fc783a-7e4d-449d-84a2-cd726b86476f", "value": "T1BB03F233A221B952CA440875C1DFD65F67056FB4E9E7EEAC72038F9A2D412C17EDC850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807883, "uuid": "644e63be-5ed2-4ac5-9815-f27e91e547c7", "value": "768:lOgBaHN1tl9TR/nBGbb2TnS9GMz/aqGdJVInfXg2Hs3q3U7UA:lOgBafL/nQ9lzpGjYv+rH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807883, "uuid": "2c58427f-ccdd-455a-9106-5941db41edaa", "value": 41416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807883, "uuid": "c793691d-eff5-45fe-b850-621504e20d50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807883, "uuid": "7d63d76d-8468-45f8-9b13-b5fbadf81e25", "value": "ARMV6L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a671bffb-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754772, "uuid": "70705c87-e33d-45ed-86f8-ec799facdc75", "comment": "Malware payload (Mirai)", "value": "0dd4686a110cae71e20ab6c90d3827e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754772, "uuid": "b71d39fe-ff26-4965-bbed-368563f0646f", "comment": "Malware payload (Mirai)", "value": "8944c1c38f79ceda333e256bc5fc6a02878e0c9a29313f204e6542b63c792a41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754772, "uuid": "63dc2a0e-3a56-402a-8693-ca87f0a4f693", "comment": "Malware payload (Mirai)", "value": "4aeacf8da7f4c166f3417ec60aa0045e2678066c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754772, "uuid": "c39a43b8-7f20-42ce-a668-b937f3c644b8", "comment": "Malware payload (Mirai)", "value": "fae2ee4d9164b0be6bc5675c1962bfbcaaf69510dd519d304dcb932bb73f1409dabf8993bdc3c75a88abe5be1aca688f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754772, "uuid": "36bd6a05-e59b-4028-b242-12d802ed5ae6", "value": "T112535C0273A84E0BFAE61DF4253F1BD583AEED4021E5F185A94FD74A4235F33494AE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754772, "uuid": "b4d9d887-f498-4e76-b063-68e895d760bc", "value": "1536:fp3/tcoPzVx57hown8n4SVsgEZJB4kv9IZa:ptcEVD1own21VXSJB39I4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754772, "uuid": "a5b3b120-858e-4101-ab22-a7f15bf482fd", "value": 63736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754772, "uuid": "ce382df2-73e0-4e42-b0a0-ee56986719d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754772, "uuid": "50b1af52-d774-4921-bc89-941550284340", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2cc8af-3dac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776794462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794462, "uuid": "985be3ad-aaae-453a-8faf-fbf19fe5e040", "comment": "Malware payload", "value": "c62dffe79a634516543a32511ad3e0db", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794462, "uuid": "2b21e662-e715-4d7d-8c0e-8d6c69cb234f", "comment": "Malware payload", "value": "89616a503ffee8fc70f13c82c4a5e4fa4efafa61410971f4327ed38328af2938", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794462, "uuid": "41502a2b-2f21-436d-b92a-53d95de74e39", "comment": "Malware payload", "value": "8800a6660a53dc1fc8ff4af5c31312a1e81ac6cf", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794462, "uuid": "3aa5d36d-475d-40f1-b0cb-4ae7edca695a", "comment": "Malware payload", "value": "c36ca3c88707f562462ca0c6d65c209ba0fe354bfaa5da9f4447659dc9b077d76b0e176aa207c32477dbd0ee4c3be815", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794462, "uuid": "34de055f-17b6-46f8-bb7f-a678a1984eb4", "value": "T1ADE5331499E23327E64F413296E2AF1FD97AD80612E0D999E2F1C14B857FCB8B63035D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794462, "uuid": "e29a8899-beff-4b13-a9ef-26e3841e1d69", "value": "49152:/QQnGaMHCjk9JnhoF9ew3wuNEe8+qxoPskmI9uH3ZIYtCbea7e398:/QQnGaMHM5P3wxe8+c+O3gaaa3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776794462, "uuid": "3e56a43a-b5a5-4ba8-adf4-1ef6d9961ac6", "value": 3232031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776794462, "uuid": "cca74628-48a6-4057-98e7-e9ed5af56f73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794462, "uuid": "90b73b7e-b9d8-4f7b-a0c6-792b942a975f", "value": "SystemApp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ed910c-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808487, "uuid": "04858f18-996b-4923-a17e-40024a245929", "comment": "Malware payload", "value": "05774c488124de95b86464df4c28cda3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808487, "uuid": "d3b1b59e-7756-443c-85c5-863e188ffb70", "comment": "Malware payload", "value": "899d348cd9495d2f1fa745117185a7b46e931bc1520ed731a42731a1543bd3f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808487, "uuid": "c5545711-ccbd-4831-8c11-950aaf6d393f", "comment": "Malware payload", "value": "3492a3c437d05284785f0cfe9dab44c75785783f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808487, "uuid": "5e6b3f56-1a55-4e80-8b8e-7660c6b43614", "comment": "Malware payload", "value": "5275be16e091db0bbaf64b2c5d4ae15813489d93194c2c41d1a4960df9f2d19553f67d5f9e0fc7c9d339021cbbdf13a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808487, "uuid": "4857147f-b9b7-4557-913a-6260cd61aac2", "value": "T17D567C81FB08A126D94A0E324CB30F74A3516D82C1E4C96F5709F76F55B1AF69A4FEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808487, "uuid": "13f5ee58-d8e6-4e5d-9ed6-db4852b27507", "value": "98304:FHki5UPR9nNFYLwCsuqexilM8Pid6OxTNOKlnBPLAYHRvjET:hCowCI659lhzR4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808487, "uuid": "000ec5e3-f44b-4d7c-836e-6b3ddb7112d6", "value": 6029496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808487, "uuid": "efa4064c-182e-441d-a601-aaa6ae3671c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808487, "uuid": "237a6221-3743-44ac-8a15-42553ce2b762", "value": "h2stream.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ee98d2-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776807861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807861, "uuid": "883bb7e8-252b-49e0-ad26-65fdc7a9dda4", "comment": "Malware payload (Mirai)", "value": "ed922ae49e6e1a519a2c2d5681b5e343", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807861, "uuid": "174bc6a1-6e4f-4426-8d9a-8c17366d4bb3", "comment": "Malware payload (Mirai)", "value": "89a0bf47fd151b84836447d0606e627d2d73dda96ff9bc7852dec39536b78d1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807861, "uuid": "90218808-0d58-49af-83a3-65d256bc4291", "comment": "Malware payload (Mirai)", "value": "79f442f31752edb3236933669f7107c00ffda2d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807861, "uuid": "a6ab87cd-84f2-436f-a235-307dee030021", "comment": "Malware payload (Mirai)", "value": "71128159511e7c7567d40f2892b8b64646c84e41c1dc071ed4571562e14f59b425d974c29b155d3e001488a27815db4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807861, "uuid": "1598feb5-2136-41fa-bd8b-a9ba3530f76b", "value": "T18CA3C62B7B130E23C0C610B552E30632F9BADF5938BC4697B8A07D9D6F3998431567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807861, "uuid": "a2b0964a-cee3-42e5-8fd2-65a58a286b5c", "value": "768:WFyTpEsIle7C8CoDAC4W1Yw/FuOMbzvzyGPVh92lnIUGt0sTYO+Nfb5Vt/iBOHld:mF8BDeYOo1IUGtDmND5phtTigvsvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807861, "uuid": "04a6b4b7-3fad-46ed-8fc2-3fee94f44e9f", "value": 103272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807861, "uuid": "2171083a-0695-4220-8b96-eacb1f5d6651", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807861, "uuid": "29bafc19-78ba-49ad-a72b-7d57945e01bf", "value": "SPARC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10791c73-3da3-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776790599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790599, "uuid": "7c69972e-b423-4403-a24f-8a1cec591f15", "comment": "Malware payload (Phorpiex)", "value": "552d2e3418b0d90f75d728f2ee5fefcf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790599, "uuid": "1ca2ecd8-522c-4223-8981-83b8546dd3e1", "comment": "Malware payload (Phorpiex)", "value": "89c067ac857aa6ccc6e3ea1db06429e12acf9110bba7795c735451f3b99ed7a8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790599, "uuid": "7a47a3aa-a65e-46e9-824e-2081797847ce", "comment": "Malware payload (Phorpiex)", "value": "26d3f416c0fc2fcb8c87a8576606e903060096a6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790599, "uuid": "274771c5-1707-457d-bfbd-7ed73d9113f1", "comment": "Malware payload (Phorpiex)", "value": "846eb877a74eddeb86454f1e9413125d91614685572d6d5e345b00f7c054531af54fda481e5d255b4d0c32f93d4ac3bd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790599, "uuid": "81a373d4-a03e-4609-990e-1e57c5ce9ba6", "value": "T13E823B0FB9424216D0D200B49676867BD979A8B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790599, "uuid": "5b92c41b-e7e6-40b6-a519-dd5fdf726525", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790599, "uuid": "48afe119-fb30-4ddd-9ecd-5d12d62429af", "value": "384:FI78VGQic1Kwzw077u9NHuagBhav8U9cJ:eAo0769uha0US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776790599, "uuid": "37ea2740-a33d-458c-8be1-3bc0f679fbdc", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776790599, "uuid": "aefd8c37-0fe2-465a-b77e-32f68ddca874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790599, "uuid": "580f6638-7d8e-4ff2-a573-fcb2b38c169d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0ea477-3dd4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776811990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811990, "uuid": "213f12a1-34de-49c1-8e51-6f561485c79d", "comment": "Malware payload (Mirai)", "value": "5ce0edb49d0dd71052fc332532956269", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811990, "uuid": "848481f1-207f-4d0c-a00e-600253487c62", "comment": "Malware payload (Mirai)", "value": "89fc5cf1b3e6535db5ec0b251c2ae1b6c5acd45f63f1fa18178da1ec78185ab8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811990, "uuid": "ac9bd819-7cc9-4f47-b601-c39bdc19bb7b", "comment": "Malware payload (Mirai)", "value": "be9804c956c3dd7c1c3205eda4896215e5c992b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811990, "uuid": "a160b8e1-d4b3-499a-8bc8-04b89a3e98a3", "comment": "Malware payload (Mirai)", "value": "bca32b469a11699e151b556a853ad2af9e49021c280c1fbea96f1b03c49b120642ebca909aa253f41aff82f2a1ad3990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811990, "uuid": "a30bc5f0-eefd-4804-9308-b4d37ddd01e0", "value": "T18344A432995CC587C021617D60EECF7BDDBE73CA2A14CD067D912D385A95EEA3A07E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811990, "uuid": "a1f97330-5a49-46fc-bc79-a5fffa4add9a", "value": "6144:Ax/qvBi02k4OknpPh0dMIAQUdTG7HEVKf9mWwB3eA4:Ax/qpiNk4OknpRIAQUJcmWwB3eA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776811990, "uuid": "070f2849-ad4b-40e3-8055-dbb52771931c", "value": 277420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776811990, "uuid": "03fc5dc4-fdc4-40e8-abaa-d0ba678093fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811990, "uuid": "0a8947bd-e6eb-4723-8ed7-caea4ec8c590", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c746b7bc-3d62-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776762988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762988, "uuid": "dea2791d-1747-46dc-8094-93bcfa08daa1", "comment": "Malware payload (WeedHack)", "value": "995d8ccbed61212f14514496490a4314", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762988, "uuid": "33aa126a-2dee-43f2-8754-c7027abd867e", "comment": "Malware payload (WeedHack)", "value": "8b562a584f5ada7d76d8071894ee74b7cd2bcc3d9799c01ae0f3c1df6670d15a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762988, "uuid": "e8a3dadd-2901-410b-b1a9-41fed689e10b", "comment": "Malware payload (WeedHack)", "value": "a71a7aff45ef913d00831b36862017862618434a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762988, "uuid": "6b27ae0d-9c1e-4a54-acd4-87c0634784fc", "comment": "Malware payload (WeedHack)", "value": "b250ad15bdc36fedcb59d75f39275fd18712879e59688e1016a01d7041d375a40fc1048fa104dc05bedebc37831f1c84", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762988, "uuid": "7097069a-0e7b-452e-a7ed-c390a9ac22b1", "value": "T1BCA533D5AA5B5F2F392C19455008DEEDD1D5192F9ECC2C0A5AFABE35A105E4BCC0D2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762988, "uuid": "649ed698-0372-4346-b5c9-957e2629eb86", "value": "49152:lAPU8We+R62mCQSHN6rLyNE3aEtdbboQFoiJnV4tZQmOVaLt1aCkBU:lAM86mCbKy6qEtd/7h4tZFLL3ac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776762988, "uuid": "9db59849-06fa-4c51-a58e-369951523de5", "value": 2228507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776762988, "uuid": "75115182-2157-42be-b696-03959375e0ff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762988, "uuid": "62bbed69-cb64-42a8-aa60-d74b50d8eda5", "value": "MACHINE SPECIFICATIONS.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96360a28-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808432, "uuid": "08e01533-a61b-4529-8e31-ca9ebdda7540", "comment": "Malware payload", "value": "c3a270c2a1cf7381e23e817995e166b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808432, "uuid": "44466bb5-6b5d-47e9-a372-93d7a459eb58", "comment": "Malware payload", "value": "8b9268990208322b43d9920662ea93bcfa713adbb30ca6439ae04fd784e1c6ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808432, "uuid": "bc23ca5e-d268-4523-8c78-c990f6faf47c", "comment": "Malware payload", "value": "68afa9b0292f80881a715b914cbb28656bd3f37b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808432, "uuid": "6f6c6f88-fda3-4477-86ea-323b3991e50a", "comment": "Malware payload", "value": "32ed1da5d0775c266d450c4ba939b7acbca745ec21a89f7a3971ea4d34d89ca4c33d3e1338e0b12b756b1a758ed6fa36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808432, "uuid": "23b870bd-c3aa-417c-8355-fe687657e04f", "value": "T122350156FA252F2BC8564675C59BC2382377F1814B82B303B148E67A7C4336D8F1EB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808432, "uuid": "2f6fe0b5-7507-4a3d-9328-ec16cbaec243", "value": "24576:l0tqcI4qN/1sfElJokJ56nrGn+lANIliGZQTj1JdlfR55SimdVKxv:aiN9kiUyn+VlTZM1JnfR55/mdIxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808432, "uuid": "a02f5143-d1e8-44a9-90a5-8563f8d26e89", "value": 1136784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808432, "uuid": "936cbc31-c6c8-4d89-83fe-7d6965a933d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808432, "uuid": "c4cbbf7e-5e19-477f-b06a-b92738eca505", "value": "bot.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbe94f0-3dd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776811374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811374, "uuid": "caf9e970-2b46-48ff-9f46-33c05d09a563", "comment": "Malware payload (Mirai)", "value": "b5b808c18cfed0634f394d35376e90be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811374, "uuid": "e9a0ebdd-b00d-4675-8429-0b7fb396b60d", "comment": "Malware payload (Mirai)", "value": "8bbf0d368ac691acc6c185edcadf658e332120f218fc421dcc140fa29cd24e80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811374, "uuid": "023b5fe7-0fde-431b-b725-b7f4bfb5af69", "comment": "Malware payload (Mirai)", "value": "88be12762cde77e4437f636c01eca8ae043032b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811374, "uuid": "b19ceefd-7276-4d26-b7f3-2164b742c9a1", "comment": "Malware payload (Mirai)", "value": "f47b01c408a50b2a36534d925dec202e65ab126cdaeedf32f5716b18f6576dfa6747a301ba3efbdbcefbfb1faf498f7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811374, "uuid": "6d1376e5-6024-40e8-85a3-357cd2df7f2b", "value": "T1C353F746B982CF03C5C261F6BB9F426D3B1177ECD5EA3207E925BFA03B464D61D2A610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811374, "uuid": "f1fa284a-c54a-423f-835a-c5b273b0e409", "value": "1536:W6QoH4zMlYkl/KDHs8A+zQjXO0LklHNTocQRuROd:W6ZYzMljZKDM8A+zQ4lH6crRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776811374, "uuid": "87ccb371-0458-4219-baed-98c3c57c40cd", "value": 65412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776811374, "uuid": "d54f5b24-2614-4c26-99b2-ffdd31b1a9da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811374, "uuid": "eeb5ccaa-22a3-4655-b769-97ae6b1b938d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f13d870-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776733473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733473, "uuid": "3379c21d-3f66-4647-a2aa-355791d7d5af", "comment": "Malware payload (Gafgyt)", "value": "cb3bdbec07392a6441054f64b4adf280", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733473, "uuid": "1c61a9e1-3ce4-4188-9551-e9f26e58bc82", "comment": "Malware payload (Gafgyt)", "value": "8c31ddf155f193135e49a86f609ac61766b198ed13829dba5ccd309a3536d9f2", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733473, "uuid": "1eb2c0d5-6f1a-4d86-b247-d2dedd8c10af", "comment": "Malware payload (Gafgyt)", "value": "9af260f88c092e9b9f68f2bab75c17f67b83dc78", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733473, "uuid": "c588901a-d1ef-4310-8723-99de7a117ed9", "comment": "Malware payload (Gafgyt)", "value": "8c458460b9d8b0410e9f54e9ef6baa87a16e3658e03ea2d5eeabf2c12d6f6961c6dbcb62885e539e92461d3290dcffbb", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733473, "uuid": "20b50336-ee7b-4af1-9cda-9dbbb800acc6", "value": "T1D1732B8BE743CAB3C4430AB9019B6B150931F9AE4A5E5E53F7186EB49F121D53137FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733473, "uuid": "db8312b3-9709-471f-ae2b-5a8d45bcb797", "value": "1536:7X6I8YheSwtcWesrwulT70X6xacmzjj5hxTnnkF3s7bOmLIlVma6jtafmek:+I8YPw718U70XKaLX5hxTn03PmUlVmaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733473, "uuid": "ecaff363-a332-4091-bd03-b187c686742b", "value": 80595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733473, "uuid": "833a2384-343f-4007-81c2-4bc6f27c57e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733473, "uuid": "afae800c-f8ea-44ff-ac4a-deffeb789ee8", "value": "assailant.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5ca42b-3ddb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776814702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814702, "uuid": "a195b645-7f35-4e2e-a109-897c8da74b65", "comment": "Malware payload", "value": "0803ac479ac804071c9135ee08c8a1f8", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814702, "uuid": "5ca35436-1cee-467b-9d80-125879d67592", "comment": "Malware payload", "value": "8ca8564127fe93d33395ee9a93c7f45f0c88ef90a4deceeaa9c8be669f8f45ce", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814702, "uuid": "742b2d48-41cb-4dd0-a4bd-7b5243103a74", "comment": "Malware payload", "value": "e72fb3b72a27bcd90c5dde57d9fd67d7a1ec76b0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814702, "uuid": "77dd1935-8ed8-4197-b459-2a83b9d352a7", "comment": "Malware payload", "value": "d205168e2faa2c03ca94b842736c2f5f3f9d980320c55030d7e2615bf9256d16a8f63c6e4654d5ca8707b82c8830bd78", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776814702, "uuid": "ac1c3b84-0867-48b2-bdd9-bfb8e5043488", "value": "T1C062123DD9A5FCC4036F72D05A693F46105C5B23FBB16B6CF9C508AA1824689DF3A19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776814702, "uuid": "4eff9cde-d59f-4c16-aabe-2702d4a02695", "value": "384:lR9wKCh+4usBchcb0csYeNOZ1MEG5lvWZJNgfZAU3rgB+1h+7ck:ZQoR6wcFCFW7+Huck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776814702, "uuid": "bc297490-9514-4a6f-83cd-5209c07232fc", "value": 15349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776814702, "uuid": "7a7d2ae6-4307-4585-99a3-2c8406808049", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776814702, "uuid": "9fede438-41fd-4d6c-bafd-e9b381c30f50", "value": "script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302b3781-3dbf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776802678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802678, "uuid": "a50645ed-05c3-4237-88c7-88dbcd5df6ef", "comment": "Malware payload", "value": "c055428a1f8ecdf522448e2b7575c642", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802678, "uuid": "224b9c47-6c31-4bb7-acd0-3af907926791", "comment": "Malware payload", "value": "8d906c78c2187241ed9999e273ad31b2dbeceb19853c67912a951267ea0464e4", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802678, "uuid": "69afd87a-0c9e-4a36-89c0-c758ea0463db", "comment": "Malware payload", "value": "bf2bd7a8fe2a4ce4032727435ba28ee21486ffc9", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802678, "uuid": "79f4a4bf-5516-424f-a4fc-83d0538c4ee2", "comment": "Malware payload", "value": "86f4f39a92c8c7e3bca3144f2261dcbf2a5d38306802c25d6debfbd2ab4553d06ecf9a2862cdaa2e6b6ded9e47a40bda", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802678, "uuid": "870551a4-76bd-45e0-b75a-37c2732e4285", "value": "T152957C0BBCD105BAD46AA33289B6A1D67B71F81A0B3233C72F54A6383F763D15979344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802678, "uuid": "b19354cf-3cb9-4057-b403-04b535f3af83", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802678, "uuid": "1e0a500f-8fd0-4ec4-abdb-360e6e82b49a", "value": "24576:wOd+sMx2yiPG/3WcpMDLjFbWY3nwlRnD9GnZpdfXQjHdQWmGFWPHw:wONMxzu22HIY3wHD9GzVXAHdduQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776802678, "uuid": "d2244d3f-f2f6-461d-a4de-610a20ea18ca", "value": 1975496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776802678, "uuid": "f7ea8f3e-2de0-4a86-b374-66e14d566968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802678, "uuid": "c0e37ef3-7d70-401c-8107-bea897c8386d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a997ebfb-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806317, "uuid": "5270fc51-a823-47bb-a153-2e15465ddfda", "comment": "Malware payload (Mirai)", "value": "acad120b180c064fb022f3a8fbedeb6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806317, "uuid": "40431c85-0b6a-4086-9846-87c548f4bca6", "comment": "Malware payload (Mirai)", "value": "8d9b41cc92aac0fb1d3ff6bf1aa58b28d436e82aa9100e10f8c0d925d744841f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806317, "uuid": "b5bc0858-6761-401a-953d-28825bb00499", "comment": "Malware payload (Mirai)", "value": "4d376fcd2928f4d8d40192ca73633842e70d3808", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806317, "uuid": "1ddb9eac-fb03-4c06-9b3c-591495bd426a", "comment": "Malware payload (Mirai)", "value": "bf10a7fa79021bba387f4331ca75ac0182003c432ce17b7f78e257178d02bef9f83a5a9fce921b93ea80e139b48a9c0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806317, "uuid": "fa3d7906-399a-4cf9-80c7-05acf1474a82", "value": "T18EF2F163F9B78222C307E87DECE590ED57FA9FBCB23E32A407104555169406B02FB59A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806317, "uuid": "fe448ea8-6d37-44b5-9c50-93db638adf88", "value": "768:XNNbLjA21zMaZdEsYHKizDKP7G4+FxZEzWWKBYess3Uoziw:dNf1zhus4dzmP7G4abEzWl+epziw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806317, "uuid": "54f26391-fa8e-4943-b2b7-3d7feb3eb59f", "value": 36964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806317, "uuid": "aec177d8-4eab-4f63-b9e4-1450d82c9308", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806317, "uuid": "2e0d72ae-ee4b-4197-a718-f050e4e1c922", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba62930-3d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775129, "uuid": "9dd7c903-2a49-401a-b0ee-10f41b732962", "comment": "Malware payload (WeedHack)", "value": "676f70d6873566b7cd25c5af4a7e3b3e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775129, "uuid": "5f3e22b4-ae81-4d4f-8a3b-53c76ab8fd9e", "comment": "Malware payload (WeedHack)", "value": "8f16042fea6091e3503540f7b49d1ff682dce8fe002fedb71c3b189547d082c4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775129, "uuid": "2ae928ad-16ba-4858-88db-e9d0ae95f9d3", "comment": "Malware payload (WeedHack)", "value": "b07985077a59b2f4fe37436593c033bde9c29980", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775129, "uuid": "bf4c9000-74b7-44ff-aab7-3f75872368cd", "comment": "Malware payload (WeedHack)", "value": "59b68de91d1b79f1deb4f7a2b37640d0ec9598f3ce90792a5b60e1deccb813b1b400c50a82c31fc012c6db5f7ba96429", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775129, "uuid": "8fd43f52-00ac-468d-ac03-8b1e2b3ea88b", "value": "T145C2C0A2C277EE2FCC174AF529C5BC4A941B86D26007781D9C7298AB2457FDBC744ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775129, "uuid": "4a6a3d62-b380-4e62-8d2d-707f25952ec8", "value": "384:k3w9gntxxb11GDqufsP4Tu3GJ9imN1JkXihpx3NPYYAuRFN0EqoqUO+z627QH:W9nh11w/kATG2wm9kyhp8YAEqBU7z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775129, "uuid": "888adeff-1cc0-4804-9274-25328662d2fc", "value": 25765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775129, "uuid": "ffa49047-fccc-4a80-98cc-6f673b66ad1a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775129, "uuid": "bd1487ac-9846-433f-b1d3-614f30287300", "value": "KryptonClient-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148e8863-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776733482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733482, "uuid": "e3140df2-a9f0-4c85-a0a7-f7edf5e6e5b0", "comment": "Malware payload (Gafgyt)", "value": "0f2428e857dbf4a3c1b747c7d9c0583b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733482, "uuid": "015fac4e-3937-495b-a7b7-eb27aec2a423", "comment": "Malware payload (Gafgyt)", "value": "8f8346d945fdc7048d7eb33741155e6f12d3134004767b7e9730c59b72521bf4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733482, "uuid": "11ed9fc3-69cd-4fac-98b4-97f2edfe9bb3", "comment": "Malware payload (Gafgyt)", "value": "572f7be641bd3ccc7f190e7999d5f497bc706378", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733482, "uuid": "6e4d1690-22bc-4bfd-bd23-c6440d3331ca", "comment": "Malware payload (Gafgyt)", "value": "f18f6ac6c589a3115574eb15ea1e32aadebc97c1ef42566fbfba8cd0168bf0026c5ed7dc63f0f29c84e0ece4ee0b8d8e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733482, "uuid": "56367ef6-10b9-4134-a1df-3ffe1e8bda9e", "value": "T167734BCAA781CAB3D08315B112EB5B110933FAFB1A479E41F36C6CF09E055897127F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733482, "uuid": "8a757463-e1f1-48b4-9170-844c8fa76e56", "value": "1536:qA4L33U38JSPBqvvW3geGo6dRsImP5hannnIEZ/EM9m7mLIlVma6jtafmek:qAmUMQPBgvK/G1du5hanJZS7mUlVma6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733482, "uuid": "a0a2727b-8f85-46a0-9bc0-763a8a377254", "value": 77683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733482, "uuid": "de5d686b-f2bd-4367-a07f-046d63e47956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733482, "uuid": "102c6914-748d-4d35-bfff-047b92b770d9", "value": "assailant.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b820b4-3d92-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776783546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783546, "uuid": "f3772698-3723-4f66-8d85-2511649e1c94", "comment": "Malware payload (Formbook)", "value": "17dbbe51400289f15eaa33e86821ee14", "object_relation": "md5", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783546, "uuid": "a5ef6b8d-8e75-4bae-8032-fe38014a4434", "comment": "Malware payload (Formbook)", "value": "8fb80973de986d4adc2fe50ede022c38791eef8d4ee9d32208745d8fca136f96", "object_relation": "sha256", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783546, "uuid": "49de9964-9f14-44e3-833d-a2f69b071b83", "comment": "Malware payload (Formbook)", "value": "61b82fb6dabcc2746672f99e5da90898de284865", "object_relation": "sha1", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783546, "uuid": "57ae042e-476d-4962-b1fd-b15d60cae901", "comment": "Malware payload (Formbook)", "value": "fa43e5056d44a562ca02c8e21971b706930a25220ef06d58bdd78ed321661a233b27abf6a0bbc2b4a5b7d6fc24ed812e", "object_relation": "sha3-384", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783546, "uuid": "625a98b4-27c2-44e4-b2d8-8fed5a7444eb", "value": "T1286523701EB12FAC5FBC9709538F974A0242039B1848F3BEB7D478C926BFF64990A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783546, "uuid": "ae049f84-765a-42e6-8841-56a7dda44eef", "value": "24576:/RJS00dSpaVjpuq7jKzesfbatxyX2Btnn1CxXml91UkbuDbMSkmGcfAymFT3:y0Wj1Oan3CBGwAhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783546, "uuid": "214bb84c-9d78-4b2d-b910-e254e00a0ca3", "value": 1424667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783546, "uuid": "b052aebd-ab99-4e20-96a0-80fb0f854fc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783546, "uuid": "d41ee88c-eec9-4e65-bbd4-63f0716ec448", "value": "swbtdq.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e475c631-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775063, "uuid": "4ca603ca-7f2d-405e-be0e-0c4bcedd8be9", "comment": "Malware payload (WeedHack)", "value": "5452fb4458d7f69be51c77c186e30086", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775063, "uuid": "0736a7d4-9944-4615-8e32-feb34eb4c4e9", "comment": "Malware payload (WeedHack)", "value": "90b8d82f995f5e8c4d674d843ecb8fe0bf7446784a063f3484d35675733e959e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775063, "uuid": "ce49bc4f-bf14-422d-b471-5ea576fc25c0", "comment": "Malware payload (WeedHack)", "value": "40ae9453f918a679334dca78e9a8458d0e3b3533", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775063, "uuid": "d2394045-7416-47e1-ad26-8ec36f3b5923", "comment": "Malware payload (WeedHack)", "value": "74f1c65e7c90c8cb2ee0f76cce91f579910e3459ecfb4c98c5a2f0076d1be08513dbcac4f8d8c5092611f760950347fe", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775063, "uuid": "39bf5d03-5aaa-4c74-96b5-330fccd1efd8", "value": "T11E55F26BE60F07DDE18B38B0D4546213B94A9FC404CAF06E4BF12A264A57C8B9F51D9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775063, "uuid": "88e2dd72-412d-4cbd-ada8-758cf54f4aed", "value": "24576:Ow6WWM+ImFIvvf7P1dXZ+njvxDpc2g7sRpErXfnnQggKW95lG:Ow7WmjQx1LHpSXfni9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775063, "uuid": "46c07d01-a304-4577-bdb2-fb57d37f4860", "value": 1297622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775063, "uuid": "458b0f6e-0e96-40dd-bcde-d3a146dcd4d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775063, "uuid": "6ed283fb-bf0f-474e-803f-83c6ffb99143", "value": "Dupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fd09f9-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775015, "uuid": "90883837-9a89-4ead-81be-8f1098575810", "comment": "Malware payload (WeedHack)", "value": "606c066dd725290cdf4cc90d0eea93e2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775015, "uuid": "630441c7-6ce9-4500-98bb-e2fdffa60b87", "comment": "Malware payload (WeedHack)", "value": "90d4deea5051da8724b5d43aff5a64ba62811fdd521202f17704fa51883d201a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775015, "uuid": "ed6d33d3-11be-4c84-abb0-ad27c9dfdf93", "comment": "Malware payload (WeedHack)", "value": "f9a857c14b1a0c1fc93c20e475307df4fdcf4c16", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775015, "uuid": "600e15bc-238a-40d0-a541-08263bca3340", "comment": "Malware payload (WeedHack)", "value": "9e704728b596e805df45e7ed14caea5fa04c73b531433544763db785ac048345c45e5bbef803185bc879e1e8cd73222e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775015, "uuid": "7ecbf598-9c39-44cd-8eac-3a48b54d5a15", "value": "T1A004D0AAE0FE0E1AC51F1CFF424726D2EE2D2671E121701B5455EA836C0F4C9EB77269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775015, "uuid": "7bd21e91-ffee-4554-b9ad-1d16626f1b6a", "value": "3072:p7h1m8VOpONZurEvEH62E8g/WpIGJsdP56DDP8/7+5T6tNd4shW4f9xrGA6wrx:X5O0Z4EeXE5/WOGSP56f4I6phW4f9B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775015, "uuid": "6714a32d-8c47-4873-b7d2-007631371fb0", "value": 178532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775015, "uuid": "4f6ec63b-6d87-4089-a9ab-685125684e08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775015, "uuid": "d1963fa2-5d88-4736-af2a-eac3a5faca84", "value": "Better_Bunnies-1.0.1-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ad5ba9-3d97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776785660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776785660, "uuid": "c8d0d029-a865-4dc0-8dfb-d928979efc9e", "comment": "Malware payload", "value": "30a6bd09e8b5e042318eb4d6177fb1c7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776785660, "uuid": "7afd5be9-b8bf-447b-bb1c-72a2307b4886", "comment": "Malware payload", "value": "9165c05fa9dd0254721a8a44413f119e7702a7f6b825746ed3e9b7e92256ea2a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776785660, "uuid": "2b168f19-47c6-4023-945a-855d7b8436d6", "comment": "Malware payload", "value": "4134aee7b5affca5af9bfaecdd6621c7ab97a7f3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776785660, "uuid": "4b5cd5a1-1412-4ab3-a605-14da85a681cc", "comment": "Malware payload", "value": "7f5ea21be3c66c6b7fa3f0ff9b387257ce61cb7564f999a0aca06244ccac392956ef29d96ff7c6aef379c9e9b54a98f4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776785660, "uuid": "980e1040-0e9f-420b-bb02-e5b43af7a81a", "value": "T12D565AE8F95E843DE92E34B356299A1B95FD6DE20F2DF6C752D0B84917334C21233A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776785660, "uuid": "ce522898-6cb4-48bb-83e0-290b3f410ae8", "value": "98304:VFczIfuxFLLI1kXcabYT9VpP74P9RDYjQUfFKa3ae:VCzIonTcabYT9VpDW9RDyQUfFKGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776785660, "uuid": "4b5e3a61-7dd3-487a-96ed-874e468e1a71", "value": 5961728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776785660, "uuid": "5a2f2693-90b8-4d4a-b9b3-4386ec05ffe7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776785660, "uuid": "3c648624-ceb5-45d5-9515-d3d5ea1d4899", "value": "resources.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921ca893-3d79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776772777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772777, "uuid": "7ec7f145-cf2e-467c-bf9e-bdd65c3fc55f", "comment": "Malware payload", "value": "b7ec63b21c1db90d881981bd1d9f0cd6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772777, "uuid": "125b2f41-cb2f-4261-ab57-e4f52f905a6f", "comment": "Malware payload", "value": "918070bd24fedf87125fcc8ad551e18a4aa488f38fe7c1cfbaa385d0a941a32d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772777, "uuid": "26e8c596-3697-40c6-9421-a4cca7bb576f", "comment": "Malware payload", "value": "58b2f517ede7978239448e747b442d94ed05618c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772777, "uuid": "72d5d9a7-aefd-4eb2-b089-83385654b652", "comment": "Malware payload", "value": "a9ee438b958a12832f5c3c824921fd823d94a6f5777c2b0218646eb773edfdef88b634118b90d59506f57e5fdd5b2da7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772777, "uuid": "685fd470-29b9-4e9b-b62a-fc86048e1bab", "value": "T17134F94C678E70CD117ABE7766237043B67AD8C2B60C8064F9D7759FFCA432A8499E24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772777, "uuid": "cf0b1ae6-efa0-4144-bacb-86be86be2591", "value": "6144:Il5YTutWmIDeIuXYtf+RfNK7KbRKbH/OOoYx00RePJ9:Il5YTutWmIDeIuWfofNK7KbRw2OoGHR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776772777, "uuid": "a2f31bf3-bc83-4b19-a720-5d69ec956782", "value": 238192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776772777, "uuid": "d51b2d26-10a1-48c2-b037-72e70826db7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772777, "uuid": "d7613df3-6555-4437-849d-fa71e381ca24", "value": "918070bd24fedf87125fcc8ad551e18a4aa488f38fe7c1cfbaa385d0a941a32d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a6c644-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776733506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733506, "uuid": "41f3e7dc-5ea3-433f-ab1f-a4fcee865b81", "comment": "Malware payload", "value": "aad73acec535c0b80378b314881f1db5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733506, "uuid": "36a9ef4f-3645-4df0-a3c6-a97e5d0abf9c", "comment": "Malware payload", "value": "92f8522b1dc06652ca0bf0245a1d80e63229bfcdf5b905ad800882a34aa9e623", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733506, "uuid": "71c3b362-75fa-4a1e-a6d2-eb54cf901013", "comment": "Malware payload", "value": "72fef7573d686f83de1336180752c8d8589c132b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733506, "uuid": "35d1a523-7f55-4ba0-b047-56a8bbaf9e6f", "comment": "Malware payload", "value": "1000191f6d7cf3746e27734b5e664dcbf0db5dcff02a7e752b157a7615e6ad6e12fd5d7ef7f33d25fc40d42e663118cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733506, "uuid": "616ce92f-bed0-4a4f-935f-faf42c527893", "value": "T134A65A57FCA558E5C1EDD130CA6296637B717C490B3023D72B64B6282F77BD0AABA304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733506, "uuid": "e71f5ab8-09c4-4862-9cee-179abdf0b7c9", "value": "98304:AaXRMQReej4UXEALii6Z2OADh2DmTUeHlvniO2fUXEL:HSyeuXo2HQD2UffUUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733506, "uuid": "fa8efc9a-a188-4cba-b1f7-8d5799988bea", "value": 9932926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733506, "uuid": "52d788dc-0072-475d-b203-466395b761a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733506, "uuid": "aceddbbd-798e-409d-9616-72298c6c8fb2", "value": "agent-linux-amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314cc788-3db5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776798385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798385, "uuid": "47a033cf-f48d-4e15-b740-5381dcfbb8bb", "comment": "Malware payload (RemcosRAT)", "value": "bb3f7e4b8c47a0709c445f69ef875dc0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798385, "uuid": "d6c26c04-4d5c-495d-90f3-3d135b3ae640", "comment": "Malware payload (RemcosRAT)", "value": "935ef0b7c8d49856976cd4dc69b1d6c398f3147b59d9f6d04f5adf436ac5bbd9", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798385, "uuid": "da39f37e-b441-40d5-91e6-8cedb6dc526e", "comment": "Malware payload (RemcosRAT)", "value": "1637c5d9f9158fcd8157a97c2a209df49e377e6d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798385, "uuid": "d8f04609-175a-4cd6-b628-6cd8aef8519f", "comment": "Malware payload (RemcosRAT)", "value": "e58eea31cf1c50689eebc701d6879310139a759ea0f77783922b6c12e7238a4e2693e955224134ad319292be82bba22c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798385, "uuid": "9e6410d2-c135-4435-bd01-1fa6a75453bd", "value": "T1F034C3AF8BCA1C9FDAA0358F1DC11BDA528D6132148D4D6B3D4FA21334EF5E935A184E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798385, "uuid": "8adf9e73-1b07-4cd3-ad18-5936542076a9", "value": "384:RnUvGgvrO/BgiQQi290Tx0RqqjSOrO/TUvoBf2+C7uZgghU3Xv1giQQi290Tx0R9:RK+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776798385, "uuid": "715a49e8-c2eb-497c-b8a1-5baeb2115633", "value": 236121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776798385, "uuid": "3ded6ef4-10af-4c71-8630-77a35e2a3bf5", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798385, "uuid": "d3a0c968-5df0-47a7-8d5d-99bd5ff696f7", "value": "goodmornignbetterthingsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a311612f-3d94-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1776784402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784402, "uuid": "dd1858b7-9072-4d14-9c5c-f208ee9e4f71", "comment": "Malware payload (DCRat)", "value": "3ff75ef0521a67f2bc8fd8d16f47d8c7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784402, "uuid": "b81c5a38-2acc-4c7a-865c-54a8680a7e9d", "comment": "Malware payload (DCRat)", "value": "938743ca619fae52348a4908e7b112c0c8ec9bc9e4cbc2018fff85a7abc709b8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784402, "uuid": "8f6bacc0-ab8b-4805-a827-debee96bd03c", "comment": "Malware payload (DCRat)", "value": "a996f89b484242067696802b705bb1003227d749", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784402, "uuid": "b3b3c828-5dbc-4057-96a7-861d6e5b9efb", "comment": "Malware payload (DCRat)", "value": "d0b1caa835f33c0589678b338e98d2dcf94314b46b2e1234a062a4c973988caa89587d2014c0232509c81f4e399a0626", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784402, "uuid": "97962f07-94c7-4432-9327-dea88583a6ce", "value": "T101859C017F54CA22F1191637D2EF850447B0EC112AAAE72B7ABD376DA5123933D0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784402, "uuid": "dbcb0f5f-aaba-43a7-ab6b-5abb762eae83", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784402, "uuid": "c3cb4cd0-0c9c-4a86-a151-8c20d8b2b79b", "value": "24576:u2G/nvxW3WieCZOEuCfC9+CSc207I/xZhpXjpQc3Caef8moXnIKUFvaMQ0CRRcDP:ubA3jZOf82+pTJpi8vgNab0aRzb+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776784402, "uuid": "31d452a6-d5ff-454c-9db1-2a4848ee76fc", "value": 1829030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776784402, "uuid": "ded73268-d2e8-4cbf-8836-a772a815467b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784402, "uuid": "0934dd5a-f1fa-4425-a699-21d8e4316f0a", "value": "DCRatBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2abdc96-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808507, "uuid": "2bf4b900-44ff-4a0c-a92d-69ddb24e73c5", "comment": "Malware payload", "value": "fbf59f7fb846328c3756efab94671e11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808507, "uuid": "2fea0639-9644-493a-bc3a-b473c4868e07", "comment": "Malware payload", "value": "942a26f48c351cae40acd4507e156a99c7c8aa495520c838fd801582c4c6b611", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808507, "uuid": "1f227df9-73c8-44a9-aa37-500aadb9216d", "comment": "Malware payload", "value": "7f64438a73e59cc9092597f6055063a26c29a8c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808507, "uuid": "1e4413fd-4617-4103-a42f-9efe5332ebf3", "comment": "Malware payload", "value": "27b22914d95c3f5d289d32c5b7c474d93f362a1fb74abd17e96268bd49f8d8c1a9b13044d98706e3a52bb57c0b6595f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808507, "uuid": "61428713-570f-4e92-a467-734264e15dfc", "value": "T11066E919ACC42BF6C06C5A7454FACA5522706D144EF14A2A26A4FFEDFC762387F4788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808507, "uuid": "4112d152-2323-42ca-b14f-24328b1c2d90", "value": "49152:DvFdgYUdkdrYQmvyACZdVB/ScmPJKpP973LdcMj5EWw:qLvyXVsP43yYE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808507, "uuid": "9620a701-8856-4825-b195-a7e289e1202c", "value": 6881495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808507, "uuid": "77f98a92-4edb-472b-9f5b-565826a1b9e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808507, "uuid": "901226de-aa91-4964-ad1a-f9b6547096ff", "value": "h2stream.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e475e08-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806298, "uuid": "24d86e89-2934-4f6e-b079-0646beced9d5", "comment": "Malware payload (Mirai)", "value": "ce6f42918bd833c42390a681a93cc79e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806298, "uuid": "1bd46390-46d6-4abe-9fc4-44dfd9931006", "comment": "Malware payload (Mirai)", "value": "9436991caf6979fdcf5b37ab9300fd39fda95b19960c1dc3f9c0dddec6321624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806298, "uuid": "d11828f6-ded1-4076-a681-fa569b8430ba", "comment": "Malware payload (Mirai)", "value": "545f52f95fc055a5abda6ae5b1857027c0e51f9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806298, "uuid": "a3b9dc4a-2e0a-4824-b5ea-0184bb2bc250", "comment": "Malware payload (Mirai)", "value": "b05b2c598047fe80a4730bfe5a18e8502acc13c12e77ee54e4dd6eb067936ef87ffa929521c1378131a90631899fd49b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806298, "uuid": "5411fc72-b069-41e1-95fb-97af10d16edc", "value": "T151734C31F939192BC0D4917A21F74722B6F687CA21A8862F3D710F9DBF615403A47EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806298, "uuid": "2e6b1f0a-f731-470d-9c7e-09569249060d", "value": "1536:IjPXYjriSP2PbyZlEPRtzJYm5is9Jsmtt6/bt:QGg9JYO592/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806298, "uuid": "5d0b7a74-859a-4707-9ca3-eae32fd76f61", "value": 80296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806298, "uuid": "53461a67-d47e-4c9a-9f32-6796dcd53357", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806298, "uuid": "8225fe38-efc1-45b6-b857-6abdc27273e5", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70eb29c7-3d4b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776752965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752965, "uuid": "e81a7a2e-4d16-4a93-a6b9-5716c2b1fbae", "comment": "Malware payload", "value": "86968f2ad8ebb144d534fa41e8ce461b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752965, "uuid": "33a047a1-8710-45c2-9d85-6e345d6df6d7", "comment": "Malware payload", "value": "949974b99763714d671518b518a819797ba3d072b0bb3063a7c13b161373e055", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752965, "uuid": "d2ccbec6-be37-4c2c-be7e-0151d068bf66", "comment": "Malware payload", "value": "8426c35e7498045b5efc7e3b8eaa8ab504c3f8b9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752965, "uuid": "6854ab84-8553-47ca-afef-0a1685e9096e", "comment": "Malware payload", "value": "3943d7b2d938545f3f75986cb199af13e32214376392fa29a03abb80477a655f52d3570dd3cfab502fbf4a1990470bb0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752965, "uuid": "b534ad80-81cc-41ef-a71c-98013038c723", "value": "T1DFD3BECC899E88B48B1F34A84A5F5C57CA9DA123061DC990BEEEDF843F115B075BE4E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752965, "uuid": "df6347bd-6201-4dbc-a288-17599ec8e7ba", "value": "768:JvX9X3333xxxq0oRtyqYUOZzOZ082GsmQvjIEYzZrR1txqbPfDrgGLc1+lMdP6u/:JviOA2GsH6FWkhKkbyviNpcLbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776752965, "uuid": "cf4f970b-2498-40fb-ae81-ee093b9f8919", "value": 134509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776752965, "uuid": "c5fe2f0e-660d-4962-b806-a6247533ec86", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752965, "uuid": "522ac81d-0237-4566-8b0e-9ff4b4de8179", "value": "Meeting_Snapshot_Beta_4253.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a55dfc-3d79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776772788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772788, "uuid": "f63609c2-67ee-4694-af0a-6c825dd6adb0", "comment": "Malware payload", "value": "21e5094a0bd12ce38fe87a747c217768", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772788, "uuid": "9bed25cb-a2f2-413f-8904-c4233f788a19", "comment": "Malware payload", "value": "95cba5ff5bd1bd9073da7f132c28a3655df3df4dcdd027d8f314c58485825008", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772788, "uuid": "513b3e91-9db5-40c6-a2a4-8ebbf1691abd", "comment": "Malware payload", "value": "824e2acda13e5356f286929a4d6d25286bf9980d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772788, "uuid": "c9c88d88-ca61-4028-a723-4343a840534c", "comment": "Malware payload", "value": "7a152d1fb80810dce260db36b97e05ecbc0ea1452fa1b45098b726793606a769db6ddf92562d23c9cbc2c8136babfc8c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772788, "uuid": "8fef16af-5f7d-4723-92b1-ad466e523e58", "value": "T18D34FBCC664E30A013BBFE77AB27215AD46988815168D434F6E4798FBF3433DC49AE25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772788, "uuid": "00f7866c-1f43-434e-a99b-698d65f594e6", "value": "6144:mG44mXilXZPbnvBBzRS6B0EhGC4nLxSy95ttjKYJQuB0mMqupcG:9RtSf99tbJQuB0mKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776772788, "uuid": "a4425d61-803b-48c3-8aa9-8e79814d76d0", "value": 238294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776772788, "uuid": "1f1b4f20-a3c2-40d6-8078-f5f14a28b582", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772788, "uuid": "a3ad7e2d-82b4-4664-bb32-cf5daa1738bb", "value": "95cba5ff5bd1bd9073da7f132c28a3655df3df4dcdd027d8f314c58485825008.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e29cc48-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776807828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807828, "uuid": "933879be-faf9-4e96-a0f6-7b8d9d0eaf72", "comment": "Malware payload", "value": "4a4161ca3ff6275e8cdc3e44debb0f58", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807828, "uuid": "ac4d2cbe-da34-4e55-810a-e0e15d064852", "comment": "Malware payload", "value": "96ee41b2d81c7c279b3f0bf78279bdc81569c8d50f10e3a4cbd1a6e41b7c533a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807828, "uuid": "b04dd13c-527b-4dab-ab88-4bd6dd04ebb9", "comment": "Malware payload", "value": "be5d03ed64505b25b33b2cdf07c518681bd5cf07", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807828, "uuid": "cc108e1c-6929-4c23-b8ec-146617d35e7b", "comment": "Malware payload", "value": "19d68885ff157e979f3fba0505364c5394d3d3c3f217a862b1a99788f1b4e9cbba8491c64f4787ccb910f4a2ed3ac10d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807828, "uuid": "7e059382-f3e2-4de0-af12-28838860609e", "value": "T1293163C660D158757EF5F52732A8850178C5A1C792CFBF49AEEC38D485CDD08B415B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807828, "uuid": "809d4726-61b7-4c2d-9ded-5561d8d5b258", "value": "48:1p9pGKp9pBrpb5pM6pG/spZp1p5pS+rpQMpU:1LsKjj95j0UnjnjuMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807828, "uuid": "0d166173-30c5-4646-8be5-66422fcbd7fa", "value": 1713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807828, "uuid": "a61945b7-4ae5-4407-b98b-d33d3d458513", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807828, "uuid": "cc8ea023-7eca-461c-a104-26246953ff4f", "value": "Ciabins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04512986-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776733455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733455, "uuid": "72b86cb5-8904-4cb7-aa4a-32dfeaac08a0", "comment": "Malware payload (Mirai)", "value": "c59580bf6e970a44e799870c8daeb998", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733455, "uuid": "fd02c4ac-b286-4b7d-866d-a5562d342fe8", "comment": "Malware payload (Mirai)", "value": "97d667691e062e27a9cc5fa7eb0a2c5eb8bdabc9260ce6a9cabba259730b41cd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733455, "uuid": "d802445f-4295-40fb-90f9-fa654a1fdad0", "comment": "Malware payload (Mirai)", "value": "ea4499c4b6dd8fee2559a1e779345c8f44bff1f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733455, "uuid": "0d841239-effa-442d-a690-b8c1ae86b398", "comment": "Malware payload (Mirai)", "value": "68aa80a5661b5b630d6748401f67dd4cf3f9bab7c9ba26a1ed18693a22db1639516f9d28ea736c17fb1152e55bc8a4bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733455, "uuid": "fd76f2a6-3577-4563-9e88-129408062566", "value": "T1D5B3E867FB11CEB7C85FCD730AAA8615108DA59746D47B6BB3B4C958E70694F08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733455, "uuid": "07851749-652d-424a-9b57-689a6204c61a", "value": "3072:O0RZwXWzkdJj+5hVftid7xmkizF9GhsRiAe:OPXhra5hVftid7xmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733455, "uuid": "e481f707-766c-4b2c-8a60-0ab439932fe0", "value": 115403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733455, "uuid": "52bc8852-b269-45b1-b33e-34025970b4ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733455, "uuid": "4ab19e09-1f34-4c2d-97d1-1b36fd64989c", "value": "assailant.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd20f856-3dac-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1776794754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794754, "uuid": "699012ab-92c9-42a9-b8d7-a03f26a4bfe1", "comment": "Malware payload (DarkComet)", "value": "ff87c4abb85255960a6cd2df5d69ed6d", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794754, "uuid": "28f6d9d8-41ff-4107-8186-87a7731c8351", "comment": "Malware payload (DarkComet)", "value": "981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794754, "uuid": "d596aabc-b8d5-46b6-b8a3-4da4d6627196", "comment": "Malware payload (DarkComet)", "value": "8e11a744edab961795b0c9d04c80d23223f2df69", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794754, "uuid": "ba60ddaa-b1c7-46f7-b454-67dde804910a", "comment": "Malware payload (DarkComet)", "value": "1716dd57430d71a0dfe07df545ec0d07c1084c1a8e5ea0b17eb8b5d8a0a6f94dfe2ba36c27367b8560cb370a03844e7f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794754, "uuid": "d54d658d-4ae1-45a9-89a6-50ffbcf8f6c8", "value": "T124E47D21F5808477D93229B49C5B92F5582A7E202D29794B3AF63F0C5E391C37D2A3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794754, "uuid": "0f744e8f-2e92-4bad-8874-2c38ce728e00", "value": "afa29b04755418c992de6c84f739a842", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794754, "uuid": "a5502d0e-234a-4d9a-bf89-1759adac98b5", "value": "12288:48UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixym:RUKoN0bUxgGa/pfBHDb+y1HgZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776794754, "uuid": "7165dd5f-3435-4c1c-ae7d-3e244da34497", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776794754, "uuid": "a20b19f6-7c6f-416a-9bb8-0688ba70bddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794754, "uuid": "f7d7d482-743d-4a57-83d0-4e3b155b65f6", "value": "Microsoft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6006a31-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776774985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774985, "uuid": "8d3315e4-5f0d-4142-a3b7-b5c0341f2313", "comment": "Malware payload (WeedHack)", "value": "2339409ae3538cce6493b3d1c37053cb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774985, "uuid": "8c09af5a-e76e-4702-8ced-3fe6cd1ea46f", "comment": "Malware payload (WeedHack)", "value": "982a6058ef6b813cd42e84d1660d3b9634d7e9dc7b7a62da0f6c95d913466107", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774985, "uuid": "cdd2136d-848d-431e-ba4b-82cb20f0299d", "comment": "Malware payload (WeedHack)", "value": "e84e56f5e66ae312c1dfd43c497dd31871d8d5f5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774985, "uuid": "118acbd4-6efd-421f-8e53-68f2526dbd5d", "comment": "Malware payload (WeedHack)", "value": "5695c75b4e36375c4b23382b40c5f2b025efd90aa238e61976dff3672e82dca22f41afc8bc1f208894e9f881892d422d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774985, "uuid": "1d6f16d8-e4bb-48d6-b451-852924235dc8", "value": "T1DB953322D11C04F6CB1F9376F4308732A45EA6C8B407256E36C45C43A89F7E59F7AAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774985, "uuid": "5c440301-03b3-4d70-a419-f4cac37002b6", "value": "49152:jVjy0qQ/cI9A5OQ17nltqcffdypFUiZU+3g:j7qQ/25Rnq+dYFUiFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776774985, "uuid": "66572069-9407-4c37-850e-99eaee0c3487", "value": 1907350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776774985, "uuid": "b238fcaa-4a0e-4d3f-a03a-511a44851106", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774985, "uuid": "a2c60f16-06e1-4c07-9586-11405d5eca8d", "value": "Argon-.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9b022a-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809223, "uuid": "97472db5-ae90-4a37-8c8b-b70df1a14eef", "comment": "Malware payload", "value": "5edbb61ed4ffc29faa668526316eb306", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809223, "uuid": "35d69f1f-0292-44f3-8dd2-3534bb5630ad", "comment": "Malware payload", "value": "98a1a78e72710d4fbb066ca7e1a3b09829c30a14f4a4002046b0c209ef22070a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809223, "uuid": "a32722b6-5e99-43cb-8a10-fb7477af95e0", "comment": "Malware payload", "value": "015a0e9a27325c46e678db85de5d41f30f17b031", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809223, "uuid": "55038de0-5a81-42ea-bb23-15215f3558c5", "comment": "Malware payload", "value": "af56638a8421091334b00b91c4e0f5960678b3a9995b92c38f0fe0c329d69c2ea180616fd1dbfdd0e39df183a213c788", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809223, "uuid": "af578398-9a91-4853-b043-db2b584e9158", "value": "T1585618C1E991D24AC63D6D31EFD6EFD8E3672E315C885A4AC9C8F33E1DB214580B59A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809223, "uuid": "acc6d230-79e0-4e9c-941f-25a041952f3d", "value": "49152:MuW1oH4TsOtnGWAXD/VgTHgDiBvPF+8jPhnGP80Hxwt5E+:MuW1oH4Tht50D9vyCRwjE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809223, "uuid": "3939f05b-7ee3-49f3-8b83-fe1118284180", "value": 6422712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809223, "uuid": "a8beb8bc-b2f1-47cb-ac0f-0c1a5208adb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809223, "uuid": "fe0ee98c-32c8-43a9-bf6d-bf25a2190145", "value": "h2stream.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5af23bc-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808458, "uuid": "018f1f73-eda9-4539-8335-94933efbe48c", "comment": "Malware payload", "value": "791f9f22ecfa3a9b8378a70506d34fcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808458, "uuid": "13c8262d-c999-45a3-8a29-7c7096ad5931", "comment": "Malware payload", "value": "995b11fcf3b13fdaf004c73dfc135207f75abbd5bd34258fd5aaf356be848077", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808458, "uuid": "a0795023-e104-485d-97a5-178528ce8194", "comment": "Malware payload", "value": "97d6c9637dc64b5d55b340a15c6850368f97513b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808458, "uuid": "4cace915-a1c4-494d-92af-3f641f9ea5c5", "comment": "Malware payload", "value": "e2962858c19d704a60a4a3007f9beb18894ec34b9c482817567138d3251114335c761a4b77ac8ba006b8755fc3e8fc85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808458, "uuid": "b68f40bf-2660-4001-8706-504510a0348b", "value": "T13B55DE06F8809F62C5D12976F65F8268731747B9D3EB720699189B343BE786F0F3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808458, "uuid": "49c05bbf-fc43-4da8-8942-5f82fa7c8dfc", "value": "24576:6z/qLvfxB+6qHxWiOeiJnaGYTAlt2TuY0HYF414/bj+eNsnnO30VGZW4jiV:6kfxB+bxWitGYlTz/F414/btYnTYQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808458, "uuid": "cc410cf4-0f51-4658-b149-1ef66c7fcdb9", "value": 1325139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808458, "uuid": "eeb8b782-35ed-4c6e-ae5c-208e180ad596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808458, "uuid": "bbb66084-cec8-47e9-9ede-a298f5bc38d5", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420383df-3da6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776791970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776791970, "uuid": "3deaf2c6-f3d6-4909-a66a-8b41a5267fdc", "comment": "Malware payload (RemcosRAT)", "value": "2f2af338af1887f035c7dd3d9fb6dc4c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776791970, "uuid": "d2e87e85-99ae-4691-ba0c-10269198ae2e", "comment": "Malware payload (RemcosRAT)", "value": "99e1e256c872e4db55d3f4d9604a1d4d2e7b4fe89ec4874c40cc84ee8ead088f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776791970, "uuid": "62cfbccd-aceb-4c86-ab64-c6c2242e9695", "comment": "Malware payload (RemcosRAT)", "value": "12fb23d6d9fbb1ac5995f236ab17168aed61d065", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776791970, "uuid": "995cfa5d-6620-472d-9f99-54c284c8f677", "comment": "Malware payload (RemcosRAT)", "value": "1ad1da486bb71ab59c6e64099a600d81e60917ccc32aa22015f4b1fba9682398a7621e361b0a508ffcaeec293831dda7", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776791970, "uuid": "cb7f20ce-caaf-45ee-8cb2-f2375eb7e9a8", "value": "T1D325E036F94489CFC427C2B07A12DC510B0EAE56B768ABD2342E7B667773E5DDA83041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776791970, "uuid": "00083e1b-72d7-4e2e-8741-f7590c509dd9", "value": "24576:O9rVcBeAK3odlW9rVcBeAK3odl2cLmviWd:OhVUnMhVUnVSvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776791970, "uuid": "a72cbafb-3fda-4190-a025-337761a22922", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776791970, "uuid": "6520b194-6208-4057-ac7a-c3bf77ca7841", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776791970, "uuid": "87584215-bda3-40af-9ff6-1f15a78b2dbb", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.12631.18103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d4dbe2-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806331, "uuid": "ebf7f8bb-cfd7-4e1e-91b7-a5399eff47ca", "comment": "Malware payload (Mirai)", "value": "70010d770691de296ec4e7e106a7ecc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806331, "uuid": "f26513d0-931b-4330-8e4f-c54fe8b6d203", "comment": "Malware payload (Mirai)", "value": "9a1241a79e889b38b7a00c89e3e23894a07dbe6c1a5d3bb85109025207f279b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806331, "uuid": "8ed7096d-ce15-4530-abfa-0120d250e4ed", "comment": "Malware payload (Mirai)", "value": "9fbf42a92813f7f192b917787f26c2bc3104cdf2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806331, "uuid": "8bb04613-a63d-4c4e-8b7b-f2529d66e77b", "comment": "Malware payload (Mirai)", "value": "e3a8a77e9bac1f2e9ccd9d7b7177e58d22c8acf31ade9015b71d0d9ed16fd14a05745560ef92f58e14322086ce269697", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806331, "uuid": "cbec2d55-8ca6-4925-98e8-64bf2acfb95b", "value": "T19A03F14EF2A4E95BC3FE5C3CC24E02896E4631C03326EB581B041E6DAA26957F48E1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806331, "uuid": "333d82b5-f281-446a-a4f6-c34d8ba911d0", "value": "768:72MoE/SqQA5UtdcptahIVgXaNp/T8V3eoTaFkUvWm:WE/S9AetCyYgqNp4leRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806331, "uuid": "1a3d764d-9d71-4e7a-8649-6fef9742f55a", "value": 38776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806331, "uuid": "f8684cd8-73f8-4ee0-9a34-870e993e52b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806331, "uuid": "8d947dec-665a-4052-8e31-97a1a4990331", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd30427-3d62-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776762704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762704, "uuid": "092a2135-912d-4ba6-acad-8c3be971b7a2", "comment": "Malware payload", "value": "745f58060f00f2937664434e08778c0d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762704, "uuid": "f3266af7-0c27-49b2-bb0b-79bba5cc1d86", "comment": "Malware payload", "value": "9c2d73bcb3739fb1dfa99b7ae74b28c779f533d7d768c63642b2ac678703d1f7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762704, "uuid": "0dceabea-2884-427e-b7b9-11629d30ab12", "comment": "Malware payload", "value": "db33780cb157d739c11f3e549a7f61dbc949ebcf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762704, "uuid": "d4c29507-b218-48af-ad3a-ba50912768c9", "comment": "Malware payload", "value": "84266be6ef17548e00c8c2f887eb1e70ede2fe159103eab9fcb1cca8e54f3910d474a2d06f648a1f524e69ad2c30f183", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762704, "uuid": "842a3a2e-7886-4c24-8bac-4be9f1066069", "value": "T197245B2811F38449A5A3CA192FEDE879CA77B705049C317F4648567B4F92B20CD3A7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762704, "uuid": "4ccd72e0-b39b-453c-bb5c-8eb1da096b6e", "value": "6144:gvleNi3KqKsV/gUlvxvY62JF+EnXsNc4MGZRJCZ:g4NyKqKsV//pjqEEn8z7ZRJCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776762704, "uuid": "9daca1c7-791b-49d6-9574-92231e540d3a", "value": 222306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776762704, "uuid": "162b5302-2986-42c4-a5d2-0b67135ac828", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762704, "uuid": "28438c58-4c6e-4c08-b03a-da2702dad5ae", "value": "Green Riyadh Uraija-PR.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d06897e-3db5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776798431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798431, "uuid": "ebc8a95e-09b2-4e80-88f7-a6d36084cc51", "comment": "Malware payload (RemcosRAT)", "value": "51f202dd375c45d1e52a71c494bcaef3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798431, "uuid": "d4fc8d31-e180-4973-892a-72e4e09c287e", "comment": "Malware payload (RemcosRAT)", "value": "9c371a6e57055ead473161576b242a9b71e0d209119cdbcff7814dca2ca894c8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798431, "uuid": "e09b1804-6a1d-4b69-95b8-29a14e1b2ddf", "comment": "Malware payload (RemcosRAT)", "value": "72abb102453e44d3308ea9af84b67c6b1f3ec713", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798431, "uuid": "2b448572-8f0f-4fe8-b40d-c6e3a6a38a08", "comment": "Malware payload (RemcosRAT)", "value": "ed5b0d8dd3368fbd676e13ee6291d02aa8e62139cfe78ccf341dd630f3f5db931cc937a574951b3e3b9d8d6fb3886491", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798431, "uuid": "25829ab2-5d21-473c-91ee-ccf574e318b2", "value": "T1A9E5021589C47FB8CFAC161D50FE160EA3E08A8A5016698DFF63BD46BFB7A00521B1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798431, "uuid": "f821fa12-b5ea-4239-adfb-4a6042833774", "value": "24576:0aDrxf+YOO25a/YJzMVXmYxgNwDHBRqljJo1BZfnes1yBm3fhff6PsFaz3WgV56I:H0o/98Mf7N/3ZX9gb6Ut0ypH4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776798431, "uuid": "9361237d-d80d-4781-8dbc-d3f5b419324b", "value": 3133753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776798431, "uuid": "a44d79f4-7a50-4938-bb72-31e5c19aaeb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798431, "uuid": "220090dd-8969-408d-a9b0-4c7639079b69", "value": "RFQ_PRODUCT_LIST_7863278674857615247851782547127854163757125478124523.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9cba99-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776733467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733467, "uuid": "76c52829-1cfa-4014-a40e-b47acbf1566f", "comment": "Malware payload (Gafgyt)", "value": "17504687f9f9e24315510963d3fadac5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733467, "uuid": "47d56a56-3f10-4118-9259-4d0b6b2d2086", "comment": "Malware payload (Gafgyt)", "value": "9c8227163b1b2803dd8013487f4cf7ab596332b39186bd58c9e8bab7bc562458", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733467, "uuid": "6c1e9b9d-44f4-4c24-a0ce-ac4454fbc01b", "comment": "Malware payload (Gafgyt)", "value": "0042f80b2dbd3cc96dbcf888e3056f4fbd6338d2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733467, "uuid": "b30ab431-aaea-475c-a89a-0fdf3f530837", "comment": "Malware payload (Gafgyt)", "value": "1e18d42eaf0e3e1d8b01d61a0c3982b4fd6ad4b273a5a4ddf8f65b3cd6527458a8553080c06862330fac755e5f1927ed", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733467, "uuid": "d2ce39aa-6950-400c-8bf2-e1db840444ab", "value": "T105A33A377B130E23C0CA947211E31731BBB5D2DA39FA5243B9A16DE86F266843562FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733467, "uuid": "15af5a5a-5b2d-475f-9524-1966c4d0082a", "value": "1536:XBJ2MNM5oqtkUtnsphaK6igkvmQmF6OXj6ufeuTe:KMN8vephaK62vmQmF6OXGufhTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733467, "uuid": "77bfea35-930f-45df-8abd-6fba444c76ba", "value": 101398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733467, "uuid": "cd35f314-df84-4418-9c04-af7b38a0b81d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733467, "uuid": "508c0d18-2fbc-4f97-9dc2-e16110af5640", "value": "assailant.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5a4251-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776733470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733470, "uuid": "bb060473-73e8-4503-b044-e1a3f88237a7", "comment": "Malware payload (Gafgyt)", "value": "b29d1d73e3e30e485715e812af211e0a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733470, "uuid": "f0d0cc11-4109-4c78-9358-f118da9d9a9d", "comment": "Malware payload (Gafgyt)", "value": "9df8f7d55a3194764db3cbe5314bc9624e838b766a85e57f7c9d6ed858e1eb68", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733470, "uuid": "e4633482-6c52-4fdb-81cf-70cf75489e28", "comment": "Malware payload (Gafgyt)", "value": "42280a40ba73300ca143cd0026c96417bd2a0ee9", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733470, "uuid": "1e95b5f1-b2b9-4888-8068-acd110661632", "comment": "Malware payload (Gafgyt)", "value": "0ea8c99ef8cfcf64093a9b39fd0b018448218f4e2a4646eb506864e74c4538d1e1ddcb0c79cb0d3cfb15f91d4e01e595", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733470, "uuid": "257c1a30-4ca2-4d59-92e7-9e29dc4ced3d", "value": "T126931957B800EE67F04A973604D74B117630FBF60E832662B3277965AE722D63827F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733470, "uuid": "17b0de34-4843-4ea2-bacf-8c4c42a4c717", "value": "1536:1dnE88zmf0TzWzHSB8Deu0WkSzZUyMGl7yDKwJ3Rdt7g4w62IcGOmQmV6qDj6uff:1dnEZmfPzye6gUyMGFyDKwJ33t7g82Ix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733470, "uuid": "5ff4a814-840a-4efd-8eb6-479fb3e15848", "value": 95618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733470, "uuid": "f987b895-8ee5-4af2-9dd1-4f229798a7ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733470, "uuid": "f8448e10-4304-4fd1-b0f0-b7c2fd47661e", "value": "assailant.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f37d210-3d70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776768799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768799, "uuid": "8d1e7ff4-acf4-483a-905a-747c5a5af5e9", "comment": "Malware payload", "value": "bfebd41ad393b0b1aa9f405cb956f12a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768799, "uuid": "0b8b647d-d97e-43c8-b150-2af588ebb12c", "comment": "Malware payload", "value": "9ed7c746dd718b72dd9a2a1450c806c682536029b5279de305c0255d36292422", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768799, "uuid": "db94c442-29c0-4202-b09a-53269f2c4ca1", "comment": "Malware payload", "value": "20f67e6a10162abe44be415e173c877a4b6cba1e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768799, "uuid": "affa63b7-430c-45ce-a777-9f122dc70be5", "comment": "Malware payload", "value": "5d35c5835ba1b2f1a080cb244fe0e4915f7f738fa730a07877221ae1a883651c1c2a0df5e9ff00d9748a3e8353e67cd3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768799, "uuid": "75a4dd4c-a073-4351-92bd-915abc924eb7", "value": "T1DAF24AA16CC721CDF33B5FB193DABDBE4985E0B4390EB2B02141764053A5983DEA2B75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768799, "uuid": "ec6131b2-6738-4421-ba1e-4d4c55257bee", "value": "768:BMfYp/XHK4crx5JxTcKNusFsOf5KfKnE5EYluG4D1QcrXih3:6IFORkIskG4D2cryh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776768799, "uuid": "8e932ca1-67d8-4a75-a79d-532c4f042b2d", "value": 34958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776768799, "uuid": "a222d487-7982-4dd0-9de2-862f558e8267", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768799, "uuid": "8e6744af-e642-40c9-9590-094da38c8a7a", "value": "stove1.jfif.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f71d444-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776774947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774947, "uuid": "ca3b57b6-5eba-4c4c-b2ed-8eb2e0eab6f0", "comment": "Malware payload (WeedHack)", "value": "a30c841d71f2326e448f56a4131bdb06", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774947, "uuid": "bba68bb3-24ce-4a4a-a9e0-d263214a0d25", "comment": "Malware payload (WeedHack)", "value": "9f192e00de4d21fe105e833eb5c4660c136a77cd33c149a29ab935b7d61bb890", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774947, "uuid": "5767ce10-666e-4421-9986-16a08fc8f25a", "comment": "Malware payload (WeedHack)", "value": "e67e7261d66348b8519a1650d5fd77c2678af1f7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774947, "uuid": "a666a48e-b911-4edb-8cfb-0cc8aeb1b596", "comment": "Malware payload (WeedHack)", "value": "915ccf17b5dd6e5d52e3300a1c7c7db37e233a568c98f28c81980b67a65d39ad84e893940109f18621aaedfa6f600075", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774947, "uuid": "1b754578-cf57-4335-a5e6-41e049c4019b", "value": "T1F374239B0B2C9253EC0234ABE388C9D55D7F1E8D9E5792B764A34043A092F5F1FC49A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774947, "uuid": "c4ae1f30-2fcb-4ea1-9468-2b1f9ef0fc74", "value": "6144:OOg6CePYLwxu+uSg3OB+i9j+zf4jSyHPu8uq2TtiVoQavlLnmIzogF0TyZXCg3bC:OOljPtu+Jg8D9uf4Oyvu8SJ4Av1mI6Tf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776774947, "uuid": "5b13ab2b-70e2-4418-9469-64913a975429", "value": 363769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776774947, "uuid": "b786f208-bb52-4a19-9d6b-a34a7bfacbd8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774947, "uuid": "df3b70e2-4bce-4e79-9b7c-fa534a2610b6", "value": "9f192e00de4d21fe105e833eb5c4660c136a77cd33c149a29ab935b7d61bb890.file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd579aa-3d79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776772797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772797, "uuid": "ffe98fdc-1f85-4886-b187-9e915a2627b5", "comment": "Malware payload", "value": "ebb11957776d4f77ded02f7e0bbed654", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772797, "uuid": "0b6c99fe-3ca6-42da-a8a5-dbcc922d77b3", "comment": "Malware payload", "value": "9f19f7786086d3fa618819a7f6c0d8bf18ec8a84b153bf5c688fb02b740092b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772797, "uuid": "31de218a-f20a-4b29-8a1d-ac1e0391a81e", "comment": "Malware payload", "value": "874b70112258198a3eb5a339f9dd0f4ed4020308", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772797, "uuid": "32c5cb1a-e542-4769-a3d5-63cd2a116343", "comment": "Malware payload", "value": "5e525cc15052a23df54a6dcc710ad92e57dca24acb9d9011b9dfe16e267b0b342439cf9864e6122b5b687a7068a91ce1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772797, "uuid": "6270b290-b002-445b-b4e7-f4231fcd5cef", "value": "T14E34EA9C678E70CD527A7E7766237441A63A98C1B50C8078FAE7758FFCB432A809ED14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772797, "uuid": "7b28a95b-0b08-498e-a382-939f2273ab20", "value": "6144:ObqmCeVN8ZahhS147CJQwDV26Jb5k/6kqoIB0eE51d8uJf5:ObqmVVN8ZahhS147CJQwDV26Jb5k/6kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776772797, "uuid": "d70f3546-903e-4c35-acab-f2a2c13449c0", "value": 243211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776772797, "uuid": "6645dcdd-51a2-4433-9988-1e5aafad0582", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772797, "uuid": "d0d735c6-6420-4bd4-bb8b-7f882bf3a75a", "value": "9f19f7786086d3fa618819a7f6c0d8bf18ec8a84b153bf5c688fb02b740092b4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961c22e9-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806285, "uuid": "2fd4d7f3-7ed1-4041-9b85-63e27459822a", "comment": "Malware payload (Mirai)", "value": "9c77f01171eff53d1daef84fa0f5b607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806285, "uuid": "e424ab8d-0cc1-40f6-a73d-6351a0500cd8", "comment": "Malware payload (Mirai)", "value": "9f9d9888106c0e98b2914ec4ca274c2dd54ff321f8148abed1d9dc7b18cf07cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806285, "uuid": "95ab7225-e1ca-48a1-abf5-e954b682d47b", "comment": "Malware payload (Mirai)", "value": "a68c8fad2bf14ff801fa2342a8b73c47320210be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806285, "uuid": "22c42a2e-be63-4eb1-9779-403c8e47f5e7", "comment": "Malware payload (Mirai)", "value": "3838dd92bea164dce5e3dbb974707f089e00d96156d11ed1d998a81dec8b66677f2cdcef1d5fdb25defa02f8b4d64b88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806285, "uuid": "86624890-8edd-4eb9-8aed-7675f98dfe08", "value": "T197B3ADEBF64715A2C85243F013C79F8E3E232290AE57A4E76D1E177B19790CB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806285, "uuid": "9bea9ddd-40af-4e84-b340-87ddce69668f", "value": "1536:NnQq8UA1GLckzizaliGTx6VCNbsp/xJ6bngHa/LW5:BQqJfckezRE0VkspWngHaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806285, "uuid": "0ac4240c-c085-4e4d-9f57-c1230129a491", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806285, "uuid": "38bf5203-b4b3-4dd4-81d7-2c32cfc89238", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806285, "uuid": "fbe190a5-56c3-47a0-92b6-9b2fa0741f13", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bb1a71-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776802016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802016, "uuid": "06a15d6d-1a55-41f8-ba34-e67eba5644cb", "comment": "Malware payload (WeedHack)", "value": "d96c3ded0f127dc9cf3cef0eb85d533b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802016, "uuid": "f91aa1a3-cba0-4404-a974-5d703e01f4bb", "comment": "Malware payload (WeedHack)", "value": "a077c47cc41b86e2bb6869351a2babc947ab05ae45be55636fd856da007aa009", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802016, "uuid": "6cc94e72-a695-4315-9425-989ef1da02fe", "comment": "Malware payload (WeedHack)", "value": "0560cbd372b5066fd55c29eb4c6d4fff8108c154", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802016, "uuid": "2149a077-17d4-4d3d-af6c-8526bb80335e", "comment": "Malware payload (WeedHack)", "value": "10d7fcde32b55f1c5a5863805693dc7807b81d520986e4e45b2bc8bc56f0fcefecc0ca4a36346016f0b6ff103012d4d8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802016, "uuid": "ae1435d7-e606-42bc-8694-d99ca202218e", "value": "T18D4533FE74E30225796271C66C61AC37F099EB649A9AC65341F10C331E29AEDCC62D37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802016, "uuid": "3f6f8b74-7059-4cdf-845d-d3a511a3f2c1", "value": "24576:pG8DbWR0L0NxeXGL92pfMkPJvHg4Z7wxHt+NYzQRYdrJI64RdLHERFG:p7HYNYe4Z7gHt+KzQC9InRdDos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776802016, "uuid": "b8edb330-c316-4085-bbf5-e8fb28118405", "value": 1193400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776802016, "uuid": "98d8e9d3-6a27-4a47-bfec-d0a2f72a74cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802016, "uuid": "01c2a9ee-2608-456c-90f6-12b76c542ccc", "value": "Phantom_Client-1.0.3.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12812e16-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776733479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733479, "uuid": "8ae55cb9-bed3-498f-b9f6-d22a234cc88f", "comment": "Malware payload (Gafgyt)", "value": "5de21bec814d435f3938f3f1614e9466", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733479, "uuid": "b01c95e0-3821-4505-98c2-301a6c026bfe", "comment": "Malware payload (Gafgyt)", "value": "a105a6a8a5f3b949b8268ab62c6f90f42bb4d00608f6b786f9bf82eba391ab32", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733479, "uuid": "4d054f6d-d6e0-4d91-897d-118560ad881e", "comment": "Malware payload (Gafgyt)", "value": "ab575608d6d6d67fa2efb2d20d602b717ec02856", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733479, "uuid": "1fb4ef62-27ad-48ee-b76e-7d2785f3b45a", "comment": "Malware payload (Gafgyt)", "value": "9c46e4394fe70a6e50ce197eb6868507c5f4ac14d28a2624f11e77e3badfadb998d483d55d404e4322d7a8d1173ce19d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733479, "uuid": "6e539176-0d1d-4d27-8e21-79b75aeda738", "value": "T1FF933B17A652C57BC08762F41BDB9A11AC13BCBD0B63A30673D4BCE82B159D72DA9F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733479, "uuid": "94b7fe13-08ea-4d85-bc0e-b8b9b1cc1010", "value": "1536:W7WREyqkQc923v2uNi7pNF+BoD3Ophanvn00/FmoI5um2Xj5YZA0e:4RkQT3v9EbYBo7Ophanvn00dmr5um2Xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733479, "uuid": "cf2a7124-b921-45f5-a2f4-18c8e0fa416b", "value": 92932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733479, "uuid": "27ddb5fb-657e-4f05-8073-700e01139d59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733479, "uuid": "10268407-e0c6-4772-819c-9e281f8c514a", "value": "assailant.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16acb02-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775085, "uuid": "52447c82-6f84-443a-853f-ce2ced05e023", "comment": "Malware payload (WeedHack)", "value": "8cea4cadc6610e2fd43d83771d4b662a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775085, "uuid": "7945a2d4-472d-45a5-82b2-0360ed47cc40", "comment": "Malware payload (WeedHack)", "value": "a189fda777e31808e6f630861e7331096d8dd556be5004efa66ace0dacd2e50f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775085, "uuid": "64bcb95e-409d-49b7-9544-55759e5f5fb6", "comment": "Malware payload (WeedHack)", "value": "6afa3e8c132786de00ff889ec8b8eaac00ff78e2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775085, "uuid": "8a9f1e81-7cc3-45c9-8740-9267acd46b7f", "comment": "Malware payload (WeedHack)", "value": "762e71a8f8cd693fe5da41eefd0a9801369142bffd3e87543ed3ffd8b62d685dbfbf2149e34cdfb1cfeb84c83e03a705", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775085, "uuid": "84f479c0-8efd-48f3-9375-e371b9411e8d", "value": "T19FB2D13371695932F946C472068EBF781F8F12D231876E5118B6829F077FACE4B6DA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775085, "uuid": "83d5955b-6c9c-4d56-82c7-14424ab7830f", "value": "384:A3w9gntOjBnECP2k4CryDHm30lhgsM4em2N1pv1Jik/2hsqdvKlRZ+K3h5zMV:q9ns9cCryD0eM4eNzvmhPvKlRlRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775085, "uuid": "b5db5f31-265f-42bf-99e1-2c424fee7d23", "value": 25650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775085, "uuid": "65a715a5-c38c-4e32-8001-fcd2a31ab679", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775085, "uuid": "6deff11e-365d-4746-808e-3378f6fd8c92", "value": "GrimClientPaid-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4525771-3d75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776771117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771117, "uuid": "82b8ee23-e738-4efe-be79-2587da5bf386", "comment": "Malware payload", "value": "27741557424edae928f8bbcbf322f005", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771117, "uuid": "21f271d6-a581-460e-8af9-cfbf0d5481bb", "comment": "Malware payload", "value": "a1e770aac14e1a11685bd2ef19c6055b2cce69d7bebca8ab40165a61154579a7", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771117, "uuid": "be818a1e-4b20-4a98-b043-9d7299c80085", "comment": "Malware payload", "value": "1e7aa7e1836e45d587169a9ac4511dd776e968f4", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771117, "uuid": "654a25d9-3a05-4e37-ae9c-b1f1535609bf", "comment": "Malware payload", "value": "c19f9dde0b6df07dced70a5e5393c53b2b08742e091a33158bc3c67cc730b641959adbf064b94aca58604d18a1f02602", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771117, "uuid": "9a91828e-b072-4ba7-a83c-f8582d0a0654", "value": "T1FD64231B9F24FD6D8F19E36C20EB970901648A17CB0B3EE5749DD0476F668F09B634A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771117, "uuid": "1ca7c270-f4e0-4d57-a4f2-3478dec98059", "value": "6144:hC6yFusH4SMIEV7Aq9OUZmM/LxIonq2MutpH4lDIfZy50IX:w7sS4yEV7loUUMlHq2MGfZyCIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776771117, "uuid": "35e51c75-138e-4f3d-b919-18777c432330", "value": 328888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776771117, "uuid": "b1fa1189-635c-477c-8457-8b09d5eed932", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771117, "uuid": "79dbb9e6-06cc-4ebe-b723-70c5b4a2dbee", "value": "a1e770aac14e1a11685bd2ef19c6055b2cce69d7bebca8ab40165a61154579a7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5340b3da-3dc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776804884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804884, "uuid": "5a90072d-752f-46b0-9477-b0aad2767a99", "comment": "Malware payload", "value": "2178d1cc7bba1c616509ef1abcf6a3c1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804884, "uuid": "fb28a93b-c2f1-4739-b4f5-55b15ac065be", "comment": "Malware payload", "value": "a1e96a96f484d457667657e8189cf96be273030800ca1beebdfd8a4335ce4ff0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804884, "uuid": "ce578cf6-bf18-4431-8ede-da6283d6ccb7", "comment": "Malware payload", "value": "4cca26ba8ffc2e56162ad2bbd9351e16a40e45bd", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776804884, "uuid": "1df28a19-15d3-4746-93cb-929540c69821", "comment": "Malware payload", "value": "43061f1392d952c4764d635b5dc5576889353efdf13ad9c41115a6dd11b0655a33ab7fda354f74c8f0ca9f8f16a76bb3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804884, "uuid": "f70d9181-6830-49dc-a3c8-e5a9cb7fd59b", "value": "T11731DC251FD61826D2F18C7A965FF3028B043643DA534F3E84E0D14868E0A1ABE3AE5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804884, "uuid": "c930f2db-5af1-40e5-b50f-27ee90bf7ca7", "value": "24:81dfJeJUq0+5d0/LXRrJB6G1j884668xlQnAY/VcyZdTm6:8bQJj29JNDentVcMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776804884, "uuid": "09b3c854-6a4d-4d7b-9f72-efd2698bcb0e", "value": 1774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776804884, "uuid": "d23da4f6-b198-4d95-978a-e7311393de65", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776804884, "uuid": "f1e26e2d-95d2-4585-8c0a-ad80b1b35fe9", "value": "weapons_list.rtf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900478e1-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808422, "uuid": "228d23f2-b94c-41b9-a04e-e95563621d9e", "comment": "Malware payload", "value": "201a4aa29a15bb63428370828b874b44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808422, "uuid": "c018fee5-abe0-4b86-a708-b6adb901e563", "comment": "Malware payload", "value": "a28d0ec3138f9514000e64263db3a460ef5b3580256522d66d44544f50c59415", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808422, "uuid": "5c1702dd-1994-45b3-998e-1cbe8177ba5d", "comment": "Malware payload", "value": "56025113c6f154ec3d1de9250f668d0988eac414", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808422, "uuid": "4dab8d6e-36a0-43ec-83b6-0cdf8a2ac3fc", "comment": "Malware payload", "value": "0199cb0aea7d5c4daf7611f01de176125bb3fa3619ecdc5666cbacc63bb57f231f9780896d077342f585517e6c17eb3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808422, "uuid": "65b19342-5f07-4d79-a5b4-e39382e5baef", "value": "T16995E15AB2F374FDC067C030835BDB626936F47545222D7B21C4DA342E96EB01B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808422, "uuid": "95cdd78d-478b-4136-95ed-dd9b7cebbefa", "value": "49152:A19DV6Ab6AGRE+gTr88IXI6F2irjgyW10d+2ua:K9DV+RU8l1frjgJC1ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808422, "uuid": "39c0a60c-7157-4915-b861-a4f4c0da6c55", "value": 2010493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808422, "uuid": "5015f5d6-b389-47bc-9b9b-d7e4ac940913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808422, "uuid": "f26169a8-3bd0-46a8-9a3d-4e9fd01ae82b", "value": "bot.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f635374-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806273, "uuid": "eea90a1a-5f08-4c66-84c4-3ba93f0e97cf", "comment": "Malware payload (Mirai)", "value": "07f2e7af607d82544174312361da8088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806273, "uuid": "1a1dcb47-cde1-4276-ae51-95225b373212", "comment": "Malware payload (Mirai)", "value": "a2e10404778932f67daf1fceba3367bb7d9b9ebb120d019f98ad570f4825a76f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806273, "uuid": "d72b540c-4d78-4a69-b3a3-d950db211101", "comment": "Malware payload (Mirai)", "value": "6a42138aaf65b4db740264708442bf71ae9351eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806273, "uuid": "de717211-53e2-44c2-b782-a28a23bac584", "comment": "Malware payload (Mirai)", "value": "bf29bc8511a0920e39d56bb54c0ecbe3d0616dee04978b5470d3de2425b0b670fd47a58d5a0017b28a2dd7455beacb9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806273, "uuid": "d38f5ad1-efed-4ea5-9b0d-42b24a7b3ef1", "value": "T120530212A4EC5AA156F8AC75F66B0DC20A1595F8C0FDF1D246F0C534DEAF5A283B43CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806273, "uuid": "36a09a1a-15b1-4c56-ba3b-a91588a7cfff", "value": "1536:EqRaULyIfrpr6qtAHAb39LVe1k+SvL/A2pcVrHav6hv:EGQIcLu9JMkvvL/A2iVr6v6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806273, "uuid": "dfaf8bfd-0d87-48e7-8975-2b73b9648ff2", "value": 61980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806273, "uuid": "e700166f-56df-4b4c-8e88-6abd548c1bf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806273, "uuid": "feee16d5-7fd4-44f5-ae7a-12831fbd8c5a", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c805c3f-3d92-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776783505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783505, "uuid": "bb7704f1-6b97-43fe-b8ba-e4e4db0d947c", "comment": "Malware payload (Formbook)", "value": "51879457fe05b7f9f475d5b6952533d4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783505, "uuid": "9606122a-9497-4253-843f-6aa0238b448a", "comment": "Malware payload (Formbook)", "value": "a2e9ec8e6fd15f8e1879a501544361ddb39ca718591463136a768cacc056416d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783505, "uuid": "f0e8a67c-7fd2-4a15-befd-dec31ce50f12", "comment": "Malware payload (Formbook)", "value": "3be3c78b566280957ff8aed0f8b03536c20cf11b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783505, "uuid": "58ec2a88-3c14-459d-a335-29f0017bfce2", "comment": "Malware payload (Formbook)", "value": "8edf7ddc3263cb3000b41b6241999addfb32ef7de2580e5945f68c7d9e340ac13a44f8bb1f81e80f7f342c3b91980b59", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783505, "uuid": "0b77399c-6b09-4c15-9313-61e0b762e2cf", "value": "T1F662CF1145FED24CD01188E299D01683AB49422BFB9DC7DD52FA27D12FBEE2D1839C2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783505, "uuid": "95e0cca6-e0ec-4fc4-8891-5d834a2ba03f", "value": "384:jyBDzu+pKvmgELOMp7JzCKyfC7xTH+hQcWgLsKm6Qk:jgDzbYhE6oBByKFTehQcWgLsK7Qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783505, "uuid": "18aefd3f-8a5f-4bd1-83dd-1caafacca89d", "value": 14590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783505, "uuid": "61de9ee4-9487-41eb-874a-508ea02d5a4b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783505, "uuid": "411dded6-6943-4faf-bcb8-d16203dca753", "value": "Bozza dei documenti di spedizione \u2013 Conferma dell'indirizzo.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a79325-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806395, "uuid": "d6b644b2-d523-4457-80c9-7ea4d94ae795", "comment": "Malware payload (Mirai)", "value": "a1e4eae82fc77b682abf8f588bfc64ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806395, "uuid": "408a4f49-ce65-45d9-ace7-187844109a68", "comment": "Malware payload (Mirai)", "value": "a349dc00c1061a8090457c6b27465a92639054fceb3b6c96db6f82ce7b2b577f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806395, "uuid": "113d1ebd-069b-4eef-a5e8-953acb3f111c", "comment": "Malware payload (Mirai)", "value": "d53fd43293a5a9ab3de74883bead272cfe66f53a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806395, "uuid": "37d75c40-4602-4ad3-81fc-907675706fab", "comment": "Malware payload (Mirai)", "value": "ef1d54261938f8aabda40b63b49d614f940ed89558ec79cc56e0940547efb045b1e5a6d49b6c173c870b8b46a6e1c3bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806395, "uuid": "6815b8fc-c897-4c9b-9ab6-a1245864e6f1", "value": "T1F9733A56FD815B23C6C1123BF75E028D3B2653E9E2EA72039E259F2133C791B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806395, "uuid": "3be0b499-8821-4140-933b-bfcec84ee4e0", "value": "1536:+X8G83rkUIifVdd0+fKo6h6zk+XgLvpC:+X8G83nL0+iV0OpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806395, "uuid": "d0ba6f40-655f-4ff5-917e-fd43e2d2db8f", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806395, "uuid": "cf8b5bd3-a9ff-46a5-a184-dd1531fe7a40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806395, "uuid": "4df8dece-c101-4ad8-97dd-17ad9eef19f4", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96556d97-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776801990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801990, "uuid": "d8f1c734-15c4-464b-bdef-4288e42fdeb2", "comment": "Malware payload (WeedHack)", "value": "a931e3826b85987381853f36f8b5d477", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801990, "uuid": "7842168e-f9a0-42be-9f77-3b025c06a332", "comment": "Malware payload (WeedHack)", "value": "a34dc7033335278acde43d8af08be05b3c0321b2319fca17a801034742dec4ee", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801990, "uuid": "e4db7c7c-007a-4724-8df2-86b69f58bea2", "comment": "Malware payload (WeedHack)", "value": "1f407763ed530ebc92f0b82ade73f598e7395cf5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801990, "uuid": "8cccf62f-45be-4f8c-9e7e-89cfb1fc302b", "comment": "Malware payload (WeedHack)", "value": "4c5d597463edf62b2522161a5377e8deb2a791f316e7ce109e30d7db193bbdf9473522d0b78989b8bcbc47361c3be214", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801990, "uuid": "72837d06-642d-414d-a486-70a4c9d715d5", "value": "T1D64423F310A45E56C04B6CB2D7CF243D2BD783BF1649720474E43E4847966AAD5AF628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801990, "uuid": "0aa80807-e23d-4153-8789-3c27a6dbf335", "value": "6144:EyGSv/YoaahqZikohWlIshTSmWn2ljU5xHL+0zGjAokWR:bv/thqYYjhTWtrzAjkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776801990, "uuid": "4d509c67-3e01-4db8-9ea5-532acd982593", "value": 271614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776801990, "uuid": "80922871-f508-41f9-9746-8e8c8cde5691", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801990, "uuid": "83a03958-c375-4e2c-a298-071b938857c0", "value": "Krypton-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f2b958-3d92-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776783516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783516, "uuid": "f75ca1b0-c593-4a6c-859c-c23511859aec", "comment": "Malware payload (Formbook)", "value": "9905b604d10474e5615275fa9f0701fd", "object_relation": "md5", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783516, "uuid": "ca3cf12e-55e3-43d0-964a-b21330c4bf8c", "comment": "Malware payload (Formbook)", "value": "a378d9ddfbcb133d15e59e6a7066c624b90152c38439aab5885319fc679d64db", "object_relation": "sha256", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783516, "uuid": "e10fa6a8-94c1-4ca5-a448-10feba1c9c4e", "comment": "Malware payload (Formbook)", "value": "719c0439ac7c18fe8679828a3fba5f2fbcf03f17", "object_relation": "sha1", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783516, "uuid": "1aae0737-e238-44dc-b35e-6ce8a41eddfd", "comment": "Malware payload (Formbook)", "value": "00334a137e43f5d315973d7c1d2faa906b1d2decb5e5fc34d8639f2c11b0f5eafe11ab2c826afca5435dee303a754e5d", "object_relation": "sha3-384", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783516, "uuid": "df1a9e1f-28c2-402e-8ac6-58e1ff1803fc", "value": "T14BF261C83BC7B5A21E4230FB382B7052F53E8D80650D4454F6E891BDB968769D5BEB38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783516, "uuid": "8d06cb56-47d7-46f1-b38b-d93449939b73", "value": "768:eB62ZJgG5HOs5DUM/lSz8gJ7sjKN1YxMInOJ8aIFZ2n:eQpG5HOs5gRzXJ7uKWMRJ8aIf2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783516, "uuid": "aab471cd-22fa-4ad2-8a87-7f3271114bf3", "value": 36169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783516, "uuid": "e08464b2-6fa4-44ae-9366-12e5ac0c2122", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783516, "uuid": "58868d11-ab29-4778-b4da-6ca57839bc03", "value": "Bozza dei documenti di spedizione \u2013 Conferma dell'indirizzo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2537e1fb-3d85-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776777748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776777748, "uuid": "a965d180-a287-445d-bd48-d16c34f2c30c", "comment": "Malware payload (Formbook)", "value": "d38f8a088ce46cc72475e423d36f827a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776777748, "uuid": "314061b8-9e31-4813-b7fe-7555b5909774", "comment": "Malware payload (Formbook)", "value": "a4ca575207a3457bf0aee272ca372adabca987f5d093889f23f6daeabf42f0e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776777748, "uuid": "a55d49a4-4d55-4ca3-b90d-27db83dc9b83", "comment": "Malware payload (Formbook)", "value": "c8b88608664b55184283f227aaa6f770149796db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776777748, "uuid": "2b2a07bf-4797-4a10-9e95-afcc41e6a6e1", "comment": "Malware payload (Formbook)", "value": "e2b2adf7fd8d82f5375a8c1b523920b2e71360ac84abc210c48f46671223e550352d3971359c4c56ecd310b91a5de7cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776777748, "uuid": "7029a30d-8e1b-484e-90c1-0b525e0841b0", "value": "T17715D0C56E832B99C33D5BF8C2624446B3F08913E397CB5B6ECD01E5AA577D9CA03852", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776777748, "uuid": "15b689ca-9fa7-4e50-b4c9-a5f6d7ad4617", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776777748, "uuid": "466b2c81-a3a0-4e69-a829-86032273eef1", "value": "12288:MTOpSSOWM578/fCvQYFFlCUsh7ytgfBKd+1EhVEvgKV5+evewK0NbJFUdOrN6:kOpSz6CIYFFTdgfA+K/8vJtZJ2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776777748, "uuid": "6548cc94-69ad-42c5-ac42-920f0bc4ca78", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776777748, "uuid": "3e56f46a-fe67-49c9-8438-552cc57f331c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776777748, "uuid": "1557cd14-d782-4899-a7a2-5af74dc856f1", "value": "TT COPY 8410122904 AND STATEMENT OF ACCOUNT FOR APRIL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0603cb43-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1776733458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733458, "uuid": "d63c7eab-c89d-4231-8837-e8d7bebc30d7", "comment": "Malware payload (Hajime)", "value": "953be36e4224e5b4a2413872ceb0394c", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733458, "uuid": "129992b9-7000-405b-8869-a3a8ab4f793e", "comment": "Malware payload (Hajime)", "value": "a5a22c8e51f0d2a7d06439660762372669f7b4f62a2e541f34effaa1d9c6db7c", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733458, "uuid": "95124c9b-7f9c-4f1b-9ad5-3c8a512c4601", "comment": "Malware payload (Hajime)", "value": "9a72dc006137344bef0d48a1ad89a24bf5fba715", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733458, "uuid": "3c335171-1208-4e37-93f4-733f57bee284", "comment": "Malware payload (Hajime)", "value": "dd8efca2f5b3c19e22629ee19fadf03be96500875f32c23b3026edd580815ccff09cb55a6f14782766f3ee376329a5a8", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733458, "uuid": "faf669ba-fc76-4fa6-aa05-dc651aa85bc5", "value": "T1FB7302E017B5178C1372E8353AED205E9128323972AE35602D97528EF947603A6B6DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733458, "uuid": "441a0f2f-2b2c-46fb-addd-5816c533f56d", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBs:8D+CAXFYQChaAUk5ljnQssC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733458, "uuid": "393ed17a-860e-4d7c-9264-6d87748d5ef4", "value": 78592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733458, "uuid": "76f0bdcc-099d-4244-bd64-90bfe23c2494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733458, "uuid": "208b45c3-a034-4e5c-8fe8-6bd1947cb9cc", "value": "config", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecdc4aa-3dbe-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776802300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802300, "uuid": "3f94effd-b60a-41d8-b144-fe03b3baf333", "comment": "Malware payload (WeedHack)", "value": "247ffa6576113fee86ded19ccef6a5d1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802300, "uuid": "7000a638-aa65-4d8b-a70f-d2854719a3de", "comment": "Malware payload (WeedHack)", "value": "a5a289667820ecabcaea29cc308eb0d6623226da001b93fda8ab112c4712bf1e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802300, "uuid": "efe204c7-071d-4ff1-8aff-ef1552b8f51f", "comment": "Malware payload (WeedHack)", "value": "23370cb0f8ab4fc4ef87da2ccf62cd7073357975", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802300, "uuid": "3d65ec70-c893-4ac0-bcf4-d2a611404535", "comment": "Malware payload (WeedHack)", "value": "3d7ba26a95763461260cb7e9e70c28e72dd2f6285d5e0b9347d30d1a57efdc457e0d93cfb6408108b2dd3f7f93f961d2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802300, "uuid": "00e74fd5-948f-4615-a694-508ccae6b9ab", "value": "T1B985F162A15D8671F7D3A7F2D0D01A133E3FC1CCBA8A6A5F24E49E4721A34F79325606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802300, "uuid": "96be9782-2c77-44bf-bbe0-c6f84c3b6d59", "value": "24576:hW0N0ys/b0rrHuBgCgua4mNLGTvmhTLzaPgZzQSn+qp1NnchbO80Pyff+:NN9sQrrObguPqTLOIZzJnFZcA80P6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776802300, "uuid": "d2a62be2-fc56-474d-850c-d5e20027b11f", "value": 1838487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776802300, "uuid": "8bc002bc-26a5-4f10-8310-a2346bc6a083", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802300, "uuid": "fb3c4928-2b0d-4afc-8b27-da7520e4a6b3", "value": "MaLiLib-0.27.7.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a9c106-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776733464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733464, "uuid": "16271f63-f206-456a-842d-e3c993ba0e6b", "comment": "Malware payload (Mirai)", "value": "285092546cc9d0aec50134871441da5e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733464, "uuid": "e6bec444-40dd-46f6-b603-de967a51a590", "comment": "Malware payload (Mirai)", "value": "a692239c989144b0148e29dbbfa3c55a43f1b2659aa42630225760a8c6d88b3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733464, "uuid": "85bcd3f8-9624-4eb5-83a3-ba96f9e5ff70", "comment": "Malware payload (Mirai)", "value": "af236fc654cd5b2983668c7fdd4caaa6506e689d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733464, "uuid": "b69461a2-73bc-4557-a68e-14d1cff7cf6d", "comment": "Malware payload (Mirai)", "value": "8d2d65646c445313dc4871d31e79130899ed4274395d9ecf55ab31c0e3e51f3bfe9c23f5a9ba358b8988510e72fc147d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733464, "uuid": "b1e78584-1eae-4132-888c-bbebd9a03b91", "value": "T129B3C96A3A21AFFFD06986310BF7AF2087D522D626915383F15CD7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733464, "uuid": "997c1c7b-3a08-4c62-a1ba-0d195b575afc", "value": "3072:ZyuJSwJH3Zh5hZMPaW6HxmkizF9GhsRiAe:Quciph5hZMPixmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733464, "uuid": "390e62bc-9fae-47bd-aa68-eb3885269dfd", "value": 115259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733464, "uuid": "69ebde3a-ee45-4e72-a222-c2c4b028ec35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733464, "uuid": "a0c2802d-caea-4c04-922c-a6ac0e5562ef", "value": "assailant.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f3a3b0-3dbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776802583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802583, "uuid": "9496a502-dd7e-4021-b6f4-d0ef9dce74cc", "comment": "Malware payload", "value": "1d7421e61e7a4cc3772af70debc7a5b2", "object_relation": "md5", "Tag": [ { "name": "crepectl", "colour": "#4C2929", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "Fiber", "colour": "#8ED852", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802583, "uuid": "487fc966-53b5-4b46-ab42-216bda7af4ee", "comment": "Malware payload", "value": "a6c4948ec670f6562d7007c3a6f1ec2b030a1dce6450f193b02f1fdac35b0bcb", "object_relation": "sha256", "Tag": [ { "name": "crepectl", "colour": "#4C2929", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "Fiber", "colour": "#8ED852", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802583, "uuid": "5d5c4f44-965b-477d-97cc-c44d0e4b9dda", "comment": "Malware payload", "value": "89aeeac77c265d0d491d9c56329042896bf011e3", "object_relation": "sha1", "Tag": [ { "name": "crepectl", "colour": "#4C2929", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "Fiber", "colour": "#8ED852", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802583, "uuid": "50ca0902-eabc-4e46-978d-e36aa33ad00b", "comment": "Malware payload", "value": "19a8c76a0976f7db02bbbb1f98d8eedd6eb56245098534f94f2c925fbea5b15f35059f5a29671124e0d0bddc92fcff35", "object_relation": "sha3-384", "Tag": [ { "name": "crepectl", "colour": "#4C2929", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "Fiber", "colour": "#8ED852", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802583, "uuid": "5ae0fd20-716f-4118-b78e-f4a44960b872", "value": "T16467334583F21C0E235BD61DFB89FA5AB4C17A6AD02308DCE55279C17EDA74292C8FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802583, "uuid": "6e59d95c-05e4-418a-8105-2d4238964931", "value": "786432:8BZ/1tz1JwT1XWEqsHcE5pLLyF3zy+ToMd:2Ntz1JwJWVyc8gc0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776802583, "uuid": "a46ae93c-04d2-4e3f-9f99-3b06753c8162", "value": 31414738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776802583, "uuid": "d920cd59-3e02-4ad6-8f6a-704037cd7d21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802583, "uuid": "7b2b71f2-1bea-49cf-b2f1-525988c3ae73", "value": "D0WNL0AD_SETUP_FILE_(KEY_2256).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e540c513-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806417, "uuid": "01ab1ae6-7627-4c86-91ab-cafd5ecd6c5d", "comment": "Malware payload (Mirai)", "value": "5f7e2023637d8b3f30c110b152674b51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806417, "uuid": "3b78f801-438c-4b67-b50c-3388307ea944", "comment": "Malware payload (Mirai)", "value": "a6c7b6f8867bbae47688662cdd8fa0ff708e3845f277421539c89dd38e41149c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806417, "uuid": "ecb6952c-9250-4860-9906-b743284f9fe8", "comment": "Malware payload (Mirai)", "value": "c30524833e73d088d2557eee10711c58044aa1b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806417, "uuid": "4d608d12-a351-4b9a-9bf2-64dc0e20d958", "comment": "Malware payload (Mirai)", "value": "ceb886186efc8006946e0922b167a4efa911ee169b178b3f23b6b0d36c107aba408be5e855d091e2ad5b6274e05553b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806417, "uuid": "cbda9b74-de7d-4eec-b2ba-f803270f559d", "value": "T121733B57B98180FEC8A9C07843BBBA36DC6235FE1379724A23D4FE366D05E611E29C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806417, "uuid": "78872829-d07f-4c39-b515-5711286d50bb", "value": "1536:RKSCs7NyDuNvCKrh3L0t4B1IZbXLuO5Wb+N:R0CNoucKhE4BkbXKOgb+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806417, "uuid": "48bcb0fb-fd10-4e93-a8f6-0af561a96c8f", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806417, "uuid": "f7d4b11e-a902-4e5f-aebe-98df0fabec0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806417, "uuid": "1d697265-0b65-4a82-81bb-eec34ccc5808", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f492f8-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806305, "uuid": "568b0520-6c0a-4576-a937-604ee32f8299", "comment": "Malware payload (Mirai)", "value": "e4b6ef94cd3ed3b02bd81cae2ce30599", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806305, "uuid": "c4fc1362-1d1c-46f1-8927-4aae03bbba48", "comment": "Malware payload (Mirai)", "value": "a6e64017a27686771e2f8115fce3f6461fc9eb13ee1da0d50cbc3adf14fc2b00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806305, "uuid": "2439bb41-12ea-4d49-8288-7a30b70afebf", "comment": "Malware payload (Mirai)", "value": "ec13faa8a500f1cd473d3fca698a86bdd7f38510", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806305, "uuid": "c44276ea-6391-415e-a02b-cba44f00212b", "comment": "Malware payload (Mirai)", "value": "e950e211c6cc7bac2eab24d4c87024d182d26f1f0ce3156d52f211276fdcad7cd2b84c9f370bbafe068382df75022b79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806305, "uuid": "e25da692-c737-4c4e-ac58-b992d7f1aece", "value": "T1DE03F1381E2410CCC568C9B5AA558BFA3A466FA360429A333D47BAD37A5F23130DB5E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806305, "uuid": "3ac428ed-c220-4858-a908-1ab6ac32c7d9", "value": "768:7dJAvi5nYhR/xjbJ6SJjpBGsHibnfdVdO0UBza++JgGlzDpbuR1Jf:7daihY3flInfHo0qiVJuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806305, "uuid": "a58c9b0b-a7d9-4053-9512-97b40c74a5a5", "value": 38192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806305, "uuid": "3309b0d4-b2b8-4d97-b8b3-cf7d4964da2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806305, "uuid": "dc3324a8-830d-490f-8d34-1de54ea50515", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1e93e9-3d3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776747271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776747271, "uuid": "063ae9f4-3bc9-4d5c-8c60-772a25cc66ef", "comment": "Malware payload (Gafgyt)", "value": "adc2ac0aebdcb6dfbe1ad878a613b7eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776747271, "uuid": "ebe097ad-47ba-4577-9b53-1883843fca7c", "comment": "Malware payload (Gafgyt)", "value": "a8ea1c9138c365e208dfa812b0597a1f83a650dba47f09c3ae264fd238236d2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776747271, "uuid": "71a78111-17da-4c11-802c-aa92309f5925", "comment": "Malware payload (Gafgyt)", "value": "3e99882f715d76be5bc3dc921bdf78f0e56d878d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776747271, "uuid": "4c60bc90-a920-49a8-bebd-19d944ecf0dc", "comment": "Malware payload (Gafgyt)", "value": "d613858821008195bfc381e32e2589a79f33544cdd23cceef95fe28469d7767c1489a8da0617184ad8c29086dfd944c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776747271, "uuid": "678ca8a1-c688-409f-b72b-6635d1d54f5d", "value": "T10204E606BF608EB3C85FCD3306AA8A0124CDF49726A5772B3734DA5CBA5654B19E3D90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776747271, "uuid": "6347c2a5-f33e-4e4d-a896-1751eaf5f9fb", "value": "3072:YLnA+9i1Kq4twau5hspY2eLmxbEH5Vt0E1G2q:qi1KJtwau5hz2eLmxbEH5Vt11G2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776747271, "uuid": "8fb1c235-8856-4d89-bf6f-bd3140343ddd", "value": 176872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776747271, "uuid": "0941f589-0544-4680-81fa-0b4a54801165", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776747271, "uuid": "51bf37e7-a036-424a-b606-2f02cd33f381", "value": "FBI.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09289da-3dac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776794733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794733, "uuid": "03840ad0-01c5-4d19-b403-f92709e09fe9", "comment": "Malware payload", "value": "53eff95b800422760c3e93606c966698", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794733, "uuid": "640a43ea-1671-4ba4-8104-9370da61fe9e", "comment": "Malware payload", "value": "a9562ab6bce06e92d4e428088eacc1e990e67ceae6f6940047360261b5599614", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794733, "uuid": "5f9e3216-f6a6-4691-bdb3-f8618b11ff2f", "comment": "Malware payload", "value": "f50634f96e167b1ada616e62f59c58b1ddbcc958", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794733, "uuid": "631cb0da-4dd9-4eb8-b644-94ce4d435862", "comment": "Malware payload", "value": "9a17fd36ed7ddcb8bef688d1e04e43f4742542aaf112ce862210849ff4178a31d1d57820301e7a0926941856ed7ec2d2", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794733, "uuid": "9b4a6d35-6568-4119-99d9-a118f0ca90b1", "value": "T111364A46BC1D6862D9CE7A351F2653943339FC045F82C7172A18BB7DAEF23588F22661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794733, "uuid": "2b9522fb-1315-43f2-aa50-491dc4265e1d", "value": "98304:1ND8vo2FNgyLOLfAB+GaUeQjoYuNnsoE1X/I:1Ngvo2FNgyOLfAUhRsBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776794733, "uuid": "dabfb732-59a5-4b3c-95ee-3c4782f989af", "value": 5170434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776794733, "uuid": "d1754852-29d3-4e86-bc22-7b2c1a186c82", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794733, "uuid": "6be989f9-3a88-4ea9-9590-64e532811311", "value": "localencode", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe90f5e-3d47-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776751346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776751346, "uuid": "dabead97-d214-492d-ba14-2ac7f05ef7a8", "comment": "Malware payload (Gafgyt)", "value": "1d532bae94bc2b8bf0d2ef17102a7e3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776751346, "uuid": "3146623f-6bf1-4405-9844-c6808d1a0d4c", "comment": "Malware payload (Gafgyt)", "value": "a9c841e14e0b1844ff06ad2cc7f111af2210aec1df50c349251268ac0c70cf36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776751346, "uuid": "f91e9d8d-5d18-4f27-b0b6-ef1a009dc208", "comment": "Malware payload (Gafgyt)", "value": "66b685f440439d2d5c974a7c286e7125e53fcc1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776751346, "uuid": "cb05d1a6-7130-4056-ab31-988538f5ad8f", "comment": "Malware payload (Gafgyt)", "value": "19a91dd4b289ed5611066413a3bff18d135accb003d810266fcf059a2f5a1426145d8a48756417c6a254814b95fe1696", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776751346, "uuid": "61589082-a4e0-4fc7-ac97-b20dc1221023", "value": "T16104CA1A3D21DF7EF159C7304BB78B30D7D536E626E18346E26CE6181E2128E291FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776751346, "uuid": "0ecf9c71-393c-4df6-97f5-f7588fa51f59", "value": "3072:pvzk8lMwFT4TptFi3/1F7NsBy3Dl9yYQHi/i355hspc0p3wPULmxbEH5Vt0E1G2q:pvzk8lMwFT4TptFi3/1F7b5Yv5p5hDM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776751346, "uuid": "53e11014-54ff-4cac-952f-ecac4292e307", "value": 176392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776751346, "uuid": "4f672528-d836-48a6-96c3-86778f70e830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776751346, "uuid": "81f555b1-331a-4c34-b04e-78bff6900eb1", "value": "FBI.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f818058-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806300, "uuid": "aa08e8b6-77c0-4340-afeb-c024c4eaf389", "comment": "Malware payload (Mirai)", "value": "04a73c47f7f55ca1df2b2f4a1810aaf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806300, "uuid": "8e3ed55b-6e08-4de9-97f2-280bb4a0c982", "comment": "Malware payload (Mirai)", "value": "aaaacb507bfa697f8cf6565091bf4b9900f47182bfe688c387fd27ee45bb5dd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806300, "uuid": "49d56924-a65e-4f72-a7ae-81c4eb9b262f", "comment": "Malware payload (Mirai)", "value": "43a6a830947dc9af9cf05d0c8e4d6e26372223c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806300, "uuid": "a194cc89-2c47-412e-8bfc-27fec7194abf", "comment": "Malware payload (Mirai)", "value": "6e0a56ccfa4ec09427893680567df0ce93fd86de2eda04d9a73c8dddd158712f4abe26eae17b6ce5c23e7fb665309e8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806300, "uuid": "c550264c-a716-4ff5-bcdd-c7dfc5bedc77", "value": "T12A733984F98785F2C447483041ABFB3FDB32D9E411A18B5DEF969F35DA33602AA13649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806300, "uuid": "8d0e5400-8d28-4727-972b-b1eb0e5b9e48", "value": "1536:RZhKaqC9CGXpbeV2afxQwE7fWf81RQ2LkivL73CJTfSUL:RZhK4CGXpbeV2afxZEqk1RQ2LVv4fSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806300, "uuid": "743672ee-51b0-4695-b93a-623ed94eed38", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806300, "uuid": "d0a97d3d-cb00-44d8-9c63-36e0eabb8c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806300, "uuid": "4276cb76-3902-4197-98a4-cf9eff3971f6", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897b7374-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754724, "uuid": "0200d797-e791-4ba7-aef6-3f1a7945766e", "comment": "Malware payload (Mirai)", "value": "ba4af8dabbf10410b2cba95c9b203f9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754724, "uuid": "42546f93-3ff8-4add-bced-3f8381f565ed", "comment": "Malware payload (Mirai)", "value": "aaecb33a3539567326ba19ddce135933724844359fd3696fd9197de292fd365b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754724, "uuid": "b5c4b339-e229-43ad-8ec3-b0e3ffe98019", "comment": "Malware payload (Mirai)", "value": "48dab7dcb9a7bf6e8878d37915043eaa78ca1dd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754724, "uuid": "2000da9d-0775-4793-9e1f-3fb68fde8ae6", "comment": "Malware payload (Mirai)", "value": "124c5c80f1a5737807b0dc25d211dc7c81f5632040c43cfd05d1cdbde55e97f9b9522fddd8fd1f39b7ab8141edbf9eff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754724, "uuid": "0b4ec32e-f416-4d36-82bc-c226af2df562", "value": "T1A8631AC4F5C785F5C81B893860ABF73FCA32E57680719BADEF8A9E32D6277015201259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754724, "uuid": "b0c1bd06-d2f2-4385-af6f-85c2d0e02ae0", "value": "1536:99IEpE5HVjXLBHpJVEzpAXwS49cuPbYAeWky81:4EpE5HVjX9HZmA/EcuD9bkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754724, "uuid": "e082bdcc-bc42-4d3b-91fa-d44b7fa5dd6e", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754724, "uuid": "23fce48e-d997-4267-a928-6f8aaf43841b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754724, "uuid": "a3df4a1d-a5a1-4172-a7e5-97db9c7146c2", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c604899-3d39-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776745226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776745226, "uuid": "9c245e4d-db37-4363-8c94-29e7e37611aa", "comment": "Malware payload (GuLoader)", "value": "70a5dec115054c30ef5972ba6169e339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776745226, "uuid": "91210232-b82b-46fa-822c-ee503aa55ac4", "comment": "Malware payload (GuLoader)", "value": "ab30fb5ba0d540145ddfc6770a82b5ca2c75840052494f97b2f7e2445621e0b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776745226, "uuid": "24a7f036-c2aa-40e9-954b-ef22dbf181dd", "comment": "Malware payload (GuLoader)", "value": "2d18ada029608dd916a2cff24152940410161cae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776745226, "uuid": "c5ec31e0-2bfe-4661-8602-4cbdb387f007", "comment": "Malware payload (GuLoader)", "value": "f56de3c4556b294248b1ce73919ce18f1a317c77c6da44cc91b74c295de23519e5a1198484116d4d0531262036a44862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776745226, "uuid": "271cb385-1f51-4b31-895f-0918e31ae707", "value": "T185B4239D3193F8E1DB965232FA750366BF71AD0F40E0CE534B701799B862B838E16683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776745226, "uuid": "e1e0befa-831e-49fa-9bd2-973f45aae744", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776745226, "uuid": "d159d7fb-2d5a-4f54-b001-f1300b4bbefe", "value": "12288:GYgV8pp15+w+dUepjH7jkyOIAbiA6h8l7dHiYVVVRfdzi:Rsi+wUVjHORbkKBCYRPzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776745226, "uuid": "f3f7e9c7-2a63-4a30-a94e-6f53534ff635", "value": 531903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776745226, "uuid": "add9ee60-fcec-4f6f-8ed7-19ea165a72bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776745226, "uuid": "55af42a4-5779-48ec-a3c5-5db99aa0ae33", "value": "SecuriteInfo.com.Variant.Tedy.947919.26021.15624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7da3f70-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806314, "uuid": "96944277-d61f-4f5c-8e49-780593f13255", "comment": "Malware payload (Mirai)", "value": "2c488ccc6a3900dea446bcda8c0370ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806314, "uuid": "1985fc62-47d5-457f-b32a-7c2cf34eb0f5", "comment": "Malware payload (Mirai)", "value": "ab39b080f81872452ba03d8857f48a6330876c0cd673bd7f9063ad806d8665df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806314, "uuid": "87a20b32-7355-4087-a67c-802e033f4beb", "comment": "Malware payload (Mirai)", "value": "e48b40b7a8a553e0b74fd9286d128b51f534ebfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806314, "uuid": "bc7c5bbf-5ce8-4aaa-9ce6-2346ea1d9639", "comment": "Malware payload (Mirai)", "value": "45e978ddc467bdae2e9aaf4ce3d801ee5e153efb82d3894117d1230c2aa1b00228649c28bf454e2ccc90341940886324", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806314, "uuid": "016b6b70-382a-4394-97f5-ba321e566f9d", "value": "T1A6F3394AF6418B13C0D61776BADF420533239BA4A3D773069A28BFB43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806314, "uuid": "e73ff878-a072-429d-8e54-9ac723072562", "value": "3072:Z/NRMyuSdaIb3BhvLDCdVU+qFlfsYwFDmNeqM/9Ba43l03:Z/NRBbdaIbRhv/CM+slftwFDmNbM/9hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806314, "uuid": "76ac23f4-28c7-4748-91fe-fee45e058bdf", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806314, "uuid": "5e850783-056e-4185-8e9a-d98e2eb34775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806314, "uuid": "ce374bbe-177c-42be-b31e-df4141319f9b", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9c335c-3dd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776811396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811396, "uuid": "1acd7d88-332c-4e83-864b-e3a26ea359d1", "comment": "Malware payload (Mirai)", "value": "52e242b97827e6a3c3e5ac0202214fef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811396, "uuid": "c9f5aa5a-974c-470b-bce0-7ec6049ce096", "comment": "Malware payload (Mirai)", "value": "ab50882f051add575c083b5ec856f0493166676a0161c9c85bc6ef85102c3331", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811396, "uuid": "3ebc84c2-a284-4b5d-9bd6-76106f4cee87", "comment": "Malware payload (Mirai)", "value": "ea645a55c23edb60a2ccc7a755b9273fde3ee98d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811396, "uuid": "17eecb1c-1141-4c7d-916c-943d276a924f", "comment": "Malware payload (Mirai)", "value": "47063ae35912993167653b9f2d77310c08b0105d9360a3500da98b38ce2a70c137672ee6a9e1b04c8150b5cd5e56c0b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811396, "uuid": "fd6cd324-c15a-449b-a999-93c9740af504", "value": "T13C635C02B70C0F43D4532DF02A7F1BE09796FD6226B2A1807919FEC94671EF26546FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811396, "uuid": "c145ee35-8dec-4b92-96ae-68b73d2b5d19", "value": "1536:7RDLzauIvQxrddatYjqk96YCtaz2/1uWW:cXmdaeIYs6eXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776811396, "uuid": "8098c636-060f-419b-9ab3-d2211119bb8e", "value": 67344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776811396, "uuid": "0b02f28a-88fd-4cc8-94be-aa715c6f9d9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811396, "uuid": "874a15ad-547d-44c9-8dea-ada14822c8d6", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6565bc0-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776774959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774959, "uuid": "351d7776-e15d-492b-a3de-b5e9c5eee8f6", "comment": "Malware payload", "value": "1c86ef575f45816c11c1788ab1750ba8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774959, "uuid": "7aabad9b-91dd-4a6a-891f-851de6122c2f", "comment": "Malware payload", "value": "ab878c9b957b90ff3d132a32b1cf677b15de2399b2171bcc666175fa6b4504c0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774959, "uuid": "23ecdcd6-6b56-4e49-b2e8-31bfb3500229", "comment": "Malware payload", "value": "54da7aaccca9be4ff7a8fa9574cb67ddb307c714", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774959, "uuid": "209eb5c5-585e-408d-92a2-c48766045468", "comment": "Malware payload", "value": "1352001fc4908f65f43eaeb268f06c14a50fc49704e81d8ff5305e684400585458df2834e3be4713fe0c81ae690cc9b4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774959, "uuid": "97eb2b48-18c6-4c62-884a-bae611d21b9b", "value": "T16F7633FA9F70B232F596B4B89E48F745DC4252D6A232E621773DD0A2B147CC711CA18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774959, "uuid": "a479f309-bee4-4f21-96db-3a3bd1733396", "value": "196608:LEBJmggIetBYCQXQCVh4/zejy3RZYXvfQJLfdnJLcvEFZDnf2+OI:LEBJmxpYQCVh4/KMZAXQJBWcFZzf2+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776774959, "uuid": "c16166af-730d-4b29-a958-1a17cb9fd777", "value": 7817036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776774959, "uuid": "089ecfca-f1e4-47a3-b9f9-46ef1e9dd75b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774959, "uuid": "2afaa6cd-9edd-4f5b-ad50-3cc0b560a40d", "value": "ab878c9b957b90ff3d132a32b1cf677b15de2399b2171bcc666175fa6b4504c0.file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3793228-3d5c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1776760485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776760485, "uuid": "4b3329c3-02a9-45fa-a66e-afa6cfdddebf", "comment": "Malware payload (GCleaner)", "value": "4bd321ac2163c30f557e5afcd182748d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "logger.file", "colour": "#A68073", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776760485, "uuid": "2f5fd3b1-b227-4521-8022-3be1937330e1", "comment": "Malware payload (GCleaner)", "value": "aba14a64c2427ab54db44a605d5b408d57e713b3a4d26a226b657c3f9fb12928", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "logger.file", "colour": "#A68073", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776760485, "uuid": "9f2e285f-b10b-49ea-924d-d2ea8e5d64c3", "comment": "Malware payload (GCleaner)", "value": "9aaa9c8c49fa50c7a8cbf55ffda6fdce704fec6f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "logger.file", "colour": "#A68073", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776760485, "uuid": "88e8464d-2891-4d5d-bd2b-11fbe96dd80c", "comment": "Malware payload (GCleaner)", "value": "72011a43af32e9b6ca3a392d80c734fce175e4de3c98a8c6147f0e9c5743afec28d2dd1b3b961356666d79d82c52d684", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "logger.file", "colour": "#A68073", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776760485, "uuid": "eb802175-963e-450c-a78d-7dee44bd2d46", "value": "T10F221BC4A35561EAD54D033FC522CD23E596F10582A1EABF90B4D2B79F42B436A3DF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776760485, "uuid": "73da4acf-b489-4f70-a208-dd04407ac138", "value": "56cec9df8972d62c264a5f8ff5aa5ab6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776760485, "uuid": "f5b1c4ad-d240-4923-9a07-29afedc4538f", "value": "192:i6fTPULD5G7eEyzMlVnhfyGjcuXl0mRiZSJWXFa4n:i6fTMLD5G7WgVn8Gj5XlQMJ8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776760485, "uuid": "3148312c-7284-4ee6-9994-b9610f755843", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776760485, "uuid": "722d103a-be14-4b92-8a94-f91bad2bce91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776760485, "uuid": "1fea5aa2-16e4-448c-86a9-5bf6e7d90fd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eec07d7-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776783724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783724, "uuid": "d278b0b6-165b-417a-98ec-fc03fd6dbed1", "comment": "Malware payload (NanoCore)", "value": "c19485061350f991377769bc3a339af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783724, "uuid": "86c1d91d-cf22-4701-864c-9e02976e0bc1", "comment": "Malware payload (NanoCore)", "value": "abee9e2c579bed2a9169e1c0b0cfcf910a941ba7a3e556a7cbb9716a90616cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783724, "uuid": "b8a1a755-8c53-4b30-a7b4-2171199b080b", "comment": "Malware payload (NanoCore)", "value": "89c64eebbcbb955c39b29f0c0e05537550f66c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783724, "uuid": "534a2b64-c782-43ea-9ce3-e89a52414618", "comment": "Malware payload (NanoCore)", "value": "66d98281a512304b8ac7edf9f7356ab34d4fb60e16c873610a844b1460057098fb7ecef5c1e5d7d941fa33ab2d744ad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783724, "uuid": "0c880885-dfa7-4797-b745-5b23072c55e0", "value": "T11014C02A77A94A2FE2DE8679711252139378C2E39CD3F3EE18D415B68F667E406070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783724, "uuid": "a1b92ff8-55c9-4a68-9534-98e55e5a11b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783724, "uuid": "2076dc3f-d28f-4acf-bad8-550b566f380b", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI9v6d6+Il1c3rxbivlpfI:gLV6Bta6dtJmakIM5yXT6rxm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783724, "uuid": "6ba2fcae-3a19-4de3-bd10-de695113ea60", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783724, "uuid": "66ce4e64-316f-416a-802d-2c4e92656994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783724, "uuid": "566a8f99-ea91-4cd3-a6e2-2bf858242cde", "value": "farzan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf158f90-3ddb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776814943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814943, "uuid": "f6890190-4465-4db7-a5bf-2db9278e3fda", "comment": "Malware payload (Mirai)", "value": "2debd54abca64d7d2705f3660e26f77d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814943, "uuid": "b0570b70-5073-4926-916b-c0cd806ae803", "comment": "Malware payload (Mirai)", "value": "adeead6703411111de6d1fa66cda2ee7676f6f5f6cac1a3553263f58c1a486ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814943, "uuid": "f39b540d-5e62-4f6a-b370-1245200b5ab6", "comment": "Malware payload (Mirai)", "value": "f90f7145be08375eebf007ef361866945f09a33c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776814943, "uuid": "2d7cfd9f-5f2c-414c-80ab-f76f7d97d77b", "comment": "Malware payload (Mirai)", "value": "26083c5da801b4a94aa53f5188f52a120f6c4f95eb121479f84146c4610bb4bb966f13c8103c1c78043ab73962ae80c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776814943, "uuid": "868345ad-e742-45d1-966d-de6e9a3661eb", "value": "T12E34A3B2E84CC9C7D426723D94EA8F7ADE7A72EB1705CD117DD1203689D6ADB280BC41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776814943, "uuid": "7c76d16a-7243-4854-af77-57dce18a2b63", "value": "6144:liNeY+gV8TixdeQeuacWjcW0JcWcBob5hhWMT4JdDKo3:wclgB7T4Co3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776814943, "uuid": "0503f1d3-4800-4649-913e-f09e52d2c21b", "value": 232272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776814943, "uuid": "12986c0d-1633-4d80-9dcb-0ecdaacb8c25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776814943, "uuid": "39a6ef4a-dbdc-49ea-8c4e-e3388c96ccfb", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacbd6e0-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808521, "uuid": "89d5bf92-b333-4bcc-97ba-e45fed18a89e", "comment": "Malware payload", "value": "95d355c0ae3b971110fba9aa219ebe29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808521, "uuid": "b435c0a7-1e0f-4bfe-9ab2-6ba23eaf8577", "comment": "Malware payload", "value": "ae3e28e300aaaddf982b86e54a92445fbe43468736c66dfc40afe4cdc5babaf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808521, "uuid": "12f49608-97e6-4a3e-8c1f-0cd053f7e71e", "comment": "Malware payload", "value": "a2613a13dbee6ec0f35e43c55e8fb065ab102019", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808521, "uuid": "afb043a2-95f1-4348-a359-197c7bc62ac4", "comment": "Malware payload", "value": "385bb70591a63e57728f9a831d747d732a55f2117a4f5c7ae4dc80c877790304a59320e1b272fd6ee75d6c03a1e754c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808521, "uuid": "47ee4d48-1757-4fed-b93d-248c2c903351", "value": "T111661862BF58DE5FD29632354AA6C23473D13D1081B020379716F71D2EBA3A09D6BED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808521, "uuid": "ffc6cc6f-3095-4824-b1bd-a62c6e0eaeac", "value": "24576:yWdP5F/SKiMPyFujRxTUqMl6xRtT9JAzFYhmz3Nxo4OqOWfzo4l7YFZCzt2jgip6:1jtdUvOSFYhCs4Dzx1YFZ2C5lHxvt5E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808521, "uuid": "f454836d-d0d9-4355-ae37-62a001b63887", "value": 6750392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808521, "uuid": "af400420-1edf-497e-bdaf-9203b748ba76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808521, "uuid": "0fcc7586-374a-4ff9-9c0c-33a903e70c7d", "value": "h2rapidreset.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504618fc-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809174, "uuid": "3a42d037-9498-4c28-8424-9db98d929074", "comment": "Malware payload", "value": "b111a7014b9f8f86b4d65dd9cbc3b32c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809174, "uuid": "63d92044-7922-4cee-bd27-e30f2cc60755", "comment": "Malware payload", "value": "aed049671c89881ab6c3a8b9312997685c2f4c5866b3b5e4bf5522fdd4d4a7a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809174, "uuid": "2580f561-3e82-49be-bdf3-7effec73f960", "comment": "Malware payload", "value": "201abc6b2cb92e33ccddf0865e3abc887b1289f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809174, "uuid": "b6d91d8e-1e5d-4542-bd17-cd6d6a3a4eb4", "comment": "Malware payload", "value": "96b0f577feaf7125589561e9a2a67756f70c510d467860448b8765cad69677319b6b0b067c8df862f57766215a333df7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809174, "uuid": "067f9e7b-5cb9-489c-adc0-c99676b2d437", "value": "T154563811FECB54F6EA031E3104ABA22F63315D054F24EBE7EA447F2AF9776A11932149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809174, "uuid": "0740cc53-7fee-4bd5-8dba-49bfdb58de64", "value": "49152:9mitu+YPUTHXFsyqtLEi0X5YauoTeanUy66gY4jEGjR/tF6z75En:cQuiTH1sciouCCanU+CXkEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809174, "uuid": "57021d6e-30e8-4ff0-b22b-41a803858e9a", "value": 5959864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809174, "uuid": "46a8d198-51cd-441d-8838-a739a250603e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809174, "uuid": "2571c4b8-aa3e-46b4-841b-dd079649bf07", "value": "h2rapidreset.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1428c56-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806384, "uuid": "8545cc2c-f965-46eb-963c-6b2c4fa75def", "comment": "Malware payload (Mirai)", "value": "17a73d646db1013e8d8cfcfe4df31b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806384, "uuid": "16dd08b1-b186-457c-9a11-a1ef4c5fb776", "comment": "Malware payload (Mirai)", "value": "afb62a1a445c34aeccaa488680b0a60505b2f77d21a0506dcdd0e636bd107c8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806384, "uuid": "cac3ad00-fa08-4ce5-a3b7-5b24626a7278", "comment": "Malware payload (Mirai)", "value": "55029ebe02b4223b713ea89df2745e58a65d3e4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806384, "uuid": "76a7ce40-08a4-41ec-b223-ce5a16762e33", "comment": "Malware payload (Mirai)", "value": "b7deb7df262249bf014792b8a38e35d0540ecdb9136209879f90b9a06c49a03c01c372bebbadb36bc76cff58e7a90e75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806384, "uuid": "66bb524c-943c-4159-8c46-1025a25bc1f3", "value": "T1C7A3B44D7E319FBEFBEC823447B39A12A64927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806384, "uuid": "c6cc9821-a92a-45ec-9943-16736f88ac14", "value": "1536:9pLZ3NcS0YDw6hHMy8CjJqsNT3qgDt9HVeJ8e52sg/:7ZdcW0y8C9qsNT3qCt9+2sg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806384, "uuid": "a774c701-2f13-4ee5-9506-f28703a99477", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806384, "uuid": "52427ac3-29d7-481b-a581-d5d803cc816e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806384, "uuid": "e5b6c72e-48b9-4791-9c87-d03240360e75", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc5bad5-3d9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776787692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776787692, "uuid": "7a3e82f4-6c57-45b4-9f1c-aaf9a3007060", "comment": "Malware payload", "value": "2524c0cff0694fd97da81ee0202f372c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776787692, "uuid": "5ba996ed-ae3b-4d44-8ca2-b72355e6148d", "comment": "Malware payload", "value": "b0c9c3a9352e9d544b88e9bb3a42665125c2272f396cc5a40904487c8b18ef2a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776787692, "uuid": "a7e7774d-6994-418f-a633-e5fd37b2b3a1", "comment": "Malware payload", "value": "c2e54062427283b384686d5ff250218b352696c2", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776787692, "uuid": "e376cc7d-8c34-4483-a30b-5ea568f4f74b", "comment": "Malware payload", "value": "fc1b925da679a13c1c0ee8d27f9ed0fe4c64b9f028c9810e0348731c6be6383cc231f665790c44e5b44daff6d496d165", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776787692, "uuid": "c8392282-6237-4f94-a9d6-abf35e720e8c", "value": "T19176BF56A6A450E8D5BBC078C6468617E7F27C0503719BCF06A0A77A1F33AE16F3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776787692, "uuid": "7bba72bc-6823-4557-bf85-d6879cdd2690", "value": "dd34bdfa86575a79f2b83d58217cd56e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776787692, "uuid": "d51bef41-765f-4cc6-a1a2-aa9650f863d9", "value": "98304:64+H1gtcBy2rVCA0gh3CgO96zPgeqgpqvpZKUEx/vypfH0bv1a:Xi1gtcM2rEAnh3CgOIzPphpqRBEdGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776787692, "uuid": "2cf8eaeb-2c76-4676-805f-47133d1150c3", "value": 7211520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776787692, "uuid": "4ac59ced-0718-415e-b63d-38fe9db67ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776787692, "uuid": "bb372a74-ac07-44b7-abc3-1b96b1071f52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68638118-3d63-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776763258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763258, "uuid": "c682cfe2-626f-4856-a372-82b4b68251ec", "comment": "Malware payload", "value": "7355df158c186bf802995675c45ffe34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763258, "uuid": "db07aa88-c524-45b5-9502-b9504df25c67", "comment": "Malware payload", "value": "b16dcb5ff96bd55cfc735e265725e2395bb2f09ea814a1f7149ed5d0ea766240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763258, "uuid": "db7f2935-4556-478b-8f60-de861afa0c4f", "comment": "Malware payload", "value": "9f600ca4ff251cf072881e747b529975bbca3539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763258, "uuid": "dd664cef-1585-473c-99d4-58866cb44ed5", "comment": "Malware payload", "value": "55b82f5287879c0ae20fb4fbd0ff57a900fbd0291023d6cf63c8ce6307463098195f44fbbc3c80e6e85c1ab5f92a0379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776763258, "uuid": "1923a9be-1ccd-48bd-9b6a-7a4374c0b12d", "value": "T141C44016EA21A52FE45389B069399546BC2D3D721390EC5BF7805F9970B0AABF0F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776763258, "uuid": "2e0cd14f-b15a-4dbe-86e6-83f09fb56914", "value": "d9a9dbbf5540a45841c42e085c402665", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776763258, "uuid": "b4514771-acba-4f96-bf01-4a01d10edafa", "value": "12288:VowW8of9FDN038W6+vBVbUWFU7z8lkUZ0Cqfn4agfxUj3sPX:vCudB3ZEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776763258, "uuid": "c820c405-1b14-4723-973d-f2afdf2903f0", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776763258, "uuid": "d8f70688-44d5-4f95-83f4-3ff5a5ab039c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776763258, "uuid": "514a4d0a-a500-4d2f-a651-727d9c409263", "value": "flavines.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795adc2e-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809243, "uuid": "3f89b79a-deed-4345-a713-9dc75e0aee5c", "comment": "Malware payload", "value": "fd6a7b079cee0bfd8462d78649b71fd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809243, "uuid": "0c0d684a-0ad5-4932-951d-ca2f896ddd4c", "comment": "Malware payload", "value": "b200703810583d2ef507b7c7349cb7563414aaffc0e9ff16f875158931cef336", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809243, "uuid": "b978cbb8-7073-4acb-9f00-5774e04aee9d", "comment": "Malware payload", "value": "cb2e2d1ca66fb5000e7976a754e6be8670b412ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809243, "uuid": "790c5fb0-2a85-4003-a556-382d2fc2b2a5", "comment": "Malware payload", "value": "0097ad9d52b5cd7c79b2b7496e975e5b2b93e2d3a1ee305399135da0e0948e2e0b8d3ebfc38edc12b3dafa9ece866534", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809243, "uuid": "8d356f21-d606-42f1-94e9-500e2ac1bdf1", "value": "T1AE660955BDC22F6AC1DC137454FE625662603E458A96073323E4EBF83A7773CAF46888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809243, "uuid": "48167302-807a-469d-8152-1d5511ef25a2", "value": "49152:wgEFvlxixDv68wl2ROH5iguYpZfuE5m5EH:wNdlQxDC3VI+8EH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809243, "uuid": "7a869dca-74d3-4043-9d45-8fbbd7345596", "value": 6750392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809243, "uuid": "f5f129ed-d960-453d-b06f-9700c541adf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809243, "uuid": "e6980fed-aae9-4b79-8865-2817ac5fb0c8", "value": "h2rapidreset.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515dc505-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776807887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807887, "uuid": "e7da6cb9-d652-4c8a-b682-b5f22ee7aba5", "comment": "Malware payload (Gafgyt)", "value": "0f5fb4dfc24e4e49d3b509a793fd78cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807887, "uuid": "48578cc7-7993-4419-9e39-b740736e7145", "comment": "Malware payload (Gafgyt)", "value": "b26e38152913fe46ced5daf1f14825a9464915c0fbf1a4f91ae8964078abad85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807887, "uuid": "41198a4b-1876-430a-b4e7-d19361afea24", "comment": "Malware payload (Gafgyt)", "value": "df616800921e2e99147d4806d2bb33e37799c1f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807887, "uuid": "9145df33-510a-4198-9584-4326c250c417", "comment": "Malware payload (Gafgyt)", "value": "7542f3cdda13f662d529a0b88de2abf4b439029df6d4bf398103a809639920d0352999ca733e0db1ffcee9bc9634c78c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807887, "uuid": "a3a140ad-d3de-4c9c-8df7-0d8a7150ac08", "value": "T116F2F153D755C7484215E87C2EF7B88EC810E709F309E2A24F906DB99B93FAC19192CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807887, "uuid": "5b001813-70e5-4a63-b5af-dbf06f3efc11", "value": "768:WdkeU5QnPpRWmc1JEUKJY32cD5ekqa+SsqnbcuyD7UryqH+:cRVpR2UJ6DAba+Dqnouy8mqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807887, "uuid": "fce613a1-4917-42e4-ada4-32a3ac513b3c", "value": 36772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807887, "uuid": "d00e3ae2-c817-44c9-bc7f-1f13460dff9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807887, "uuid": "f304055a-8439-4f44-9a6d-9a411fddddb7", "value": "I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c64843-3d5f-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1776761756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776761756, "uuid": "bc1d37c0-a854-4f67-9df5-def96648f931", "comment": "Malware payload (Socks5Systemz)", "value": "3fddb88b8c1ab151bb9c05b4e6a06d5a", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776761756, "uuid": "272cb936-3e62-4a52-81e6-015cada4fadf", "comment": "Malware payload (Socks5Systemz)", "value": "b2d256a12bbb8f0e3a9fe9dc31c86064451b6438057451827643e7b9d4392791", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776761756, "uuid": "4c558e6b-091e-4385-a770-92ecf2d1bdaf", "comment": "Malware payload (Socks5Systemz)", "value": "1ad7a1dceb57c842605a7f2d51c77a5219ddabc7", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776761756, "uuid": "ca8e54b4-51fc-404a-a56d-9f87a25b07ff", "comment": "Malware payload (Socks5Systemz)", "value": "a353c0ffe65285c263123be4e1d055dae5d257bbc27c0313920bfb6c2df662fbfd2625ac2479d978a89757a4524a658d", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776761756, "uuid": "3d6e20f4-fed3-4430-b3aa-b3caef638169", "value": "T19BF533A2A9F2E07AF1644C7A8F1915128137BB512138B55FB9F9799D3B3A70340342FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776761756, "uuid": "826fb7ea-7c94-4aad-a495-6def8827db29", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776761756, "uuid": "50afe2b1-9c18-468f-a853-89ad33d656fe", "value": "98304:NajUcGrdPnu0BVYVfCM28vfW1/AX/FeVpo:pNdfdTYhk1IX/FKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776761756, "uuid": "5b8a857f-ce2d-441d-856f-108eeb3ad738", "value": 3438047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776761756, "uuid": "c5a1c243-f6cc-4c4f-8e0c-3c822120167e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776761756, "uuid": "59b8ac88-f954-4de4-a597-737f57d8d6dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c839c9f-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809168, "uuid": "0d643790-bb0f-4088-8a9d-8167d112f928", "comment": "Malware payload", "value": "d7b254d8899d9d0d8827d0286cad691a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809168, "uuid": "1f64ce17-82e5-4bd3-9a58-a1aaf41485f3", "comment": "Malware payload", "value": "b31d1537891823da6d38020fbcd95c2a6c4be79d1a4a1b3e2e397fabf53bf325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809168, "uuid": "98e07606-7835-44ec-9fb1-cf3a5ed20530", "comment": "Malware payload", "value": "0d38fc217e3753e7b648b6208a0918ea0d518af8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809168, "uuid": "3c06d301-68a2-4cfe-a94d-7d6ee22a6a2a", "comment": "Malware payload", "value": "270087dd9503c9c0d5f88fc660f6891e8765a4fa304dcb39a3d1810c2e66be0a3959fe923b76c1b0353f1a7f6c3d4dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809168, "uuid": "bf7098d3-89ae-43e7-bce7-f258449d79ac", "value": "T1F1567C09FD249F71C7A403B649B802981330AD02AFC75716A734F73CFDB66D8AE46696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809168, "uuid": "a2919c95-180b-43f2-8009-068ff57cf7ad", "value": "49152:KjwUndJXtlunLkWRWXHKArUaA0idIf2dJuV0l9cfhEIiks5ED:C5nzXt6kWRWXHKADXhEhk+ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809168, "uuid": "c6cf3963-3fa6-4990-b6fc-5a78f9070ae7", "value": 5898424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809168, "uuid": "adca6d0e-f94d-4b34-a5e8-b1424dae9c68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809168, "uuid": "21a75c7c-4ad5-4559-9368-739f012189c2", "value": "h2stream.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741bad78-3d4b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776752970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752970, "uuid": "a4bb1b5e-e538-4bca-b4f3-e0e566fed43a", "comment": "Malware payload (Mirai)", "value": "78ef472c93dd74bc8fa946c9f535c9d6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752970, "uuid": "469b9da5-8dd2-4f04-931e-b04561d243da", "comment": "Malware payload (Mirai)", "value": "b3b8cc9c3584a5613cb386adac2a3107fc8c3d714bf7db3c8c479fe69774e43b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752970, "uuid": "7c54bc47-a3ee-42ca-958c-45b6b772bc1c", "comment": "Malware payload (Mirai)", "value": "ce8c78ad692090c05e9ed3e6fc49b273819f7c46", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752970, "uuid": "462f931d-a5ed-4b38-8a8e-b3f5b26ebc85", "comment": "Malware payload (Mirai)", "value": "42f489a12d444c9fce07920dba930c00a8ab924afa370717dae06f4d42ac11898c27ded5bcbaf34c001c0dc26b6e847a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752970, "uuid": "109830f5-c8ef-4aad-890e-55c0fb495dcd", "value": "T1B251638673918834EFB25E9676B5C404B580E1526EC1DF4AD2ED78E9A8CEF083C50793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752970, "uuid": "6d9ea72a-c590-40f3-be0f-9f2e1d22b5d4", "value": "24:vncjOSnz/aIOSnNLOSnjjOSnFbOSnhTQhkaUoOSnK2oOSnlrOSnjQTOSnHjOSnTZ:vKRDRBRfRhRlSRToRRRuRDRxRz5RAR9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776752970, "uuid": "4683ce78-7c9a-45c9-80ef-b976b0a049d3", "value": 2751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776752970, "uuid": "c0246395-1045-4af8-affb-92cc7db112bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752970, "uuid": "82908491-d5b0-481b-a01f-cc54b4586261", "value": "sora.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd09e172-3d45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776750569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750569, "uuid": "e1396017-8139-46e0-b480-066429c7cbc6", "comment": "Malware payload", "value": "26d461e9bf959bd0f7b7a370007cf413", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750569, "uuid": "c8124195-e42f-4556-8ef0-a30fdef7daed", "comment": "Malware payload", "value": "b3f4352781c5fbf85c57f392ad49db434a242a61a87cbacd122a2cc285b17785", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750569, "uuid": "c5d1aa35-a498-48ac-b09e-05ebc982d985", "comment": "Malware payload", "value": "7f270e84d1273a13b6add8783bb9882b73fce2ee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750569, "uuid": "552609c0-8e9f-472a-bed4-57fa741f00ad", "comment": "Malware payload", "value": "6469f3685ecf634168b983d57ce6a91fb8c15dc35758f7c7c76fe0f3ebbced9b44f31a10bfe372cc1f7b0709b01139c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750569, "uuid": "ec6218b4-8602-41be-9257-9d2e01f7a54e", "value": "T10BE06F4DB9800833BD769CBABA8311C4914FC38A3C0BA69D86A9281FB0F0884A0108A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750569, "uuid": "ffd89d77-5e07-4c73-9fb2-301a6b605f6e", "value": "6:/24J+d9FENsRV6M5dOuRVYrW5YQIe3F1FGVKhOXqIKLsVKhOXqIKa03IKa+IKq1T:/24J+zF8sbYuREcYhghsOLsghsONJY1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776750569, "uuid": "83ac0c4a-cedc-4be6-9422-553a0e332563", "value": 361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776750569, "uuid": "bb528add-5701-4d95-814f-619bc75be726", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750569, "uuid": "8851cb48-dcf8-415e-83f0-0542237f456e", "value": "O.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c19d223-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806268, "uuid": "2ecdf901-a696-4b3d-a921-7186f4db2074", "comment": "Malware payload (Mirai)", "value": "4ca99eba1e82305656f52b803eed88b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806268, "uuid": "427eabaf-bcb9-4e66-90b2-50d66754d28e", "comment": "Malware payload (Mirai)", "value": "b4314c55c2b5cf84b3cedade40e79979382ec134426039d0187867b51a1a891e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806268, "uuid": "df91e4d4-bc93-4296-9f4c-8bc934c684d7", "comment": "Malware payload (Mirai)", "value": "36b814a7565d16e08890482b5cda183bcf63a8ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806268, "uuid": "87a8484a-735b-4d8a-b4b6-7013e58f6b57", "comment": "Malware payload (Mirai)", "value": "9b9216c470e3304914110aeb0e9f2b564cdf172fca18d4c4360870b2ac531efc65b55f876bf65ea31ab3040010512b57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806268, "uuid": "86b6f94e-612b-4999-86a8-70fa82da89bc", "value": "T1B5F2E126F2C4CA6DD06A6339057F7B0BD641935C655280E3BFD9FA9A486BB3032147D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806268, "uuid": "568200bb-4ece-41fe-ab50-5afbb48be983", "value": "768:cjprYXIyyg4saVS26cbdVc8A7/Yqz5G9nbcuyD7UHQRjj:cjpETv4s2T5m8ArFc9nouy8HyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806268, "uuid": "4f0ec63b-00de-4303-8b27-bad958889eab", "value": 35016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806268, "uuid": "d21b7634-54a0-424b-bdd7-04bcb8bc3ab1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806268, "uuid": "8629b322-2789-4f81-bc07-6c1316c7b718", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7942fdb7-3d79-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776772735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772735, "uuid": "846cb74d-ddcb-434e-b0d7-413671f43f97", "comment": "Malware payload (Vidar)", "value": "5c53e5c0c228485343b344ccb349d77d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23.bond", "colour": "#0261E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772735, "uuid": "6f09cbe1-0a8b-4fd6-a3c5-c2ef2ace66e8", "comment": "Malware payload (Vidar)", "value": "b44f3d30c0de554548254cc59dc7c000df92a323ef96c7d5f16e7f54f1ec1154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23.bond", "colour": "#0261E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772735, "uuid": "e538e3e5-0e0a-4624-b079-593ce303c698", "comment": "Malware payload (Vidar)", "value": "e113f28b3e41753ff718088666195ff4328f7571", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23.bond", "colour": "#0261E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772735, "uuid": "f353ce7f-d804-4230-b4ad-2549d548508d", "comment": "Malware payload (Vidar)", "value": "62bffc0709a4fe87dced1b5f4ebed910c02e9e70cb9c3e30ec01fff1f348c36b6da4cf0defdd0749db86109afa17c541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23.bond", "colour": "#0261E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772735, "uuid": "8f070519-c37e-4150-9347-9095dbe9103f", "value": "T1A6C56A43ACA008E9C46E92758DB7569A7B70BC480F3223D35E50BA787E73BC09E79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772735, "uuid": "7a5d9816-d9b9-4b14-a2ac-c93c7958c1f1", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772735, "uuid": "c47558eb-960f-4626-8fe7-8255fc9ac99e", "value": "24576:oMCoI3rXOks8KtvpHvknQtPlgSS/NDy//XiUPeD0SjRCrjrpeXtCMLSl+iPenFW:oMCoIbXOks8Kt5kzSS/OltzkDSlAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776772735, "uuid": "ceeb4a07-8108-41b1-9a14-805efdfcc8f8", "value": 2736128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776772735, "uuid": "db404281-a79d-4be5-a432-0333a363f5a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772735, "uuid": "ec736bfe-a841-4a0c-96ae-7572d0fe2a22", "value": "b44f3d30c0de554548254cc59dc7c000df92a323ef96c7d5f16e7f54f1ec1154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386c1b59-3daf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776795820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776795820, "uuid": "24457d8e-c431-43c9-a819-63f88ab0d04b", "comment": "Malware payload", "value": "d5f60d76d1477a49b4babb279a54d0f4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776795820, "uuid": "daa90a81-f53a-4c64-9b0f-1f73b3d92e52", "comment": "Malware payload", "value": "b49b67d7f32fa7aabedc149638ec480949084bd7549376c8abfebac884af8016", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776795820, "uuid": "f6a444e4-4c0c-49c3-b362-9f7583a2a001", "comment": "Malware payload", "value": "f6bb7bc83295a1918fb6bd56d8ffdff745eee42a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776795820, "uuid": "ed60864f-9768-4b04-a564-1a95db4df6f9", "comment": "Malware payload", "value": "190306dd3962ebe9763f8dd2fd50ffca3436a63806f9f1eb1651463a2ed14c120bdc483ee8c0e9a71fe64c840392d590", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776795820, "uuid": "b2e54804-94e8-4c72-a876-3983df2b40f0", "value": "T1BB137D6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776795820, "uuid": "c349a7eb-fd26-4b86-8448-885c64abf0fc", "value": "768:bgXRWNGxVe9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b0lx1cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776795820, "uuid": "ce392496-7723-4ab6-abdb-0fd662eaebd4", "value": 45527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776795820, "uuid": "73492e17-8d9f-424d-83c8-2f0bcd2e3fb9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776795820, "uuid": "1f37c3fa-919f-4edc-8358-1fe2b843af39", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8692b5dd-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754719, "uuid": "ec6ac8d5-4335-4f58-9f3d-3fb51c1563a3", "comment": "Malware payload (Mirai)", "value": "b430762eb7e591cda892a148caacafa4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754719, "uuid": "80eefdbc-7dc3-4820-bb08-80c3dfb0a8e2", "comment": "Malware payload (Mirai)", "value": "b684714154f55c587f44c11e2913eec31c04d9f9268b35a41d63de96a7147301", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754719, "uuid": "cff0a5c8-612d-4d63-8127-b2ba03c5d1ce", "comment": "Malware payload (Mirai)", "value": "d53789a6ca8a120d6205c4d483d9fb4c1c45a6a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754719, "uuid": "37dbb16a-68a2-4ff5-8cd9-6e2bb3b46f1c", "comment": "Malware payload (Mirai)", "value": "0ae7956feb88ee609443b48938dba0bfc7f789a0a7da7d8ef9a8db0d476c4b444d14f14cffdac153e87d510c3e87051f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754719, "uuid": "67835155-8504-474d-b549-1ccfecbc8e7f", "value": "T1573302A2676E6AE151B09777FC33BC5A56EC17E8986730D62CF0661977C08024EF2781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754719, "uuid": "6656f00b-1915-4d15-ac97-6071bb876aeb", "value": "1536:S9O/ZMAXIxNUk0W7ZLcPqF1aBexo4opKZbc:S9O/ZNKyqFLGqFUFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754719, "uuid": "0f432255-2b26-4249-8ff5-5039dffc588c", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754719, "uuid": "f30dc054-8c4d-4066-bde5-d7b032d01c81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754719, "uuid": "c87ed276-2c3a-4b72-bbaf-cb1817eb1ed4", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6630681-3d4d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776753940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776753940, "uuid": "8d8337d1-0aed-4ad0-a45f-3da20b74210c", "comment": "Malware payload (Vidar)", "value": "8b4843ffeff0abbacd2c238be94712ea", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776753940, "uuid": "37d440f0-1be0-4e48-983a-1b59771adf69", "comment": "Malware payload (Vidar)", "value": "b6ff9c7b9a93f045a947ebd1246eaf893f3fe8c94a77bd184d1e28ae551ec32a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776753940, "uuid": "8da538a2-41ad-4f03-b876-f2f67f9ea6e4", "comment": "Malware payload (Vidar)", "value": "10dee3d6fbe77368bc7b15a20fafe4ed84357480", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776753940, "uuid": "d47fe6e3-3432-4cc9-bc8a-2f67e1defae1", "comment": "Malware payload (Vidar)", "value": "f8809dd198621832226d0920b22a96d0f0a36e39251e6d1345185bdd71910226095405cc3f67c106a394d17af66ae0d3", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776753940, "uuid": "2472d70c-a1b9-4604-b3bd-051509e5e41a", "value": "T110A58C667CE144F6D46AA3338CB6629277B5B8480B3223D32E50BA783F727D49D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776753940, "uuid": "9fec3fd6-5e7a-4f28-883d-47a4c5282f89", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776753940, "uuid": "59dfa1df-fa41-40e9-945b-37ebfb0609cb", "value": "49152:/PJSIMO9Rx5f/5/P12nEv2nToSP6ymycY5:/BRTZ/P1iEXSP7TV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776753940, "uuid": "ca9a1d6c-5ecd-4ec5-b4a5-4c4bf9457121", "value": 2069632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776753940, "uuid": "1042ddd4-d58f-405e-9ee3-7f57ca3ec9f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776753940, "uuid": "2d1aef76-5010-4c6c-b110-e494aa4ecb58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04166241-3d9f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776788860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776788860, "uuid": "d377da29-9ba9-42d2-b27b-593b428c1f3b", "comment": "Malware payload (ValleyRAT)", "value": "5fc7d690d7dc7c6692c74bbd0d49d7a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit.Win32.BypassUAC", "colour": "#148CDA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776788860, "uuid": "0005c190-409c-4e94-987e-a737c1170ad8", "comment": "Malware payload (ValleyRAT)", "value": "b735eae82bf30011c9f674e3e4698ad5c77481eccaf40436adbb36b49091acd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit.Win32.BypassUAC", "colour": "#148CDA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776788860, "uuid": "bc452ec7-3e27-47f5-998c-75415f844bf0", "comment": "Malware payload (ValleyRAT)", "value": "24c6a8d1309e5c148563e1552a7f2eaf2c3d0b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit.Win32.BypassUAC", "colour": "#148CDA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776788860, "uuid": "0e7f5bb7-e35e-47f6-8e45-dc617fbde0b7", "comment": "Malware payload (ValleyRAT)", "value": "d16de46281820937460ef2cb7b4367dede225a9ad3a8b563b861647d9fa7e8ed7f6ef257b9b9e48bebb1a67bbc41f1ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exploit.Win32.BypassUAC", "colour": "#148CDA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776788860, "uuid": "05042fa5-8f5e-42bb-bb95-15f2966d6409", "value": "T1607733F4ABA461FBE11827347D82D83352B225FD3CE0DA4D2D98500A8C73E47D999E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776788860, "uuid": "16a86482-c0e7-4d94-919e-d9279e2c232e", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776788860, "uuid": "4f23e616-f777-4579-ad7e-8ddd56b67d83", "value": "786432:K11cVabtGYEQ4DCZ91roTC0i+R9IXekmIBtD32subd:ic4t9ElDCjohIVmIPTAbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776788860, "uuid": "9bff9c65-3341-4218-977a-87732e5d00a5", "value": 35637386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776788860, "uuid": "3198c7fc-0bd0-4975-bd9c-18ec18cd2ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776788860, "uuid": "a86bbb64-9637-48d5-9a35-bda3a44555a8", "value": "3setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eec3b4e-3d4b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776752934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752934, "uuid": "9c882917-30c9-4318-808a-c23eba7cbdab", "comment": "Malware payload", "value": "7fa9738b64f3acac525e38ad27c752e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752934, "uuid": "a7d16894-179c-4a0d-856a-7016ab6a3aba", "comment": "Malware payload", "value": "b751bf0112aa1bfd0f56a6bc55967a762a4b25b2c183bffbcf4b42d476def774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752934, "uuid": "56d22764-5f60-4ffa-a2d0-071b325fa80c", "comment": "Malware payload", "value": "7b9e5343fa58cd4e1a2542a5fffd372050e5c570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752934, "uuid": "c1597f4b-c997-4cec-8b0a-af4aeea12b8e", "comment": "Malware payload", "value": "127abf7cc24007acfe8ed7f8a548d370bc34831c19e3cdafdb02b78a34193932cd13eaba2728f253798d3d2c69e05228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752934, "uuid": "dbdabbc6-6076-4fb9-b068-34d55c1530db", "value": "T193169E1BBCB91C69C09AB13484777605F665B8041B2317CB1AB0F6282F7B3F25ABDB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752934, "uuid": "3a59df19-a636-4cfa-9b12-9740afc6a724", "value": "49b6e05e46e74288ba13e83380a9921e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752934, "uuid": "09c3a680-a237-4756-be82-40b7f442c2c8", "value": "49152:/rzVDjHTfVHL2xIaZGoh/t/OUXEI1dQShmsFh6IwhyGdjMOQcQbHbw:/rzrIh/rFd3JwIXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776752934, "uuid": "848797cb-ec95-4583-b252-97df140cd776", "value": 4320240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776752934, "uuid": "ffbe6463-368c-4e56-bc46-fc9d671450ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752934, "uuid": "04235131-42ac-4bd5-9d14-d7ddcc187ea8", "value": "SecuriteInfo.com.Variant.Tedy.941067.77596421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1773be3-3d61-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776762576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762576, "uuid": "6f9d2dbd-3afc-4236-82da-33898b431b83", "comment": "Malware payload (AgentTesla)", "value": "fde2dfe1fe130e477a45ea13f94a3419", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762576, "uuid": "3dcf58e1-4b30-4f6e-a9a3-3649899a78f3", "comment": "Malware payload (AgentTesla)", "value": "b801a66ae76e41c988b510439359b9406bddb77d1d13d8bae6a4e1ba0a3b3558", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762576, "uuid": "6fcb46b6-d207-4d47-8657-71b398c4b97d", "comment": "Malware payload (AgentTesla)", "value": "3ecc5fbbe7683abd3e7b39008be9726c859fe66d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762576, "uuid": "7e0e7189-a850-44cd-8fed-74062d15526b", "comment": "Malware payload (AgentTesla)", "value": "8632d91cb6f6671e470d5b757ad12c619c64b0f7b18374bd093f2453df88637e9ad956a835c5d2997d5f4e5328e6ef20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762576, "uuid": "6b558b74-80a8-4844-b105-f4a55632e43c", "value": "T184958B3785F283F10FB0783E1A79BE82D6A5756E1A0BCE585C154BB76C02A5D4F8AC34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762576, "uuid": "c9ddd075-cbca-41c5-9c5e-118a95efdd2e", "value": "192:ioIbsOoElBkF97iASPssOoElBkFIsoIy8PtsEqhpiASPOV4tKIxueGloYbry7t7L:5DvUfB7k2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776762576, "uuid": "1f875d82-7cd1-4ee9-bff1-413190cb044d", "value": 1944491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776762576, "uuid": "456ffccf-5eed-481d-8d88-6ff1abacba2b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762576, "uuid": "358d6099-8fe8-4865-8111-49c16c4f8187", "value": "476328792096083;1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734018be-3d3d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776746956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776746956, "uuid": "66465bc1-887c-4e62-8504-b3781d4dc4d3", "comment": "Malware payload (Gafgyt)", "value": "756fa1a6e6600a7c80746716a7a9b721", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776746956, "uuid": "ef8b4025-b2f5-4476-a3ef-7b7de7be5045", "comment": "Malware payload (Gafgyt)", "value": "b8703680ccde02b1cca07d32416df55bba3e971030753dfb5cfbebb4ddb3602e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776746956, "uuid": "2f2bc5be-68f4-42d9-8bd3-ecbe5c6ba3fc", "comment": "Malware payload (Gafgyt)", "value": "d0ac1ef2fae93b4e93449c72369fcbc5916077f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776746956, "uuid": "f54265e7-381e-4186-b62b-7ca03527a859", "comment": "Malware payload (Gafgyt)", "value": "aab6c2ee8ab3192ace89b7038e541748add622b62973c64f74633ad6f9f7dc32d1470c7a0ee60a53a7a45a4adfdaa955", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776746956, "uuid": "c8d522f6-ff91-47d7-8dca-ac117d5b3716", "value": "T1FFC36B13ED614F57C0835EB165E79A340F53F8E64F431B85A12AEAF45A43DCEB809BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776746956, "uuid": "5795e6d2-63bb-4b11-bd93-7b13c8c2188c", "value": "3072:GIGAGxYNUCLA2zSOu5hpp8vhntmQpf6KFIYnT5W:FuxrCnSOu5ho5ntmQpf6KmYnT5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776746956, "uuid": "7f7d1687-fd99-4dbe-87f0-8342433c9a56", "value": 121946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776746956, "uuid": "44747383-34b3-4bad-b665-c0b4238ae633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776746956, "uuid": "8e768723-5af2-4a04-b383-8711018a248c", "value": "FBI.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f094cd-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808410, "uuid": "26519329-e48a-4344-a1ae-184336d3741b", "comment": "Malware payload", "value": "237c174e12fed568c57f3891de583543", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808410, "uuid": "32657ad5-76bb-4377-bc68-8e1198a71b76", "comment": "Malware payload", "value": "b89ca0930239e891f340dd65107c744bf2d322c9fc98c3a08cd126d680599cc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808410, "uuid": "de4bcfe1-0d9c-4669-bdca-c2afa1c2a2c1", "comment": "Malware payload", "value": "4dc027b134bed91c71a05fb46beb59a1974c38db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808410, "uuid": "09227bd6-0671-46bb-ae6e-2b9f4674ac29", "comment": "Malware payload", "value": "c64f936ae17eb49410311653e02367b4ca870c09132640427889ee18899493fed927ea63ea51682fdb81e23a5b5588b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808410, "uuid": "cc31d58a-590b-427f-abb6-62ffafee7afb", "value": "T10475D197FB0A0F97C0EE8B34841A829A03685D935952C76DB69C3F9D6F3E3994FC1448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808410, "uuid": "86d14b9f-aa22-4c06-8a12-787d23aab2f1", "value": "49152:SPS3333333333333ZI3a33333zUjvWhJZ8OUI2Atkw5:S63333333333333ZI3a33333WvWhJZ8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808410, "uuid": "48e80f52-22de-417a-bb02-4d19514326e0", "value": 1666352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808410, "uuid": "aa16dbe3-27d0-4396-b82c-75531fbe9a41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808410, "uuid": "d00767ae-7b8c-45c4-85ff-9e77f2754e87", "value": "bot.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12a1d04-3ddc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776815457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815457, "uuid": "c6ce597a-08b4-42c7-82df-881a2465fb74", "comment": "Malware payload", "value": "414003b3c5873bb8baff0295d7d3e28d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815457, "uuid": "c05da212-b081-4149-82be-208b50f8ba99", "comment": "Malware payload", "value": "b9757d0f6331115a7bbca5621122fe878c77487f2242d98f75c68b6be317f938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815457, "uuid": "5a388298-3041-47d0-91e9-820b94131b37", "comment": "Malware payload", "value": "65b74a471ab8c82514eee43331281a335c771aac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776815457, "uuid": "f43248bc-66b0-4f0e-b0ba-674e7c3badc5", "comment": "Malware payload", "value": "433c0b99ce8081d191792005ccbd14b0a299ac0a3efd5284778479bcf4ba9fd03e345a6e443516dfa85079db2aada8e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815457, "uuid": "fda48315-9b9d-4086-a2db-3ac75fa530aa", "value": "T13D53F25FEA1298DEE54E697938EFEF206A5070A1318E67CC7706D410F62E452B7ED038", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815457, "uuid": "94ed96e2-6525-40b0-a4c3-4ce83b8305fc", "value": "1536:BRUvrox/n5RmqnTt04g9EAiywtx2koqkroPe1eP:BRUjoxP/FnpmEALwT2k8roB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776815457, "uuid": "5656679c-39fb-4d43-956e-3c02b5bf896c", "value": 65936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776815457, "uuid": "557a67d8-abe4-46fa-afec-2522f3fd59d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776815457, "uuid": "ec97f91b-b7a5-4a28-a8b4-5e01988244e2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8beeaa07-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754728, "uuid": "4e11e5d8-47d6-4352-a408-4a1017a80188", "comment": "Malware payload (Mirai)", "value": "0de94ebaf2abae7bfce9855a75878c6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754728, "uuid": "25fcaee4-72c9-4335-a651-2ac842842ce1", "comment": "Malware payload (Mirai)", "value": "bb1f21fc18f8c0dfe436a48d46add84fec220111a57f04f189cc3cb7fcc0ba2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754728, "uuid": "97120db0-a364-48b1-adee-02f86ce60ba5", "comment": "Malware payload (Mirai)", "value": "ec4c06065798e4c37961bad047533b3031d305cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754728, "uuid": "165f445f-63a4-4043-8789-e0e3dadd3a85", "comment": "Malware payload (Mirai)", "value": "38d0dba168f438d59bdb051b48161a301a58bbb521d719ae399e8f7f3adf0bd45935be065d199047602f9ba4e3918726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754728, "uuid": "551a324b-686e-4d2c-8622-f395fd63b560", "value": "T1115339C4E2C3E9FAEC10087D317BAF629E73F13AB135D99BD3D959639901A02E10625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754728, "uuid": "2e97b96e-096f-4031-abe8-51b21260d835", "value": "1536:0UEMAWwPQk16/PTWKRmyaSkDu4eFOV/r:0UEMAWwr16/PTWKRmyaSmu4aO/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754728, "uuid": "971dd753-ba71-4463-b6be-3908fc08dd54", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754728, "uuid": "c4aaa00a-80c7-49ac-adf8-ee957e23c54a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754728, "uuid": "cf320b07-df3f-4358-ba23-9970dbba3687", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81533869-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754710, "uuid": "47846191-fefb-4b97-b51b-f78b16f91052", "comment": "Malware payload (Mirai)", "value": "5b057778c1b6d08263a6fd10d2ca3212", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754710, "uuid": "66777120-28da-4f4e-b5fb-10123175f4cc", "comment": "Malware payload (Mirai)", "value": "bb5cef7936de6236a71c68f55bfdde3ba7031564b973fd61bd14520077f6e124", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754710, "uuid": "588a4cdc-96b0-4310-999d-283da83089c4", "comment": "Malware payload (Mirai)", "value": "c4463fba5457a48c66d8e1511ad864be7bfebd77", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754710, "uuid": "c497dba7-aee5-4d4d-af1f-43fe9dc48f7e", "comment": "Malware payload (Mirai)", "value": "8bdd13d3e9265584d7264fe27673573f4b557704c638deded662f2df7041e0fd4ab879e24582b8aea7bd0ada213b2fee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754710, "uuid": "7bfa9929-19c4-49cb-a6ad-2f1b8fddd48b", "value": "T10BC2D084F041CA45DFFA69F12D40DADBFBD06F1EA9628E8022A553D19F9D3638306DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754710, "uuid": "5890e231-fe4b-490f-9b7f-f71ca11f40ad", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7Pvh54uVcqgw09C:mam+AnKehPRa9aHh54u+qgw09C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754710, "uuid": "05a561a9-df14-4257-bf64-c73f814fa8fa", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754710, "uuid": "1b21bb37-0dd9-4666-839d-dd9dff9d11e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754710, "uuid": "631171e5-4e3a-4a10-be30-66937ad8c39c", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1915f86-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775004, "uuid": "47e7dc9e-2ab2-4387-a77e-f9b72f852ada", "comment": "Malware payload (WeedHack)", "value": "0c78a77d8ef91e120103bf512c726f50", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775004, "uuid": "ef279b7a-df97-4e5c-8c52-1037fb0b2b60", "comment": "Malware payload (WeedHack)", "value": "bb88df278e68caa6f4726e44b36da7dc08353b79f0dbcf072991fbf7c914a977", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775004, "uuid": "eb4b9881-e0a6-42ca-9125-70de114cb8e1", "comment": "Malware payload (WeedHack)", "value": "b953d4e3b2646bdb6785132de465982ddfa1370a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775004, "uuid": "6551ffd9-fe51-4805-a1de-6fe38ccfc0b2", "comment": "Malware payload (WeedHack)", "value": "ac957ec60da969a1bed60b01a9041430ba9f3401755087fc0f2a280e3ce9649ce2524582308d8dd24e6b5812a6354796", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775004, "uuid": "2791dd5b-a8e0-42a6-ac98-62a554bfcced", "value": "T1EB74E105D7AF1C3EF727F3BBF49083146C6D0BCE456332AE3499885B646B5E14298B29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775004, "uuid": "a27bfe5f-08e0-4883-a653-a1cb8bd23391", "value": "6144:wLJI3FniyULgkkZp/a+x8i/WIFBIZiJAjPTV6FH/0pxx8d35:wC1BkE//3FBHeP5AcDx8J5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775004, "uuid": "e6addd28-663e-41b1-98ed-ad4121078243", "value": 364609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775004, "uuid": "fef7a4ee-689d-490d-a4b4-ce2510588bfc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775004, "uuid": "13de5856-58b0-4710-8a2b-0741f02d022a", "value": "bb88df278e68caa6f4726e44b36da7dc08353b79f0dbcf072991fbf7c914a977.file.jar.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ede1c1e-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776807856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807856, "uuid": "d76580ad-06e7-494d-9cf4-e1d843468439", "comment": "Malware payload (Mirai)", "value": "e5da49a52ac725353591601ea6c0249f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807856, "uuid": "611d1068-3549-46af-8f6c-71f5dc4250b9", "comment": "Malware payload (Mirai)", "value": "bb91e0710543b0de44efde7eeaca0584bd1476eddaf93833610b3375d149be6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807856, "uuid": "79d45a9e-161c-4382-a131-5fa6f2977f51", "comment": "Malware payload (Mirai)", "value": "1ca1bd21b1cd04df1757898b6daece8364b62533", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807856, "uuid": "60a6f534-e2cc-430f-bb0a-47302d5c8bf4", "comment": "Malware payload (Mirai)", "value": "320faf3e836c58154217346905aac60d5d194b88334f3ca6e33f7be065e58e918610cebaa35a9749799374800fec32fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807856, "uuid": "9b73955d-99c3-4321-8064-b7317724abe1", "value": "T1D193E687FD01EFB7F40AA77A449348157230FFA60E921A72B21738ABDD361D41426F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807856, "uuid": "51cec2c1-ed86-4a9e-814f-15577a72367f", "value": "1536:QX0XSn0yTJ8w4vHPtIzy6tsU8CFigjzBAkDjDRknyuFPxgS:QX/n0yTaHWzy6tsUmgfBB07FPeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807856, "uuid": "2c0798ee-ff35-4670-be6b-8c14a98bb46f", "value": 95816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807856, "uuid": "879a2342-b125-4d53-a5af-44d5c24e1b1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807856, "uuid": "b238eb27-43e7-418f-a7e6-9725812532da", "value": "M68K", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec76e09-3d73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770034, "uuid": "b3361c5d-a83d-4bbf-ad37-0c13d352614a", "comment": "Malware payload", "value": "4bc4f6dd1dca82adddce636fb517c5b7", "object_relation": "md5", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770034, "uuid": "96a2a465-d6db-4d92-b5fb-5ecc16fcf66e", "comment": "Malware payload", "value": "bc71aa97d8c29f497fe61dc320e22809fc1700322ce379312d2f99072bf9a103", "object_relation": "sha256", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770034, "uuid": "7f8d0024-ec1d-426c-9703-6f32ff3aa37c", "comment": "Malware payload", "value": "10a9f5a272bd785fb15640f2283613d7924408d5", "object_relation": "sha1", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770034, "uuid": "c1326633-281c-4b63-a314-0c895ed6b15d", "comment": "Malware payload", "value": "59acd600ec096e484e515b6abdf418f3a175355401a2e02e149db92230daa0857a6d1696c69e993ae7f0c5a2a921c854", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770034, "uuid": "b24365d9-9e24-42ba-b78f-3879b8f4a061", "value": "T13421B66F7017C79817CB2607B7EB8A4CF420C83804DE26E1B81F038563959745EED524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770034, "uuid": "a36bc275-c086-4936-b979-34f0059a21c8", "value": "24:Mo7SVS+DmhiPfABA6d1YCMnnpNGsJvICnDysLKrCaHZ0ni0+fABogX1V:P09CuGennFJtDyqKuajm1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770034, "uuid": "b693a952-51b0-4a2b-87f6-de28320135e5", "value": 1379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770034, "uuid": "0b5118bd-5b5c-4d22-b2f2-6e132c7dc649", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770034, "uuid": "d616b9ec-5de3-4876-b357-56681d74cbe5", "value": "bc71aa97d8c29f497fe61dc320e22809fc1700322ce379312d2f99072bf9a103.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a570dfb-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776801943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801943, "uuid": "c4459f65-bd1b-42e9-a861-39339500ec51", "comment": "Malware payload (WeedHack)", "value": "7b3ce0a09ba03c13655b1a66d2389283", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801943, "uuid": "7dcaf850-de89-4071-a777-04c791ed73f8", "comment": "Malware payload (WeedHack)", "value": "bd887ba4455ec773b92e8010871e4c4a9c4bc8e8a31d1b76926ec71f26b2dbd7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801943, "uuid": "9db5c222-30fe-4fc5-8905-9d6c86b473e9", "comment": "Malware payload (WeedHack)", "value": "699eac3ab8ad3c8ebf2daece8458c89dc84071c7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801943, "uuid": "6e5c142c-9402-47b2-bb67-72e21c7a7c36", "comment": "Malware payload (WeedHack)", "value": "b7a5874f45ce6ea5f87a9649e7330b6689ae1303a9f4870b402f5a30322b15d9e34b2aa00f890f7c5f3ebec5c0937204", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801943, "uuid": "ff74d013-fa13-4f90-9955-24985b7b4a28", "value": "T196342395F0E86F06C603AF3BE5843E18F67D06D43284BB95A6F145CF6807E48A75AF90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801943, "uuid": "24db80b9-7359-47d1-8df5-32b307df9af9", "value": "6144:Av8mCcWQ9+6J0ahHQKqxtvD6EdPm51m3XX:O8XEo0yK26EdssX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776801943, "uuid": "4c1b90ca-60fe-49bc-9e66-ff539b87efd2", "value": 230605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776801943, "uuid": "cfb040c2-5a0b-4ca4-936b-6e1cc7eeb25a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801943, "uuid": "173a2d1a-b119-400b-b1f9-deef0739d83b", "value": "Example-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753edc96-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754690, "uuid": "9a491ffd-7d26-4d7d-9017-0036dbc498cb", "comment": "Malware payload (Mirai)", "value": "79d1d8804157031adcf8fc927042855e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754690, "uuid": "d6581fcb-8724-407a-a673-445a69c9da67", "comment": "Malware payload (Mirai)", "value": "be7193c29d39c1715ee5755890ca08b084cb90f898141bb993a603fadc315853", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754690, "uuid": "749ddd73-3e07-4e59-8891-7de1054102e1", "comment": "Malware payload (Mirai)", "value": "c9f067d50d97d630d1de6a3505ebed3fea0e8e21", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754690, "uuid": "1520db46-e2b3-46b0-8e5f-2333627c1b76", "comment": "Malware payload (Mirai)", "value": "f53fd6d3f41154861c4cba6e6c7c257606deaecbd6358c7989349c4a8c2b93aab2e619e5d9a178681b65cdbc2a33c15a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754690, "uuid": "e5c1826d-fc2b-433b-80e8-ce5bb5820bc1", "value": "T149D2D0ABF18BD0F4E5F684B5905820C0F46872AA5B2187FF485B62BE886338B5635F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754690, "uuid": "0ec4510d-77ce-4d45-b34c-d531604e6553", "value": "768:CYSoXdJZtUjkFfNJlVrQeHvPx2csGHEK89Sx0sW:CYJdJZGjkFV35/McrNZtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754690, "uuid": "7f1e7213-1a26-4afc-b8b0-ecba500a104c", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754690, "uuid": "4218adb8-7d0f-464f-a240-4b8fbafdbcf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754690, "uuid": "10e2f67d-5a7a-4270-9abe-bfbecdcca63d", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a986c37-3d77-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776771718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771718, "uuid": "181e4d87-51a9-4be0-ad2f-c16e0bca2dd9", "comment": "Malware payload (ValleyRAT)", "value": "0df5d1dddf3e23395f65233ad0551976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771718, "uuid": "63c67ef4-2be7-4ccf-bc26-756302815e31", "comment": "Malware payload (ValleyRAT)", "value": "bebbd92d12dbc0071acce399db475182067b1dd3000632915851888509a10ad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771718, "uuid": "67200abd-4bc3-4e94-9252-db6df4a1a658", "comment": "Malware payload (ValleyRAT)", "value": "7cfdf33571146e3b8d3a01085e41e5f04dfc6b7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771718, "uuid": "3d649c19-b267-4959-add1-6fc71bb4dc35", "comment": "Malware payload (ValleyRAT)", "value": "be2dc41ca8ee0895546f42cfc9814fe46ed56298e4314e16c11b091228f8990b54774762c4ef71f63b6efb3f3fa86c24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771718, "uuid": "da733eff-55c5-4cba-81cb-1a259e48ae48", "value": "T17C28337267C4F85BD35ADD33EF418D9ACC76A8938280713B97C035C8A6B5502DB39AB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771718, "uuid": "103c175a-cb37-497a-8b5e-97fdae322c1f", "value": "311d1e93d89e02a2908fe4b6d6a25ef7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771718, "uuid": "e3f70a18-dc2b-4ab8-a53f-ca919d8d590c", "value": "1572864:B6TNu+Ov1zPENSL09SktUXnARViC+17XUrKCvgX62SWEwu0iLxkz9Fg6n:B6TNu+EpPENbTf1AX+K+gK+upLxS9Ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776771718, "uuid": "6c3ad3aa-c801-4218-88f9-0d823f40de9e", "value": 93541751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776771718, "uuid": "cf3e28fd-51eb-4cd8-9179-c1818c78fe35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771718, "uuid": "ada98ee4-aaa9-4662-9eaf-97ea8143b8ef", "value": "88-ije.oo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62f313a-3d68-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776765536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765536, "uuid": "e682955a-a396-46ff-8ce2-cff80aa4c6ed", "comment": "Malware payload (ConnectWise)", "value": "1defb209a3dcf15a5aa40bf63f6930a7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765536, "uuid": "eec39177-8b24-4c9d-89a5-dd2a50b6f21c", "comment": "Malware payload (ConnectWise)", "value": "bf70651adae1db15cd799bfe05ed0686dfb0a3fc7454cd8836ea4dd2543e4b27", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765536, "uuid": "76150501-2b73-4784-9c06-d69e5ffd4433", "comment": "Malware payload (ConnectWise)", "value": "eaab6a1849735f1ffbb49ad04e3b8f52e3ea2a18", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776765536, "uuid": "85c0ee90-0ec2-4351-86fa-53f5fdb73110", "comment": "Malware payload (ConnectWise)", "value": "b3bc2e09b4c02b3acb0f4f2bedac2030a52e8bc0c5378f09f010801e2725154aa22fe7bc35ecc95e7c476598d2cf406d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-hirb01-relay-screenconnect-com", "colour": "#70D84B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765536, "uuid": "4091de45-9228-4c9f-be2d-220bdc3471a5", "value": "T101C61201B3E565B5E0BF0A38E87A42656A75BC049712C6BF5394B96D3D32BC08E32773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765536, "uuid": "b5adc560-e845-43fc-9d1a-ee64b7625404", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765536, "uuid": "34ba19a1-2347-4873-bb47-beb8b128df38", "value": "196608:OfefPnlHm9R0AZJZNHm9R0AXHm9R0A/Hm9R0AH:4HZ0mu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776765536, "uuid": "f5c0c8de-fa17-4907-92b9-5374ab364311", "value": 11904056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776765536, "uuid": "7e3dc823-1d9a-487e-a405-06389069edf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776765536, "uuid": "bb7e2ba5-406f-4eb2-a18c-7f8b8ad7610f", "value": "bf70651adae1db15cd799bfe05ed0686dfb0a3fc7454cd8836ea4dd2543e4b27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f146cfc-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776801978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801978, "uuid": "3089220b-fe22-4d25-9826-e4ba8b0179cb", "comment": "Malware payload (WeedHack)", "value": "6d01d02374afdd2dcb148c80eedf233f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801978, "uuid": "3e791ae5-ce54-4745-84d5-44d529580770", "comment": "Malware payload (WeedHack)", "value": "bfa92b47c570dbd16ed61c58e0f098d923fc51e46817306f41a70d8af332ba7b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801978, "uuid": "abafbd94-681e-434a-b249-e4fdd3f4f45d", "comment": "Malware payload (WeedHack)", "value": "f19a62b3eeeec64f543ea91aef6c47c81ff2b61c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801978, "uuid": "49738d12-2a3f-41f3-9475-b58dd52fd067", "comment": "Malware payload (WeedHack)", "value": "95f1c821fab17f8dccb55f6b02ecc76b3955197600421062945532bc1444e437ffc92cf3cc7da13e6d3f92efd1e7c35a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801978, "uuid": "e2737bd4-3aa6-4821-814b-b93dbd0e3aa9", "value": "T176C53332A6797A78D113A13456981863B81F26B5DA0F38AE3CFC07475167EDB87273B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801978, "uuid": "eef89f25-75c8-49a0-9887-817582c493fb", "value": "49152:s31rAf1hZkDUCrWy6cgRjzTQniOCCv/yPT/EDGQ6eCyRz+77M8NlfDGCP:sNihZGUeWyYRjXQnH5v/yQDGheCUS7vb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776801978, "uuid": "7fefbb28-66c1-4283-ba2d-1284d95c7ae8", "value": 2674774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776801978, "uuid": "c485ca2d-dfa7-43e4-8088-d255a8d9f86f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801978, "uuid": "451cc87e-ccb9-4621-a1e4-30c8dfdc289e", "value": "ImmediatelyFast-1.6.71.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc14ef2-3db5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776798436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798436, "uuid": "550addbf-63b5-4c8f-b287-3d14a625de4d", "comment": "Malware payload (RemcosRAT)", "value": "75d02379ba86ef84b2dbcac00c856a07", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798436, "uuid": "6978a6b4-72a7-4948-8af5-4a18ad6a5cb3", "comment": "Malware payload (RemcosRAT)", "value": "bfaf3900078db99c433f5d6e1d58989ae2c7c5a81aabeebc4668a87a89790466", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798436, "uuid": "bfaf0a49-b6b2-4e54-9bae-3249d96ce213", "comment": "Malware payload (RemcosRAT)", "value": "a8527c290eca33866358f967c43d0e1594498eec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798436, "uuid": "3105a800-831e-4cee-8841-be8e63cb8bb4", "comment": "Malware payload (RemcosRAT)", "value": "9ccdec1bef75b3e4fa2cda3f19118264d4ec391c9ece74373c562238b89ede267b4e3eb3e4bb68be1bdad54cfc1a7848", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798436, "uuid": "2a974341-c18b-48e2-8fcb-2babbde691bb", "value": "T1D566A604D0B2B609C8EAC7498F7BC6A0CC5EE86ADE8CC897681BD43C1E19FD3559459F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798436, "uuid": "73f3a52a-94b8-4bad-b32d-e164b83bd75f", "value": "98304:8XEn9OqT1XRUCsb0k0vkN/t6is/HF03+OcF2K0bINu/bbkJag4XA3l9ov07/LmU:8DqT1X3sbroSKfF7F2sqPkJWw3/n7/KU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776798436, "uuid": "f80262e5-b983-45b0-a8fe-1e4f4812ad71", "value": 6480135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776798436, "uuid": "a908bada-d444-4ff2-8e20-f1719064b61e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798436, "uuid": "68dfa389-c1a9-4e4f-9c6e-4557cb156c1c", "value": "RFQ-R632090.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f61c90-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776783818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783818, "uuid": "824cd1f7-a1d9-4681-99d4-3c6945d440f0", "comment": "Malware payload (Formbook)", "value": "efb55f099a0c87dad431b246552885df", "object_relation": "md5", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783818, "uuid": "905f96b5-35f8-45a6-bccf-6f35b207bf8a", "comment": "Malware payload (Formbook)", "value": "bfe726695213b853ec993a050a4706b83d7a11178c43da6735075b28456ff631", "object_relation": "sha256", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783818, "uuid": "4403804e-ba0a-46ca-b65e-8d11ae587c1c", "comment": "Malware payload (Formbook)", "value": "04f02540785fdf9c10d61f290f96d53dd8e8e7f0", "object_relation": "sha1", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783818, "uuid": "425d77c7-0ea4-42a0-97d4-91b632180061", "comment": "Malware payload (Formbook)", "value": "012f5f55eb6f41b5a9d60ada4d0be721abdf703abcecc1199e5dbaac00baa3bb38f8f1008ba245953bb395e03b6c9e30", "object_relation": "sha3-384", "Tag": [ { "name": "Bozza-documenti", "colour": "#8090C6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783818, "uuid": "e17491f1-e12c-481e-9921-c812f338d135", "value": "T15175665263F99618F2F77F74A9B916600E7ABC96ED79D21C1280506E4DB1E80CCB0B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783818, "uuid": "42ad25a7-9497-4a9a-85cf-37ba25525026", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783818, "uuid": "abe45f39-2202-4bf3-a35d-f2ce950e1b1a", "value": "3072:a2HEppvBBdGL+Jr5f26tJK5BOV6TsSkE33dov0Ux6mleu91TcMrP4PB6es:aBm6eqeW126e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783818, "uuid": "0405197d-4a15-4ed1-8cc1-ce23acab5ff4", "value": 1672704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783818, "uuid": "8a539082-c134-4fbb-b347-9803927c10f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783818, "uuid": "964f71ff-6c05-4e8d-a249-9cf17a5c45ad", "value": "bfe726695213b853ec993a050a4706b83d7a11178c43da6735075b28456ff631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bbac0c-3db2-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776797070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797070, "uuid": "6688ab5c-534d-4ca9-8dda-55ddd484b6a6", "comment": "Malware payload (PhantomStealer)", "value": "ffbfa76289c96a3169c8da6e859b8832", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797070, "uuid": "a0046b3f-b990-4a3f-9582-e727c4f537e1", "comment": "Malware payload (PhantomStealer)", "value": "c023166a028773efc229e5d4a052fd768d356f7674bc57de91169b9c47bcae55", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797070, "uuid": "c1220bb3-3b0e-4256-8c7b-6aa0cee73450", "comment": "Malware payload (PhantomStealer)", "value": "2aad7fa73889ba1bb1107a1c5e463ac304e4c069", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776797070, "uuid": "38a65c45-43fa-4404-9038-0e5c70b970d6", "comment": "Malware payload (PhantomStealer)", "value": "9504c58696ff195820095b0773ea7e819a701e9f3d80f09197dd760ceb2cc46bb78a51f901af3e4d242daacae66f255c", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776797070, "uuid": "5f4f34fd-3f90-436e-98aa-1ee90b4f51f6", "value": "T1FDF533709EE53DB447E89244F4EB7F4A53E45E334869E3CB16E815CB007BB92E50AC68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776797070, "uuid": "1131df48-0e97-4796-a49d-315df3a7c514", "value": "49152:mrLQ0uX8dacBj/6ODdwsrsB4fFsvEiWNieYt:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776797070, "uuid": "e0a8a88b-57e0-426a-b677-d6bffec34585", "value": 3413452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776797070, "uuid": "cf4fa81e-39c0-413f-9c0b-39a70194ad83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776797070, "uuid": "1b1d9d30-44ba-4ccb-9167-adce931059af", "value": "update.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76319fe1-3d1d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776733217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733217, "uuid": "5ac4d9bf-ddab-45b4-b296-b26fcc5761f9", "comment": "Malware payload (Formbook)", "value": "3606909d911b6660edaab2de0b848284", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733217, "uuid": "c898c83c-3c21-4dc1-9106-b726c84fe4ad", "comment": "Malware payload (Formbook)", "value": "c10be6d4ac17e2870be8a9fa3ac8917c48aa9eaf85dc1352351ad130baeea356", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733217, "uuid": "11b643fe-9f61-42a4-bf9f-f7b557a1de7a", "comment": "Malware payload (Formbook)", "value": "caf42592b3afa84e86da478e6ee9e0daa9a1ff4e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733217, "uuid": "4dc1700d-3b27-406c-a2c6-9645bcb5e950", "comment": "Malware payload (Formbook)", "value": "d8bee52d7cb7ad2441a20299f6d702e032683c7f1154203edaf9fb9d0e7fa6c232b4c0f3d0d5192abf9ca5a5106548d4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733217, "uuid": "69194eeb-722a-49fe-99f5-b4eab0e0b516", "value": "T16F146B3297BC5811B2B2872CC36144E5CB6F3BD23BA7944C86BB4DC81B76045B5E53AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733217, "uuid": "b5a1a8d6-a514-4580-929b-ea42585d8449", "value": "6144:pdV4kdZeEUfhLfF75N9U87AWqAd0EqGdPZwDxMm:pdNdZLQhLf979UIi9GdPZwDxMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733217, "uuid": "8ff53707-4a1b-40e0-a60d-db0d846ce95e", "value": 206200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733217, "uuid": "0008e38b-bfaa-4f05-a6b7-606ee44c15e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733217, "uuid": "03022b81-ff2f-4449-a75c-2f16d7b5a1ee", "value": "rWhatsAppImage2026-04-20at10_16.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b455400-3db5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776798374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798374, "uuid": "00844b6a-98cc-440a-84e2-d49b3e5952d9", "comment": "Malware payload (RemcosRAT)", "value": "18f81389af07b269c9cc464d31dfd640", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798374, "uuid": "b36e3f4d-9e53-443e-a813-38b073c76028", "comment": "Malware payload (RemcosRAT)", "value": "c1efda68f23064c8767cf98b480189ada512ede14e7f22bf4d57752e3e6e85bf", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798374, "uuid": "6b424a43-c93e-4e26-8ce2-b0c810001614", "comment": "Malware payload (RemcosRAT)", "value": "8c663b83693cbfce2b4bbf8673140e162f04da03", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798374, "uuid": "1206db3f-2df2-451c-b330-96b838609eaf", "comment": "Malware payload (RemcosRAT)", "value": "b2ec1c55731933f841272a508558991a3fbf3a23dc7f7264e8ad8dcb8e40625e90a80cd2a631be67f7c01080b6ff2ccb", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798374, "uuid": "3523b74f-406e-417b-8f7f-3ae83d48e655", "value": "T1BD645FB30EE010F0FA554145DAFCA4E16932E3FDA129AAA7DD138050C2D1B71E65EEDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798374, "uuid": "070c8c0a-45ba-43f3-b056-553daa5d2a2a", "value": "1536:oLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLG:3KE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776798374, "uuid": "994ab39b-e5c0-43b9-a535-02b948c74f26", "value": 327127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776798374, "uuid": "745ab827-d2ab-48aa-9489-9f9380beb595", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798374, "uuid": "12c93095-e092-4d73-99ec-436e302e09ae", "value": "wechangethethingsnew.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0406cd96-3d62-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776762660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762660, "uuid": "b6e3f27c-6f25-440c-9bdf-ddfa5ade57e4", "comment": "Malware payload", "value": "e8c2496288f639431263cc4010bb8d55", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762660, "uuid": "bc44e186-08ea-4832-8003-78d9763fc3be", "comment": "Malware payload", "value": "c299406b97bb61fc8fa4e1ccb0d4f18d33d0e30796fe0cb7ef3c8b683197bc18", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762660, "uuid": "ed170d5a-8aca-4c41-8abc-ce2e59f35e08", "comment": "Malware payload", "value": "f037af7d6df138432c20a3bb7fbb08752e82d176", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762660, "uuid": "5197885c-4e11-4045-9fab-f4047e4a5bdf", "comment": "Malware payload", "value": "34991df247482dec97a3747409afa1e3df80e913c810043503a9a38a7a69f1fdcbee222b8e268b0586a9f4c5e9cfd889", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762660, "uuid": "7b658488-223f-4d19-8630-2b2fd8271a57", "value": "T1D9B423B586946E1B751FD3BA2585BE1A493EF1B4100C3E0476924D332F6660E2EF87BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762660, "uuid": "07a07818-73c6-4b88-b865-626fd917dd12", "value": "12288:Px302rjfIQte9iuMIP4VcradDnT1dP1kkACjp6b1qsnTJ/Y7t:PJxrjfN0iLyadH1dJAc6bzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776762660, "uuid": "e6b7915b-f66c-43de-95a2-0d7f6c324c4f", "value": 537053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776762660, "uuid": "a7cc5330-2f68-49ee-8cae-943a18f01f27", "value": "application/x-ace-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762660, "uuid": "8ce63059-d494-4be9-9357-da01e287311c", "value": "ContractXDocuments,XPaymentXReceipts,XandXOutstandingXInvoice.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed028938-3dc6-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776806001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806001, "uuid": "d7739df8-ece5-4d65-9b86-f03b488eb720", "comment": "Malware payload (MassLogger)", "value": "ff868121e1e4cf443dac8bdb463cd11a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806001, "uuid": "e0c70fef-73bd-49bc-8e7f-c75bdfa1af4c", "comment": "Malware payload (MassLogger)", "value": "c36037a7c200df52585e8d49cd275689e84ec89a7cc5a58b1ce1c0f9e4a366d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806001, "uuid": "eba699cf-0574-4a73-8e6a-76bd2386e833", "comment": "Malware payload (MassLogger)", "value": "6a748b021e7ceaf568e2b250324a8173f516621b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806001, "uuid": "52f6fea4-2c54-4ee6-9316-c091395f0ce0", "comment": "Malware payload (MassLogger)", "value": "82f6f73e4621a374d24dd47a8b2a715ca9b1a4d87c905a684c6d45e33da8c1e709b49ddaec67babf86d0f845dfb718f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806001, "uuid": "9ea7db45-1d93-4b4a-b5a5-3a3bc12c098f", "value": "T1BD34289477FC1214F2BF8F79A87454504AB7F427A926D70E1CDA61DC2A32B90EA14B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806001, "uuid": "85fe5087-e0a2-4a61-88ca-e7bc81f9e5ae", "value": "3072:DcDTxU7ZsUFLX1OSBsZHvfDMPcNJGdSutY2Oz50ARISFirKoXsG+fKpK:DVfcKGHYPUZmm+rKocyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806001, "uuid": "d349e254-32b8-46f5-9ca8-458282d5145c", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806001, "uuid": "7058d700-83e8-4dd0-93c3-bb264e0eb6dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806001, "uuid": "663ecc29-b56e-42bd-adec-b6a871bd824b", "value": "plikan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8877659e-3d95-11f1-a769-42010a9c0008", "comment": "Malware payload (Grandoreiro)", "timestamp": 1776784787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784787, "uuid": "7d4f9d70-d7f2-4f8a-97e1-205e8df17932", "comment": "Malware payload (Grandoreiro)", "value": "6446427dcb7528fc294ddeb57c59e134", "object_relation": "md5", "Tag": [ { "name": "50600tvc0415", "colour": "#D8BE95", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "goldsymbol09394002-dvrcam-info", "colour": "#AB147C", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784787, "uuid": "0f19121f-202d-4781-a7d3-d0c9ce03355f", "comment": "Malware payload (Grandoreiro)", "value": "c3b39e888177ee55ac58fcffb7360273f448307e954acfe56dc8a66c6e39acc1", "object_relation": "sha256", "Tag": [ { "name": "50600tvc0415", "colour": "#D8BE95", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "goldsymbol09394002-dvrcam-info", "colour": "#AB147C", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784787, "uuid": "16934c12-3e48-4b48-a86d-1616064daac4", "comment": "Malware payload (Grandoreiro)", "value": "e0b480352481e9a0b87b21141504f30535d1ebfd", "object_relation": "sha1", "Tag": [ { "name": "50600tvc0415", "colour": "#D8BE95", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "goldsymbol09394002-dvrcam-info", "colour": "#AB147C", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784787, "uuid": "c0cfa8fd-542b-4a5f-b121-db3a5886901e", "comment": "Malware payload (Grandoreiro)", "value": "92ca591e33a61f12db4efeb95652b505e8a0ff815128f48b2d9696f2ae6ec53dc905e1cd8f1aecfafaf3a027bdf7b0d5", "object_relation": "sha3-384", "Tag": [ { "name": "50600tvc0415", "colour": "#D8BE95", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "goldsymbol09394002-dvrcam-info", "colour": "#AB147C", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784787, "uuid": "b75453c1-9eb1-431c-98b0-fbae77754b4a", "value": "T13AD53328D901AB1DE250D167D4C241646D8BAB5FE7C1CE837B1EE69B54C1C8FF42CA2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784787, "uuid": "a2352183-2549-4587-8ea3-19dcab1a03fd", "value": "49152:c/LX7sU6OQxZVkY/DlhV6yYlBydzXjn8/eI/ekGnIxOmaYT:cLx6OGV9RhHeBydzqeywnIxOwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776784787, "uuid": "fd157f96-26fa-4f95-ae52-969179cfeb35", "value": 2909797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776784787, "uuid": "a2b2dea5-36e7-4e51-ad56-e6f9398d35b8", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784787, "uuid": "e39c26b5-8c0c-42b3-9a1e-29ea57e02ee6", "value": "41d4685680db50cffe107cce8d4a97919b22e761c4a4af29777949dad41ff405.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fc17b7-3d60-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkWatchman)", "timestamp": 1776762187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762187, "uuid": "b6c14486-17f2-4518-bc3e-ea14886519da", "comment": "Malware payload (DarkWatchman)", "value": "92dc66e72099b6f2d1dce5a552a98739", "object_relation": "md5", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive0117", "colour": "#F7DA47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762187, "uuid": "49caae17-6847-4ee2-8b51-89721b05eb72", "comment": "Malware payload (DarkWatchman)", "value": "c3d07b16bd87be3b5883fea86f1213f565ca2cac69e7be7172b5348d0dfc78a3", "object_relation": "sha256", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive0117", "colour": "#F7DA47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762187, "uuid": "33fa1e88-62ec-4894-962a-2197ab2038a2", "comment": "Malware payload (DarkWatchman)", "value": "7c553714094340b34f9d94c82bc68a27868b6f33", "object_relation": "sha1", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive0117", "colour": "#F7DA47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762187, "uuid": "751aa502-d9da-4230-9bd5-25b94a59ce2d", "comment": "Malware payload (DarkWatchman)", "value": "aaa8f90ff06f23e12e84a778bc203b5ce31c32e31ff24b685ed3eda7e6ae0bb884667ed4330de006b90bdee5c91839f0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive0117", "colour": "#F7DA47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762187, "uuid": "2f7f36ec-4132-4477-89ca-40e42ab513b7", "value": "T1F9944CBD7066AE95F92A12FACDD578D50FAA1B038EC6B089C0157FA208B7735FD16C01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762187, "uuid": "d7302468-f8e1-448e-b48b-57890f56a43a", "value": "7479cc87f5e1cfcb03747a39cf466e65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762187, "uuid": "6350a237-4f4e-400e-a48a-984a4686f792", "value": "12288:47Rj3xWFb4TOtEZR2AKpzf6Jo/MWRNtImnsZG:47Rj3/4tkK5HIJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776762187, "uuid": "6d1dd2e5-6c2b-43eb-a149-47d7b0524604", "value": 423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776762187, "uuid": "186bba7a-4a25-4481-a313-2bddd86704a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762187, "uuid": "be514c62-2ec0-4c95-a4fd-6dff631f00bb", "value": "c3d07b16bd87be3b5883fea86f1213f565ca2cac69e7be7172b5348d0dfc78a3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4ad222-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775026, "uuid": "5e499cc7-297b-4270-a316-30ed016eeeb4", "comment": "Malware payload (WeedHack)", "value": "d111ca42ae0214082806996aa7560943", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775026, "uuid": "55f27f62-d8fa-4dd2-b868-37bd87af4d16", "comment": "Malware payload (WeedHack)", "value": "c403a21fb518bcad10cf9892530729f49c9cd412a84674c745f6022b25edeace", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775026, "uuid": "73b306d2-6272-4616-bec6-564d86ffe4b3", "comment": "Malware payload (WeedHack)", "value": "930cecc8d61df93e1f56e9b95d05aa63a5d14f76", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775026, "uuid": "23d032e4-e016-4d87-b60e-b80fe880a25a", "comment": "Malware payload (WeedHack)", "value": "9f933a116170ac782502feeeaf66a121a854ce01af719a2129dbbb28df3785a9ceb3d3c9a7c638dce63589fbc623302f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775026, "uuid": "0f1acbba-4142-4059-aa01-98001721f19c", "value": "T1127533CF390C14944D2D8DFA972DA0E39E6C0C38794E4DDE292FAF11A1655CA5A8C7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775026, "uuid": "f4d7f5ee-5a96-4d6a-a5bb-437fca518ed9", "value": "49152:ccrgj/WKPJ0PvHZN+PyoxL0bFFWyPMJgxKrE6:cWadP+ZN+RxsbFMJ1rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775026, "uuid": "6ae8b9fc-014a-44dc-a217-e23fde24b3d5", "value": 1623564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775026, "uuid": "a39169a6-db28-4a58-88ea-0aecd951a2f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775026, "uuid": "25f879b2-ad60-420d-9ed9-5da43e615fa8", "value": "BrealifeAnticheat-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa61c99-3d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775154, "uuid": "3c260313-a353-461f-bdfa-3e7a2d8e0e8d", "comment": "Malware payload (WeedHack)", "value": "54c6f0c12830b8f5a0073392fe5e91ee", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775154, "uuid": "92caaf3a-90dc-422e-a8bd-a1a8b305e041", "comment": "Malware payload (WeedHack)", "value": "c48984951740e81969cadede474bc3330821987e4c7d7b84102a18c1b9ee9d37", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775154, "uuid": "38c51a75-cd12-42cd-ac8e-a878a916868b", "comment": "Malware payload (WeedHack)", "value": "f8ae2742d446bd7a60f583c2080bf34b2b7c186c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775154, "uuid": "f7667e24-7c2a-414e-9d23-ff7da515ad7c", "comment": "Malware payload (WeedHack)", "value": "28e87c65606813e32fcddd31f2fce99671dfa8bb8129e59d7534dab29f5273b36229f70a8db164b78713eb4f89442b8a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775154, "uuid": "b62fce28-f8fb-4ebd-a331-9430883cc0b8", "value": "T11F253376BA2115A8EB4040F90105709A8B1BB136C16F15F1CAD6FF697F4DF3B3209E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775154, "uuid": "53302bc2-6a28-49a9-97a6-a20bde70ec0e", "value": "24576:TYlom97mBEBjjKBGzgd/cDwRBQvYSWzBXW97nVtqS8TkTOeAmxB8G:M7pBjjw5lZBQgSmWpKjkTONmx2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775154, "uuid": "21cd5d7d-7056-4c72-83dd-df46dd3272af", "value": 1039793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775154, "uuid": "46ae54dc-f618-4f72-a2d9-75c5ff376ecd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775154, "uuid": "976afb7d-343e-4611-b326-5f884dab62b7", "value": "MetalDupe-fabric-1.21.11-V1.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2f4a61-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776733493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733493, "uuid": "1235f00b-4858-4bb3-955c-6eb4e22b98a2", "comment": "Malware payload", "value": "2fabb255b459161821612a694031b80e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733493, "uuid": "2e071a8d-1480-4de4-b53e-c8691978c36d", "comment": "Malware payload", "value": "c5f7b3f5711c2cf54c9aa99298b60571a2aec9e908fcea196546e757423e3036", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733493, "uuid": "30e5c857-7ef8-4533-97ec-e8a218b3f8d2", "comment": "Malware payload", "value": "1c958de7837aed120d2a79b95cd585d94f764df8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733493, "uuid": "fe3f105c-962b-4573-ad9a-4281e84d6667", "comment": "Malware payload", "value": "3a550347bf314aae8462aaba842ea09edde1adcff3cae4a38416ed4304539ae14428afe99e64c40e99c025fb9dad0ca0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733493, "uuid": "c0091578-bd0f-4254-ba3a-8049475b211e", "value": "T12B275B647D5CFC2AD7CDAD786F36629C3220AC498FD1C21B0505BFA9DEB27948B23191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733493, "uuid": "81134f94-fe3a-4a82-a230-ccb64f2617ce", "value": "196608:KrclmvYuOjY6JgYxTNE4/M1zertCIAvl7OO1fAKmMKESPpq5SW:+clmvSY6JgYxhmzeJCIAvl7OO9JWbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733493, "uuid": "71230c84-af09-4f5a-907c-c0715ff08482", "value": 20316286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733493, "uuid": "acef7f78-2856-4261-be4b-7644aa58814a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733493, "uuid": "b073d5ba-69d7-42b9-99d5-fe865ae1006e", "value": "agent-linux-arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540cbfe1-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776807892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807892, "uuid": "a8432953-e66b-44ff-9fc2-767d4c13c57a", "comment": "Malware payload (Gafgyt)", "value": "81c671d658bdeb96b4f8864f318bae7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807892, "uuid": "7524288a-c1d6-4d2d-8b79-2b2463bf6473", "comment": "Malware payload (Gafgyt)", "value": "c81ef4d33c833956048aa2eaa74dd4c32e6ed729914b83480d43b8e11942e776", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807892, "uuid": "9487887c-137e-49e6-b81f-1158df3e7f54", "comment": "Malware payload (Gafgyt)", "value": "eb2094534d48799a36a266c12d2d70d2e943ed01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807892, "uuid": "68400938-be7e-4f2f-a313-5014aa1b3427", "comment": "Malware payload (Gafgyt)", "value": "c5af26041bccfe4c608838ba93d996e2f149f3743d489191ae85bcf091e0d66a0aa6a30f2489643c9297259c99b97263", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807892, "uuid": "3e8c5fd4-ba4a-449e-adb2-341cd072655e", "value": "T10303E0438BE6F8BCC535FA7D711F9AC0FBA09D2ED6410D3B04DB12B648A26A45734221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807892, "uuid": "f3b9d606-fa51-45c8-9f07-fd34f1618c2e", "value": "768:l/y93ruaPqh9bH/DGo28hky98TG80AKZtZNyatPvHSk2PM0vKJRasv9sPD:lm3z8bH/N28C90HMGkK3FuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807892, "uuid": "3149d8fe-1873-4d0e-ab90-d57b4232dfdb", "value": 39748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807892, "uuid": "aecdefa4-febe-403e-921e-e2bb57d9a0f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807892, "uuid": "4233b255-c977-47fd-acf1-42bf1d68d44f", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ff16c1-3dbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776802226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802226, "uuid": "228a15c9-258b-473b-b4c0-5d1959e2496c", "comment": "Malware payload", "value": "f80d669bf3f002e9edc7b13971ec3063", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802226, "uuid": "a8fde82b-8840-4bd0-a85e-195aee25acb4", "comment": "Malware payload", "value": "c8cdf46fcbaebba29df13ca40a3ab8d37cdac54e333b3957facf4ef6c88cef34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802226, "uuid": "a55a083b-1f27-4a65-a584-54a1378f1a38", "comment": "Malware payload", "value": "a9c810dcec56a1cdbf9df6fda469a9bde6089188", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802226, "uuid": "2dd3b50c-9a10-4357-a81d-b118dc8c5c51", "comment": "Malware payload", "value": "89a16afd37d5b46f2e8c93d768f41833c73c8f22b30d8a31546bd0ad79ffe7ab3da31652793ceb18b31df324abd87776", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802226, "uuid": "afa39122-9c7c-418c-8c43-0c425385ae8c", "value": "T1A303081BB751CE3FC99E8330459B8E30B2B5E061AB7153171B2052797E93788DF2B58A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802226, "uuid": "dec833e6-110c-467f-9761-ea9d66a23a07", "value": "384:LPZc/VdecDfnebP0Mp6dYWt6YHbl9Fyjolrd:LPZc/He3bP0MK6Y7XKyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776802226, "uuid": "d9e82da3-1ea9-4bbc-8e52-244584f9794a", "value": 39576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776802226, "uuid": "9b204442-2459-4d18-b938-8bf5bfd3869c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802226, "uuid": "e3c5ed78-615f-4bac-926f-4fde9a64143a", "value": "injector", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d5a6e3-3dd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776813775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813775, "uuid": "f865de2f-99e1-43c6-9a8a-2db2df002d98", "comment": "Malware payload (Mirai)", "value": "8c2c9574556261a39170cfa3f817ed50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813775, "uuid": "4a851ad9-91c5-4462-aabb-3a18f6b0e7cd", "comment": "Malware payload (Mirai)", "value": "c954d7adf3d1239db32efe6eb42c4d64a79e8885ff0a4b91cacb7f913478ea18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813775, "uuid": "a9f2a90b-7a4b-441e-ac48-93068207f777", "comment": "Malware payload (Mirai)", "value": "928ee761fb8f1e83b9c8ce8656e2e9c397c0d9ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813775, "uuid": "8a14f18e-5c84-4d5a-b44b-428c590eb324", "comment": "Malware payload (Mirai)", "value": "6209476ee8e48085e6f14cdaca682f0c8ac533843ab9d9e012e01fbc00dadd85925184073ca76477cbde4293c42396f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813775, "uuid": "17983e4c-a2e9-48d7-8302-e792acb2dac1", "value": "T1514329C4AC03DEF8DC4125752177E7328A36F43E1129EA97E39C96A3AC52B81E1472DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813775, "uuid": "b30108ad-afad-4710-9979-b1d9ab3f7afc", "value": "1536:5qnSCYjVxz9rVzGECrSMkKdpgoXc+nzh1ydI4vnUtWvy:8nnYjjz9rRGEMkKLgoXnlEd5vy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776813775, "uuid": "fc2bc850-c167-4cea-b1ac-6da47cd6ae4c", "value": 55280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776813775, "uuid": "32927cae-21c1-4f35-bcdd-52b1a3cb0599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813775, "uuid": "42598d0b-760b-4bc9-8a19-753028c6bb74", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f674200-3d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776781658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781658, "uuid": "3c5ee0f8-1e44-4198-b16b-882a444eceb1", "comment": "Malware payload (PureHVNC)", "value": "0288cd16004c4a514b859bfa50d5fd91", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781658, "uuid": "bcea3fe8-2e50-4761-9747-7aeca05ada10", "comment": "Malware payload (PureHVNC)", "value": "c9c97de140cfc61e40413a04b915a6ac87f86503b5baae73c5708767dc23d5eb", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781658, "uuid": "36123321-0a54-406b-a723-94fee1c56a3e", "comment": "Malware payload (PureHVNC)", "value": "93310abf2edc230fb45c6b533e0d4da084cd814f", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781658, "uuid": "e6982c3a-a54a-4c44-9646-19bfdaab15b9", "comment": "Malware payload (PureHVNC)", "value": "8c8a612b7e7c07c5057a298e62e9e38551066fbc3892cf87028cbb4f44fa7f34f7d356fa660be565e2bf4c9ff561e5e8", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781658, "uuid": "2ed7418b-b036-45d8-b4da-64c1ae46f0e1", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781658, "uuid": "6fb39642-461b-47ab-88c2-1f8f2032b624", "value": "3:VSJJFIqF1F65IFV7Nx:s8qF1Fhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776781658, "uuid": "352b246a-4040-4539-b830-bc2ca2861b2b", "value": 43, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776781658, "uuid": "edc2df0d-353b-4bba-8187-d60c8b639165", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781658, "uuid": "1b93ff2a-fac6-4098-8458-a678f7508de0", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cd407a-3d74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770532, "uuid": "88c5bdf9-21da-4a44-9b18-ee5e369f6cf0", "comment": "Malware payload", "value": "1a821a3efbba011d281fc1f251d55dc0", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770532, "uuid": "0f4359ab-149a-40ee-b16f-511885c3005d", "comment": "Malware payload", "value": "cb12100562366928a2c57fd381ed1922f514f6826df898b4160954d56e2ab6a6", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770532, "uuid": "e070eaa7-53a1-49a1-b530-fdbad00c6f59", "comment": "Malware payload", "value": "1c2e3717437f4e3f73fa627619124c0d5c1fdb41", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770532, "uuid": "24142179-9622-45cd-8f18-dff028c50114", "comment": "Malware payload", "value": "52189822fc68325959b0345d979c3deb02cbc1dc5c03049963f9bf97054ed7f6d4de77078ebda26529f4b4b52f86aad1", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770532, "uuid": "04b77e87-e0f2-457a-becc-9eb25490c8a4", "value": "T19A642321D93597E58186A071492E4F89F8F697CF046E6690F3BDFDC103ECF08916A22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770532, "uuid": "0fe1b7b6-d728-48d6-b3d8-491a8c299a55", "value": "6144:Iw2e61aOZy8V3KnMajnjJZp5sKt9gkiHWE+Au04AkQVWctJaHtsT5eyewHmt:xq5JpKNr9FJjABFJcts1eyeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770532, "uuid": "eecc7e75-69ea-409a-8ad3-57c9b0bb2d70", "value": 328927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770532, "uuid": "c400ff19-a39b-4d7b-b017-b85963546674", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770532, "uuid": "bb8e59d8-f92d-41ff-a969-fe7e30047b89", "value": "ZNmmIvD5.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7d6084-3d94-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776784232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784232, "uuid": "cf309f89-ae34-4e31-912a-23baa78435c8", "comment": "Malware payload (CoinMiner)", "value": "692d293e0591aa60f40f2a7c66f4d31b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784232, "uuid": "4a39ff32-8c83-4065-8da4-b4cb19ef8bb0", "comment": "Malware payload (CoinMiner)", "value": "cb5dc229dc9bc577e385634b61cefccb9fc6779cd63eb332ca5f48bd381d8169", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784232, "uuid": "7d3ada57-353e-407e-89e0-7e894bf5214f", "comment": "Malware payload (CoinMiner)", "value": "6914fff8c7fa4bdaba484f312334195e46e9d880", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776784232, "uuid": "9c8e08fe-220a-4e58-8e23-fcf2c6377ccb", "comment": "Malware payload (CoinMiner)", "value": "8686466cad9cf05b0c7b21482b8741c1e03314614c022911545dff25eef7ee5e5f5a7f38386e67718e5e291f73e4cc91", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784232, "uuid": "df9fc86b-0448-41ec-b653-cbcd2be8ed69", "value": "T18422292B7E894131E3E089B412B58A8E667C45736786B3EBF373D5590FA92448440BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784232, "uuid": "97f3f726-a003-439d-997c-d219640678d6", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784232, "uuid": "f0bd1414-70d1-4353-81cc-36fa9298fd06", "value": "192:I15oJEWtW5BCx+etGPFJxTEZmFhSmc732:m5oJUWwdPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776784232, "uuid": "fc5eecaa-25b3-42d3-be4e-9687dcf47d0e", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776784232, "uuid": "bb426bed-8fc8-4df2-b9a2-c74660d8c818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776784232, "uuid": "348d00f0-607d-49cc-924e-baf2e1ea62f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f374f46a-3dc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776803435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776803435, "uuid": "ef5f135d-85c3-4506-bbe7-c06f6ca43581", "comment": "Malware payload (Mirai)", "value": "9867c017d2c369841c65739f9d253b81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776803435, "uuid": "fad999b8-2877-4c22-95c2-648f9e17579c", "comment": "Malware payload (Mirai)", "value": "cd12071a4e39313ed81a386235286ea95a3ce8551087a8058f231995ea217f54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776803435, "uuid": "830dca37-560e-43aa-a7ae-2e7b1f674837", "comment": "Malware payload (Mirai)", "value": "f97535afd7fba527560181e53c8ec8e622871fab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776803435, "uuid": "0ad0fb66-f0c5-49bb-ad3e-7731c9a9ccb2", "comment": "Malware payload (Mirai)", "value": "5396fe32a8437e32227a6f3f7e9a9785d7f2dc65893118b397d5959eed5016f79bc3ea8b406a669813387b408db7c64f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776803435, "uuid": "b1568499-6664-4e30-bbd1-be20ad3cb6da", "value": "T17983C61A3E218FAFF32D827547F74E31965872992AE1C688D17CFD412F6028D641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776803435, "uuid": "8fc4419f-5563-4389-bad6-3dd7cfa5de74", "value": "1536:SPl0Z7DjPoIrWt5P1sf5FDOal2S8KmXKfd3MNQxeR5s:T9Wt5P1sf5kal2S8K0KF3MeeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776803435, "uuid": "bdf13c41-a565-48bc-b907-f8d4b77f1138", "value": 87396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776803435, "uuid": "f6809331-8e19-4255-bcc5-d6bb9386774a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776803435, "uuid": "b5f92b18-e8a4-4ec8-993d-c0ed7e91686f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2888ef9-3d62-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776762926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762926, "uuid": "ecc93667-54d5-4055-b05f-0ac4a6925d96", "comment": "Malware payload", "value": "6e61d9a6114eef5994b28a4a6666576f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762926, "uuid": "80ae47c8-c826-4fc3-a558-1e4eef63af2f", "comment": "Malware payload", "value": "cd89e5551c294a167f6e44d5f4f70bd05832972a10a164c7933034d01ad7bc4a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762926, "uuid": "e6c66c53-7cf3-411a-9f90-8f1d119f9dbd", "comment": "Malware payload", "value": "f8468ba17c0b1836340cdcd7b114d3690de5a4c7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762926, "uuid": "5b828c46-a1fb-4afc-98eb-1b9543be1838", "comment": "Malware payload", "value": "d6889caf66eb749e1214ae491192f9e9dabb473573f88c9aae5a1240e3e9b864c05cfda5a3f57f07598b2c1b5bd75887", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762926, "uuid": "1ded8851-780c-425a-a7d1-3f2438a155e1", "value": "T1B8146A025BE96008F2F60F68AEB710218E77BE595D38D41E15A8588E47F3D14CDB6BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762926, "uuid": "0adf061f-fb26-431d-9041-dfc73914e806", "value": "6144:V3tL8iLZhUldyJURiNLq4E55mh5GCNJoZ/kC4BQmcM:7QGZU0ThLoZ/kC0QmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776762926, "uuid": "b9389762-d13e-4e8b-9c89-610e9d22b6e5", "value": 204382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776762926, "uuid": "6e40d3c9-a9e4-40cf-bdc1-f0f90497d5b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762926, "uuid": "d13aba04-1bef-418d-ac1a-bf837b0ce1d4", "value": "Overdue Balance Invoice for JAN-FEB-MARCH 1000071067_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb014c2-3d4b-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776752828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752828, "uuid": "dd8b6c1b-db6b-48e0-b9bd-f993d14ed767", "comment": "Malware payload (Phorpiex)", "value": "391680868d454433d6949e9048195985", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752828, "uuid": "3a69bb4c-5e50-4845-ad20-d3bd1ec9bf5c", "comment": "Malware payload (Phorpiex)", "value": "cdf876273c6175f4cdbaacd6ab361ffde60edb2ac3ffa2bcf8e74c5a18f4e462", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752828, "uuid": "556495d4-7229-48ff-9dbc-f5d407f13f95", "comment": "Malware payload (Phorpiex)", "value": "ab32be44fe8accf31cf87b347b78871a0fffa786", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752828, "uuid": "97cc1b14-c2f9-4556-8177-1159e1166db0", "comment": "Malware payload (Phorpiex)", "value": "aa36e1eb336548a945e8d21d88475bc52d7301e5e05956364da0e318188eb897a8d97929ed9311f3d1f2000a4e35857d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752828, "uuid": "09748fe8-b72e-4ddd-8827-af740e42775b", "value": "T1C1824A0FB8424226E1D110B09572967BD9BD9C7A738424EBF7D44ADA0B686D5FC3314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752828, "uuid": "00cf18d5-4a61-4ea4-84c5-d8e8ff35904f", "value": "ca5592c42b764400102051895df05794", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752828, "uuid": "22c36f26-2273-4e5d-a36e-df5b2e936c43", "value": "384:AH1tbmV2uL1EaWwtG0yu9NHuage/zav8U9c:6sVPo0P9Nza0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776752828, "uuid": "41d9e2dc-af78-4319-9250-6332c6f92d75", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776752828, "uuid": "f59de605-757b-4f05-a9ad-90a4f534fcf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752828, "uuid": "7fc723f8-688d-4122-ac2d-e19dc5cc8f1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962d414d-3d89-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776779656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779656, "uuid": "d2191f13-ad85-4e2e-ad4c-f11d994dcc0f", "comment": "Malware payload (ConnectWise)", "value": "4627511958f765739258475da04b412a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779656, "uuid": "7a29d554-9ed3-4532-8776-c157e8ead9d6", "comment": "Malware payload (ConnectWise)", "value": "cef451428106ef1258471dc76f5eefb212edab465d01b18f16afb040a421d0d3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779656, "uuid": "2eba9b7e-1458-4178-b8e7-3bd8b44738fc", "comment": "Malware payload (ConnectWise)", "value": "26e8655693689424034fa7783d3cb03819d5a126", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776779656, "uuid": "84ebcc10-3ff1-4d19-8aee-20dcdc75c466", "comment": "Malware payload (ConnectWise)", "value": "1b040ea360a84de4bc0828a3b5e6aee04ff056f0a81f3dec0d49b2469c5415a0f2a8b1ccd03e3473ba696577f9fd170b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779656, "uuid": "04990c3a-1f43-4c1e-aa80-578e66f5ff3e", "value": "T18346F141B3D695B5D0BF0638D87A42666A34BC109712C7EF57E4BD292D32BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779656, "uuid": "04185c2d-0eef-4902-b4d8-1f401a0639de", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779656, "uuid": "e394ba9e-93c8-40c5-bc1f-15aac970b9ed", "value": "49152:/fmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:srs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776779656, "uuid": "0c217260-52bc-4bb3-b32e-4ae8c307db4f", "value": 5670624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776779656, "uuid": "5ffff54b-4633-4e93-be84-84aae9b56afc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776779656, "uuid": "36084f5e-ece9-4eca-8c0d-aa89719392b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873f6983-3d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776752573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752573, "uuid": "79429525-c210-431c-99c5-f319cfe88acd", "comment": "Malware payload (RemcosRAT)", "value": "117e6e365b5e5d35673208cf39b288de", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752573, "uuid": "c0e901e2-c933-4815-ae72-515fe61e5c41", "comment": "Malware payload (RemcosRAT)", "value": "cfa65056a9accc2678480771e25891733787cf1f0ac46727e2663ca8383e3795", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752573, "uuid": "135e5c35-168c-4391-b5be-b4306b0613b8", "comment": "Malware payload (RemcosRAT)", "value": "7065f8865d53e9104f4781d85ef51bbe9f2ab6c2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752573, "uuid": "d44a55f6-561e-4297-b270-b2666bd8ea5b", "comment": "Malware payload (RemcosRAT)", "value": "eda72aa26fb55238d44472271cdd7441bf61f39426da3bdc254376de17624cbd6b44a5a6da89879b9e4424b37e99929b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752573, "uuid": "3b6d34ae-633b-491e-a226-1b57b8b2bb16", "value": "T125635C76DD640B195E8B2BAEEC80A951D279C265312210E1FFDC539C900F9BCBBFD609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752573, "uuid": "db76f79f-b18c-43f2-9e38-01d62ff59b89", "value": "1536:y+oz+wcXnpVFuVcszvjNfj6cKhA6wQ9BuDImPkVtquF1R6:yLBcZ2VxzJ6/y6wmusmPvuFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776752573, "uuid": "76cf9d1e-e241-447e-a8dc-8c9928049b65", "value": 73255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776752573, "uuid": "db844100-e342-4af3-9ee3-19d4b06c5ba2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752573, "uuid": "d2daa65a-0943-4b59-b66a-fe693c0c55ee", "value": "Staff Appraisal_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ebead1-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1776783862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783862, "uuid": "1fac923e-5bd1-493d-bfa1-c8df8bde1621", "comment": "Malware payload (RatonRAT)", "value": "3182b26d6f0c92fa635eae44bd4e4476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783862, "uuid": "40ec8b54-5233-4292-b152-e1bcd079be4d", "comment": "Malware payload (RatonRAT)", "value": "d1153f654601bc77fd5839d463e0088ca38e28ebfddf556ebe511e0fb3dbf6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783862, "uuid": "3765dcae-88ba-47be-901a-9681d119e59d", "comment": "Malware payload (RatonRAT)", "value": "a53ac82ede685aee92859257ffed32adcb9d9d80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783862, "uuid": "eea66189-67a2-44e7-b6bd-4ce46a68192a", "comment": "Malware payload (RatonRAT)", "value": "4648ec824c27641524583b1e57f2feb52e3ba26ada67859fa85ccb24f9cd8fa5df2070ea9ba54691b8895699fd89ff4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783862, "uuid": "5f4e96c5-5b8a-40aa-bffd-0ff3f7fcd3e2", "value": "T17306CF407BD0CE1BE1AF87B6B4F2061057B5EC15A796E70B2D90BAAC1CB37445E1839B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783862, "uuid": "52f4ab8a-6e9d-424e-8230-da9fe3becefc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783862, "uuid": "1df5f668-72f9-44a6-8551-900c39916663", "value": "49152:fmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sT:0q0WgVUuHjkDGjYQeqpgmltT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783862, "uuid": "f820b08d-8548-458d-9b2f-2c3bb546fe7b", "value": 3695616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783862, "uuid": "5869f44b-c869-4ee5-975f-a9e3ad6ec4a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783862, "uuid": "8558b604-baf6-4e31-83f9-2d5b28885760", "value": "fornoodler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819c2deb-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776801955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801955, "uuid": "efce0a50-fc53-4358-9012-acf32a85509f", "comment": "Malware payload (WeedHack)", "value": "e17698425567134fca2d2b3b3dc7f805", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801955, "uuid": "e5e4b206-77ee-47fa-b0d2-02f5c5c7157e", "comment": "Malware payload (WeedHack)", "value": "d16252758dcfc75597ab6f15222959c6e50d39d276123f0f21b5d47894396547", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801955, "uuid": "e3b21769-ee4c-4142-9f2c-20b1a7a4bc7f", "comment": "Malware payload (WeedHack)", "value": "da1c389d725a22095999cd30bc63118d6f5c4add", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801955, "uuid": "9925a75b-25db-411f-b149-9ede1283f202", "comment": "Malware payload (WeedHack)", "value": "995429042de6fcb0ea45424b6f47b9b0fcc4d6f8fed11fc91208000467f20ce440d233cdb340b4695a19ddb8082d2d9c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801955, "uuid": "ea8ed77e-9cf9-44a1-aadb-a1f947b900ad", "value": "T141A533F3C0011C21CD419E3549669DFEDEA7953C488F294E09F9960F27AEA8096B46FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801955, "uuid": "93a2c9f0-0e01-46b4-bf4e-0ed854b5e51c", "value": "49152:jVYgYF4S0n/dQ5jDSO93y0BeWGiT5tOIJglOELLVia6xWoZ1:jSFT0nFI9i0B2iTiwgHiaEbZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776801955, "uuid": "5a5d8f4b-6d9c-47b2-b58a-57ad808e6554", "value": 2098805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776801955, "uuid": "c73ee962-2cd7-4097-8905-69782de6974f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801955, "uuid": "8c41be38-a8cc-4d78-81d2-1e4318266a47", "value": "Example-1.21.113-.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17162dbf-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776783738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783738, "uuid": "d9900276-8cb3-4305-92bc-f2853c2f79fb", "comment": "Malware payload", "value": "9d40ce37c0d47ebc8597bdc909e1d54b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783738, "uuid": "bb1d462c-a656-4925-ad01-c10cb8b009a2", "comment": "Malware payload", "value": "d28186a36c795cca398beb66ead3c6b3c1969b6d71683aaacb8c20f25a719ae1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783738, "uuid": "43d13b39-6a07-4e12-aeb7-df3aee0d36b7", "comment": "Malware payload", "value": "37cac18c499d6f18e24064f710ed35930b70ed91", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783738, "uuid": "d24c9b74-fa18-4031-81fa-0fb757380024", "comment": "Malware payload", "value": "f7b89169db5113a53f151785d8fce0318988aaebd2673c26ca1dc1b20ef65c9b31338ed1fb57234358078160d3f54427", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783738, "uuid": "8a28e0d6-6fd4-4a2e-9b5a-df353ed1b7f6", "value": "T1D2564C3064DF8CF5E5BD04B3556F9A6D992DACF60B21C4C753D0BBAB18348F102B1A6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783738, "uuid": "1a669d91-a338-48da-ba6e-32bd1d897b20", "value": "98304:VJczIfuxFLLI8kXcabYT9VpP74P9RDzLjQUfFKa3aE:VGzIon8cabYT9VpDW9RDDQUfFKGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783738, "uuid": "2413f865-84ea-47e3-9693-b6c0ea585251", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783738, "uuid": "34a698ba-36e5-4ff0-9415-2b3b3892b7f4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783738, "uuid": "bc12b886-f923-4273-9814-40dc93cf75ce", "value": "resources.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b66698-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776783821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783821, "uuid": "bcc06187-7296-460c-ab3f-0886b00f716c", "comment": "Malware payload (ValleyRAT)", "value": "6e212c422f027629525b8c7dd76c1ce6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783821, "uuid": "ec145778-a5c8-4b40-bfd4-e20e68405042", "comment": "Malware payload (ValleyRAT)", "value": "d47aac6bf3946c1fd7b88106af11dfd32c7af3d9a72089e40ffef6555c9182ba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783821, "uuid": "e8b91fcb-24bf-48fe-bcf8-b262bd2b6b35", "comment": "Malware payload (ValleyRAT)", "value": "b426bccefc594180a23aa59610f1bee17697beb3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783821, "uuid": "26e62246-5544-444c-8b70-c7d4d1a0142f", "comment": "Malware payload (ValleyRAT)", "value": "8a4c4b7b2efd76de7a77fecbc3d698aaf78fa878a220592c0fcb5345909d6a30b1e979810870c6283fe5e6e1d7cc4c2d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783821, "uuid": "8e3bb919-511d-49a2-8eac-c76741f26b82", "value": "T1A3146C09B7A840B9ED678274C8534A17F27374191760AB9F07A447BADF6F7C0A63E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783821, "uuid": "b144f0b8-b39a-4222-985b-898677f07cde", "value": "df8990443cc127e2ffbb912633ffdf5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783821, "uuid": "c170d3f1-93ed-477f-ab9d-20790a2030af", "value": "3072:fzjeqPVo0z2rf3CV3odFWkh4bhX58HkWAySgFgOpKuXJKYGEWL:rdo222ReFW5158HbA2giXb5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783821, "uuid": "e0809c83-57c3-4198-be50-089ab027f46d", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783821, "uuid": "49c19ffc-e30e-4c5f-8d93-e62c44c3062e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783821, "uuid": "fed41201-367b-4b12-b098-a662e5e6af21", "value": "malware64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3640820-3d62-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776763035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763035, "uuid": "ce0809f5-991b-4333-b578-513c0b86135a", "comment": "Malware payload", "value": "5d52532ed7ba7d7b734bc9537c055232", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763035, "uuid": "1e0ec62c-22ff-4be1-8648-fdfb974c0f8f", "comment": "Malware payload", "value": "d4807c4d7c22bc335d1ce92243973fdc1232121f17d7549b1c315922f7d26403", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763035, "uuid": "0473e9b9-a7c2-4c69-a93c-aaff29d421d1", "comment": "Malware payload", "value": "83152b0c90defa20d57599b32a3987a2d849d9e0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763035, "uuid": "ae131586-e478-4140-b930-9fa9e5b39aa5", "comment": "Malware payload", "value": "6304679d0e982a63c47246542fbbdb6d1794a2e353794df3c63a79cf3b4f4cad2d8e100f70b7406212e39ad96a512e33", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776763035, "uuid": "bd7bae59-7809-43db-be15-847ef1ff6b47", "value": "T139D50C72F137088D88F7FE73BD84FF56C2A932219E7BE0A7A36544A5471C597640B20A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776763035, "uuid": "2ef8b02d-5190-4f8e-bb4b-49d428b9472a", "value": "1536:un9cqOncWoyqqq0KodrrxsNrqqq2sKoKIzC8PCUJKlpkGNe0TKodrrxJn9cXqqqM:Mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776763035, "uuid": "9f4d2bae-a4a8-4d33-8369-537a2ab494cc", "value": 2770508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776763035, "uuid": "3ed39053-cca3-4d0d-9dad-19871033d128", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776763035, "uuid": "75944245-96cc-4526-b19b-e422bed424fb", "value": "Request Qoute.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea15811-3dba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776800877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776800877, "uuid": "b18029b4-52b9-48b2-b3b9-2d9a4b07d778", "comment": "Malware payload", "value": "232d6503bc02647b36d15f355aa387b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776800877, "uuid": "2f5f6067-1e7d-4da2-842e-6dfe1cba1062", "comment": "Malware payload", "value": "d484ea47225bf44f74b8465b0309e242fc9567da0db77ba65818470293735ad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776800877, "uuid": "a9dd80b1-bef0-48a1-b68c-901d350ea685", "comment": "Malware payload", "value": "2c335fd89d45a2817cfbab12064842effbe0f5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776800877, "uuid": "66d5d1d5-77a6-4952-9b80-03fff579f439", "comment": "Malware payload", "value": "f60d5164e327d040f7efacd86d29c6c60d55ff9bc515182d3d8b08e0e43063499c456194be0523386d312c9fd9ef26e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776800877, "uuid": "a11a0045-33a6-4bd7-9268-5222988c4477", "value": "T1F3168E1BBCB96869D09AB13484736645F5E9B8051B2317D71AB0F3282F3B7E04AFDB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776800877, "uuid": "bd526ead-7dff-41ec-90aa-4689acc7a392", "value": "c11ad45cb168e1d7904acd8a3a64301d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776800877, "uuid": "44e74c06-a870-4899-a303-f34691a290a9", "value": "49152:n4VDdpkyUWJ7If0n8IRTZtXWn2rypDgcgpZcoM2jZ/Qc2obp:n4tWG20nF/9M9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776800877, "uuid": "37800e0d-6ebc-44b5-9ac1-df183e9415ff", "value": 4289512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776800877, "uuid": "54c415db-3aaf-4e9b-a9fc-2a140473917e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776800877, "uuid": "bfb46cea-c44b-4716-8073-a1d963d032e3", "value": "SecuriteInfo.com.Win64.MalwareX-gen.87813211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50ff82b-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775037, "uuid": "af927db8-b67c-45af-81e3-c0ec9abe2508", "comment": "Malware payload (WeedHack)", "value": "0bd7d658feacd1e9666e50b841297830", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775037, "uuid": "b57a2e21-3aeb-4e24-8915-320c05348a5f", "comment": "Malware payload (WeedHack)", "value": "d4a9852e1990e5f3b9e20eb3e4111482a6faf229ff94fd566f42db2d49de0622", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775037, "uuid": "b8b35d6a-e2a0-4d8d-a2ed-843f3ffc0ed0", "comment": "Malware payload (WeedHack)", "value": "776a1c2c3122f270a5affc35cbf37b1f0a29e143", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775037, "uuid": "45cb196f-662f-4d8d-9058-20a662cf6f86", "comment": "Malware payload (WeedHack)", "value": "44d9d96bd6f24bbaa6bfaf974cb24182f4830cdc2cd326acd0d50552a730dd1aad9565c16b4c14515aea5eec0c4ad3ac", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775037, "uuid": "9db343cf-5558-4f47-ad4a-b8bf6a77153f", "value": "T13A74E030D61C04AADA07B237E9102F356C4FE2C9B027620E366C9DD7895B5E9CF7466E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775037, "uuid": "2c4fc625-5322-4058-af7b-cec8447c46d3", "value": "6144:j6e4uVSXkI1iNVVuNZcHlU8U3vacPWq6/fZ6LaI3FRQDL:Z4uQXeV0LcHlm3Scqx6H1RM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775037, "uuid": "e3fff43d-28db-4b29-9a7e-4c391e54e5c2", "value": 361874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775037, "uuid": "3b4baaa7-2d9b-46e9-b290-418993081991", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775037, "uuid": "2bce0466-0fdb-4a58-90e8-6ec4a19e6793", "value": "d4a9852e1990e5f3b9e20eb3e4111482a6faf229ff94fd566f42db2d49de0622.file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a0ba51-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754719, "uuid": "a5858f7c-442f-4ca7-ba5d-22c21f84056c", "comment": "Malware payload (Mirai)", "value": "9513e32a24b7e5f8fce1adcf6c963674", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754719, "uuid": "a21aeb00-5bf4-4f5f-8fd3-d65809f1a56e", "comment": "Malware payload (Mirai)", "value": "d4aecb083f660af8901b06cfb181a6f5b40cfb19bf390272449b1f535d7e96b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754719, "uuid": "103e146e-15cf-40f0-8e47-0628f27c0a31", "comment": "Malware payload (Mirai)", "value": "dc5a3ab12f40df4e9cce356cf5bf20fd29d8cb6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754719, "uuid": "b2e29007-b061-4a66-9cf2-6556bfe1fcb2", "comment": "Malware payload (Mirai)", "value": "411b55d9be5350b98e1589523b0cd87cdd05ed12460e737e8a82ac20922702b59019df36abf577280053b4aa6314552a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754719, "uuid": "1d2f0001-895a-415f-8515-69e645b510ad", "value": "T13763394BA54550FCC198D17842BB763AC863B47D137EB2963BC8BF1B294AE605F2D40A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754719, "uuid": "dfd2df38-712d-496e-9dd9-bd4182c5229e", "value": "1536:GZ9CBJ9BdpojMJ2yFRP+UqajVt9hCi20hZ0j25s0zLmju:pf9BdpAMJ2yFRmUb7CiRb0y9Lmju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754719, "uuid": "9758a4ed-fdff-4659-a828-762a0dc30475", "value": 67360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754719, "uuid": "c3c42ea3-b006-441b-bdf5-5c591ecb4f8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754719, "uuid": "f108135a-1512-4393-8ff2-0c4ce94146c4", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c158b2d-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776807852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807852, "uuid": "074a662c-5943-484c-9781-afde17ceda70", "comment": "Malware payload (Gafgyt)", "value": "6eb21537df909eb6c081a54e650480c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807852, "uuid": "7c6e542f-8b60-4403-8076-2605ddb9a670", "comment": "Malware payload (Gafgyt)", "value": "d4dc96500a5f30db330e643488bb3d852a7b58425f67c2301c08a9b4e481a62e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807852, "uuid": "0e2306c3-bd27-40a4-bfa0-83e20b3af660", "comment": "Malware payload (Gafgyt)", "value": "2ce1fe6850ad192879211535dd689c17190aecac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807852, "uuid": "1f6ab143-b06b-45cc-8457-47d106daa276", "comment": "Malware payload (Gafgyt)", "value": "609ab40c5e6b056640bd6a7c78760d0710dc4551709c78cc2e372cf2f169ecab92f510739b629cb8a8c676c7da1de495", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807852, "uuid": "d067a41b-5597-4ead-9d7e-88412327ac16", "value": "T118F2F126E82D964EC1AA00711AEFF56E0434330ED25D09FAFE7915D94697F723934B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807852, "uuid": "9db59925-5a6e-4154-9158-35cdc329d630", "value": "768:bxtvZ6vpuEgK6N0co/UfSagXVwmLAXEkGZQnbcuyD7UryqQ4:H8263tFwskGQnouy8mqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807852, "uuid": "9c798e47-8f60-4021-9eb6-dd5034d2fd6d", "value": 36480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807852, "uuid": "2499c2e9-8860-449e-ae9d-e7471ea193e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807852, "uuid": "83debeb0-432a-446b-a822-8acfbd6e1d2c", "value": "I586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259ba8bf-3dd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776812538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776812538, "uuid": "ea0ec358-6739-46b8-b3f2-36b0dd122123", "comment": "Malware payload (Mirai)", "value": "621b0e38520e465fbc1650ea23636cc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776812538, "uuid": "8ab6bcfd-7000-469e-aed7-936f0724e729", "comment": "Malware payload (Mirai)", "value": "d4f0c75cc901dd5941875bf83628c3ae3084acf567488ea7e37712130ed060c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776812538, "uuid": "745a35ef-f915-4e42-b7a8-25db5903f0a1", "comment": "Malware payload (Mirai)", "value": "20ff631796b2fbd380f709bfb083044b81af002f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776812538, "uuid": "e5e6f816-0922-4da4-af3f-abc58fc34465", "comment": "Malware payload (Mirai)", "value": "d5391c1f378f05036f31bbbbf2e0177a6d2f590f2c67413597e930c5ae436c18c7277bf4958ba2264a5c5217e4b712ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776812538, "uuid": "a5b628a0-a7fe-4751-b3ba-b28e822bb4e1", "value": "T1009312C726C6567389BA0532CE7AC28631C58D7C8DB7E000674B9B2D5533E0E617A7CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776812538, "uuid": "84991970-a44c-49ad-bd7b-de7029e2ae57", "value": "1536:Xi4DoETPeRirmg3p5p8RM0rsXw+NGf44MD6I3xUu51FZgB7ih8lBT/8ccPkn42kU:ZjPe9g3pgnrQa44WfrsBe2sDk42kAekt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776812538, "uuid": "991ba6f4-b8a7-45b1-b480-819a0bcaaa75", "value": 90888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776812538, "uuid": "9ea8a690-65f3-4329-b681-7b9f57290e26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776812538, "uuid": "339f1694-989a-415d-83bb-971a2b9851a3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364c56c7-3d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775200, "uuid": "1c4f0568-5c00-465b-9442-392c4c884cad", "comment": "Malware payload (WeedHack)", "value": "07b826df02502b99b91d58dbd058b596", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775200, "uuid": "709f95fc-cdd0-40d4-ae49-85ec533a53b3", "comment": "Malware payload (WeedHack)", "value": "d50686e19bdac5b20800e9d13b9e7d0c3d7b1d852aba483f3301c65eab557c07", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775200, "uuid": "9dfdf827-041c-4926-b053-6be004234212", "comment": "Malware payload (WeedHack)", "value": "61cebbacb9cbe5b1cf815376a409683e30ef71c2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775200, "uuid": "6dffdebf-69d3-4e3a-830b-cdf7f3dddb0f", "comment": "Malware payload (WeedHack)", "value": "fc8674f6ada56aec6af41b181695339f7745cf3b645a66750fbe795cb51b78f7c0df94efb4f13ff6a64d3037d61425d0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775200, "uuid": "c09a1384-7814-4c1f-ad96-847f4f94697c", "value": "T19104133153489E35F823E7BB41474DE1BE5AEF97E0293D0A013D9B8E2C659717B23129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775200, "uuid": "d0ae5d67-733b-4949-9bc8-efc2a050e5ae", "value": "3072:4TjsGZGd/hxBBuXs2Oc9aZMY4VGkXEDIhmOH1QvbULnt7mOyALbKdmVfkD6zdltQ:4TIGYjNfX4gkXEDIhZavknIOJbtueBbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775200, "uuid": "7123f080-3215-4c08-bbe6-2e1d9efd68d0", "value": 188897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775200, "uuid": "ff61216a-82ed-4f3b-acc9-c5c293ece47d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775200, "uuid": "c3868145-267d-434a-8fdd-5782b8621429", "value": "ul0e8nj.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec56263-3d97-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776785818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776785818, "uuid": "cbd1b89d-4a3b-4995-9bb8-74c42cdb67ca", "comment": "Malware payload (RustyStealer)", "value": "8b3433597de3cc60d5762a7036ca534b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776785818, "uuid": "ff9078ee-6bb3-4e67-9caa-bc4c3d433765", "comment": "Malware payload (RustyStealer)", "value": "d6ca3760b43fdc9c099b9cb71777718927784a9a26df512a53cbd8810317a490", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776785818, "uuid": "bdebf495-69f2-424b-abb3-e7a85869fd37", "comment": "Malware payload (RustyStealer)", "value": "4adcb072129e2f23bd717b1cdf5ec4f992694b26", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776785818, "uuid": "f91d4ab1-9dcf-4a12-b7a6-c016cd069ddb", "comment": "Malware payload (RustyStealer)", "value": "7332d235c5d8b10a057f13acce26de2efaf103aff689133ef7f10f748147ebab888434011fe1166ce58e8444f7bb5217", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776785818, "uuid": "62c011c3-b661-419f-9a8c-de97cbb48b62", "value": "T1AC969D03E39181ECC45AC1748367AB33EA73F8894634B2AB5BD85B212F66F905F0D759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776785818, "uuid": "7db1e8f1-a816-49c0-a3b1-7229c9f5668b", "value": "be9db20a0a086f6fcf0e952dc3183a39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776785818, "uuid": "e2327069-dc32-4548-b851-458ec407724a", "value": "98304:bT1fllfu/h3BflpgjHiCmu0Yi8IMfEicdDkArixbK+s:XB8ngGC+jjDriI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776785818, "uuid": "73fa811a-36d7-433b-be19-0e75ee585e3e", "value": 8946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776785818, "uuid": "56fe1fbd-683d-462b-8a2f-eda9d29060a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776785818, "uuid": "7d6203c2-7bd3-4071-b98b-4a91d6fb4ba5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd2e433-3d77-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1776771726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771726, "uuid": "e3289f3c-dbbe-4779-b8db-86f1366dab45", "comment": "Malware payload (Stealc)", "value": "cef60f6aaf2a677f9b9410228a82acd9", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771726, "uuid": "ce178f46-1c05-4c4f-b45f-347529e6fa45", "comment": "Malware payload (Stealc)", "value": "d88968e99100502f4937c257b4b3fa7f4eb83f67f2f5181e8af1a7ea48567556", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771726, "uuid": "100a96e4-63c4-45b7-aa64-60163d59d550", "comment": "Malware payload (Stealc)", "value": "c716e8438253cb5e2e9d09ac8d6d1ea11e334f05", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776771726, "uuid": "5cb7d42b-006d-408c-bbc5-8586f3a937fa", "comment": "Malware payload (Stealc)", "value": "fa67a99a542df107676d3d637da575039ca5ee2e79252733460c1290a092509882a87c4d9da5713c30aa03423597c55e", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771726, "uuid": "0fecf51e-3b78-40fb-8477-697663474b2b", "value": "T13975495BBCE008F6D0AA9332496665A27B71BC450F3123D72E90B37C2F726E49D78758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771726, "uuid": "c854f370-f1ee-4ed5-81a2-71f3b729f8c2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771726, "uuid": "43281051-b160-45f4-9e5d-a51294cd1b15", "value": "24576:jpJKZErA3J9w4zYmGRjzFv/QBele5zKD9/no13V0b:jpAZQA3I40mGW2A13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776771726, "uuid": "466df357-e82b-45d2-95a1-8ddadf2d6cdc", "value": 1611776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776771726, "uuid": "05315f72-a0d2-45bc-8825-77e4afdde0d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776771726, "uuid": "5d6129d8-51c9-46b5-a52e-e8b2d91a081d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88018745-3dbd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776801966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801966, "uuid": "6d784a1b-8840-42d6-af26-37bf5771f8d1", "comment": "Malware payload (WeedHack)", "value": "717dc97576412d168bfa03157817a829", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801966, "uuid": "931a9bb4-e074-4821-9000-4577088c05e7", "comment": "Malware payload (WeedHack)", "value": "d9359ec9f08e56bec76bd3e188cc7bfbc5d34668a6b0b0ee279dd996e8986d73", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801966, "uuid": "f3ed95ea-a00d-4d4b-b726-599a7111d210", "comment": "Malware payload (WeedHack)", "value": "322ab1a5ddc84a0e7f2e81b4f25f1b19e7980795", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776801966, "uuid": "73a285f1-2136-41be-94c9-bf8bde6a6a53", "comment": "Malware payload (WeedHack)", "value": "019948e7751b985bf918905294145e6cadca3318414cb5d788a559fa21374a95e266d48eefcd28fc7a371390117a6b99", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801966, "uuid": "922da64c-a708-4e68-ac7c-dc3b0ea9a8e1", "value": "T145C2CFB3A52E5C02F583A2B4F9001DA1698F4FE42109311B51BA854B3CB7BD6EF4E6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801966, "uuid": "db05b3f8-3b54-41c6-840d-151b83691760", "value": "768:OD9np4bNjxGznuLMbnwXeJfcNej6XYlbp7O0:OTGNKnQgwXa0MjUYlb5O0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776801966, "uuid": "b29e4c9a-8a0a-41a4-b489-71a05c781baf", "value": 25741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776801966, "uuid": "373c951a-e547-4af8-aebd-2905c3f01e8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776801966, "uuid": "fbc65470-48fc-4240-9a42-08578027a3a1", "value": "GommeHD_Verifikator-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e58ec7-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776733476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733476, "uuid": "77d29b85-213b-4c4f-bf4f-c843f7dfadc7", "comment": "Malware payload (Gafgyt)", "value": "8af554e819058f61c36017d7cd303917", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733476, "uuid": "794aad5c-a3e5-49f9-a07d-0b5f46924197", "comment": "Malware payload (Gafgyt)", "value": "dae87d66651b2e2c28511450b30f37f741fb16068afe6496ea406b5e8a185ecb", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733476, "uuid": "a0a5d17b-1b74-4c6b-a353-37b0f329a84a", "comment": "Malware payload (Gafgyt)", "value": "d6808505e6736e01a4ec2fc6cedbaebce205f118", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733476, "uuid": "d6af68c5-19c3-4717-8c95-b318fe796b8a", "comment": "Malware payload (Gafgyt)", "value": "ffb56c46e07a7bbf2e11b940d09a2386931391a448b542ded177fa30b557880a5d5dcb0f4ba3a127d3a992248e81952b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733476, "uuid": "30ffd213-5274-40d6-b880-984fcceaa0a1", "value": "T172C33B06F5518B53C1C3177AB69F521977232BF897CB33229624AFB42BC179A0E3A950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733476, "uuid": "fbca748a-f456-4a7d-a642-ad9dc27ecfa9", "value": "3072:kdxalJfNQa2BJNZt75hO3K5HoX0BbmOQUJ1UXpTn:YxalJf8t75hO3K180BbmOQUJ1apTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733476, "uuid": "70471954-8254-48de-8441-07a259bb0518", "value": 118812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733476, "uuid": "f5876466-35bd-4c93-b22e-7e0da5e2f549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733476, "uuid": "b353d2c0-89d4-40b3-808c-5d761f3d7891", "value": "assailant.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733748cf-3d4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776754686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754686, "uuid": "5a108c37-49e8-43e7-9681-acdc248eac66", "comment": "Malware payload (Mirai)", "value": "80f98a8860dc59aece9135239818e16b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754686, "uuid": "5423ea05-cc7e-402d-b8c7-67e48aec04d8", "comment": "Malware payload (Mirai)", "value": "dc0853f8854f97de708998a5204d01b65d39184664ff9ec354182705a993da8b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754686, "uuid": "966cbabe-8d98-44b7-a194-a2dc93b3075e", "comment": "Malware payload (Mirai)", "value": "bca9d02aa7ea66ccc53bb0e89ca7d5e1bbddc180", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776754686, "uuid": "04616369-8ff0-45fb-a188-a815f2b41ee2", "comment": "Malware payload (Mirai)", "value": "83bc15bcaa21246347154b882ffb3034b4627dde7a396c42e7c94c8bb87fb868d3f3ae659005edfc8e530611a3577e24", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754686, "uuid": "4fef9f61-dc72-4e8d-bdb3-94d905ab4154", "value": "T179E2F1A39371A052DE7837F6F85A86CE2B7D4FACC57A70B3160066282D9A0435F3C453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754686, "uuid": "934a2392-3263-4e59-a3f8-06ce5477f603", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9XS9q3UEL5Io:1orm1vpALgUJHLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776754686, "uuid": "c499b6c6-9f25-4a2d-9045-337cd62c7429", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776754686, "uuid": "cbbfeff8-9af7-42cf-ad65-8315aca90a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776754686, "uuid": "459b260c-0bcd-4a00-9d3f-bb4e494f3921", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d038342-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809249, "uuid": "b49d2490-fec2-46f6-98de-92c44956830b", "comment": "Malware payload", "value": "d73a34afecea3746f00fb83812aa9374", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809249, "uuid": "a9f31e09-1207-499c-9ed6-bd4c35581e6a", "comment": "Malware payload", "value": "dc28c611331aed921efe5a499564b104cc9462844ec98127d83c2845fce3ba52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809249, "uuid": "392cbebc-d20d-4008-b6df-4a2101a66917", "comment": "Malware payload", "value": "a0e16df86defe0686c19c573f43879c051d7eec3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809249, "uuid": "756c58cb-c88d-4be0-86e9-ae5736170258", "comment": "Malware payload", "value": "2d77478f4dd6683796a7eecefd4186cc0e567c5d06fd022222b26dc8abed043ac1c928052c982ea7f3a14a2c6dcf7df1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809249, "uuid": "31a2bc23-f4de-4def-b710-9273575f7373", "value": "T177763911FECB14F6E943193145ABA23F63325D058F24DBE3EA407F29F9B7A951932209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809249, "uuid": "f2e5a778-8ce9-4408-8251-ccf8c5c667ed", "value": "49152:D0XbyL+GMXf2djWWj07+1T6By2/Cswsj5zB0emHrLIWoYCk1PQswkAhZPpmfssG5:QLyS+80372bdBiPfofk1Wr5ZHEtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809249, "uuid": "bbcca7e0-d841-414b-a01e-afdfbcb45875", "value": 7319736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809249, "uuid": "4935f3e1-c1b2-4090-a8a5-0c8d67b249ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809249, "uuid": "e94d5614-27d4-47a3-9025-a2bbe6885c20", "value": "h3flood.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1121b581-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776807780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807780, "uuid": "f1ce57fe-c6aa-4638-a1f8-7043f6590c73", "comment": "Malware payload", "value": "3ec162612b9139ba70ac9e0097ac99be", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807780, "uuid": "8514255e-8125-430c-8f5b-aaf9b3f8bdf4", "comment": "Malware payload", "value": "dc45c85532f020671784683a6cac2eec511fb85577e4efd17f415cec1e79f131", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807780, "uuid": "1678809a-38da-4121-8b57-a4edd68e98c8", "comment": "Malware payload", "value": "988c672f144073903276f1ce71d74752179450dc", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807780, "uuid": "4919d53f-4368-43fe-8221-e38976fc6358", "comment": "Malware payload", "value": "8e10d851ad204b06fc4b3f2df97a5b8a512c81a0a13d64b2235cbd40895f4700e08534d1326662aa43d3ae3d4687a63d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807780, "uuid": "7ddec68a-f061-465b-acc1-fe509ef04f77", "value": "T19941A61E23D40264C4A28E56849B6683B64A464FA04F0D453F4ED2C66F305FCCFDBDC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807780, "uuid": "9da3ab6b-1d44-4e03-b75a-9020713602f9", "value": "48:S7vM/WAsdwTG7AOpFLZmF6h6JtPkDeeTkQbEMt/kDeakAHb:SYXKwTG7AOpFLc9+Dob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807780, "uuid": "3101d476-86b1-45a7-9856-56d7b53e56e1", "value": 1954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807780, "uuid": "0c4471db-c1c7-407c-8650-fbb60734d6d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807780, "uuid": "c30edd1d-587b-4702-8780-f46658a512da", "value": "216-146-25-163.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49162348-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776807873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807873, "uuid": "6dd7ca15-caa5-4672-8001-9474060de0b8", "comment": "Malware payload", "value": "3c71b3c21fa904ee1a47ed364eb19670", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807873, "uuid": "b11a4b46-2da9-4d24-98a1-a2d117fc1da3", "comment": "Malware payload", "value": "dd3298f0c1c727b71cd49cf2e2757dc88c9dae4b8a5dd3727c69ed61f72ed6bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807873, "uuid": "83cd9bf9-6698-40a7-a92b-2fbfdeab135f", "comment": "Malware payload", "value": "a7d2ff85bc18a2bce51e047be3c82f6992405d44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807873, "uuid": "92dbf05a-d974-4cbf-b152-dd47cf29973b", "comment": "Malware payload", "value": "f7c54daff6da560555a70f44638298be0d81120fdcb1a15df0aef62b705ac9bb6180a4bee069c85f968dcd96da4c9de5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807873, "uuid": "4c1498ff-500d-4cea-acdd-a57ad0d95e6a", "value": "T1AE13F20FC9286EDEDECC4D341AAE67259AC1F18DAC54DBC817866659DF1898373CE034", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807873, "uuid": "b6b5c0b3-1406-49e1-8b80-da553dc5b838", "value": "768:4uZ1rKzM6uUDWrly8uqvX08ai2SorAWEfxaSCi21uZMHXsCqZA1WRq0eO:v1MM26ly8fvz725zEfxM1X3sCqK16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807873, "uuid": "81e71dcf-5d88-4e0c-ab04-f514acf8264c", "value": 41424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807873, "uuid": "110a51d0-6669-4b2e-b3cc-b4c66a7cf1ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807873, "uuid": "1c629bd7-5bf3-4959-bb22-b0037b01348b", "value": "MIPSEL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413180a4-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1776783808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783808, "uuid": "aa79a90c-d06b-42c9-940a-94c358f50715", "comment": "Malware payload (Stealc)", "value": "8ddf70f0051c5e63dc257ece46d7c392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783808, "uuid": "12134c23-0c89-4024-8905-1aa341d3fe01", "comment": "Malware payload (Stealc)", "value": "dd39ea7f1b04393f672dff7ec34678c708949f6dfa388591c92bfee1f1696f88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783808, "uuid": "f9e83bb3-a212-45df-9cef-f4c11f700fdb", "comment": "Malware payload (Stealc)", "value": "f46f503b49c822b6259205e5cbd06763a96aae8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783808, "uuid": "d4d1c515-646d-4f5c-9d6d-17f1ad71fd39", "comment": "Malware payload (Stealc)", "value": "339d93635bbe638cafaca2ca8bb750375578834a4845a7520848d2e587c60ec98d809a1e50e7fea9c77a806ea63da79f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783808, "uuid": "73db8fc2-b2fe-4816-8706-25fc4e2e994a", "value": "T178F48D5EE7A502F8D0BBC178CE424552EBB2B8155770978F03E15AA61F372A05F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783808, "uuid": "e4e71073-9aa2-4d53-8e3b-d96d470fcc13", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783808, "uuid": "9560db1d-a993-4c3c-80e4-0a75b26fd52e", "value": "12288:XU8VHX4ZPBuvzkOkW7UE+YTRqwJ4tdnDv3YZtF15kjHKA:bVH6BuvbkW7xXVVmtdn73UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783808, "uuid": "6a2a6f93-9a16-478b-afa4-594672d74e63", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783808, "uuid": "f23b71e8-4203-453e-a45d-734f83b70298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783808, "uuid": "44a2e474-6447-4cf0-9a50-7cbd37e21ada", "value": "buildx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a6982c-3d79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776772815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772815, "uuid": "3a65cdbc-d46f-4b48-8875-c2ecaecef4a5", "comment": "Malware payload", "value": "30e681aa4a1ffc8b214b15065be9610c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772815, "uuid": "538f0a86-826a-4b8c-a685-b73fd0dd3f8f", "comment": "Malware payload", "value": "ddae94c0848fe81889b8b8c6489a2179fa964c0314687fee771ed16f9cdd08f2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772815, "uuid": "00d9a5ee-009a-4f41-a33c-f53b3d7235c3", "comment": "Malware payload", "value": "c9f93d0d56bee976ef91a6fcc7749a83ebc17e6b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772815, "uuid": "ec05bb43-da3e-4ede-96d9-e25c4be42032", "comment": "Malware payload", "value": "60f0b3d86f5df57e4f8282b8fe260d86c3721961d6bc093c30e41740f56f9ba7a91ae6c9c4a14ab918f2d9d4dc786a44", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zloapobikahy23-bond", "colour": "#2CABCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772815, "uuid": "e640bb6d-0d79-4405-92a3-aaf424822447", "value": "T12D34F94C678E70CD117ABE7766237043B67AD8C2B60C8064F9D7759FFCA432A8499E24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772815, "uuid": "ba2413bc-28c1-46a7-a6d9-3c170bb2ea41", "value": "6144:/l5YTutWmIDeIuXYtf+RfNK7KbRKbH/OOoYx00RePJA:/l5YTutWmIDeIuWfofNK7KbRw2OoGHR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776772815, "uuid": "4250c002-6e56-430b-8cf2-524d34919777", "value": 238193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776772815, "uuid": "2f8448ff-0548-4aa6-bd0d-a945fe5948f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772815, "uuid": "40e77c49-7388-43a1-b68f-ab51f59c3c63", "value": "ddae94c0848fe81889b8b8c6489a2179fa964c0314687fee771ed16f9cdd08f2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6683090d-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809211, "uuid": "0c64bbb1-7c32-497f-8dd4-3d344c941934", "comment": "Malware payload", "value": "c7b38240306cb5ec12c373cffc8b4c0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809211, "uuid": "1a28ce9a-21e5-44d6-b733-bf19d91c59c7", "comment": "Malware payload", "value": "ddf667ff96d1aedeca398f9b7245dc8bd55fda4a895a52b700ed3e65e9b8ef88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809211, "uuid": "e85c5ab0-4c3a-4196-9a98-11b7f4c81f98", "comment": "Malware payload", "value": "f1125078727b88825c615154b370345c1efd2595", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809211, "uuid": "79689655-4827-4642-b9fc-199ab6380dca", "comment": "Malware payload", "value": "62e0a589dc885bc5ab17aa084215d061eaeb0b5ed0951b8b2c8c6adc4d40beb85182ba6246bd1297f12ec7fe302e4114", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809211, "uuid": "a709d7e0-ea6d-46cf-9ad5-3aafdd99fc96", "value": "T14F766B09FD649FB1C6A402B689B812542371AC026FCB4717A634F33CFCB66D4EF46696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809211, "uuid": "001b867c-edd4-4a96-b4c1-299ac290c4c0", "value": "49152:zICakRmoU3x6SjUHSB8cgD5bWyP6F9J1wPssG8I08dIf3uxAu30l9cYqEPUXyVPn:3akRm16SjUHSB8cgD5p3UEPjVYE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809211, "uuid": "9eeafd94-e236-40d9-b25d-9e698d9eece1", "value": 7209144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809211, "uuid": "f2b7a92b-3772-484b-9690-9fa8da0ced3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809211, "uuid": "51a33694-514f-4185-9291-7fd091ca2e9c", "value": "h3flood.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c39ee6-3d73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770278, "uuid": "cde79dd3-81f6-4818-94f6-4cd067adc688", "comment": "Malware payload", "value": "0a55991103cf852bf17f90309e9e32c2", "object_relation": "md5", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770278, "uuid": "3ecffe11-464b-4549-b9bf-7efe583aa776", "comment": "Malware payload", "value": "de0200651bbbefb3a525bb471bba195179d4a13f74f9a082b66cd6b35e1098cf", "object_relation": "sha256", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770278, "uuid": "6e4778df-85cf-4f57-b257-82cf9ed3528a", "comment": "Malware payload", "value": "4fd659ccc8f1a4169a1de0b7d2792612fcf6362d", "object_relation": "sha1", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770278, "uuid": "9b4a7aaf-607b-4dab-bcbf-8074cd7a9200", "comment": "Malware payload", "value": "b746db3ccb6547621f34d8bc6b6d704812e5af4e781b701a2ad99ab30d5f532c7c8d5cff98982d2a00d438fec315b28c", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770278, "uuid": "4fe80cc5-b7a9-4618-8a20-75b5c4973299", "value": "T1A3E07D18962386B72306C1ED5525DD14D2C682F161C69F1E5B00D85B5441735A5CD2DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770278, "uuid": "3ade5196-4824-47f6-a323-9a3a68d2ef48", "value": "6:Rjj9K1tFEHsa+9U/y/CdjVAjlsWygDFThFqPMMvNhn23f+hT+v:pBK1HEHAU/ao+ls8Dd2720Kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770278, "uuid": "7c2af91d-071a-482e-a840-fa31abd7eb9a", "value": 322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770278, "uuid": "8efe8520-3ccd-4c4d-aeb2-62dec7c98e89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770278, "uuid": "4b37e448-f13c-468f-8cbf-bff8bc5f4c8c", "value": "wr.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c7910b-3dab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776794345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794345, "uuid": "f43e956a-6909-46fa-916c-94f6c9a85f2d", "comment": "Malware payload", "value": "c2e5c4adad409d2bc85d8a10ed424786", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794345, "uuid": "f7890ec0-017b-4a85-a2fc-af58a48b328b", "comment": "Malware payload", "value": "dfee6ea9cafc674b93a8460b9e6beea7f0eb0c28e28d1190309347fd1514dbb6", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794345, "uuid": "270c3ab7-757f-49cc-95aa-93b64d2e6fdc", "comment": "Malware payload", "value": "0d55ba7883b0732bf99cc0aa8d9e85fb5c56513a", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776794345, "uuid": "eb93b2fc-e925-4310-9ee0-1345e396d0ed", "comment": "Malware payload", "value": "4a0c959343df66a63461bf05e2121861286744976a9374b35b7922662e90ccefff8b691bf11450194c65b0f0f7cf0e95", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794345, "uuid": "2bd399f6-7bd9-4b64-8e5f-4e6d5e5adc83", "value": "T16095339BC0A9181EE10C657B84D1B9FA4C2926B6FD0E21CE469C45D843FB5F9CDCF682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794345, "uuid": "6dc72487-4468-4549-bbf8-c648993c72a5", "value": "49152:xzLptb3G987QsMvsI6i++7HQA2lHzqJLjjw44G5B44N:xzLptb3+sB+7Hj2pILjjwyBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776794345, "uuid": "facd383f-d810-458c-b2b9-98a2c3a234f4", "value": 1931674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776794345, "uuid": "c74f0171-cb7f-4c78-93c0-5f6f0779322b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776794345, "uuid": "0011a05e-64af-4207-90ac-c18cebf2a147", "value": "TeamsApp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1a149f-3dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776806405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806405, "uuid": "1077c515-f5f6-46ac-970b-3118a4be7077", "comment": "Malware payload (Mirai)", "value": "686cd3f8d6c8d5c13561132d9b2b17b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806405, "uuid": "83210157-0aad-4f9e-a25e-b1506780f8be", "comment": "Malware payload (Mirai)", "value": "e03f6f03e10614404620ee4965f8281bd6b9737531d880f98f8a1dd4325c67ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806405, "uuid": "bf2ecc24-552b-4124-829d-9e721af297b2", "comment": "Malware payload (Mirai)", "value": "b76d36814c968625c19e416471bef35c84ce47af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776806405, "uuid": "e3222eb4-9f35-45a0-8e2b-bcab36545c52", "comment": "Malware payload (Mirai)", "value": "c9d36ee6a767061979d88f036349acd4199318e69dd44dc2f56cdff4a55d5d81fea6584c905cc7ddabd5efb59a30156d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806405, "uuid": "c129eba8-5578-457e-98a9-c033cd5b7d1e", "value": "T1BD735C41B3480D43D1971DB03A3F2BD597AFE9D122E4FA856A5F9B4681B2E33144EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806405, "uuid": "0e1e58f2-7a7b-4e53-9980-f504e68a01a4", "value": "1536:blSeTsxpNDXSo3NFd8YnulS7IJV+OtPdas0hOw:JSeQjNDCMw07IT+sSOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776806405, "uuid": "c2fc466e-223e-4658-b111-91051e9a1e0f", "value": 75432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776806405, "uuid": "dcfbab8e-f6dd-412f-970b-2ab87c72ff44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776806405, "uuid": "cde7675e-8239-490c-8096-bf9d41c4720a", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71c3ea8-3d46-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776750935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750935, "uuid": "53d7c5b8-c669-4913-bc15-faa5ee1901d1", "comment": "Malware payload (Gafgyt)", "value": "239e795974e01f2c3ec65e62571379fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750935, "uuid": "fc796aa5-32d5-46a0-99ee-36e359103461", "comment": "Malware payload (Gafgyt)", "value": "e08ff933a5730f0e9209c75582a193ac9a3cf4aec9db9af8c2152205228cec84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750935, "uuid": "939b1600-9555-45b5-b0b5-bd8ebf2db895", "comment": "Malware payload (Gafgyt)", "value": "3eb6baa2b7a562ac7e731dfbb4600752cf18a0f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776750935, "uuid": "f5b5a7e8-4ed8-4064-84b4-0c41a447bebb", "comment": "Malware payload (Gafgyt)", "value": "df53623c92723b40d85bfdacf4bb1defe378d2da816402240c01caed3e7a8459507c87d7cd96e63f33112681ddfcb756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750935, "uuid": "9bd63185-764a-44a1-ba07-809a5da8b063", "value": "T15BB34B86EA52C9B3D09306F117AF5B114A32F8BA1F1BDE41E32D7CB08E51185B51AF9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750935, "uuid": "ceeb9b69-b2a3-4b8c-86b4-e664d677116f", "value": "3072:gu9ftHJNdyM4tRXRbL05bj1R9TJ31Zr/HFWTT7m5lfnkKzIUnAi8:bfzN4M4tfbGf9TJ3D/HFS7m5lfnkKcU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776750935, "uuid": "171b5a04-d41e-420c-bd6a-8b7884ab2c55", "value": 117212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776750935, "uuid": "196dba64-cf4b-45e9-8bb4-1a6578c138e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776750935, "uuid": "3c3111c5-2c22-4738-ac37-9237950c488c", "value": "FBI.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0975d75a-3dd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776813780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813780, "uuid": "182ad6f5-e8c8-4eaf-9521-6e26dc3456bf", "comment": "Malware payload", "value": "cfa0a687cc19b585bda3b25760b92d7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813780, "uuid": "829ab3aa-b97a-42e6-ab36-c372656bd932", "comment": "Malware payload", "value": "e1379c69c00c70711d2d2422a5a7610194686c5f13bf40b7697a165dcc4c679e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813780, "uuid": "8aa0814e-c5a3-454e-abf9-0fe90447fe72", "comment": "Malware payload", "value": "6f0ac0bf86aeff96ef1b85f87a2835f0abe4ab22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813780, "uuid": "49038074-2485-44af-be2c-909c98f2b1f3", "comment": "Malware payload", "value": "9af3c8fc48936b33afa8fb6941a42942745e05149a2122dd99b69b17072d6abf1a30ced63e0ef70c88a2c8c152271744", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813780, "uuid": "11e9f056-5c96-47ad-af67-460d5377a1c1", "value": "T1A8630206D3C2B7A7FF81097093830B57A985147850A938ED3247089CA8E2CAFDEDD4B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813780, "uuid": "7a6537a9-3781-4e34-a498-ebd25ddeb626", "value": "1536:BSB4vLZqc+pF4asDGXQ7FkHJsHZVRvnu7jLotfP1qtThu5:VLZql4a8tF0G5vfuvLotFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776813780, "uuid": "1cf8274a-e07f-4048-a750-e8f38b0612a9", "value": 67060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776813780, "uuid": "8e78cd74-eae9-4167-8676-2ff04870492d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813780, "uuid": "ea9a369b-0e12-4c9e-867b-990a3410b99c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb49c310-3d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775074, "uuid": "747a927e-cf43-4d05-8b2a-90a827637d58", "comment": "Malware payload (WeedHack)", "value": "7ccb021a37e239933b726bccd29da7bb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775074, "uuid": "a7220734-0ab4-493b-aa7c-e74d4d16e9a3", "comment": "Malware payload (WeedHack)", "value": "e22332ee417dfe6a4d75c54eda01d7151b5a3184209f1365c9d6285be8bc8550", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775074, "uuid": "b94a4ea1-0c11-4240-89cd-63ca28c44e28", "comment": "Malware payload (WeedHack)", "value": "7d889b70d36061a1edb10d6a41d7b0d0e9a41dc6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775074, "uuid": "8f312e89-2c0e-4ee4-8eb7-a67f7d2659ac", "comment": "Malware payload (WeedHack)", "value": "68c25a62e9abc07052187a0d9a8b0a02d77082cac5cc57e17c8b3b3c623632b06cbf009844021713861d8e57821b0a93", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775074, "uuid": "19df462a-3f21-429b-ac4c-bfcbdcc9f1b7", "value": "T164C2C023AD619429EFC3CF76D5FC199D614C46CAC18FFC4AB87446B2822A6D8AF10774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775074, "uuid": "a39cfe97-5d88-4475-a69f-84f539c5c791", "value": "384:Ev3w9gntHCEUe3C8NzoFX5vkTZkm6jeB2ZUWtRFZ3bCFLgr9OHuUG/YHTioccR:EP9noEUedNzkXhq0eBabCdEbUSHoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775074, "uuid": "94683f28-ae0c-46b5-9c58-e49892024cb5", "value": 25753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775074, "uuid": "80719316-dcbf-4e85-a998-3fde5e95cf82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775074, "uuid": "4dd3d8ce-a7d9-4329-960d-f9db449f264b", "value": "Example-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8eacce1-3dd7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776813215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813215, "uuid": "0e1a74ae-63ef-439f-87ae-a86d8ab00cc5", "comment": "Malware payload", "value": "791541e4a6afbf30dba09f7e8f90eb44", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813215, "uuid": "0f1e5cd9-0714-47eb-8737-a724f1e501a2", "comment": "Malware payload", "value": "e2fe38070742fd54e7a073147e4ed1daeeb28c5c4d33f541b956ec395176a16a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813215, "uuid": "e664e5eb-fdac-4c87-bcd1-a6966c48b38c", "comment": "Malware payload", "value": "b308f9776f136a95a4957b0260a098ced62508bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813215, "uuid": "ddbc3bc5-1eb4-463e-ab7a-7efe9321b06e", "comment": "Malware payload", "value": "722de7ee4b9fe78bf1353de4efdd9f4f18e73dfa5532be9405bd3386c6c4f799c5662b6e2048dfa286a8247838be46c1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813215, "uuid": "e6c13ace-d15b-4a15-b385-4fe4147a3980", "value": "T180A27D7620F08A735A9015C4B37317A15FB2955745A320B8B4FE2B399F69B03B4FF621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813215, "uuid": "49fd4a8e-75f9-44ee-96c8-1995589097b9", "value": "192:c5u5K6L4hvZ5mN9oKNpivjFV3+gukIFzITh5oeyeVeO:PL4hvZ5mN9oKNpivjF9+gukIFzITAXGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776813215, "uuid": "25c0a743-5abd-4cb7-ac60-98dda498c15e", "value": 21850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776813215, "uuid": "4464a257-d5b8-4b51-9131-d8aa0242261a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813215, "uuid": "7841d693-7df7-463a-ba42-20473f08d79a", "value": "e2fe38070742fd54e7a073147e4ed1daeeb28c5c4d33f541b956ec395176a16a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f14d577-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809199, "uuid": "e03b2c71-14a3-4d1d-bbcb-6611c042b475", "comment": "Malware payload", "value": "29f356711a90f1a89b3dc2057bdd9eb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809199, "uuid": "aace80cc-7759-4c6f-bc2d-6e3a6babc9fc", "comment": "Malware payload", "value": "e321207469d4c3fa0300fac38e14686c1fc6e7d2812f46fdbcfe28cfa7aa857a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809199, "uuid": "76a2bb12-252b-4756-b8ce-062932d0f4fd", "comment": "Malware payload", "value": "43695ea336f70cfabf13ecddafc710ce8392f9ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809199, "uuid": "82017907-c397-4d9c-8a6a-98bf56aad1b2", "comment": "Malware payload", "value": "3e17bc3846ba2148401471602a5b5b0201deecbd07438ca62c4ad91b46dd64f12ae1321ce1c8f95eb621aea52b339425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809199, "uuid": "edcac31f-2e5a-41d4-a7c2-974730858b4c", "value": "T1CE764A43FC6555E8C1A9D13589629223BBB17C896B2127D33F60F3382F72BD06AB9750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809199, "uuid": "7db71ab6-be77-4e0f-9cd2-c93078bc4cd7", "value": "98304:Jcntva/qObQQfSNFWYr4LERDu3zHn67vEz:J2dOcQfiyERoaYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809199, "uuid": "163bb0c7-5eea-421c-b30c-dcf53d37ec92", "value": 7627044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809199, "uuid": "bf03cbf0-5cf6-471f-9a1c-333e3d56cbc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809199, "uuid": "bf480163-5f82-472d-99a6-38c7838e2d40", "value": "h3flood.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265b4574-3d73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770019, "uuid": "38a51d6a-5869-4a91-bb8b-9c310d8f79e9", "comment": "Malware payload", "value": "dcd8ea8534bca6b63dcf67f494f7d009", "object_relation": "md5", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770019, "uuid": "376ad9fe-c4b0-44db-8b53-f9124da3c721", "comment": "Malware payload", "value": "e3407368437bf55d13712c831687ff9ec2cc366986873fdbebce1a91e68b6774", "object_relation": "sha256", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770019, "uuid": "e07d4959-35c5-4b6d-ab9f-1d36b52eab33", "comment": "Malware payload", "value": "24e67aa1ff48a86c56ba0e80b6b92c56e895f0e1", "object_relation": "sha1", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770019, "uuid": "b2959cb3-019d-4e37-8428-ac02d378db45", "comment": "Malware payload", "value": "e91c82afbc9a667fc5ea18be76f070cbb356ddc0c11179cc7d766f96b37acf871fb7ca8c60fef5088fbecec82d5035e7", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770019, "uuid": "54c5493d-0c82-41fe-a3ad-9407c8a97419", "value": "T15E3141C6751E839A77860293D6C7E85DB648C03500AD16D0F8BF0B3DA355C2AD99AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770019, "uuid": "7f58d402-67fc-4bfc-b7a6-5e178ddd7561", "value": "24:XFuSlK4agfAB9cxDQFPWFLQfAB4YcY2Nqdh2TqC9ci+CfABZYCXnNAo3jn6JhdlY:Xskkg25dEdfLSS2oL6XjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770019, "uuid": "ca040cf6-949b-4317-b9c7-1f209d8940ea", "value": 1665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770019, "uuid": "3ea619fa-0638-4b69-b6f2-58f54422441c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770019, "uuid": "a11ba510-7867-40df-95fa-d53cff591eaa", "value": "e3407368437bf55d13712c831687ff9ec2cc366986873fdbebce1a91e68b6774.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3952ca0-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808482, "uuid": "89e3e375-8248-4af7-bfac-1e4e47717dab", "comment": "Malware payload", "value": "9c0b5136c5fd2920549beec57f53bdb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808482, "uuid": "bae8d727-c7fb-46a2-9cd6-781374caf061", "comment": "Malware payload", "value": "e366d7f3786ea7e32f9e0c72906df50838637a21a5fabe2a461e4594b90450ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808482, "uuid": "90dda971-f75e-4845-9f4d-2442e4f12e15", "comment": "Malware payload", "value": "778f80ef1ac1a65afe23cdb87f9383f1d2edd746", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808482, "uuid": "e5834781-24bd-41a3-815b-0ec4bf9e8650", "comment": "Malware payload", "value": "0d833a630feb3c92e93b4d4b7a3db3620049425c2ddcac8e1dd67e51802d61a4796f957459ce48ba119325c4f7e82cfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808482, "uuid": "7f6ddf11-9a9d-4e81-a1eb-e5390b8e3a17", "value": "T165662862BF58DE5FD29632314AA6C23873D13D0081B021379756FB1D1EBE2A09D6BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808482, "uuid": "6d0aa816-8fa5-4242-bc6a-c05b655bbf61", "value": "49152:mpn9Q1DptgYbVLg/x1Y4Z2CPofHxvt5E1:mUCjPWRvjE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808482, "uuid": "27b9390c-c5da-4c77-855a-73d1bf91a851", "value": 6750392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808482, "uuid": "bc958c65-7d9d-42ed-a634-95bc45770241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808482, "uuid": "0e35d55b-4709-41d5-8559-e1bf2fed1086", "value": "h2stream.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7b32db-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808500, "uuid": "3aab552d-30ce-4c71-b378-1b94bc3e8259", "comment": "Malware payload", "value": "d8b338fc4f1f03af36864efde2e0cbed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808500, "uuid": "4d913a8b-c517-4b8e-9967-60921afb6145", "comment": "Malware payload", "value": "e38f99fcbd9a8062d1cf787b0f322cc436bcb44508a45f8599e9f0bcb9407ca0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808500, "uuid": "e553ac08-0085-4379-bd6a-0e6bff68a490", "comment": "Malware payload", "value": "2255e9384cd4ca770b6e9df090b2c2e34580e622", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808500, "uuid": "ca515098-678f-4f08-adcd-ca6fe8b50366", "comment": "Malware payload", "value": "8e0dcde5d57666e4f09400ea5917403bd7c1714f88d7d8ffa0ebd23f681b2b12372d4030f07d5bd6986bb6ac4e7aece8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808500, "uuid": "fcff09bc-d6c0-4756-9402-20888c594ba2", "value": "T12D66E909ADC42BF6C06C5A7494EACA5522706D144EF14A3626A4FFEDFCB62347F4788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808500, "uuid": "0bcc7886-c4a2-4976-83c4-4089d7f2ebf8", "value": "49152:AuzdeZGYDzXmaEWXB5/EOWb/+PEKpP973Ri4d5EO:AnXBpZPpdlzEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808500, "uuid": "9d5516f1-7655-40fa-97ee-a2e95f5485bc", "value": 6881495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808500, "uuid": "513a0ab8-f8ff-4b16-83d5-182f3bd5031a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808500, "uuid": "6903d52e-4cea-4129-a432-e04be9f14062", "value": "h2rapidreset.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb47c5b-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808448, "uuid": "fe17e356-d89a-4346-9668-ec0e0825e6fc", "comment": "Malware payload", "value": "58f7dc74444ed94b5be777bcab22decf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808448, "uuid": "7dcc8bfc-63c6-4d1a-b4ce-291950f5a8ee", "comment": "Malware payload", "value": "e423ec33d58e6fc9ea318223dced2046f687f7e8005deb43ceaaf5b330b36fd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808448, "uuid": "b7e3c4f5-9f9d-491e-bad3-e70915573170", "comment": "Malware payload", "value": "170fe79ebaf4743401c1f5b5c71b3ae74aace099", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808448, "uuid": "df96d29b-2fbe-4eeb-bbbc-edb83f085e9f", "comment": "Malware payload", "value": "d7035a2bdc3ab9d82d72fc558e630bca1e1c6fb3ce342ea1a7d5b7e30d8b6f479f78f471f879caef7d3505e3594134a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808448, "uuid": "86b9a8ec-212f-465f-ac35-0dd58224ea60", "value": "T1B7766C90F748A176DA4B0A3248630B70B3A16D42D2F48D2B4719F72F15F2AF7695FE90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808448, "uuid": "211d4e97-d5aa-4710-b154-308448c6ffc5", "value": "49152:ZPOdDvv2IpYuBO/E8coH7kpyAOj8sU3nolGvJ8nKssG8I0GIbCGbkoK5Hxvt5E+w:qHnnO/ErE7k0nU8VIb6oK5RvjEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808448, "uuid": "b7ccae2a-7e70-4308-8338-9cc817330117", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808448, "uuid": "dc1c0f15-5527-42f5-9fbc-b010ee8be624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808448, "uuid": "8d44a1e3-c4ba-4e54-8be5-d0c0f9b356f8", "value": "h3flood.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc783af-3d62-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776762891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762891, "uuid": "086d55dc-48c8-4496-beb6-e29caf73896f", "comment": "Malware payload", "value": "22710bc6d9ab06918928259018bd9813", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762891, "uuid": "04b05ed1-bc15-4e73-9497-2b6c6392f450", "comment": "Malware payload", "value": "e4390b6c526c0efc9ba624c413e5b6298105743af6046f42edbe49c98b63e23f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762891, "uuid": "3108f8f6-51bb-4f3c-aa8b-58b4a45991e7", "comment": "Malware payload", "value": "9fd7f31d8647f9b1458ff384ed97657476c6c8a3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776762891, "uuid": "15db5918-2a78-4587-81dc-f568fdbfe44d", "comment": "Malware payload", "value": "9cd87537a6bf84c3a5a0c2bd306c24ee7a27cfdc88a0bde62452b6cd5f15f9da290086cd1da74a71ad9e6dac756bd198", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762891, "uuid": "c61feef6-6edf-4ce9-9094-b67de0785fe2", "value": "T1B2641238AAFA0019B1B3EF54AEE47497D92FBB633B0E985D1081034A4623D45EDD573E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762891, "uuid": "3c88c2c2-e442-497f-b5b1-43613391e8bd", "value": "6144:FLjrud12VdNyrwjoqYjU/2LmSsKnlCI0pK/10Goz1xkR:JjKdANUwjoqYjUuq0lCQqGoxmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776762891, "uuid": "aa07b8f3-efb9-426c-a3df-b80c4aff8c4c", "value": 326032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776762891, "uuid": "2d1b92ec-1061-4a76-9650-db9b8f5fed7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776762891, "uuid": "e095d8f4-2b1e-4c8d-b35f-eef30b6b4123", "value": "Sales Order - Order Confrimation PR 1000838526 - 0061-26-EL-Q_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ce51d2-3d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776781664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781664, "uuid": "ea35959c-c1be-4742-87f0-bc7152ba2d93", "comment": "Malware payload (PureHVNC)", "value": "e419b1df2a90d3f7b4ff4959039dc47e", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781664, "uuid": "6ed28f28-ce6d-4f66-8310-b0835c7040dd", "comment": "Malware payload (PureHVNC)", "value": "e732340292d87dedb465dec61f47bc9241d7dee320c51e184c0d921ac2f30739", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781664, "uuid": "f50dd1d9-504a-4480-a32b-e3a88f3a7023", "comment": "Malware payload (PureHVNC)", "value": "257da29c694940ba014355777a91866c0cb02647", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776781664, "uuid": "cb3612ca-936e-49ef-95f4-a2ed2b868127", "comment": "Malware payload (PureHVNC)", "value": "9da1af387c036b9dd30767a1aaec232dbfc2d38310dbe4f4c9be9c3c28e6b62f22c146ad5ebc4ff455982cde90c37709", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781664, "uuid": "a346fdf9-412f-42b9-a49c-32fc100c7fb0", "value": "T1D6333AC1DD77AB0119733FA62FF48E05048EEA067BC75E9FE441D21B5110EA0DB6BAA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781664, "uuid": "9dea751b-b38b-40d3-92a7-80df14c90372", "value": "1536:wtU6ywVEkYts7gnpCpnxGWzmDqv1uO1am+mHpXXbOr:/FtnpCpxG6N1am+mJ7Or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776781664, "uuid": "e0357c4c-c55a-441c-b6c5-939b3a637a7a", "value": 53995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776781664, "uuid": "b1ad8392-2424-41f7-825d-9e3ac1da147e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776781664, "uuid": "b36d372c-2962-448c-b8d6-d0610913c4f9", "value": "gskqf.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b00f4e-3d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1776774520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774520, "uuid": "bd7f23d6-354f-4bee-b7a3-7010795f2dae", "comment": "Malware payload (Joker)", "value": "16d44bc33232ec35abda3510187926a5", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774520, "uuid": "232f622e-ae6f-43a5-8704-24340ffaa64e", "comment": "Malware payload (Joker)", "value": "e7aac1cc7c4c0d2100968c0cc8f38b7e4a0a6ed636c975b2f26387ad7e8f1636", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774520, "uuid": "e255f342-d0eb-40bb-bf68-c227c97f9a3f", "comment": "Malware payload (Joker)", "value": "006fa0523400c55c5596696f5b59e4e766e38410", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776774520, "uuid": "fc383f9c-fb3c-47ba-b5b0-82f95f77da67", "comment": "Malware payload (Joker)", "value": "e2ea40cea6d936457a6fb980c35351ab684726b8354a6d653842139a087e9b3dcff7e0c8a43e15268b2db479e48e80ae", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774520, "uuid": "a3480720-d172-4272-b667-08a87153174c", "value": "T18767124EFB0EFE1BC8BAB074D88A413235526C55A70187B76511F31C79B35E68E8A3C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774520, "uuid": "123f9a7b-a14f-4026-938c-2a7daf9121ac", "value": "393216:UH+GJ3EXMu68jpjNdZGLNd+vhf4dTks5SEUZh7aRdZTLNFvx:4+I8VjNyLnIhf4dgs7UZh2RdlJVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776774520, "uuid": "dc711f36-a678-47af-9039-b199c8eb7a08", "value": 30875869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776774520, "uuid": "c24f74d1-8bde-4e50-97f7-5878b4ba5a33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776774520, "uuid": "85a6a4be-1792-4cb2-90d6-1f9273bde55a", "value": "com.aifa.phone.files.cleaner_1.0.22.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddf424e-3d75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770945, "uuid": "ebcadbba-56f3-41e2-a5ed-a537eef84ce2", "comment": "Malware payload", "value": "7dfacb362f64422a603484237afc0f47", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770945, "uuid": "f3c4ca13-ebdc-4b72-bc7a-139de2944bfe", "comment": "Malware payload", "value": "e81d4ac250512c658409b2e828096e1bc82eb8c561bde247afd7754c3d4c4fc8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770945, "uuid": "1d2ac368-d0c5-406b-b8ec-b6d9b81d0b7b", "comment": "Malware payload", "value": "bb0c3731bc6886f9c34e503029882e6f1e13d222", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770945, "uuid": "5b7b0492-b6c9-4af8-8f35-4d20d24e60bd", "comment": "Malware payload", "value": "c41d860bb5acc5ee77649243831d5a9bce927a7fc560f14d855403dcdc0a50a847bfaee124728fbf7657a61add5478b8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770945, "uuid": "fcde86c3-9a15-447e-a2ca-1adaa75c52ee", "value": "T166137D6956817C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C59B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770945, "uuid": "8bd51117-fb24-4be9-b790-9b340540f2f6", "value": "768:b++G9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b++jcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770945, "uuid": "6c66f96d-da48-4bb2-a764-6cbb05647aef", "value": 45535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770945, "uuid": "9700cd53-47b6-4f28-81c5-756615a486e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770945, "uuid": "03fc36c0-6ec6-40d7-9430-8979657f9fba", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb24c06-3dd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776811369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811369, "uuid": "853f3d51-a97a-4b3c-b007-41ab983e4a16", "comment": "Malware payload (Mirai)", "value": "49e7cefd2b116ed1e51aa86af564ab8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811369, "uuid": "b36a6154-d69d-4711-9163-575b2c8fb581", "comment": "Malware payload (Mirai)", "value": "e8755beab3b011d91269c15a21cbc810536e66426c27a4b7d69b160f350ff6b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811369, "uuid": "c1684626-a531-4322-9464-23601442b2c6", "comment": "Malware payload (Mirai)", "value": "4e4a491f315befb22b3b3aa1907f9af5a7144abd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811369, "uuid": "bb88844e-6925-4e17-8875-5cfb801f1e15", "comment": "Malware payload (Mirai)", "value": "743af1b061a4046dd7853c9cb6464b62c861fc4306aad47b7100d85d631998e89bbb42b64963b3e2934d9772949b7501", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811369, "uuid": "44659e92-2e2f-4553-838d-fc557c5f6c4e", "value": "T1E0F21B075900662CDED1A8F4C90ACF21DC117A445E6F25C7F2E4FD564ABA3D8AD2FA8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811369, "uuid": "bc193d87-bc1a-43c5-a9fa-ec7daab2e6df", "value": "384:8vz8PQ4SUWJ0y9U2dLqcw0PYpGuZgL3g0nCeaWnVLrN3dwXDEZZDiJviNHtN7b69:8v8tSJ9XYZZgk0nC4XslVdEkSbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776811369, "uuid": "6f42402d-6206-4afd-8e04-550a20ba52f2", "value": 36460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776811369, "uuid": "43876844-5e9c-481d-bab4-5c2532d722a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811369, "uuid": "8ab59bb5-db73-4239-ab7c-8e2056e67e11", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e0a5d8-3dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776807846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807846, "uuid": "adbb9c0f-d60c-4530-bb38-4ae8cabeaca1", "comment": "Malware payload (Gafgyt)", "value": "a3641fe38ab804b68394cce42bfef7b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807846, "uuid": "d1a42cba-4045-4897-9bb9-74362a54a597", "comment": "Malware payload (Gafgyt)", "value": "e9196b1a7313c41b2acd6eb03f7424aada3d6229c5cb91c0b9856fee0cf24c1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807846, "uuid": "f52b746e-de7b-4a5c-85d6-300359b3b944", "comment": "Malware payload (Gafgyt)", "value": "902ba02355104c58e4839c1d6be345c0fd608440", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776807846, "uuid": "457936bb-bdb8-4e02-8ceb-b989594522b1", "comment": "Malware payload (Gafgyt)", "value": "8e0cb050e61cfe9efdc539e00d1a42ca1e43313d02f28e6f6a216047e92dde07d53d48285c817a34f917ff6c22f9140a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807846, "uuid": "546fb439-7c96-4afd-9cd9-a9bf4defee89", "value": "T176F2F230F3EFCBD1D9DB5CB02990BAD219FA58DDB341AD8C2DB52102251C7A69562FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807846, "uuid": "508f9910-64a6-4994-bd71-6fd75ba71daf", "value": "768:alOEohRt8Wea8RYzT3PEBWWkgbNsLOdTD7veV1t4uVcqgw02NWXPt:allohRww/6kgbqLaTGVD4u+qgw06WX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776807846, "uuid": "ed55fc1f-73d0-4e87-b526-6c17aa499ca7", "value": 36708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776807846, "uuid": "259da0a7-2985-4794-a517-de0896f1ad2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776807846, "uuid": "6068a942-c8e4-4e02-a84c-415dbc40e1ba", "value": "POWERPC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fbc9c6-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776733450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733450, "uuid": "430aee57-660a-4d52-acf7-d483b778b332", "comment": "Malware payload (Gafgyt)", "value": "605dfafae4afe7d85b1d0cf8f2b7d44d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733450, "uuid": "b1e3bd11-4a56-4cf4-a5e5-cf492fe5e281", "comment": "Malware payload (Gafgyt)", "value": "ea4260f26e3971a7b8801728fd96079a0b617672f55f3acf9099ea3c37003313", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733450, "uuid": "9c5a782f-bdb5-425d-89d3-64d3c9fd62c0", "comment": "Malware payload (Gafgyt)", "value": "ff15d713e1e578396d294c041c73c93ed489f863", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733450, "uuid": "4d6c8496-c230-4cb7-8a61-610ae7db6016", "comment": "Malware payload (Gafgyt)", "value": "f5ebc679d2a31b927db331d44286a7a16f5ef8d09164fc9387cf925304e1d81d9946eda01cf8fd87c11cef0f240e5965", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733450, "uuid": "bb1a1f2e-2c27-45ae-8f1a-e0bc1e7a8fc4", "value": "T171A32B05F9114763C1C327BAF68F434D3B2667A957DB3302AA357EB02FC27991E25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733450, "uuid": "7a530d35-83e2-4d6d-a230-db9cfcc29159", "value": "3072:AWJSvCaOFM5hSWU5rKYHmCyrQ0Knm4XnTe:lSzOFM5hSNKemCyrQ0Knm4XnTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733450, "uuid": "ac90d908-b2a8-44ab-acc0-98f18d57ec4c", "value": 103742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733450, "uuid": "380fa290-fe44-43e4-9ac4-ffb07ada8980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733450, "uuid": "004e8e31-9b55-4dcb-b372-3a5508e68763", "value": "assailant.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7f2dd3-3d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776733499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733499, "uuid": "755bd014-2ce7-4253-aa26-96313048ed38", "comment": "Malware payload (Gafgyt)", "value": "df099160152e6c1bca78b50d6e852f67", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733499, "uuid": "915a02b5-2061-4003-a60e-f96272ff76b5", "comment": "Malware payload (Gafgyt)", "value": "ea5a5bf8d66b961eb51215df77d5d32a874e3e08379dab0b647a6584eda5fc7b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733499, "uuid": "b44ee384-af49-4c3e-8769-f15c441ef731", "comment": "Malware payload (Gafgyt)", "value": "e8e1724d5d2107872cee481f0ae1b369e49b4a55", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776733499, "uuid": "e388fb44-8fdc-4ecf-ad6c-3500577316ab", "comment": "Malware payload (Gafgyt)", "value": "d4bcba834f0a786264cf4dc5db26b02111c606a5137b444406fee0dceb06beb01e9b7f107d10985a880d332981414c1f", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733499, "uuid": "ea1973cd-a485-4214-9b9b-60030bb2d1f2", "value": "T164832A03A8264E77C0477AB925AB5A300753FDB70B5B168671289DF446878DFB80EFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733499, "uuid": "6404109d-53e1-43ad-b0b7-41008135b0fc", "value": "1536:ZR0f83vAGKSXVl4P+GSXsc5CI5h4x0UYfbmjpV6ZLzQflP6:ZKfKA5SMP+J5F5h4x0U6mjpV6ZHQflP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776733499, "uuid": "cab28db5-ac65-464f-a1d6-2ba4e6aabd18", "value": 84621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776733499, "uuid": "9a930f1a-7e2e-4564-be5c-c5349174a080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776733499, "uuid": "db687d28-7eca-454f-9deb-eac7e479bc8e", "value": "assailant.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fa8fbf-3db5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1776798339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798339, "uuid": "612657fc-3a8c-4e81-a338-7d24ebb7237f", "comment": "Malware payload (DarkComet)", "value": "9b71b6d3d47992615b9892c04c4155b1", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798339, "uuid": "2daf9f40-937b-4665-b2c4-92b59414b18a", "comment": "Malware payload (DarkComet)", "value": "eafc56e985f24b31dc2f0d09c15497e25feca4e1e792d315648810d4e0fb7b55", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798339, "uuid": "72d50592-dddd-47cd-a8f5-f4434d7db3de", "comment": "Malware payload (DarkComet)", "value": "419fec825a9beadc0d6434c07eb2c8decbfe3c90", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776798339, "uuid": "e8e04cbd-e780-456c-a4ca-74438c48b7ce", "comment": "Malware payload (DarkComet)", "value": "49d3326a029254c9d0e6daf1f867ae4616b298d2c680c31aaab217d3eece049ddb8866d6d4f9737d4050bd776e5c17c4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798339, "uuid": "8a3f3bac-fea1-4be0-ac13-0397e8b0d322", "value": "T1DBF44C31F181C877D86239F89C5A91A5542A7E252D34750F36FA3F0C5A3A283FD6628F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798339, "uuid": "d480432b-41e6-45f8-8a24-9a2e2cfcfb37", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798339, "uuid": "8f869502-3386-4eaa-8678-d29d508a55e9", "value": "12288:V9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hQ:fZ1xuVVjfFoynPaVBUR8f+kN10EBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776798339, "uuid": "d9841599-475c-4f65-a289-31c64883e365", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776798339, "uuid": "197ddaf7-c7d3-42cf-a500-ac3347149aab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776798339, "uuid": "b4696346-f3cd-4295-a706-4507a9fab575", "value": "hitclub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802bda00-3dd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776811402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811402, "uuid": "313d4488-86ac-4d66-a3b7-8cb7d09cd4c7", "comment": "Malware payload (Mirai)", "value": "da6f6519fd94ce46b7f579dbfe25c5cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811402, "uuid": "db6429a5-71b6-4e54-bf07-64872b22d3c6", "comment": "Malware payload (Mirai)", "value": "ec05747ce3ba5d9bf1f1c66d9696f9b3dfbd26bcb82d0588b77879369533c5d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811402, "uuid": "f2792f1f-ce95-4724-a0c3-3abf882621f5", "comment": "Malware payload (Mirai)", "value": "d5d947c279d20369a68419b17d21b8f6d52c3e86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811402, "uuid": "d12c4535-53c1-4ae5-825e-3797da6284d7", "comment": "Malware payload (Mirai)", "value": "a56a85dd4bacf30de85aca452fec8f364219a7fa8ae86ef182f165948f1cf0be8a2d38610d9e2882ea4f263db99a2d56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811402, "uuid": "70d3242f-b618-4c45-a948-cbfe06d4175e", "value": "T1234327439E06AF46D14BA1F062F28E798B52FC694A631EF9A565FEF44143DC8F0093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811402, "uuid": "edaf17c3-0186-4895-931d-77a67b1e326f", "value": "1536:lTV6gEft3RBYF2ADnlhCWRX7KFMC0KNFrLGG88Z:mJft3LALlhrOFM2zFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776811402, "uuid": "a4789f33-2783-4f03-881f-cad824b4ebb0", "value": 59612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776811402, "uuid": "20ef5dbb-f0b6-4a8c-9a26-dbef585d3d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811402, "uuid": "ad85915a-7da8-4368-9ff3-f60f639986ac", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59918515-3da3-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776790721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790721, "uuid": "dab23686-ec20-4470-a41a-e00a006998fa", "comment": "Malware payload (PureHVNC)", "value": "5b3b18f4f8bdf86d06c22088da76cc51", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790721, "uuid": "8c8ec4ef-51a1-46e4-82b2-85bce944aa76", "comment": "Malware payload (PureHVNC)", "value": "ec5dd2f5bf64457c8bf9516c1cd4bb55d733f536ac10cea63630b705dbbca734", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790721, "uuid": "657469af-8d90-4295-af37-5eee99fb5dc5", "comment": "Malware payload (PureHVNC)", "value": "0a69294ffbef470cc86b37533849491e49397025", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776790721, "uuid": "d7e8c37a-ca8a-41bd-8506-85a23f0bc2ad", "comment": "Malware payload (PureHVNC)", "value": "0d78e200393151bc4f587b8793cfa0fee0c3c5f473c83352f74867af5beb148943f7cc8b06711160c6c6c01174a47339", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790721, "uuid": "e0396a60-6d3d-4dd8-9b59-af7efdea2ac9", "value": "T18FC5B065F3C86699D426DA398B14A332C1B2BC134B76E0CF0696174A1EB7ED24F3B741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790721, "uuid": "cee76c90-fb5d-497a-8c52-a3580c3774c7", "value": "f83b773d6aefb66ee07af0238fb09c73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790721, "uuid": "cb16aef9-8860-419c-97f0-e30f26038de3", "value": "49152:S/ckKyj9RcdC61yf0D7kf8N6DwHkJrEfWRmgqJp0pDHhfhz6M:Ahvn4kf8N6DwHkJrEfWRmgqJp0pDHhfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776790721, "uuid": "8cc052db-2907-47e1-a33b-3886ecf1938c", "value": 2635776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776790721, "uuid": "8beb213d-2567-4ec0-bc2e-0636199f8989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776790721, "uuid": "ae5b0308-c6a9-4b02-af29-33680279a004", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b36f060-3d79-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776772658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772658, "uuid": "b49e2529-9dca-4b44-8983-e6f12c4b5dca", "comment": "Malware payload (MassLogger)", "value": "88b07a9518ca13e14690e60355e23d67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772658, "uuid": "1780c499-a020-4414-ae1e-ce9ef5a58512", "comment": "Malware payload (MassLogger)", "value": "ec60cb0af86dbd97c464d95e2727477a99177a13f675857ccf870c3b18c09118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772658, "uuid": "46f2d019-96e3-4e26-9493-2b8bbd2c6d40", "comment": "Malware payload (MassLogger)", "value": "902953347f28404da83ae661c5a98b8a67b51860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776772658, "uuid": "7e5282bf-cd10-4906-9070-70d89fe242e4", "comment": "Malware payload (MassLogger)", "value": "20fc98ddbbf11b1d0f3a2288883c048bffa49a708a0d2a62f0074071062aa1dce8045b4e5d8ce496b64100c53cfa502b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772658, "uuid": "8ed5401e-288e-4498-872a-d5107a28e2d9", "value": "T14023B6C87DE77021870138B77D17A096F26E8C45749CC0A0FDD864AEB85C398D5BEA7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772658, "uuid": "ed079063-9e82-4cd9-b5d0-00176716664c", "value": "768:Hrj3x0Yo0hXUVM9IVAwSdJhIBdc6gjfUKg7UPaJYW2X59NwXSX3pE60RwOw:Hrj4UuaIGwfgjf/gOYYb3NvpEvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776772658, "uuid": "1ec8d541-adc0-441e-96bf-3fa14b9d6090", "value": 47069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776772658, "uuid": "a2ece744-e01e-487c-b57c-a6cc6004ff01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776772658, "uuid": "b7d5d9f6-2862-4ac5-a476-ae53aa807937", "value": "file21.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b88c603-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809193, "uuid": "59e416c2-db81-4417-9dcd-ae91cdc68f7f", "comment": "Malware payload", "value": "45f23641fcb8ca66e3dada22c97d3fcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809193, "uuid": "2b061542-44ae-430d-8623-1a9ac0f09966", "comment": "Malware payload", "value": "eceac8086b662522cd366f16e0b1f8b4ef32fda4863140edb040fd5344684e4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809193, "uuid": "10055d32-8378-4b73-a51f-e039f2ed84d6", "comment": "Malware payload", "value": "0a057ba35fad68d444e5064464875902f2fcb5bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809193, "uuid": "0e873727-9390-4cd0-8e45-f1078a864b79", "comment": "Malware payload", "value": "372dafb1fb3e932cfe37c493d6a66530565abb81847dce7cb01e76cf4f481feb10b57d45d675b9bd824232828b97a65e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809193, "uuid": "5db193db-6940-4f77-b648-2a3be8baca43", "value": "T105666B46BC2D7462D6C975392F6242A43339BC049F82C7132A24BB7DE9F27588F63761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809193, "uuid": "2bbc1061-1f98-4abf-96d9-f6729076431f", "value": "49152:gcK/jMFk7dvQa4TnUw7wRvHhe4+yQqwA2NvzxxKssG8I0DlivTab6ux5EQL:gcKrZ7dvQLnUw7wRvHB+yY0Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809193, "uuid": "11dc1f77-751b-4e8f-bec3-b93748e09531", "value": 7078072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809193, "uuid": "52e54c73-d7d5-43d9-81ab-4952e6c36350", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809193, "uuid": "7e07190e-3abe-4af3-94c8-5b5dcfead38f", "value": "h3flood.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e4bf20-3dbe-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776802288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802288, "uuid": "9d43e194-e155-4090-9f4a-12966b446cdf", "comment": "Malware payload (WeedHack)", "value": "bce9534244b56fbde01e2b9f3eed3d2c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802288, "uuid": "873c3b41-243c-47c5-bd09-73cdeb7b2ffb", "comment": "Malware payload (WeedHack)", "value": "ee9fd1e00c9e20e55ca2192d76985b7a28bfbd6a482e15d72eedfe0aae2788f5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802288, "uuid": "e021c37b-1eed-4c1f-9608-982be1c4a969", "comment": "Malware payload (WeedHack)", "value": "1a377308e17dd6f1cc904c39ef402a0d6c23dfc6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776802288, "uuid": "64dbcad2-0e8a-44fe-aa1a-53af35964ab6", "comment": "Malware payload (WeedHack)", "value": "de2b64f41caec2c826398c13412428b3a36a4343a8df82c55683c66bc0b6e70d438ccea7340f030ff077df24c062fc23", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802288, "uuid": "ce23ac23-4ce9-4449-adc8-95b848437ee6", "value": "T17FE4332D18A56EABDEA35CA317CDA6788041D89793AD8127F84C0F07F99ED0B13C5BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802288, "uuid": "e6d9c4e4-c8fa-43d6-809e-d48cf1e2ca07", "value": "12288:IHsFiV/XBEm46swIiZ1wyXe0jcRqsygeIJREg8WPsNEA8cRb0pHO0fvay08:IJPBA6sDG40wR3bkWGaH57B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776802288, "uuid": "fce6e00d-a3dd-45ad-baaa-fe9b0eb9aef8", "value": 691492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776802288, "uuid": "4dc6db0a-db71-4de1-812b-d3d9532d0e82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776802288, "uuid": "8fc9ec90-f45a-4018-8ad6-2f1927695d3c", "value": "ee9fd1e00c9e20e55ca2192d76985b7a28bfbd6a482e15d72eedfe0aae2788f5.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312af286-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1776783781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783781, "uuid": "f61f34e7-08d6-4808-9877-558b5bd780bf", "comment": "Malware payload (RedLineStealer)", "value": "06b41d7f1874e9b7ecc464f829edbaac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783781, "uuid": "5f402404-1fd0-4dfa-8e5b-1fb4c37e35c1", "comment": "Malware payload (RedLineStealer)", "value": "eec9f3f49fe6d50c633c2cec1d18f4cb3d31d71e7c851fd52d83843c6e2bcd0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783781, "uuid": "5bca9769-350b-4ce7-a291-79ccac39c213", "comment": "Malware payload (RedLineStealer)", "value": "15176485600ef4e61a31bec1a4ce7bc21db2217f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783781, "uuid": "26bf6121-9698-4079-a7a1-21ac6e94c07d", "comment": "Malware payload (RedLineStealer)", "value": "57e9c01cb243c2cb8c15976605fd2960f35e4b201790a3eff6f5108c771ef38a5f3fe0993acc5883dac9881c4b015fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783781, "uuid": "ecd56078-6d40-4a9f-9cf1-73f766ba7ed8", "value": "T192A35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783781, "uuid": "4a54fb94-4dac-4e2e-8051-3d69d43d7c89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783781, "uuid": "fa58e235-ed76-42c9-9d38-38d42646df1a", "value": "1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2Q3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783781, "uuid": "8976ac46-f847-425a-b3f0-98f812b6a93c", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783781, "uuid": "fb169693-8c7e-4d65-ac4d-cd1ce7cd1b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783781, "uuid": "25fee6a7-c01e-42e1-9ddc-527f075f4f73", "value": "06b41d7f1874e9b7ecc464f829edbaac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd42d34-3d73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776770003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770003, "uuid": "138441a2-3aa1-479c-b2f0-b77dfe92e702", "comment": "Malware payload", "value": "ad20d2a88751bf1875aed0819be1847e", "object_relation": "md5", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770003, "uuid": "045fb477-588c-483b-94c7-277bd8ce5ded", "comment": "Malware payload", "value": "f10558146d035a79d4c128f3430e6d3ffa30f7241898607157e6c8b6b102f38b", "object_relation": "sha256", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770003, "uuid": "94e91742-a7a5-4c7d-a0e9-e05def96b0dc", "comment": "Malware payload", "value": "eaa8151bf4ebc846e3394cbd953f5961efb7fc4b", "object_relation": "sha1", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776770003, "uuid": "f3734cb5-b86d-4ba0-b485-065ad3ad41ed", "comment": "Malware payload", "value": "4602fa663ef5814a92b7b30ac156fc9c9fa093a2baa7e608a6eddc945333ea345f16aa148726d5b816ec8346df964b86", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--Adriellee1245", "colour": "#B9F73A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770003, "uuid": "7bad4f21-cc97-4dee-9cff-06b061dc4910", "value": "T1DC31B65BB11BE3A5738B060FCBDBA18C7408C4BD422A11A0B1DD17BD53218AFE1517DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770003, "uuid": "bbeec845-00f4-473f-a614-dca29d80ad5b", "value": "24:bHN4hS7VFJ1lNmnEFC2g8vaAo5tbB0A0rNGegW/EXzFYfABeaPbfABYmfea2MsN1:bp91Xmn158vpo5tbN0ZgW/EDuP6bz68L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776770003, "uuid": "c20c44f4-daa8-4943-9d00-921f7c5b59d2", "value": 1456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776770003, "uuid": "62a79900-7c99-4be3-b9d7-44d2a5a28b2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776770003, "uuid": "3bb7d1d0-7f8d-40f0-8dc7-f240ca520454", "value": "f10558146d035a79d4c128f3430e6d3ffa30f7241898607157e6c8b6b102f38b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15118f21-3d92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776783305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783305, "uuid": "e12aaf2f-564b-4165-b93f-0393ae022389", "comment": "Malware payload", "value": "d89674f722da2bdfe6dfd6ed2abae258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783305, "uuid": "3af92855-36e1-4dd7-bd78-9e33fdab9203", "comment": "Malware payload", "value": "f20c541136c5f4937a2bffcaa13be8728e26431ee8a4ce1f167dc81b0e3f324e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783305, "uuid": "8cd4b516-c336-4342-880d-c345d04b5593", "comment": "Malware payload", "value": "89f5f8d992c071aa6a1ff75847b43a7f6199611b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783305, "uuid": "0c5324a2-fd47-4013-8bd4-5ad9c69b76f4", "comment": "Malware payload", "value": "9da532eda964e55d041eed496496eaa330647407dc6adea837b0634625a916f7e1f76a2d3054b67a4b030c041d4feafa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783305, "uuid": "299a3a68-70b0-4eb9-aac4-e235bbb84f94", "value": "T14226F93061C78CEAE0B115B3096F95BD961D9DBA0B60C0D373DCAF7B16289F21175A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783305, "uuid": "d067732c-77c3-45d2-8488-68583a5124c2", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783305, "uuid": "37322955-fcf1-47e3-8236-d617a569f552", "value": "98304:VQN5tgqSsl/QRL+Tqv146w98aWM7uEPBUH+TY6RL5uJqAlXAd:VQN5tgqSsl/oL+Tqv146w9Db4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783305, "uuid": "dcb18690-37b0-4703-a28e-37d88f95ec67", "value": 4693752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783305, "uuid": "cc27759b-bf41-4875-a421-3493961ed8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783305, "uuid": "83428dee-ded8-4584-a5dd-7e0f1bd170e9", "value": "PostNutCalamity 0.1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd6b7cd-3d63-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776763184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763184, "uuid": "6255ff67-8fc1-4c3e-b26a-09259d93b978", "comment": "Malware payload", "value": "78195a51c36c1a88332ba63945f89c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763184, "uuid": "52b3d110-886c-4edb-9860-c7b0ac0b1f15", "comment": "Malware payload", "value": "f21b3f538ce1b84c45ffd5d4775f26980603613ec4c39939a30fb83cf5680bea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763184, "uuid": "bddcfdbf-4354-451d-89f3-4554e2fd5bf7", "comment": "Malware payload", "value": "560dc0bdf464f5c63f5d7366953d98b9c0c1d0e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776763184, "uuid": "e1f1a1fe-8572-4cad-b24f-dfd0580bb988", "comment": "Malware payload", "value": "a5b65b36b2fba94216f3dc70d0522881eed9ad615ea580b72db54703c06491ed450518f57789e534892b807a5a4ab6bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776763184, "uuid": "6577442b-a6b3-4ceb-8356-f981a7477e1d", "value": "T1E3C43416EA51A02FE49389B1797999867C293D3216C0EC5BB7801F693074ABBF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776763184, "uuid": "47026c08-c6b2-48f1-b9a0-a580819d3cba", "value": "b7ab7b752a0cd0f78409eece3bdd2d21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776763184, "uuid": "bddae62e-33fe-4285-95fe-1cb37a73926a", "value": "12288:9KRoIZ0xoGtyQVLUvC1Z4ivF+6dA2rvqAqYamK7:9KtQL4ov/dA2bqAqYFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776763184, "uuid": "942055e9-cc9d-4c85-b4b8-71ca802b5d44", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776763184, "uuid": "3369d7b2-7be8-446c-938f-e30a6c948658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776763184, "uuid": "4a260890-ef4c-4039-a531-2c4f28d01fed", "value": "N\u00famero de cotizaci\u00f3n de la orden de compra 140467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca99d1c-3d98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776786082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776786082, "uuid": "2064fe2f-52d5-44b7-918f-36239902f261", "comment": "Malware payload", "value": "558d4f21179336dd57457aa3468d552a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776786082, "uuid": "07b1a2dd-d089-4321-a99c-53a9184c017d", "comment": "Malware payload", "value": "f27cee10d9c99eaa2f930dc1de2b2f6c89f280b60c98b1afbbb12ec98d60fb54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776786082, "uuid": "683184ca-5f74-4d73-a9ff-06cd251e9e7d", "comment": "Malware payload", "value": "842d6c1952e50d3dee4b5884dc11034f7f385fc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776786082, "uuid": "27963451-ec01-422e-8221-f2cbba81d444", "comment": "Malware payload", "value": "5db9382fec78554a156bd5a859ca3f0c201546a89d1a823caf624c062b60b5028225708d8b0e70d7d2951fcf855e2c60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776786082, "uuid": "9a394531-f88a-4fa4-8d72-57accef01eee", "value": "T1532607E9F245C52ED42535B31A289AAB42FA5EE50B2DF2D372CC7D5A17374C21233A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776786082, "uuid": "612a8aa5-a714-4c6d-9106-7de1f4c875bd", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776786082, "uuid": "308bb63b-7f99-4a9f-8cb4-0a124a18ddab", "value": "98304:hQN5tgqSsl/QRL+Tqv146w98aWM7uEPBUH+TY6RL5uJ2D8XAk:hQN5tgqSsl/oL+Tqv146w9Dbuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776786082, "uuid": "6552ac81-03f2-49d3-bf7a-0c3c906c3869", "value": 4693752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776786082, "uuid": "edcf53a8-b6b5-48b1-9380-67b2e871fc8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776786082, "uuid": "6a7620b1-38e0-43d9-bf8b-436fbe336c6c", "value": "IdleDaysWithHer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3036ed92-3d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776775190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775190, "uuid": "4ee1b6bc-72db-41ae-a08d-a9b28af7a810", "comment": "Malware payload (WeedHack)", "value": "a7d19d5da95423446cd92cf2cfdc9246", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775190, "uuid": "f4f8814b-6965-4413-80b7-ffdd02daac1f", "comment": "Malware payload (WeedHack)", "value": "f2851b57336b42164ce2acf5cf3a4dc0a60e4948568bfe7bb4f9a9ec7fb27aa0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775190, "uuid": "87fba235-d758-4a18-ab2a-6454b273c756", "comment": "Malware payload (WeedHack)", "value": "0386a781a7763baf2b3153118267df4b48a22baa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776775190, "uuid": "816418dc-ec07-46c7-a125-7dee97a3c71c", "comment": "Malware payload (WeedHack)", "value": "ced30de9ee2310fe0ec68362a2bf209026724cb5c1de4f9a341c063775c590db1a6f720ab1d57d27f797545b6430fd04", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775190, "uuid": "adb9e294-8e1d-41e5-9ade-98df688701a0", "value": "T1E4C2D161D40B3E22DE0F4C3DC54B6AA4AD0D42A5F327784AC2EC417A4756A7CA746FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775190, "uuid": "c245161e-1465-4f1a-b7c4-a5ec42a4d578", "value": "384:l3f3w9gntKml7dDfbNHESLBLjCw3iqd0VJakAJgCwCsyijIjTCj2a5cZnG1orJ0+:lv9n5JJHESBjCw3Zd0Dmx0BGGIODmiKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776775190, "uuid": "2debd91e-3df6-4817-aa09-a7cea88c00ba", "value": 25755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776775190, "uuid": "c21bc760-af52-4c27-b298-06d4e0fbba23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776775190, "uuid": "9ba22561-f61f-4d5a-b267-71dd8c5b05ea", "value": "UI-Utils-2.4.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dd17c9-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809217, "uuid": "65599185-a30b-41ad-8e86-e55eff0cfdf1", "comment": "Malware payload", "value": "89ecb7e305ac07ec73ed1b0e0c343471", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809217, "uuid": "a176d11f-e821-4a75-bde5-cc154ccc0a30", "comment": "Malware payload", "value": "f2ec46edc68636190246fdbee765d7599c1361d996f5a64503a06137438d9832", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809217, "uuid": "4114b74f-1ffb-4b1a-8552-5895d89553a2", "comment": "Malware payload", "value": "fa912b44047d44243234dd1bc724f9e50bc16502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809217, "uuid": "3cff1c55-a25b-4b5f-bbb4-803afb4aa2d8", "comment": "Malware payload", "value": "0c7f3218f83b7afce8e914c8bc2a46760f47669e3abcb7c45bea5446c4567edabfb5d00bad18db862ad6a51b59f38ced", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809217, "uuid": "c49aaaa8-5b87-4ee6-a3a9-e6a998d4a81b", "value": "T172566C0EFE248F71C654037649B902941370AD02AFC757166634F33CFDBAAD4EE46AA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809217, "uuid": "c9ad54b9-af9b-499e-8409-3ff00e77efdc", "value": "49152:CFVcDwBHFe6NHCo08u/LoTQ3NdIfudJuV0l9cUtDwR5Ed:AcDwBFNHCo08u/qENwnEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809217, "uuid": "953f1a17-44e9-4c59-be70-798d8c933c3a", "value": 5898424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809217, "uuid": "382063ce-a719-4bf0-8c23-1798f9729605", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809217, "uuid": "0723bcd6-341e-40f8-aee8-7f168a7ffd8c", "value": "h2rapidreset.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995e66d9-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808438, "uuid": "e0a61a22-8a8e-4f74-8b20-1ce5254a16de", "comment": "Malware payload", "value": "58a416e782e2811b1e2beb24b9d20815", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808438, "uuid": "22f20e12-8ed3-41fa-9705-d72e2cf65523", "comment": "Malware payload", "value": "f33366f06a72af880465a721ebe26b4e0c6dd8f61889dae61117c893418646b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808438, "uuid": "a6e99f08-d864-4610-8edf-fe245b1181d9", "comment": "Malware payload", "value": "1e3236cc601ae95707925f10f1fbb652210502c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808438, "uuid": "7b69e940-8cdc-4d92-b7f2-f94560a9fef2", "comment": "Malware payload", "value": "cbedab03215a5eb5f96733cbe5016debe7587c962f8d5752b48ef87d89334489a674286c12178dcfc628771dfa0c907f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808438, "uuid": "b3205b9d-6565-437c-8070-bc02b3359b13", "value": "T16165D097B7248995C0706A3BE1A7EFB183677E3119D86A0F9D48F37648733088F15DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808438, "uuid": "d1a64da2-a1e3-4eab-a27c-5b9e8bb85710", "value": "24576:fBAXobSBtriTNaVkd9vVOUfv6iUlXti4wA6gHMjUl9E2CcT7:KVVkd9EUk9iEfDEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808438, "uuid": "ede43f44-c511-4573-a2bb-166cea9c2795", "value": 1493846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808438, "uuid": "76065269-50a7-497c-a103-9447b9fec3bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808438, "uuid": "9e77a06b-4de1-4da8-b298-ad0bf56e1764", "value": "bot.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84648be-3d70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776768949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768949, "uuid": "88d540dc-e1b1-42e7-aa4d-60c3230b20ab", "comment": "Malware payload", "value": "debd3f013eacb8241b6a94d1e0d8fb1a", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768949, "uuid": "0113bcde-9e73-462e-ba76-d0bf7bfae2e7", "comment": "Malware payload", "value": "f434146cddd6d79f9dbd8ef7733952ea97a7d324d7b173f0633ba385e909d30b", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768949, "uuid": "c3c02ba1-36fe-44db-864c-86289f49f7e4", "comment": "Malware payload", "value": "0a88154a22734420c80cd76af1b0d77d003d807c", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776768949, "uuid": "d0bfc309-835b-472c-9287-6914a469d39e", "comment": "Malware payload", "value": "f87f85605f37b52a12b2db5b43cf681971e9a9ff166b5f5a7888c7311fbe6e032344b9262132b54a0019b922e248d792", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "docshub-secure-com", "colour": "#4BD6C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768949, "uuid": "6ac53cd7-05dc-4c79-a31d-05d252dcc1a1", "value": "T1E25109577B12B876E727BE79C42407E91D3ED0C180B186FCA98B9B9C0CF9F974A60494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768949, "uuid": "167cd14d-c33e-4ace-9459-e4ce3336e755", "value": "48:9nbzfKtJLY8tv3kmrBBG1MC0KP9R/jMH+05IIPRXkFu1x8vFHiuR/Slt:dbzinY8tNrS1jFpMHhkIuAuRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776768949, "uuid": "95681480-ac0e-4c8c-8ef9-c29d0e3437ae", "value": 2564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776768949, "uuid": "feb0b844-d8a1-4ce6-82dc-9c9b4f3a0b7c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776768949, "uuid": "4b85a193-7072-4f65-9beb-03873655c3dd", "value": "photo-443156450.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d13e14-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809161, "uuid": "23d677c4-5e6d-472d-b330-511cd9618354", "comment": "Malware payload", "value": "16ece25ef70a54927c33711e59c30545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809161, "uuid": "cde44528-8a61-4acf-8975-a72d6480706b", "comment": "Malware payload", "value": "f5726161b1ec24638d84dcd0d0475fb9dfe05739bd55feef877da57c2ba3a200", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809161, "uuid": "ac07a6a4-1ffb-4092-ba57-af1918b7e1ac", "comment": "Malware payload", "value": "bbdd7ee3ae520abf0e2e895a5b7b26a2cb517971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809161, "uuid": "7781e34d-5dd1-4314-b145-d0270459fa2a", "comment": "Malware payload", "value": "874246aec49dc0f4d2950f1bcd70b03e1ed73d80c86f54721ae74a7cfee61973c4fba0e9c124c095bdac903ccf94cad2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809161, "uuid": "6332a6a8-332c-49d3-9256-c83a27d3567b", "value": "T1FD8617627F99EE1FC39431358EAAC23433D57D0081E020369762F71D2EBB2A59967DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809161, "uuid": "7f4981f1-0dcd-4d9b-a1d7-078d4fcf1828", "value": "49152:7519ETVzfY/vJ0pxsa6PssG8I0DQsYfxQ9eUXCPHxvt5EW:7aSxeYgPRvjEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809161, "uuid": "02abea02-c0d7-4373-aaec-ddefd12f184c", "value": 8257720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809161, "uuid": "bab95ae0-f248-4a0d-9c3c-82c284c7e465", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809161, "uuid": "7a548650-d363-4c42-a13d-61637304301d", "value": "h3flood.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b256873-3d4b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776752982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752982, "uuid": "6bdc49cf-5b02-456e-8057-dc36f827b4b6", "comment": "Malware payload", "value": "2cf2ad47dcfe7ba409c6380fc78db993", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752982, "uuid": "9cf67b6b-a7ce-4187-a31e-882017753b5c", "comment": "Malware payload", "value": "f65940e5ac29445464df52f952d216595169d9e5b04de928852f6ce7c6490054", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752982, "uuid": "66d98be9-19bb-4487-aaa7-eda2c9bab3b0", "comment": "Malware payload", "value": "98479053d5bd1a22c0998e483029c54155877ab7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776752982, "uuid": "54e4fd5f-ed83-4b4c-87f4-7c42859b520c", "comment": "Malware payload", "value": "2e44c62cbc33f224dd075c8e14f8311774aba1526c58a59e4cfbda1634cedda240c3248a23685fd7a59c5377027a2797", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752982, "uuid": "10829a09-3202-49c6-8513-55aed95ea1a3", "value": "T173137D6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752982, "uuid": "77c4c1b2-5c44-4380-8718-83f28da469f5", "value": "768:boxXRWNGxVb9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b4lxucy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776752982, "uuid": "7125f4d7-b00a-40b1-81ce-67bb37d102a5", "value": 45531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776752982, "uuid": "b032022f-6f62-4c58-84ce-a94fadae4197", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776752982, "uuid": "10b05f45-7f24-46dd-86c2-230364e1fe3e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503bdf72-3d93-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776783834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783834, "uuid": "0a000957-8934-4b63-a1bc-139aa7657f66", "comment": "Malware payload (ValleyRAT)", "value": "19ddf19d36eced2108126ebe252ba7e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783834, "uuid": "2b8eaa2a-55a7-4451-aa8c-056ecdaafa81", "comment": "Malware payload (ValleyRAT)", "value": "f6bceb65a8c1240aa3c049b6b58a14e72fa1c672816e54415b6494d0140ff658", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783834, "uuid": "b0ea4d02-d27b-4e2e-ae76-ab4358872c38", "comment": "Malware payload (ValleyRAT)", "value": "9368adce55bb48c441af84ea0948453f9c2aa94e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776783834, "uuid": "bcae5f79-d79b-4ccb-94f0-dc9abd94a943", "comment": "Malware payload (ValleyRAT)", "value": "3404fde19de59f35d93fb93fa0b6417eab5f55e8b51ffa3e4d4a9bf82c4ecb07d4f44b8ba32c528e8cdfff225caac05f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783834, "uuid": "a5606677-ec91-4893-a7b3-0fb4d4c3811b", "value": "T14336BE8A6FBE40D8D996A079C957895BD3B2BC651A31838F00B4B75F9F333510D2E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783834, "uuid": "319bd6c0-e241-4f7f-a1b9-fa90cc62d158", "value": "fc9b11f1de604afd5daf4a011cca6316", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783834, "uuid": "3252b872-c202-43f1-8ff8-2c395bb7590f", "value": "98304:7Rpupv0vkaFxXOelCiR6vGVwIHoFN6WtljaEy9RFLOAkGkzdnEVomFHKnP:TGeF5pCi4OuIHmN6WtljaEyTFLOyomFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776783834, "uuid": "024bb930-31c5-4b5f-9037-b98cb001ff1a", "value": 5319680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776783834, "uuid": "8d70d663-0d87-4ff6-81e5-ae62febf2ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776783834, "uuid": "71e4e57b-ea50-4868-a9f2-63355465f78d", "value": "19ddf19d36eced2108126ebe252ba7e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699fb9cc-3dd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776811364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811364, "uuid": "ae7e634f-8e70-4cea-a8c0-2f38adb4d388", "comment": "Malware payload (Mirai)", "value": "963af3af6ed289a651be7a996e45d732", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811364, "uuid": "0aec47df-29ae-4b31-a74d-e62e8ccfc11f", "comment": "Malware payload (Mirai)", "value": "f94e7cf6e5f9005f3579e5373d049e417297e4cc267c41e2c63d2a2126552b5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811364, "uuid": "e3770cc2-c681-4fc5-a782-f72a1f348023", "comment": "Malware payload (Mirai)", "value": "2707996b24093393e8176345297f4e1ed8b00b2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776811364, "uuid": "313e1dba-2a70-4dcb-b791-426c27600a29", "comment": "Malware payload (Mirai)", "value": "dae62f7c0721ae68661bbf60eb583319f06e88e04a4a8191618f8d1edbbf7b966e78e632636ff5f6e20e71c199ca5c65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811364, "uuid": "b9b53e96-bfbc-45d7-9bc8-60979c180814", "value": "T13B93080ABA919F01D5D631FAFA9F414D33536BBCD3EA3102D920AFA037C69DB0E66511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811364, "uuid": "ae579739-f387-4b5d-aa48-0bbc7f2dd71d", "value": "1536:KlnK6vU2DGyvelXkk0JuWkz/MxI08wUiqrG1pgQugdlu+iwB4an2vGY7N/qn:vqGtSkvwUiqrG1pa3wB4an2vG6/qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776811364, "uuid": "1bb39791-dd7b-41d9-91ca-64777bf3b13c", "value": 92132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776811364, "uuid": "13a50e35-df01-4cd6-b10a-fcedc4a12e9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776811364, "uuid": "0fc7c466-3c7b-4632-9b10-3bffbff9de31", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0fd5dd-3dd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776813784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813784, "uuid": "9b75baf7-4744-467a-b6c8-6ee5bc98c710", "comment": "Malware payload (Mirai)", "value": "887a9ec5f23945e27cc208e4463970aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813784, "uuid": "fc2cfa6a-590d-4fc1-aace-4c590fe4e7f4", "comment": "Malware payload (Mirai)", "value": "fb5e014e529004624fedb8182a80bace4d451317bcf1f002f5f9dc7b41ecc730", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813784, "uuid": "1793be7c-b359-4151-9320-6c2d2e963923", "comment": "Malware payload (Mirai)", "value": "d4e19ec5b205c931c3830e3ab8bb487daa263517", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776813784, "uuid": "e0964fa5-a1fa-4bbc-93ee-23ac56fcadfb", "comment": "Malware payload (Mirai)", "value": "ab5467debd002bcef90923e36099062c6ae9cc0e120bcfdd896aa797083f249e7439cf4962437ce6750711ea0e3488fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813784, "uuid": "b4dc400c-f0ef-48da-b243-3530fe142412", "value": "T1D3142C71945CCA87C52222BCA4E9DF7A8F7E72DA2649CD317DD4603449CBE9B3906F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813784, "uuid": "8212e687-6d44-4fec-bcf2-f2275a4873cc", "value": "1536:LGZoshBY99ExNi9DNly65YE1h/HNB5RSIzRQmkKyVJLTlK+pK7DKrtwp+Vp+wEiK:8oshBY6bQfNBxzl4LTyU9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776813784, "uuid": "20fd99a5-324d-4e99-854d-a8ad8a0d30be", "value": 202420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776813784, "uuid": "dc6d034b-d07a-42e1-9e35-af641dcd46f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776813784, "uuid": "1a086735-7f18-48b2-b283-ec41a94751df", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c34e69-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809180, "uuid": "fe7acbbb-1f28-4a7c-aa63-0a6eedaf8248", "comment": "Malware payload", "value": "59d762bb15c2789c0953b014af9316c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809180, "uuid": "c1399556-636b-45e6-8167-3bafe27b367c", "comment": "Malware payload", "value": "fb9bf5ad1ed10e7757446cc2149d08d1062072dc5bd94f6afcd0e2144448c3a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809180, "uuid": "e4744247-985f-4644-bebf-81f8d06a3a3c", "comment": "Malware payload", "value": "f508b6668c55293ba6477ed8b48ebf9ee43928cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809180, "uuid": "24f919f5-60ad-4b3c-b73c-9425b812bd37", "comment": "Malware payload", "value": "f0dee0842d431c20c5d9650aed0440d636fd26da1409e8684b0662260e7f6fc4734bb655f3074808bd4e7f14225d5a3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809180, "uuid": "48581914-e4b8-43f9-b524-7757f73a29ce", "value": "T1AD6628137A28E70EC62821304DB2CA942B7A1C4942D79527B791F729F8F21AD4D6FDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809180, "uuid": "4d040133-7736-405f-8445-ea3cd823caf7", "value": "49152:XQ6QXGa7nRV6yDw0Oiu8MxIYPeRBy77QpL6fHEZn82+VPlWvMYo5Hxvt5EN:YMw4fm8r1YYRvjEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809180, "uuid": "cf185cf4-bbde-4950-a5b5-ab37319e3429", "value": 6881495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809180, "uuid": "70edd741-b6a7-40a3-8930-b54512331d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809180, "uuid": "a36d4caf-255d-437d-bf40-efab8c516dd6", "value": "h2stream.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849a7de0-3dce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776809262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809262, "uuid": "e31cdf44-d7e8-4db6-aa50-4b655c7991c7", "comment": "Malware payload", "value": "0635612a5c3cee5b1d3fc16564410e7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809262, "uuid": "ba70a136-02c9-4e89-9da7-7b7a37af28ef", "comment": "Malware payload", "value": "fbe6eca5be75d5e22af831f9b3f77247355d183d8dcb3e7c4e18ec3ca08a7bbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809262, "uuid": "f09fa206-a5a7-418c-9d38-7b4c73600b0f", "comment": "Malware payload", "value": "33f6ac77eb44614f54e0af94aea702a581ef3485", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776809262, "uuid": "4164b0e2-d70e-4bb1-ae2a-f4c949fd305c", "comment": "Malware payload", "value": "cd909ba0b473650f7d99ad3c4d049d2c7da88f25d8f90f28f8b092f0580d8f830be11d3684b1ce8bdfa8eb29fd741116", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809262, "uuid": "969bfe8f-21a3-44b0-80f1-4adcb7989750", "value": "T1E28607177B19EB1ECB1821300CB2CA94276A2C9942D69517B781F319F9F30BC996EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809262, "uuid": "52a1bd7c-b4ca-4bdf-86b9-066fa2b2b5ad", "value": "49152:xFX3cYpF3JZEfxBp5KcwAJLj2aX7k/3DprpH69qRTj6Yf/OassG8I0H8ueQS8JYd:ryLaNRT288kKBLNXi2HJRvjEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776809262, "uuid": "77c5e5a8-67bc-4c3f-bcba-d9421fb285cd", "value": 8323287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776809262, "uuid": "23897430-49b5-4654-90dd-e8c0e91e1dd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776809262, "uuid": "43780a8b-e117-403a-86e4-e30a3dfe0238", "value": "h3flood.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01aa441d-3dc6-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776805606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776805606, "uuid": "0b9d9f12-61df-4dd9-a256-0c324dc5353e", "comment": "Malware payload (LummaStealer)", "value": "17e7630d4fc328282ee0d1ec26181ab0", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776805606, "uuid": "638275e4-fbd4-48ad-9a19-cd062ebbedf0", "comment": "Malware payload (LummaStealer)", "value": "ff2db25dd562045e84272f4bdc7e53154c43bd13ffdd4801e7cb309072e67044", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776805606, "uuid": "d8ac01a7-0cf8-4cab-b4ce-0a204c73ce23", "comment": "Malware payload (LummaStealer)", "value": "87bd89aa7404b7e08a5812f2ce83a70335ed2625", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776805606, "uuid": "87fee733-c764-41de-aef7-7e5090fdc8d2", "comment": "Malware payload (LummaStealer)", "value": "6f47eb99746d62f0bcc351375e62524ef676b95012aa2af292fa3137bbe6e87d74893a24a0904bfb40e3745737f90246", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776805606, "uuid": "4a2de570-aa8d-4c60-b77c-2fe2a7a159f6", "value": "T1A2366C90E9D704B2D646363260B6B36F2732581D0F3EE753DA95ADB9BB3F2C10427618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776805606, "uuid": "9fab552a-d625-4cfe-9c7a-cd39fbe6b7df", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776805606, "uuid": "1dbb928e-736d-4db4-9571-da475d44c281", "value": "24576:/ua7zcCxWuQvLJ+1S2GgiEM754LpEy3/MFbmv3SEQ7B5xHN1jSCCo5m21Jf6IHll:/f9JU/n7iJQX//iElCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776805606, "uuid": "befc1f0e-9282-4cdb-ad08-c27c30c2a2f6", "value": 5129424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776805606, "uuid": "341e51b8-323f-4910-8774-f9f143150c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776805606, "uuid": "5aa4539f-feb9-480c-8459-b0b6dcf2d256", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c919230-3dcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776808443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808443, "uuid": "13df3498-37e7-4131-8a0b-b39e9cb538fd", "comment": "Malware payload", "value": "6412f8e72611177f4bf128dc97996525", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808443, "uuid": "0f183279-86be-4094-aa44-989e62258cbe", "comment": "Malware payload", "value": "ffd8ceaae6bd9763accee58f339a8867fb5fdc889628189a67e34b89164d7c4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808443, "uuid": "0fc739a0-2fa8-4081-aec0-8edebd0f4527", "comment": "Malware payload", "value": "b2e1240d3a6b7c912419e38e4d1ec5a8904a738d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776808443, "uuid": "b9849d4e-a19e-4f5a-a9d9-e186a550076c", "comment": "Malware payload", "value": "3b2647ca46c487acb624297c8a6bb918028ea90be563fc817da075d1c52c3a3920471cbc14254d6ea60e8ee69d9d798e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808443, "uuid": "201b7cfa-91e7-4123-a527-4570d539003c", "value": "T19265E197FE6E3C07C2D7E33E9B8AC3B1532BB191D35341527681432CD9CAAD88BA1951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808443, "uuid": "b2339b90-9280-49c0-afda-65d31a25ece4", "value": "24576:dJ9uTMBCNwyCeThYVf+QcNSNE03Uoo3ldibsgHyfuDHd0lMV73CMPBN8b5BM7nG8:tr+of+gKcE3lMbsgVDHIi7CM5ibbM7nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776808443, "uuid": "52d31610-1deb-4d9e-a5c2-21d5a59623c0", "value": 1440827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776808443, "uuid": "abb9b97e-039f-497d-83dc-d81abcf9c480", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776808443, "uuid": "6352f14e-ebcb-4478-955c-9e19441e4183", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }