{ "Event": { "published": true, "date": "2026-05-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-19", "timestamp": 1779235381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e27b8a41-9c6a-4d74-a9e6-593a572713ad", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3818f809-538a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779198853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779198853, "uuid": "e3d33475-b7ff-4113-a73c-52b106dc151e", "comment": "Malware payload (Mirai)", "value": "514c459dcd9afe5839af5d75b2e43597", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779198853, "uuid": "eb996e3c-d97a-4a39-a61c-1e4a95206eff", "comment": "Malware payload (Mirai)", "value": "006bec32615da5d66bc25a6aa26c5209f664e446767b95c546e51a077efb6bb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779198853, "uuid": "154d07c2-deb2-43f7-a151-2efff2ed22d9", "comment": "Malware payload (Mirai)", "value": "e40e1dcabad8d74c8a844816524b4ea2394dafba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779198853, "uuid": "30bafeb4-36d5-42c9-a002-247e31c519b7", "comment": "Malware payload (Mirai)", "value": "8cb4d14b537f9c9c16582ae1c20bff06c35aa442886811f8f45c0eb5560c0e1066d5c7ff4da5b37cee71f4c23749b316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779198853, "uuid": "f382cd2d-390d-44f1-ae9e-fdac9dcfb2e4", "value": "T132731793F800DDBEF40AE77B4453060AB631E7A24A831B767357B667F9360951822FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779198853, "uuid": "bd0f902a-f68a-4678-b5b1-f1c76ab1165c", "value": "1536:zT90zRWRXeKhyHd3YKaE08nLp49E8FxPXioLxBy6fsgHbi1ooHWTMMC9opXReyg3:zTedTJ08nLORa0BXf5oHWTPPej3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779198853, "uuid": "b2f6797f-6e79-4135-b932-d4aba04582a3", "value": 79428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779198853, "uuid": "33be87eb-0de1-46d5-947d-f466098a0ee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779198853, "uuid": "3b448a63-fed7-4808-9ed6-d24e93443602", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be52da31-5382-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779195642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779195642, "uuid": "6344baa0-b67a-4ba6-a049-7f809b4d9bd7", "comment": "Malware payload", "value": "bf5005bd8d92a6b7d5d9918aeeafb9c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779195642, "uuid": "50b3ea01-5801-4ab9-89fe-53a5e619700a", "comment": "Malware payload", "value": "0148984347249e50ef716b263576217b91b5ba7e745563bc372c33c49c751299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779195642, "uuid": "015d12f5-ea9a-4a20-a584-fcd57fca4459", "comment": "Malware payload", "value": "9306dfb8c1a55564798346afe3998dc7ae13c10e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779195642, "uuid": "715e4756-37e3-4684-bc62-9cff7cc35145", "comment": "Malware payload", "value": "4f836a41cba2b1c5588caa53c0d4f3613f6edc33bfecb3ad8c48146c219c97f9e4507392f3a2dc216a1212fe0b4adcc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779195642, "uuid": "5c2c9593-14d1-467a-a068-d8baf99502e6", "value": "T10A15E55247FE11C8F6F70F5DAFB850554836BEA72E25C60D02444EAE1AB2E44A9F1B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779195642, "uuid": "3c28aa60-0786-4288-b930-7c7998efbf2c", "value": "3072:NeQlMvvk4jAiu4C65rIzPlYDY5Iqhhu0zxNb2A4DAJX/oxUJYE5CccBXdia8X/WZ:EQGkgGtYfoRz32OsylVaO/WU1zsD7BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779195642, "uuid": "4f1faa27-a021-4881-9ac0-fb3b70887081", "value": 889868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779195642, "uuid": "bf78ed47-578e-44e0-a804-c4550c6d8193", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779195642, "uuid": "79932587-15ea-4f57-9699-887e60231329", "value": "SKM91063528500.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42801746-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779220345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220345, "uuid": "f260edeb-f4e5-485b-b80e-f1b3bf3944e8", "comment": "Malware payload", "value": "10f46af12e8e1037959d2a1321fcda36", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220345, "uuid": "282b8960-b674-49bd-a69f-85d2b0f9aa0f", "comment": "Malware payload", "value": "021e597cb405fb3c8f8d2eb7fcfdcd7defa48c30099ab21a4c5c390508d3ba92", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220345, "uuid": "b0393a97-0ab9-4bad-8006-499a18eeae8d", "comment": "Malware payload", "value": "e9094026cb29c4b0d46c17659fcc918ababac972", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220345, "uuid": "91281270-5b9f-4214-b44a-57d35b9ffc2d", "comment": "Malware payload", "value": "39c3faed96dbb35df737791c3ec36f67383c0e5704a99b966181751e744a114098fb45a6cfb40dac1eaa9fcd5d88a128", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220345, "uuid": "3843957d-45bc-483b-a6f7-c23393c880f0", "value": "T162B345397F11AFAFE67D823007F66E709759369636E18280E1ACD7085FB025C189F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220345, "uuid": "29dd58d0-fb45-4e3a-a078-5c80bdb3e306", "value": "1536:kEvvLvCnyPf5/c68CR0/ntX+JdgOZ4R4uB99tUGkAi10E1XH0XaKWsrIScbeaJta:kWCnMx/c68CLMR1vuvN73P4wGqDLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220345, "uuid": "7718760d-47b0-476f-83a8-6c409956a81a", "value": 112828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220345, "uuid": "8570c0c9-7023-4615-8b03-0e71e8999838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220345, "uuid": "c12d1a9f-e900-4144-94b8-88f44a25390a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466f3409-5351-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779174396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174396, "uuid": "64d4ab88-8510-47d3-b8fe-8ff2f0768914", "comment": "Malware payload", "value": "6e2e5f7a522d603279750c8cf4727054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174396, "uuid": "8bde112a-1440-4121-a8f3-46a23316bd7c", "comment": "Malware payload", "value": "02abd6966f52c936d2488849023bb92ed1dc907f6db3ace864f923c0f741c597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174396, "uuid": "b6857a95-a5de-4dab-821b-afc3aa430cfc", "comment": "Malware payload", "value": "7e2d9066b49c64cb5495d8b346205f654fca3077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174396, "uuid": "5dbe09b5-ea13-46b5-9da0-e0c96e168155", "comment": "Malware payload", "value": "7e17f472b6d8c0aa5f650f51c8c21dc6aae00ae76e9b97827d75d9a7cf264f2e972892c36ca778c2684da1ce8ac3627f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174396, "uuid": "8f853acb-9cf7-492d-8ffc-f08f76edde0d", "value": "T137035C25716F024BF422927CD6337A73FA30B0AAE51853DF0761C92A6F236576474FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174396, "uuid": "3ae98eaa-e620-49a0-b513-a63ec46d5a12", "value": "9d6b7a90e30c979aada0c2c88281d1b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174396, "uuid": "c5444920-407d-42f9-b2f8-2c5fa320360f", "value": "768:7vBc4FsYxddOnewnpyD5+tRkXvljKKOMcv8GVDl9CEC7Y91hN:7uesY3Cnpy1mRGlGK5S79RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779174396, "uuid": "9681c8f0-54b1-404a-9db8-04a3b985a93b", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779174396, "uuid": "12b9cddf-9077-4351-8b7f-970fd181321d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174396, "uuid": "3b673319-0503-4ca6-a110-0d6e3765eb45", "value": "winhost.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74271f4-53aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779212810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212810, "uuid": "341984a9-e3b3-4c48-b497-3565c7201c1d", "comment": "Malware payload", "value": "2dc0c91388518cbe244840ac0f0809c8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212810, "uuid": "6c86ed34-665b-40a3-97e6-30fdb7eb20e5", "comment": "Malware payload", "value": "03463141b820e7404a3924b64c30e81dfa7452ce20a1e6186602760066d5c499", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212810, "uuid": "6a5bd832-481a-4deb-bd4b-48bf88fdc3bd", "comment": "Malware payload", "value": "0b69c3397ede579d7c57494ce2a41ecbd40ab87b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212810, "uuid": "561dee76-f64f-4402-8980-a12deeb09d1b", "comment": "Malware payload", "value": "deae5c33bc02c06621df2e98d1b4e538f1a43423dcf353f8877ebe5f8e59af443b556479ce4aa7f31d16e432856ceace", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212810, "uuid": "82e331b7-ea58-4528-a05f-78ead7353ff0", "value": "T1D826B351579C9372B7E0AB9D463EFA30980E514368C6DF1130AED3183A6DD07A36CAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212810, "uuid": "1549ba8a-0833-4064-a9b5-750c3ed1b6f6", "value": "98304:OwCDt3Ipm8HogToIzbI0i8f4Uho651mCsdsnz+3Ob4UUWTTWCFXVCdxavTnB2ov+:JCDNS5o0sxUhB51hz7EUdCCVVCd0vzAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212810, "uuid": "9f9e1ce3-5719-4f79-ac0f-31198c645a43", "value": 4842227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212810, "uuid": "d1f02db3-a0c4-4d3c-9496-1f83d20e55c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212810, "uuid": "85f7f242-af15-49db-8aff-d7303cb2e4cb", "value": "PO_01003943.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e4602c-53b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779217778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217778, "uuid": "f76fca96-d92d-4ca6-b5be-2a15e6cd009a", "comment": "Malware payload (Formbook)", "value": "fbba270b5b39e50ac49416169ee563b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217778, "uuid": "a69c0929-6c6c-43a2-b3a2-fa604293c58b", "comment": "Malware payload (Formbook)", "value": "03db270f22ccf186bcdb62454ab32ad0004bc382e03c5d742f2af5dd63fcdf88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217778, "uuid": "89ddb6d9-fd35-499e-8665-135ed5646541", "comment": "Malware payload (Formbook)", "value": "864a93ddc271508a13b5648bd1b96ef9e7dd2caa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217778, "uuid": "d8e1f2af-1824-4411-8a34-4f3755bd3b82", "comment": "Malware payload (Formbook)", "value": "0a4766dde48c6d77df8e9010ab5279a3ea212e17d20a148c5fbea3213900c221711d2bf760ccbf3ce66480eb1cc9d9d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217778, "uuid": "4dc2f153-5e53-4921-935c-b414fa5fffec", "value": "T1A82512685A45E043CA850F791FB1F6B9236C1EEC6500E227DFED7FDBB867A251C04291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217778, "uuid": "18994676-dd71-4bad-8d1b-d62dbadad28c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217778, "uuid": "12ba272d-a99f-4cac-94fe-0d6ced1cf5b0", "value": "24576:B04vhWZcDcyVMuHhLHIHInFg7fLhPtC+KqN0gmYqe8:B0Mhs0cmDBLHIo4i+ZNOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779217778, "uuid": "b62c8ce2-80ab-4b72-843d-a02f1d95b58d", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779217778, "uuid": "6887e627-d4e9-4fa0-ba62-2df74501468b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217778, "uuid": "6b043d3b-6476-4ef9-9e6a-dd7813a0b7cc", "value": "RFQ NO 1241010326_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad99d92b-537d-11f1-a769-42010a9c0008", "comment": "Malware payload (Oscar)", "timestamp": 1779193467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193467, "uuid": "69ceffc7-7f2d-4950-b62b-b81610439b99", "comment": "Malware payload (Oscar)", "value": "5421716788c33ac20f75e7c26a8f93c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Oscar", "colour": "#F1BDB2", "exportable": true, "hide_tag": false }, { "name": "OscarRansomware", "colour": "#D081A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193467, "uuid": "3be038b7-aada-4fd6-be66-7df8d17f37fa", "comment": "Malware payload (Oscar)", "value": "055db0c06d81258807fc2132924068d744809ce46cfa0de045410cd400ae1ab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Oscar", "colour": "#F1BDB2", "exportable": true, "hide_tag": false }, { "name": "OscarRansomware", "colour": "#D081A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193467, "uuid": "70fb5873-3b61-4034-ad23-c3f68a58a977", "comment": "Malware payload (Oscar)", "value": "8284a87ac72a6cafb294a1e6d1ed4494cf1b772b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Oscar", "colour": "#F1BDB2", "exportable": true, "hide_tag": false }, { "name": "OscarRansomware", "colour": "#D081A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193467, "uuid": "4d9b2ae2-20a0-411d-9865-15a260b40d88", "comment": "Malware payload (Oscar)", "value": "f3665b9062e68511499a76d210e08da165e639fbd4bd87a763c99b802f43917373ede169719ee3325ce950a7736cd68a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Oscar", "colour": "#F1BDB2", "exportable": true, "hide_tag": false }, { "name": "OscarRansomware", "colour": "#D081A6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193467, "uuid": "fa92c9db-e9d2-43bb-b43a-7a7eb37cae55", "value": "T1DE93D816726520B7D576C039A8C2522AFDB13055033A1AFF95008AFCAF707ECBE3DA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193467, "uuid": "07677a47-13d6-4851-99af-81111e927e39", "value": "4bb2668586c6fdb8527e06cd720e184b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193467, "uuid": "e391583d-4d25-4443-9aff-87616222ca6f", "value": "768:omFYGinE/2cDGIQGLLcMXyWc3FEkwhB8B1Jo7vINoWAwG:NfDX9Lh4zwhB8B1Jo7wNoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193467, "uuid": "38e01f79-e62c-417d-955c-b7479d683bc7", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193467, "uuid": "324a78f0-5db4-43de-a926-027cdda94b79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193467, "uuid": "fb2e7d9d-2942-484e-bb39-cf7820256cbd", "value": "055db0c06d81258807fc2132924068d744809ce46cfa0de045410cd400ae1ab7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9523de-5365-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779182887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182887, "uuid": "467b4c81-2375-4a19-9033-a41707e37a54", "comment": "Malware payload", "value": "e46b84c4295ed6d4c62025f9f8f038d9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182887, "uuid": "1e2fd64e-73e0-4891-a085-77050fa58dd6", "comment": "Malware payload", "value": "056c03d6fd1ef468bb8eebac2b49d87be9c82d6ac1fd0a9c581832647246015e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182887, "uuid": "7b0ed3bf-ff44-48d6-9252-c3928242542d", "comment": "Malware payload", "value": "ec37b46da7470317bd65393a2f23ace11c9b34ec", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182887, "uuid": "ff76f4b9-9769-41a4-8db3-ea6b872fcb64", "comment": "Malware payload", "value": "9b4e77b45ec48c6ecefd472adea07a6833194b5de3d2657c4126b7273a24af8e3aec1923244839cea5ed8a5746215362", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182887, "uuid": "695bed9d-9919-4936-be84-9872425f4b72", "value": "T1F10633917B0348B2F9189DB05C604C74B6B36EA718725A60B59CCAD8BF23E9088777D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182887, "uuid": "28bd6652-5f4a-43f2-9cf8-ea2b28a91ea7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182887, "uuid": "74282267-ae8c-4f05-be26-f1b3bad041a7", "value": "98304:NaG7jVn/N1S5mJPCAXMT9mCgVewtX4TkZdakTVLw:MSj5/N19mmnVew94TwakTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182887, "uuid": "5ffbce17-a574-4ec1-a78d-bbdb49d01532", "value": 3871797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182887, "uuid": "a816bf80-e146-4a68-9e82-dff1332a9aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182887, "uuid": "69c191d9-2a5b-4ba6-80f7-c386ef107f07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc689f9a-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220550, "uuid": "e69c08c2-b7d6-4653-8ff8-060b6ddeea03", "comment": "Malware payload (Mirai)", "value": "270c1ec018d154240a9598d94f2942ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220550, "uuid": "3943077d-3083-4d85-8e10-a0cd91fb71fc", "comment": "Malware payload (Mirai)", "value": "05e840d312b4bfd8545f1f89d68f5c8689e9676cd4e6043f8cec4b71f1f55f42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220550, "uuid": "f1193a1c-c737-4333-bd8d-18d6c798a341", "comment": "Malware payload (Mirai)", "value": "c3ad2520dee4870da6f43784cdea4e1ade3e4aa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220550, "uuid": "d7d3bf14-8f8d-4b44-9bab-77baa3f52678", "comment": "Malware payload (Mirai)", "value": "e4d2d006e3686fec308974302d48b3b418e39bce9d54bb6f821869025e63a301bba99a0dbfcc5729f1ba0e09c72e5c51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220550, "uuid": "262ae5cb-cd1f-4a3e-901d-648e1ab00b58", "value": "T1A9A34C81BC919523C2D423BBFA6E01CD332667A8D2EF3217CD215F25378696B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220550, "uuid": "bded85c6-7b7a-4a52-b81c-8121a427e635", "value": "3072:YDs1MEJNb/OUHfA8aDeUrg1Z9TjofcmLh:D1MmrOUH8eUaZ9T6Lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220550, "uuid": "8f1f3683-e66b-4204-8654-01bc1211a714", "value": 99688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220550, "uuid": "d3934111-4d35-45b6-8425-34837f9bec3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220550, "uuid": "550213ed-51e8-41bc-be48-3d4231401703", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfc0b16-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219586, "uuid": "07c6120e-47f2-4a20-a211-7b459e91657e", "comment": "Malware payload (Mirai)", "value": "4654444b287cbe7ccbe803da21b69b6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219586, "uuid": "d60e0928-4540-479c-be41-33787097e07d", "comment": "Malware payload (Mirai)", "value": "05e9521e3864a0e3ad69114aad816ec94656e8f01c9cc56a010642467d51c436", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219586, "uuid": "b2fdcb6e-0418-4fe8-9ba6-8d366a0bc0d1", "comment": "Malware payload (Mirai)", "value": "7aff106bc08af50751f3dc6360e257a3bfa3e229", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219586, "uuid": "82d8247b-c85f-4289-8d5d-5fcaff5498b0", "comment": "Malware payload (Mirai)", "value": "b987f940192f50b4d5b0492b1c89fc067a9ff8c0ec097eb788bd738494365777f4438f9dcb62440ea13c7d223ca49b95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219586, "uuid": "d2a657c8-5993-48cd-b45e-e940fda0692a", "value": "T100F33A46F6418B13C0D61775BAEF420533239BA4E3DB73069928BFB43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219586, "uuid": "db69de3b-0559-4c21-9fed-818d87f758f0", "value": "3072:w0jlwv74BRae/xGPZ06v/mYp+C9T6MjXHDjyoM/9Rv03:w0jlwyRae/xGPd/z+cT6OXHDj1M/9V03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219586, "uuid": "cfc276f7-b998-4af6-9c37-95a5f362ae41", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219586, "uuid": "ba93bcb2-48a1-4e06-a436-c1d0f455b61f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219586, "uuid": "57bf6134-3675-4fb5-928c-f15c7fb770a6", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6710ca14-5379-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779191631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779191631, "uuid": "124a2259-6961-41a8-9e33-1f0b515f8138", "comment": "Malware payload (RemcosRAT)", "value": "a4e73b508e66bce580a7033a679e9abd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779191631, "uuid": "facafc33-cc14-4203-b4b7-7fb0f7d0b10e", "comment": "Malware payload (RemcosRAT)", "value": "0641b6cd24ea6a9823d3862052faa055a1b9e9d398493f71ccde9d96c1f503cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779191631, "uuid": "4b938e04-3e9b-4dde-a234-2e58c5f91bc7", "comment": "Malware payload (RemcosRAT)", "value": "47b71ba13da765b69e17b918ecd4eeeec3438a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779191631, "uuid": "85f65879-0aa1-46b1-a2f3-cc1c9bf84080", "comment": "Malware payload (RemcosRAT)", "value": "0302ea4232549c145fe8d729b8bb6937200dcdbcb1f3d7a3e6bbaf757bb48e2debb6d61f4f41cf972f05068618ca5df2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779191631, "uuid": "343355f8-dade-43b5-8a42-b3e0ab207f3a", "value": "T1FEE413A13A90C8E7FE6997F0686A802050F5BDAC55E3930DF7BA3739A7F2351950F205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779191631, "uuid": "6fcf2b3a-4e4f-4469-a9db-4a8c3b3c38dc", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779191631, "uuid": "65b6e3b3-521e-4d00-bd0b-140f64b7b299", "value": "12288:fT2Zk/EL6QNglQxsqyp3hWo8gLOZ73aaz/jWCjNXfLNkVYW86joMAZHLlbbHOxQ+:fqerOLsqyp3hXFOZ73ayBjNXfLeGeJAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779191631, "uuid": "024980b4-b8b3-4243-ae38-28df9c8e2bb2", "value": 667704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779191631, "uuid": "be80c85d-c63e-4231-842d-4c595e326174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779191631, "uuid": "5b8b4633-f7b0-43eb-9f0c-0666fa3f20c9", "value": "0029200112026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91dc1aab-5364-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779182683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182683, "uuid": "d977c359-273a-483f-8350-7708d77f2e7b", "comment": "Malware payload", "value": "223e61565c1008e097286aeceb0598b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182683, "uuid": "92198e92-efe4-4e17-82e6-e6f4b99684aa", "comment": "Malware payload", "value": "08052e4a9ae060caa0d1ec7e4c671b113b8a4983ecd329fffb95e3b0179e399f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182683, "uuid": "d319ebf2-448f-4b94-9cbe-726159a3f9e1", "comment": "Malware payload", "value": "e1093b02e18cf208e04dd09709719a60cc41c27b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182683, "uuid": "a8005fc8-56e3-49b2-9780-4a143cef86ec", "comment": "Malware payload", "value": "c725821d8146058f56d1b14671c23ec76cd0c8cdbc2064e7f737a1055ea07521f473f47bb3e2c38c2a8c8e04f0dcb197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182683, "uuid": "8bc8134a-079c-4e37-82a7-7da4a3a7843a", "value": "T16E0833103806D5F6D36957B2F2D5E2F2E0236C5B177804CB42A8BDE7F5B80A6B0B5978", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182683, "uuid": "d4ecab00-25c4-4a92-be25-4b4cd097867d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182683, "uuid": "7a9394f0-85af-49ac-93dc-a6dc0bef7ead", "value": "1572864:n+2/fjEMJmNhzsk45EUjQoaHc2i0Ul80dTOQcVnqj9axJmt3x12bVgLjcAbmt:n9jghOe/oa3UBrcVqj9MEt3x1mujcAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182683, "uuid": "1522b489-3e20-4e99-b192-35825d7202af", "value": 84320784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182683, "uuid": "3bbb652e-1429-49f7-9640-ec164a8059c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182683, "uuid": "4506340c-6f60-4a76-a72d-da4ccfb9de36", "value": "YouTube_Desktop-Setup-1.0.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16166e6e-534c-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1779172167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172167, "uuid": "32eb1889-9a91-45f9-a14b-faed635cf3e9", "comment": "Malware payload (PureHVNC)", "value": "6eeddceed96b889b1ddf196169bb4964", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172167, "uuid": "d99cb7ca-7096-4d41-ac09-e48eb95b1f61", "comment": "Malware payload (PureHVNC)", "value": "085dd5a6d5edd8c74b366e6f46383610949e3242229d23bff70fe7dcf33d2b26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172167, "uuid": "7c4f4b92-8f68-4236-83eb-6951ec441d2d", "comment": "Malware payload (PureHVNC)", "value": "ae2e0bef839a20f85bd2da0e1a422be27c38c91d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172167, "uuid": "a884d6a3-8334-4b16-8c86-b2b9c043f683", "comment": "Malware payload (PureHVNC)", "value": "5796ded73e660a5caa8334a27e1cd92dc08b9584913d82a105de140d09972215084d70d9c7df66711e20378f3d22b53f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172167, "uuid": "5a54c3e3-35cc-409c-8ac8-c9ce4d2e6a23", "value": "T188158F6193E9D40CF2B35F517EB68452DB36BD8A2D34D1DE4C4192AE0AB2E54C8B0B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172167, "uuid": "401fc143-c4a0-48f6-aaff-86e3b9a61255", "value": "3072:CST75PxmfjPU2mtzGYnBZjxeno91/Y+iBe8ElMwjxhQGYFU121QTBRpkOfbtipk:ufN2YRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172167, "uuid": "fc4cef80-6c22-4f6a-b3ed-2e9c3212a104", "value": 886914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172167, "uuid": "7dc7de5c-8340-4e2c-8e25-7a70f0824804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172167, "uuid": "1c8b037f-f3f9-4b03-9ddd-964948a814db", "value": "REQ For Payment Invoice FER1202600086230-89_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a23854-537e-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1779193715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193715, "uuid": "b0a4d8e8-d3c3-4f00-8a9f-c44de84b8447", "comment": "Malware payload (Amadey)", "value": "8075242dee356ff10ac4e19c92301918", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193715, "uuid": "da3ed31e-be49-48a2-8505-44e2fb4f5723", "comment": "Malware payload (Amadey)", "value": "091cf0a3ee50c9a8dcbe362eb4568e46f475937c203c403d41e7a6f4d3adb501", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193715, "uuid": "123955ee-44e5-4219-8469-a3b7276d2113", "comment": "Malware payload (Amadey)", "value": "780ebb47ef0d21c64c786c7540d1babdd641408d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193715, "uuid": "9f8442d6-dbc6-42ed-b447-707e3551ca95", "comment": "Malware payload (Amadey)", "value": "28ed6dcee753784e3345bc5bc2eb9f25ceeb4ac53f4d126c432037370185338834fd485758fe53c572463c048eb5165e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193715, "uuid": "ec2b7593-82a2-4cab-8a06-bae9064730da", "value": "T1CA716D568156A332C312DAFE7EADDF4CC5D2720748A1F1D3DC8168DC05948B1D7036E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193715, "uuid": "d04fc8de-713f-4252-b10e-1ccb4eb3677b", "value": "96:GOz1gAwEz4cnnNob8wdhAsjvyRXZcyuTtT6kleZMwSsmXvzOx:R5ghioVh+82eei8mXvKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193715, "uuid": "b07313e2-71eb-4196-a0ac-1d7ee21105dc", "value": 3821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193715, "uuid": "33875ca9-3e6a-4dbc-8d48-df6de07f9f42", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193715, "uuid": "7cc841e9-2ab0-4166-9335-6670f1262d0f", "value": "New Text Document mod.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af976dec-538f-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1779201201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201201, "uuid": "ff680e6e-b875-443f-a494-309c16148fd6", "comment": "Malware payload (XWorm)", "value": "c7a6f220f2ff7d6718a5b2f0e85f13dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201201, "uuid": "e8c84016-de1e-47be-9126-45dada2d331d", "comment": "Malware payload (XWorm)", "value": "09c897832cc1b39c71da765f17adbe958551335f18d756905e733a05bfef697c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201201, "uuid": "67ba6683-3140-47e7-974e-79572f05f848", "comment": "Malware payload (XWorm)", "value": "f253dff01948c778b45aedc2e5654bfc432f8627", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201201, "uuid": "9c938924-ffb5-4892-b407-13ea93519d75", "comment": "Malware payload (XWorm)", "value": "0261f88340226f86283c6db797e7fd833fb2494592f0bb63dfa24aa40636c1396924b5009aa0de9f6e4289560b3a08a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201201, "uuid": "4fa9167a-cd15-49f9-9e07-ece4764a7f16", "value": "T12C773392268185FDE837B439C409E82DB971780147B4CA5B2B619B2D1F4B2B47F37B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201201, "uuid": "279781cb-0370-4ff6-b47a-02817ac7957c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201201, "uuid": "cf738765-7680-44b0-9b41-8672be9a4c75", "value": "786432:ZH4dQc3MG9Cf1yDcr4Ab+pSIRdormy8kx/BxPqj6kyaQ:ZYDMGYf1ymFMFKlHamP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779201201, "uuid": "74fbc443-048e-4c5c-bf2e-141cf6bfd07e", "value": 33405576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779201201, "uuid": "0a17c3ac-f3e0-4797-aefd-3c3975d959cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201201, "uuid": "c46f04bf-d64b-400f-9de4-8b3b95440e53", "value": "09c897832cc1b39c71da765f17adbe958551335f18d756905e733a05bfef697c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d2a9c2-53b0-11f1-a769-42010a9c0008", "comment": "Malware payload (DeerStealer)", "timestamp": 1779215278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215278, "uuid": "eaec7eae-14e0-46af-a19e-b6f4acfc6002", "comment": "Malware payload (DeerStealer)", "value": "35a4ddcafac724944f2f578baa027475", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215278, "uuid": "6595c2d4-c8dd-4a54-8a50-7e46725bb72f", "comment": "Malware payload (DeerStealer)", "value": "0beaafb2ad45ff5e6b8a5ef5fe63ab544f727c53960ed874dd40ebbad868d5a2", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215278, "uuid": "8daf50c2-131f-4f22-ad9b-a0d56d5eb8e7", "comment": "Malware payload (DeerStealer)", "value": "df8b452867fa198b27a3ac6cb362b2405a39bd11", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215278, "uuid": "1246dc4a-9ecb-4925-b44b-77372a0f7010", "comment": "Malware payload (DeerStealer)", "value": "cd0db27add4d4aac7d69d9e82cdc24f3e2757dc45f67c9d4bc8dbcb687ecfbc0bf98d9a0260263e32c1a73fe79d4e609", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215278, "uuid": "21144529-cf21-4ade-816d-6fe1bb7323ef", "value": "T1A546331237C179F5C61648308F0ECF66C773E29A3A457B07DB964E4B8E971B2469B2C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215278, "uuid": "0a0abad5-fb4e-403e-99fe-ce11b78a36d4", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215278, "uuid": "75347665-f238-4228-af5c-bd39184bded0", "value": "98304:+pn0YinVqZBPi8YPpwUJLlxN+QJKoAlQg7fZgzKxCqg6t23yi:+pn0YVLspvyGSQgzZgPS23yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779215278, "uuid": "b4c4ae3e-e12f-47b3-a69b-ae7beaba3fdd", "value": 5515156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779215278, "uuid": "5a350f0a-b498-4c98-ae29-5c6828c7da49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215278, "uuid": "8c7024b9-9ea9-4488-851d-9fda23120ee1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8743240a-5365-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779183095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183095, "uuid": "e5c8cf0a-aa7d-408a-8dd0-6dc96f0c234a", "comment": "Malware payload", "value": "e302a6f4e571e3d5a9954292adef29cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mahu-Agro", "colour": "#293157", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183095, "uuid": "0dc6b61e-1423-4e60-95b2-b57fbc84cd2d", "comment": "Malware payload", "value": "0d024a36cc1c1970a26a7f1ac0daf07d9478bdd6c5b6484284664ebe33eb4815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mahu-Agro", "colour": "#293157", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183095, "uuid": "c6190015-d3cf-4e2e-b5c0-aeaabba74a27", "comment": "Malware payload", "value": "29a32701ad8f97eea1fe5dbafb6a0a70fef28aa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mahu-Agro", "colour": "#293157", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183095, "uuid": "eed9a225-33e5-4188-9125-b69054c16e1f", "comment": "Malware payload", "value": "fa8e55770b83d149a89c3f5707943687faccd7c54384ec9b595e5d59d252ad3de24b65fb8a4cc33f311c2d3db2328e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mahu-Agro", "colour": "#293157", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183095, "uuid": "b562576b-99a7-4880-bba9-af9841963dd1", "value": "T199383377E5A80CEBF62DB7B0AA0BF473F0A506ED59E4B93C4B75C1249139A7001C6E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183095, "uuid": "11b3ec33-0685-42e1-bb0a-43eb3ad70b80", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183095, "uuid": "7d42d9d8-a342-46b3-9016-009ec2f651a3", "value": "3145728:SLaqeuFn44mS+xYTqk/gsGKyu3dUfTAlvZtniJU0Fg:k9pFOKTAsZyuNCARn45F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779183095, "uuid": "32afdbfd-2094-4f99-9d2c-d4f52a4ea5f6", "value": 103332680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779183095, "uuid": "bd3c904e-97b9-4884-a790-e74fba9c7800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183095, "uuid": "9a4be8a6-77a3-4b99-a6d4-6322e505bc88", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58222ed6-5363-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779182157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182157, "uuid": "631d0a6a-220e-44c0-96f5-e04f7856a7c5", "comment": "Malware payload", "value": "f2264c0a7ca43b9b188322dc723c7fbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182157, "uuid": "a4499fef-3e92-46c0-babf-9b25ca8b0f7d", "comment": "Malware payload", "value": "0e0737160b4c8047c1e808c61e734e1d5b986fa67429486cebb1fbe7f5cde20d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182157, "uuid": "3ecfb3e9-2f75-4a3d-8047-1257195e8e25", "comment": "Malware payload", "value": "fca6fff3028982b622dbadd1714d5d4e1e4c3547", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182157, "uuid": "f1c43f12-c8b6-44eb-8e89-2f116a5449eb", "comment": "Malware payload", "value": "7b29e2a7434b45d264f82a163362c7368177c53679895f374e09187390c3420265cfc6b9d841b97deb3640c24c9ded4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182157, "uuid": "6efb5e20-3771-4cf7-9dea-e6c44113101c", "value": "T139F02B6F938C3C11C6285338010307310B29E44284DD3B07C370290C4D1B2400D7DE74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182157, "uuid": "de7a8ef3-933a-4a5c-bce3-de2b29cfb7e6", "value": "6:Btk/tKjal4/PmlDppKcCKlVwIs/EnWlXhvZ:Bru4SjUgw1/EniXhvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182157, "uuid": "56660262-b162-47bb-a2b1-3c30e78dd2bb", "value": 464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182157, "uuid": "eca38dd7-643f-44c4-bfec-1faf9f7c99e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182157, "uuid": "b29e6052-fef2-4341-8901-c09451550bbf", "value": "dlr.pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac13db3-5395-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779203609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203609, "uuid": "7f10c332-70b0-4f4b-afa5-9fb8dc1033ef", "comment": "Malware payload (GuLoader)", "value": "3af35d3de456d9e1c1b9d6e233298944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203609, "uuid": "9d79155c-baf4-4fa9-b735-a45a805424bf", "comment": "Malware payload (GuLoader)", "value": "0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203609, "uuid": "6f1c51c8-4963-404f-809a-716a195397cd", "comment": "Malware payload (GuLoader)", "value": "4e35d3a590af24c8710343d47e306b9194209389", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203609, "uuid": "befd5a95-c1ee-4e27-aa72-edc109129fcf", "comment": "Malware payload (GuLoader)", "value": "c2e54c8e9daa039848c955c810dcbcd7c48055ebf0dd34e77eb1d350d53641f75ce025b432032fffe45a2af5a50f8085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203609, "uuid": "37cb5373-41ba-4926-a8d5-982672f3c949", "value": "T151152349B3358B1FE859E370D87A8B64CB7CAD687406570F634572AA3C632CA05253FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203609, "uuid": "2521cda1-b424-4970-9f22-057fea05528c", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203609, "uuid": "61766210-9bcf-4fef-9fd3-3b37c0f5d28f", "value": "24576:1A7FHfbC4WEAXf6lMeBEFmNZpJGSqQc3DKtbPik+B:1S2EzrDHVSKtTik+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779203609, "uuid": "1c8d8866-508b-43e6-97f6-2f9fad696ed0", "value": 901680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779203609, "uuid": "98bf41be-4c94-451a-a4a6-0a329078b22a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203609, "uuid": "b988adc1-5cda-4d9f-9374-6a41e84f4579", "value": "Skyggefulde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be901cef-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220554, "uuid": "d5fb7c7b-9b04-49f1-829f-cf702ebc2e5a", "comment": "Malware payload (Mirai)", "value": "1f4c3939008c662402d5359deb7d20cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220554, "uuid": "f63fa681-0453-4b04-bd6f-bc183d547249", "comment": "Malware payload (Mirai)", "value": "0f7d9e0177360499e2bf6a95e73fc4545b7fbb9d72b991aa3bebd499d9a64521", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220554, "uuid": "41a74ac4-0a4f-4edc-b19b-1ac899d05fae", "comment": "Malware payload (Mirai)", "value": "7a5e6728671311f82f4a7a5512ecd85572d62c82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220554, "uuid": "d92c33a2-436a-4ae7-8699-087742d9bc98", "comment": "Malware payload (Mirai)", "value": "932aaae23986832bd9b21cb1dd2e069388ff1ba14cdfc712e3e620fae5c8a2ed00b38aff6671e724a26415e2059913b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220554, "uuid": "acaf975b-88ff-4cf3-8d04-73368084cac3", "value": "T1CB044C46DA814A13C0D6277ABAEF41463333AB64D3DB330699186FF43F8679E0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220554, "uuid": "cad3c7a7-c54e-4898-8158-7895ce5a1583", "value": "3072:H4XkiJzhaQo/BgrZUZKagsIO8nzY2sy6OWBJfOmNEM/9Tmqd:liJzkTOkKagsIO8nM2JeJfOmOM/9TRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220554, "uuid": "7ac063ba-b5a7-4c11-911c-ad73359a9aec", "value": 181713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220554, "uuid": "1fb8e42e-f860-4f06-ab6a-26fe8b8d5b8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220554, "uuid": "e04a0974-3d39-4a7d-9143-4aec9d61e270", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ed81b5-533b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779165159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165159, "uuid": "95960656-582b-459b-97d6-d0ff61de5856", "comment": "Malware payload", "value": "b327aa9db2451507af259642ae840bdc", "object_relation": "md5", "Tag": [ { "name": "PoisonX", "colour": "#33A889", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165159, "uuid": "614246c5-d77e-4e9c-af50-26031dc83f23", "comment": "Malware payload", "value": "0fb45474ca58bd67220f79b0e3b07f940270c371ba56e27d3e2b99bf4dbb5174", "object_relation": "sha256", "Tag": [ { "name": "PoisonX", "colour": "#33A889", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165159, "uuid": "6e9fa484-a67e-4d3a-b345-54a539734b59", "comment": "Malware payload", "value": "31acae97efc2ea48e6916e0bdc5439f3952698f9", "object_relation": "sha1", "Tag": [ { "name": "PoisonX", "colour": "#33A889", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165159, "uuid": "4a5421b8-a815-4bd8-b5b7-09ecb89de5ab", "comment": "Malware payload", "value": "574348304eecb5a8c5d879a0f51a65a60fc65b466f7007f82431bf36c36933670379288777dd0afe842d60a029c00362", "object_relation": "sha3-384", "Tag": [ { "name": "PoisonX", "colour": "#33A889", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779165159, "uuid": "619837de-adee-4973-a1cf-9f01c22af0e5", "value": "T10F15330CD32E80E53DF709333B8376D64845F9566FA3B9B1944B1DB789613120AA3A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779165159, "uuid": "f9b1b421-5b79-4e5b-88ef-4ac8b6109b69", "value": "24576:zE0cl7RGOUWhl76aZ/Qxok5XxHMqYTJ6LR:zE3lVGtWhl/Z/YZFN3qC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779165159, "uuid": "9df1b6f0-eadd-46b4-88a8-a4bf5d37ca4c", "value": 878933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779165159, "uuid": "7fff34df-114b-4adc-bd13-708fe7dea432", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779165159, "uuid": "551daaa2-9021-49a4-81c3-b64144c4e6e4", "value": "WindowsTelemetry.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a02d048-5363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779182160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182160, "uuid": "736767b0-abd9-4183-9322-cb6a6568a66a", "comment": "Malware payload (Mirai)", "value": "4e6284148e38447e475f794ac26ec6d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182160, "uuid": "99a6dcc5-0f22-4e71-9d06-f705bc8cc777", "comment": "Malware payload (Mirai)", "value": "10250234b65e2c9cf41995c2d51bc7f6147cd0b06357eba0d10b655bf98e6864", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182160, "uuid": "9d06cdff-264f-43ce-b36b-0e6cb868af58", "comment": "Malware payload (Mirai)", "value": "e7abfeac73320bb8bd548c99a28e81ba51f3e75f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182160, "uuid": "7a6bff1e-11d6-4456-9d0b-6bc3888963c6", "comment": "Malware payload (Mirai)", "value": "f851e1815ea928baa87c491b81072787346351e89e513c26ed89e3e3d237aa8fe345847707d4765d402c305b6163b29a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182160, "uuid": "0f228860-ff7a-4389-8b17-bb54f4d70285", "value": "T1B3539C63D97A1D58D12499F0B0309B395733E45082871FFBA666C3B9A447EACF2493F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182160, "uuid": "c696aa7c-39b4-4952-9d4a-61b2eeab4728", "value": "1536:IXh7zTu5fQdZKZocHX86tCfD06rbRhIsR/2u:IR7XEodgZR86tuh/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182160, "uuid": "e6700932-d381-48f3-a721-3eaf28be38fc", "value": 63416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182160, "uuid": "abab561d-8188-4343-910c-ef7edd45dfb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182160, "uuid": "00f82fdc-87b4-4b91-b87f-5026bed4dadc", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9605eb78-533c-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779165510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165510, "uuid": "8dac9da8-5917-4e2e-a332-d006da0ec939", "comment": "Malware payload (Prometei)", "value": "388aceafe91dfbc6309f94cf06c2eb8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165510, "uuid": "fa9136b1-40d6-4689-b76c-a6e6820ff932", "comment": "Malware payload (Prometei)", "value": "10488af6e5a0482515e34dbdc8e03e33e1757d16e1489ce0a191a8ecb90a7255", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165510, "uuid": "4d94788a-428d-4a29-b422-fe31a945bcf5", "comment": "Malware payload (Prometei)", "value": "f6fb06f1190e33b4296430be37b12ed1f0c4b7d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165510, "uuid": "9b129064-11ee-4dab-9ba7-b900cb0646e0", "comment": "Malware payload (Prometei)", "value": "880b4e1b27980c741a1762163013fbf92c6651a85ea51ee852dca4f78a3e9a06a216e3828f980f0c998082f03de1b5ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779165510, "uuid": "4853a74a-3d89-4193-9f82-61d448aea00e", "value": "T11537CF77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779165510, "uuid": "4b49d64a-69d6-4dba-80ac-eb61c524b10d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQl:cqYUQuVDt0TZEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779165510, "uuid": "28ed8181-8bdb-4324-9047-232993cd7539", "value": 22970368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779165510, "uuid": "810d1b94-a72f-4d6b-bdcd-34e7b139e1f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779165510, "uuid": "eaebb497-db82-4387-aaf4-98b43348b5ac", "value": "10488af6e5a0482515e34dbdc8e03e33e1757d16e1489ce0a191a8ecb90a7255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3450bf-534e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779173283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173283, "uuid": "fe8cf88a-fea8-4e8d-b4ed-0ec29f3ffb96", "comment": "Malware payload (Mirai)", "value": "34ef385ea092b4e5b4236d9b92b2fb6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173283, "uuid": "e059d81d-8a9a-40c2-887e-d5a4ae910ad5", "comment": "Malware payload (Mirai)", "value": "106e439bd4abd333fd68f2dd842c4f97584dc9fca9fbe5859a696ae7fafc0569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173283, "uuid": "f8a5cb05-1335-47da-9d1e-d1a94b72abb0", "comment": "Malware payload (Mirai)", "value": "b1b07cba7490aa5a8a5081914864910d51778d8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173283, "uuid": "8079fab3-436b-49ba-ac4a-1434856760b7", "comment": "Malware payload (Mirai)", "value": "d74820e927cd08043e9ab6f8391735b41f185be19aac257c500fe3dcebc8320a1626c5273314981d378479670dbb8e97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173283, "uuid": "76413f9b-749a-4000-a10e-34efa1513122", "value": "T1D3734B22FA760D2BC5C4647661F34725F2F6438624AC8A1E7D720E8D7F24A503257BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173283, "uuid": "f8e3b62b-41a2-4568-ba5f-6c8d35b88457", "value": "1536:7Kmz+U+VZV3LQ1t6NN+A5T9wAexRt4PxIGh/2Q:OS+7ZKMNNfTuY2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779173283, "uuid": "00df84b8-942e-41fa-903b-6ccda4dc5dec", "value": 75968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779173283, "uuid": "2416ae2e-7a44-4df1-8542-c8708d761f89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173283, "uuid": "501ed479-f484-4955-addd-fc058aa26522", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d39d230-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779168394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168394, "uuid": "05c9e432-8f12-4ebb-beca-07853e0f932b", "comment": "Malware payload (Mirai)", "value": "49848d984ec861a497dda1aebbe09eed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168394, "uuid": "2e0c0a14-c12b-472b-a0c2-64763c9e36de", "comment": "Malware payload (Mirai)", "value": "10c685c2372c264e9430d7d6363fcb925b30641e069adbf8bc717be5ee569f14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168394, "uuid": "43c9acee-19b1-4d82-8a44-adab1b5a48e8", "comment": "Malware payload (Mirai)", "value": "cbc6a84e3c9a20fdcf3d1563ea703552905b1e3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168394, "uuid": "ecdbe0ba-342d-4ccc-97fb-72799c20f6a9", "comment": "Malware payload (Mirai)", "value": "5c03d5cb498ab023a32ca3f199c570cfd300be0522ab2d8f6552c77fdb5cb81e7cff8f01c409ccf60d620508c780bde3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168394, "uuid": "6a482284-e9c4-4d76-94ed-316f950645c4", "value": "T1EE82A717AFA19E7BC85BDE7306FA0701318EA41617A1331A2634FC7C3A0AD895DE3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168394, "uuid": "aa42df6e-8792-4d20-af8e-812ec76aac74", "value": "384:n0faaP2pr1yNHNWtHXi63eZXzedS/2B/StWHaYOkjwPmmRDIiyaf:n0DepJ+HM5Xi63eZXzedS/4UwaxkjMmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168394, "uuid": "db9d450e-1037-48ac-a1d7-b029b27288df", "value": 18569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168394, "uuid": "847d991b-fc18-4aea-80b2-dc5f871e2bb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168394, "uuid": "fb032593-3707-4cf4-8156-164c9b9497fa", "value": "dlr.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c66b5ea-536b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779185653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779185653, "uuid": "c632b895-8d0d-4d1a-8575-d7344bde567c", "comment": "Malware payload", "value": "f76459bce56a94dc6132ed052a4c506b", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lambdauyamna-com", "colour": "#8A2A49", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mxjxifkfkkffjjf-com", "colour": "#706BDC", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779185653, "uuid": "65883025-7059-4838-8a52-678d2b8e8546", "comment": "Malware payload", "value": "130106be2495ffecc365c740969501cbb632eb5c9153c957ac76df376b0aa2e2", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lambdauyamna-com", "colour": "#8A2A49", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mxjxifkfkkffjjf-com", "colour": "#706BDC", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779185653, "uuid": "73b4fc20-5097-4dd0-b953-1d014f9cbad1", "comment": "Malware payload", "value": "82420d0ac75d597fea9870ac77930e6ad7f206b6", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lambdauyamna-com", "colour": "#8A2A49", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mxjxifkfkkffjjf-com", "colour": "#706BDC", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779185653, "uuid": "d2aa9a20-ffd7-4bec-a06f-221cddd51c4b", "comment": "Malware payload", "value": "56923bd4134ba1b62a2f83cef3baba99a0d39befd66b0e7b7629cde9d069d8a77c15888d96dbcbe5c2ad453e89cc2a05", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lambdauyamna-com", "colour": "#8A2A49", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mxjxifkfkkffjjf-com", "colour": "#706BDC", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779185653, "uuid": "75cf6f33-52ba-4e3d-8942-b977efc9dfe6", "value": "T1CE129D1EC7888CC2D1BBF6796A808159CA26AFC846EA000516F952C96BC2BB76535331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779185653, "uuid": "6df1151e-786f-46f0-8ad5-da1c882e18a1", "value": "192:BRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+as:BRm/wksuQJ/g6dI+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779185653, "uuid": "86efd30b-4ab0-4b76-8f26-bf239d4a2fe0", "value": 9145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779185653, "uuid": "cfc8146c-2202-43b1-94d1-da7f0a66842d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779185653, "uuid": "d81a36a4-9523-4202-b48f-6319033c27ec", "value": "nte.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55668d57-53c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779222525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222525, "uuid": "6293867e-adb7-4b38-bc56-635c2608e3a7", "comment": "Malware payload", "value": "3de341a5a4224b36526428ce4cf5cb3f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222525, "uuid": "89c04a9a-638a-4fff-9f59-fd50e3d4417c", "comment": "Malware payload", "value": "13c99edfcbf9d9e9b36cf575a50164a06ccb816ca2d32c7bdf690ee1b16279ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222525, "uuid": "7ee07406-b91b-4bf4-8e5a-010093c36b26", "comment": "Malware payload", "value": "6c37748e0b2dfb0afe012625b5d35c99e36ac431", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222525, "uuid": "c8ce66d9-87f1-4b95-aebd-0302d34ec9b8", "comment": "Malware payload", "value": "03890dbe4d7e129a8ad7eb5cb35efd789856ce58da2766b4d6832a6aa5a74236db8fb89ac3f016266d18fd8e85c1b5b9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222525, "uuid": "f6a45780-d519-413f-9fd3-d67823795916", "value": "T194F1E804EBE80372ED7B5738A87717001736F6139967DB6F29C8010B2E637854962B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222525, "uuid": "b47b0003-ca7d-4e8e-89fa-1d2528cfa9d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222525, "uuid": "cbb7ca49-cf80-455f-b086-31992e17c5dd", "value": "96:d1CELVTgUe+wUyFNVx3UFWpO7DdC+hjQleeo0luEIk63Hak8Wu3ya+bl66nzNt:+ELV/e+9yxRUFsCSRt4xHH8r3yP3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779222525, "uuid": "8afe0cb8-ed59-4573-b97f-1e87a56573d2", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779222525, "uuid": "9f923481-e832-42ec-86ff-b27f4f350d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222525, "uuid": "8fd9e7ad-aa83-4d81-9a1f-94cdd96aae5a", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663e815c-534c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779172302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172302, "uuid": "33325cd7-d7c9-48ae-852f-d0b8151cd384", "comment": "Malware payload (AgentTesla)", "value": "c7d591c1934c5b4001762f9f9b348df3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172302, "uuid": "fa565b3d-9112-407d-a605-423a91fd841f", "comment": "Malware payload (AgentTesla)", "value": "15d0df4b08b911274c269cbb64dea678690034a5931e8d119d488d25fa07a63e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172302, "uuid": "bbf93d60-946f-4f83-bdc5-f6aab70fdcf0", "comment": "Malware payload (AgentTesla)", "value": "60bc138e4d52791d8728d554c1dc738e3784c708", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172302, "uuid": "dd28b5a6-e86c-40ea-899f-0568d5069d93", "comment": "Malware payload (AgentTesla)", "value": "af3d57b4d1a8771c0d0a3c2a0c63fbf9c479b624a3177f7689cabd50aecbf833612ef363e01aabd692f0519cb4d026ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172302, "uuid": "5fc7beb8-c042-4adc-923f-af65217cc7be", "value": "T13FA69D08824DEBAE90DEAE00CE6C95C02E5E22DEDF295607941AE5F4B70F9D3764744F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172302, "uuid": "999fdb97-5c3a-4a1b-9634-6afd25f13051", "value": "196608:x0lrpwkEh3DuQ19BEd1ME4gVICsHc8p48g/ftVHJ0b94EkU3T7gPafWDjATkp6f8:x0sk6DuQC1MngVI88uxF054EkEtfWHA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172302, "uuid": "3421e925-58c6-4a42-b01c-ba50b6b11c20", "value": 9556512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172302, "uuid": "1545d885-77a3-41ab-85bd-5688e25d7ea1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172302, "uuid": "54911a90-bf2b-4cea-bbb3-22709646651d", "value": "Original Shipping Documents.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8e11af-534e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779173096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173096, "uuid": "3e28d5e6-6f0f-430d-a4c6-7d05964ed399", "comment": "Malware payload", "value": "8d2aa514a1f43b2d7c07e5bad53206c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173096, "uuid": "3c260b7c-d24a-46f1-aed0-4ac91cf46519", "comment": "Malware payload", "value": "169b959d99a174bde955b8f33a2d17f9a8bb61ea4a6184dfb67335159aba15d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173096, "uuid": "160409b3-3bfa-4500-9ea0-bbd53b63c0e3", "comment": "Malware payload", "value": "224c087ccd59a8644f19b227ccf484c39565856b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173096, "uuid": "3086a3a2-a1b6-4a64-a81c-77bb53b797b9", "comment": "Malware payload", "value": "cfc7500b979f0c0bc419c531c2a6182687c6e330677d4c954c6cf9506672cffe9b48c2e9557f6abac212abd20f39b62c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173096, "uuid": "3ae98a7f-ab8b-42d0-a7fb-ba8ac1e9e53b", "value": "T1DA852A3BB2A8C569D25DC13AC1E34F44D433F0B61B33C9E792E602699A0AAD55F7F250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173096, "uuid": "f627fcc2-752d-4ede-a94e-6404eb30b26f", "value": "af05b86732709620cddcf5a766de7390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173096, "uuid": "8cdbb898-76f8-4b95-a73e-8571aa3ee5d7", "value": "12288:hssP2EbraKgx7AemuWY8z51bnC0MAqZSBNuwOVy/ht5Yx6C5oKA0ryfW6GS3ouc3:hlPVit7OuWY8zzNtOVy/hv3GEVBgTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779173096, "uuid": "bfb0b698-a323-4b55-969c-45ed03a5b19b", "value": 1801776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779173096, "uuid": "67a8d578-b866-4b6f-a0d3-a86e924250ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173096, "uuid": "c773ba0b-3634-438e-b64d-137e49b70604", "value": "720af381f6e895fab38894a5dcec76cd7bae37153c0e81b38852e1cb0b14493b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30134d5-538e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779200831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779200831, "uuid": "2533faff-124a-4f4e-81e1-2e79f34af844", "comment": "Malware payload", "value": "ddfdc077b49d99dc19645f7045a6815e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779200831, "uuid": "ece63758-26ac-48c1-8ade-792b278f2804", "comment": "Malware payload", "value": "16ad0979581ce9554c57ad04d88ee0ba009b67cdefec389f222129011e9f6564", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779200831, "uuid": "f3f30f13-c376-4775-ad19-c4cbc9e38130", "comment": "Malware payload", "value": "1fc41a066b57a47d02f0a5d5c66b96b1a60ab470", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779200831, "uuid": "50169299-c978-4da9-8394-714a5bbd69b4", "comment": "Malware payload", "value": "27e1753f01fc02055ed97d8532c034d5440b7bc368d05903b3c7891c4d002b4ae6066e4d9ed27608f00f9466326f680d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779200831, "uuid": "6fa99f87-24d2-44d5-be47-2047d6b9ff0e", "value": "T1CC137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49ADCD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779200831, "uuid": "49d2eaa8-8c10-439d-97a5-029efb24c595", "value": "768:E+29GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:E+zco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779200831, "uuid": "cef1fd27-6b1c-4c1b-99ba-35095048f97b", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779200831, "uuid": "3cea3a36-a453-4e87-b699-964c35959087", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779200831, "uuid": "e7c99ef9-f7d3-4246-b581-88cbff169148", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b23c79b-5355-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779176229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176229, "uuid": "3760799e-36bd-41c3-a28f-c252a2e663d1", "comment": "Malware payload", "value": "40604fec5186df66deb861d262175365", "object_relation": "md5", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176229, "uuid": "39749b99-bdc3-45c0-a821-3431b4984b4e", "comment": "Malware payload", "value": "18f33f1cb54fe347072cf720de5f022af69a7308cb98f0216345ec722c6f6e71", "object_relation": "sha256", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176229, "uuid": "e8d7f20e-1ba6-4382-9194-a12774250ab8", "comment": "Malware payload", "value": "c8fa049a4953fe398ee07d95bd7058c8b923331a", "object_relation": "sha1", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176229, "uuid": "447f43b2-d5ad-4d8f-becc-5fc370f62597", "comment": "Malware payload", "value": "d310e226c47c5ece93977589cbcbb906f6c5ab2f54f4fd3a15113084eb99d31d87d3add980dea09e0cbc314bdf902f68", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176229, "uuid": "4d1a1048-9b68-4080-8ac8-e42f88be63f8", "value": "T166F5339B34637B4D952C3990EF3C8EA35AB769DDA225814EB3C44CD37DA11809F2B50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176229, "uuid": "032735f1-ff1a-4158-a923-2b841969c32f", "value": "49152:qqQHGvGAfZSplBTHs8ZRkXaih7BcA+CeNyAmQHhcvZ4B5lj2nfmUd0P/Av:LRS+8ZNOcm2cB4BLj2fmUdcov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176229, "uuid": "b836026a-093c-40fc-8cea-93012adada67", "value": 3587378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176229, "uuid": "6bf97902-c04a-4016-a6a8-4b5da31ed314", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176229, "uuid": "ae49b873-ee8c-4dd6-a0ac-5e4b3feb8429", "value": "test-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4885bd-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157254, "uuid": "4092674e-8aef-44b5-83d9-b542bb08e3c6", "comment": "Malware payload (Mirai)", "value": "7e9a4c29a4c7235c6ee365a1b4b7d616", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157254, "uuid": "89daa839-1fcd-4c23-a4dd-6aa1db758fb8", "comment": "Malware payload (Mirai)", "value": "1a59b44271e873fbbbe7b142c598723725f3838aeb31ad2389f31eef6a5315fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157254, "uuid": "9bb21b19-3480-489f-8ba1-029461fe3969", "comment": "Malware payload (Mirai)", "value": "c60032f748e17d302b5fe12dedb8bfbe7a5c07d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157254, "uuid": "b784e3ec-e09b-40c4-9dde-b080971ba5ba", "comment": "Malware payload (Mirai)", "value": "f977527df6bc257457b17dbfc37a4cf1049ac1be244427f0d173b04e863135f03ecc39fdb5d6f8209930a2baf1a07bde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157254, "uuid": "9d55267e-ef41-4771-9968-b78eeebb65e9", "value": "T1EE330A96B8818A12C5D413BAFE2E118E33136768D3DFB2139E106F1477C696F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157254, "uuid": "cb650e85-62ed-444a-8a02-04c9f9cdfe58", "value": "1536:gdnM5V7dJfTYKk8nYCzCLcugLiICiR5meQG3:nJLrvk2Y/4H5meQG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157254, "uuid": "67f0d817-8809-4c16-9160-1cdd0fc17f9c", "value": 54400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157254, "uuid": "f17439cf-0085-4b89-b9c8-15419a768a6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157254, "uuid": "c6842b5b-b8cf-4fdb-bb57-8920cb679854", "value": "upperarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e55689-53d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779231807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231807, "uuid": "03c9ff46-ca43-4803-95e4-21db0adf4b54", "comment": "Malware payload", "value": "006bf0b3bfb073e5e11f49fe2b1fdf0d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231807, "uuid": "b49d3c7a-9c9c-4961-937c-7420c797e2a1", "comment": "Malware payload", "value": "1ad0926e67298d7a6f9504888842e8a2ec63593c9076e86aed50112211be9d96", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231807, "uuid": "58042c43-e5fd-496f-bbbf-2f8707ad9168", "comment": "Malware payload", "value": "b61739a4cecea22cf5de81503bc1ebe560c14a4a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231807, "uuid": "26e39381-1adc-439f-af15-adc052230756", "comment": "Malware payload", "value": "be73afaada731b0a14b802fe38627b27895d2ac68d0b69bd09b817370b8fc110e989220b836746a73fdb23c657798f44", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231807, "uuid": "0009d2c0-90c3-483f-a101-a48fb33adad9", "value": "T189B25D0FB8154319D4E100B092719F7BC9B9A9B73788A8DBF38044CD5A686D6FC3695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231807, "uuid": "3e04baa2-180d-4f8f-87b9-8ce828fa2a43", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231807, "uuid": "7a164369-2479-492b-943f-b96ac88f52e5", "value": "384:iF3thb/HJnv+UL7exaxdlLHMwXud2YLNL97cpHB9z:iVt1pewdJMw+dxc1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779231807, "uuid": "d3c078f0-3a3a-4693-99a7-94a454a4b74e", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779231807, "uuid": "491e855d-4754-4ff6-8df2-c6f140ed99ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231807, "uuid": "e3be8402-2411-4c6e-a3a3-8480a7b264f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681aed0f-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "3f9641a9-034c-468e-b527-05caac0a0084", "comment": "Malware payload (Mirai)", "value": "12dee07fd5beda6cec2f6d1fa5d54381", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "9d2c7ca9-8ca2-450c-bded-fea20e0c8495", "comment": "Malware payload (Mirai)", "value": "1b1e6840587008331942981579dbb9cae41a8792a8974e0b96012ea34b50fc3f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "e0cc1548-b51a-44ca-a80c-c57797a4d5d8", "comment": "Malware payload (Mirai)", "value": "51a5800b3fa3258816c407f50d0988f0619bae42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "4049b8ef-16a8-4c9f-a459-a117d3b6fdf0", "comment": "Malware payload (Mirai)", "value": "958c16aef9b8827a01902783ce53bbb37e5c9d60322fb633f31cebbded826ec1da2d3f18768c16d63908e519beec93ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219550, "uuid": "6c41448b-3ab5-4afe-a3f1-7b7626312f5e", "value": "T115142A05EA408B53C0D63BBAFADF434633239B54A7A773059528ABB43FC679D4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219550, "uuid": "a5f05414-21c2-436d-977a-239e41a09e3c", "value": "3072:czLeB1q+uY/1aN+d3R9pfbxeWABD/TlP+WYLNM/RTC6TWgiAW:czUkRY/1aN+d3RL9eFBD/TlP3iNM/RT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219550, "uuid": "595d3391-dff9-4447-8e96-b6f3495feb95", "value": 191622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219550, "uuid": "1e338b2e-92f7-463f-9661-1354f363a204", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219550, "uuid": "1eb103aa-681f-4343-a66e-1aa61cc79f07", "value": "mynode.arm7_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a548ed9e-53be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779221370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221370, "uuid": "2fd5a3d8-55da-4861-a2e6-7297aae8f700", "comment": "Malware payload (Mirai)", "value": "6cda48d80ee2d470b5e4fa16eda07ba5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221370, "uuid": "f3f16eec-cac7-44cc-8bc8-65434be17d7e", "comment": "Malware payload (Mirai)", "value": "1b8085075c6707426f2a22072f58e484ee5bf513015051020ff3d1fbe99c8edd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221370, "uuid": "985c9b33-6bca-47f0-a5b3-507b2b30631d", "comment": "Malware payload (Mirai)", "value": "8072d1334b08a3e59eb38e5dd1b30368782fffc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221370, "uuid": "6ae3cee6-2cfd-4507-a891-648a0526667c", "comment": "Malware payload (Mirai)", "value": "191214ad2099ca0eef1bce4f8f7b39c1aa7de32054030bfa2e12e2b423acb16cf6e3876d26c737cbdc3e08bcb1413434", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221370, "uuid": "eec1d3a4-8261-46b7-9b54-40f300e5dcce", "value": "T14E3302D7A3BBA17CD03A01362C266CD1F8462D076219869A8D41F33E9E675A33D1ADC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221370, "uuid": "77a2b63e-25dd-4b31-914a-bdd4396fe582", "value": "1536:XxaSQbaeYgWHRf1RHKIJ86Bw3F4olFcJl9sPl9:XxdQbGgWHd3HKIuBa9m9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779221370, "uuid": "21ac4d89-03e7-4a2d-b4ec-f488745ea61d", "value": 52032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779221370, "uuid": "7ccb5f52-0764-479b-928c-ffad7ed83050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221370, "uuid": "b7485076-8b13-4651-bb29-7540027aafb7", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48561a3-53d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779231811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231811, "uuid": "b2608ac6-9dd9-4cb7-904e-f1f41c0ee0a7", "comment": "Malware payload", "value": "db3ce7861dc3d7ec0552f8bf0c581583", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231811, "uuid": "649ae9d6-4de6-4288-a38e-77bc46487c54", "comment": "Malware payload", "value": "1c512b9355ab3a505a38fee04dffe2cedccfadaf596df7dac4ae27dabf3631f1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231811, "uuid": "4864a29e-882f-4db8-be23-70db03bf8bf9", "comment": "Malware payload", "value": "fc88261a9f3cbae7edb1744f5206d3ba24eeb593", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231811, "uuid": "6654d44c-dcd2-4640-97f4-b1066a042d09", "comment": "Malware payload", "value": "d03e05209a99957f2735bbf9b2a5d2f489571ad97d360fb90a0ccf535ff274ba686f19fa831b2b9c6f3ddc9028e4a2c9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231811, "uuid": "c8b2810b-431b-4d76-8fb4-5a931d66927c", "value": "T182B25D0FB8154319D4E100B09261DF7BC9B9A9B33788A8DBF38044CD5A686D6FC3695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231811, "uuid": "b401eb11-93ec-4399-889c-93c449b698d5", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231811, "uuid": "2256e77b-da51-4c47-b2ae-bd1db36a9e74", "value": "384:ipthb/HJnv+UL7exaxdlLHMwXud2YLNL97cpHB9z:ipt1pewdJMw+dxc1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779231811, "uuid": "8a670230-3f11-4059-8b22-02f6756c7a1c", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779231811, "uuid": "73c682b6-8679-49b4-90f0-8509785fcf1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231811, "uuid": "3d313212-55eb-4f0b-8850-75bdcd295a1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dd0f6a-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219591, "uuid": "69ac780e-8305-43ef-8297-dcd4686c5e5f", "comment": "Malware payload (Mirai)", "value": "6b088422e76c68f1799c19c87b7a55e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219591, "uuid": "8d1f3493-ebd8-4ea9-b94e-5e25bd4a9d72", "comment": "Malware payload (Mirai)", "value": "1de11b6939b5f08735782448b7ea981c5d361847edce9fedc684aaeddf3eee24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219591, "uuid": "8d99b40a-8981-49d7-aae8-916b770cdc20", "comment": "Malware payload (Mirai)", "value": "a6ed29361a8338daf193c24ffcbe435ebf835b3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219591, "uuid": "4757215d-27eb-4641-8415-18c4a4251a56", "comment": "Malware payload (Mirai)", "value": "b132f48b49c4e89d1bc68ae63028eac59e3c3496c7e504a610a03a41d72d87571ce8de9df79cd6c6ea7d2a72786b2de8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219591, "uuid": "98ac50c3-431a-45df-ad58-334cfd117b1d", "value": "T1B6A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219591, "uuid": "9141c58b-ff7b-4425-8a8b-f785e8fc073e", "value": "1536:SpaZOuj/Q30SQXa1r3J62yqPy/RWLW0edmpwj65NYK:5ZzjJa1rZ62yqPy/ULWzj65N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219591, "uuid": "04e25711-3969-43a7-ac6f-89a250691d51", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219591, "uuid": "5479d9c1-296f-440f-828a-7e4c3fc6596e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219591, "uuid": "889512ac-780b-43eb-9ae2-e590648e9aad", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd82da8-5368-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779184205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184205, "uuid": "8437bdde-8575-4921-bd29-56d1014c40ea", "comment": "Malware payload (NanoCore)", "value": "a47d7400496f6b630a6d42432ccd84af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184205, "uuid": "f2625e0c-b07a-485d-a3b9-4dd4c9fb0535", "comment": "Malware payload (NanoCore)", "value": "1e60f4002a53c0c1c59ad97020efdd357c8dc6ab1d7bce23a7f8a84aecc17c32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184205, "uuid": "6be44f61-d11b-44dd-95c7-0a6ef471e425", "comment": "Malware payload (NanoCore)", "value": "dac9e6250b8f1e4536eaa8581d1e87ea42c738df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184205, "uuid": "61c74b3b-2fd4-4919-a6ad-281db9eaf1bf", "comment": "Malware payload (NanoCore)", "value": "e36acddb41a263449a306d1a0798f7b4395c17275f199f483a63dc073b38caf0c96a4afa648c4fc28614e0a8f1050d2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184205, "uuid": "5cbf1d38-c080-44b5-ae66-fc1654cce4aa", "value": "T13614C05677A94A3FD2DE82B9612211439378C2E399C3F7EE28D464B74F263E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184205, "uuid": "660b8679-f329-4925-abc5-14f67ef7ce73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184205, "uuid": "1117d3ea-0d7c-4dd7-873d-05b2e530ebc2", "value": "6144:MLV6Bta6dtJmakIM5DMBrwBJnaMC8xFev7y4QT1ta:MLV6BtpmkyMFIPHPe2Dta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779184205, "uuid": "57804743-8163-48a2-b33d-d6e97fbe058c", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779184205, "uuid": "cd67a593-0687-4e98-b41e-5e64a6f5e1a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184205, "uuid": "52f3b379-4c15-4b6e-8dca-864bcd396d32", "value": "au88co.online.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6049f086-53be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779221254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221254, "uuid": "2f164d64-b99c-4ad4-afa1-ebe319b65f4f", "comment": "Malware payload", "value": "94500a51d8bd40878cf1b41684112276", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221254, "uuid": "6006aa67-65b3-4d17-99f5-c1ad47990f59", "comment": "Malware payload", "value": "1fbe4f8ac21737ccd26f5533896233c27e4cfb3003f3390427df6413a96c3834", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221254, "uuid": "6420f70c-448a-42ce-8735-c629274d0e7b", "comment": "Malware payload", "value": "2fe599e0b74ffd8a2270147083367da88ac077e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221254, "uuid": "49228616-fdde-459a-bbb4-c8819e8461d9", "comment": "Malware payload", "value": "03603860b9df2693754fb21ad96c056e6771e9329c6c052f0905349f1292f776c608aa126317015dad98381a0eb4c8ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221254, "uuid": "068ad545-4835-4ce0-8854-d2fda99c80f3", "value": "T1A823F120A006BDD4E390493AD279BA0729B3CDFBF6A173BE8938C61417C541274B0BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221254, "uuid": "e0f27622-294b-4da9-8a9f-781ec7619de5", "value": "1536:eudpAZY/1m9ox/YRW5oFQF5Lu7xb5ZnpUrzyOaLPkqza:/dJ9m92AW54bnGreOaIqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779221254, "uuid": "1cb0bc75-1832-45f3-9640-836bf4266caa", "value": 49720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779221254, "uuid": "b111312b-252f-4951-82cc-6fd8daef3b68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221254, "uuid": "9d561992-10cd-4a8e-9b6c-25199fc08f78", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94f8a92-538b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779199473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199473, "uuid": "3fa09b6c-62b0-4b65-9399-065e6ac816a6", "comment": "Malware payload (RemcosRAT)", "value": "208d7ba5192c2c551b04e02723c8a1e6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199473, "uuid": "ae012720-8ee8-4525-8e0d-ac1a4834fb62", "comment": "Malware payload (RemcosRAT)", "value": "1fd7d83a9b431315fe10786b947dcea5baf83078d433a63db36b117775e911c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199473, "uuid": "bf1e2f9a-1b40-485f-bc5f-7e628d2c6d92", "comment": "Malware payload (RemcosRAT)", "value": "9970f1e3543f796022c5ff11ce65b917ce02f7f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199473, "uuid": "174c5859-ad15-4b38-a6f8-7f2a0fcaec3a", "comment": "Malware payload (RemcosRAT)", "value": "a6a2072e06046d740b4a3922e1958fed2d8bc1f8a7b17302996d9c77e65b5c6ebdc508981529ad4771ee820d74788441", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199473, "uuid": "0dfebead-70a2-46f4-8b76-0cc0ccabf470", "value": "T10D267C8411217797D0BCDB600F3EBAD86C8D898FF8A0C843351696B88B55FF566963B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199473, "uuid": "2eed09de-e392-4672-96b1-7640cfccb6d0", "value": "98304:w6CnPk/TNmRN6hj+Z3osCT2pg9bN2609rDLCNmvP9uidcS5eo+Ww7mZ:wILNsN4MCCwb46+rCwvP9v7gBh72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779199473, "uuid": "a9f5c112-5ad2-4bd7-9b3e-86bf3421165a", "value": 4690463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779199473, "uuid": "6bac988b-9ce2-44e3-96d7-3d4a2b64ff86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199473, "uuid": "0d9d8c63-4657-4931-8327-583933faef7f", "value": "RFQ-901126.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df23f954-539b-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1779206435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779206435, "uuid": "f65e9f44-e2d7-4cd9-9ff3-3f29c9c00505", "comment": "Malware payload (PureHVNC)", "value": "33eabc8c4b20cc5d183b9c8530dc7b62", "object_relation": "md5", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779206435, "uuid": "6e789732-065e-4a17-8272-6047bd07022c", "comment": "Malware payload (PureHVNC)", "value": "2004144f6c630e44f975c24fa311c41edf228213a958b5cf4fca2140d0341a7f", "object_relation": "sha256", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779206435, "uuid": "56f45da4-f816-4341-b39c-6581db814646", "comment": "Malware payload (PureHVNC)", "value": "13ddfe1cd90fdcb813796750890ff1df1a83a15e", "object_relation": "sha1", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779206435, "uuid": "831d7ef4-9a27-41dc-9608-8d859414e19f", "comment": "Malware payload (PureHVNC)", "value": "70b07a33d8b7231bb200cd114b3f6c4b099c39886ffe5c9ea7e36cbdef29e975236427a477a0a4e8d87642c103589b4b", "object_relation": "sha3-384", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779206435, "uuid": "4a7332eb-0c54-4b96-9f04-a30cdef3552a", "value": "T12CF6B84C81DEC849D2F75D0456BC28E624D1DBB9E21D449FFB803E961BBA3940A2B773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779206435, "uuid": "bdf63eff-95af-437f-86f4-f10bc0910894", "value": "384:aROE5mpjE0NfSsWWOSkIgLDe9TnO0PyHyOwhIA8TTatsQmgj4y9AVLG2fxVvk3GR:V/Tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779206435, "uuid": "5d593004-4d5a-412d-9733-4f7400e247d0", "value": 15721754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779206435, "uuid": "f0db16be-677f-45e5-bc6d-d4fd7eca4c6c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779206435, "uuid": "d55ff964-c422-4e4a-bab2-1248716f6d9a", "value": "Rechnung_4587-2026-GmbH.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fd96d2-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779220348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220348, "uuid": "4be00a1d-0fac-4320-9599-0ed3ecdd7720", "comment": "Malware payload", "value": "6b289a1d1cb7e0d8374eb2a1e95fb94e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220348, "uuid": "b2505547-45c7-4dee-86a6-d2645566eca3", "comment": "Malware payload", "value": "200925c71852eec0b84be2a54f897952421b3e32ad7d291487d5b76c13bacf98", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220348, "uuid": "d2a73766-55d9-49a9-a998-01deff78209e", "comment": "Malware payload", "value": "3c28055b73c4cd949fdab6463ebd1e9c638229c0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220348, "uuid": "f7f4f7e5-0cc3-43d5-aabc-f47f3d97ee54", "comment": "Malware payload", "value": "8678da5d9571fcb1066dfbc4364d5fd5b39a93d634588420ab283c57c641ace5e2a0e9d04ec835b4c94dccaadb8aab82", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220348, "uuid": "6f55baef-bcf3-41ba-90f4-05174100c1a0", "value": "T1595307336652DA7EC08B91F06BEBC922EC31B83A0771704563E4BEA36F59CD02D9C251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220348, "uuid": "eeed38cd-d172-4a66-afb5-e858eaecbe91", "value": "1536:mdduHs2DNaxcyRJJQVc3z9uie1DJh0Oout43y:m7xM2cTVc3cT1DJafutMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220348, "uuid": "db6e2a39-12c9-4045-a19d-d942164f8f5b", "value": 66656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220348, "uuid": "28dd5e1b-d50f-4331-89c6-1ff96d8bedde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220348, "uuid": "cd0ce367-c3b3-4b99-8a6a-5b545e5718c1", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6742b389-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219548, "uuid": "31fa6186-1e9b-45b7-85ad-8b1922e814ee", "comment": "Malware payload (Mirai)", "value": "10003192df63cdea43aa087b671696c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219548, "uuid": "41e78fa9-5704-4b49-a678-d78fb2e202ae", "comment": "Malware payload (Mirai)", "value": "200d8363aefd4602b0490872ee4d3076513686b4f746764827fd043ab506accb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219548, "uuid": "652cc9c1-45f5-4b09-befc-4bfccf9c3790", "comment": "Malware payload (Mirai)", "value": "817c6405c93ffeab0704d9410150be265e8eab07", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219548, "uuid": "c42c65b3-cccc-40a8-b27f-698c909786cf", "comment": "Malware payload (Mirai)", "value": "c93f3686fe037d4027b3500e11cae35b2b89a5a1a2fe770c14c122f15ae2e19ea64ad7dbbf74c63cece645e0198f2084", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219548, "uuid": "044911ef-1da9-45c5-add5-6dd4d88d048b", "value": "T16C040B01F9144F57C5C22BBAF7DF42993B336B1897EB3301AA28AEB42F4679D1D29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219548, "uuid": "e3a2dbe9-dcd2-4252-bae8-8b88c2f78c9c", "value": "3072:zvFPzd4LJsoas8kpGoiZlcy6vskuBOLGYVmmJEC81oZLNwaXQe3LwS:zvFbd4LqoadxbZlcy6smJEC81oZLNwap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219548, "uuid": "6b11f53c-a355-435c-9082-e6f9626a1afc", "value": 187122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219548, "uuid": "196c0e6f-dcbd-4211-bb62-6620e5279154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219548, "uuid": "64acef7f-f218-4cf6-9f47-7df373172a65", "value": "mynode.arm5_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea354f2-53bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779221896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221896, "uuid": "f24f40f0-c5fa-472d-a665-cbf1d4bc7245", "comment": "Malware payload", "value": "9afd9eb4460b301174e2a5f7d5f9c707", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221896, "uuid": "3e3c0648-e222-4edc-9672-ec06b4b9aabd", "comment": "Malware payload", "value": "207fa692624885fcb2a3fb9730d9ad56966caee49d2ea9c409e8a58e05e8127a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221896, "uuid": "03b4d63c-39a6-42c7-8bbf-14a1fcc86928", "comment": "Malware payload", "value": "cb48470ab07b50b2bdda3868d1fec9b8b1b8d96f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221896, "uuid": "b91f90ed-6631-4432-9f26-7bdc05b477d1", "comment": "Malware payload", "value": "233cc6a45407f61d834ee575368f597e5cc135ae9bee269717446e80063254b97c9b311200b6bb5060732859bc0307d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221896, "uuid": "96eb333c-85e7-4873-8283-349a1b0448ec", "value": "T1EB2833C0651EBD38C3A3C53A7196597D9B5FCCC944E681BDAC92D030BADC922A709F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221896, "uuid": "4181e3a0-cc9d-4c9e-b3aa-7c1d3eb1008d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221896, "uuid": "2f7a188a-8456-403e-aa53-aaca1d17367e", "value": "1572864:ZejOYf03PwDdsoMxscxOXCY5gVePQz4/I29s8eZZnZCqJlEjGL11rPZ7:Z4xDd91QkRO/vgqJiS1xB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779221896, "uuid": "728e1eae-88e0-4960-95ff-04d00a119818", "value": 93672955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779221896, "uuid": "21c66dce-8e66-4c1b-9565-2872d01ab8e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221896, "uuid": "c2b223a4-7c91-47b6-8988-fffc8996818a", "value": "javaws.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2614597-53b9-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1779219245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219245, "uuid": "380962e8-ba05-47b6-a4a8-080475305cba", "comment": "Malware payload (GoToResolve)", "value": "77ea053818d040255e617f233cef37a7", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219245, "uuid": "29d23723-cb30-4bd8-bb50-ac72671f0c09", "comment": "Malware payload (GoToResolve)", "value": "21a563c3d3e15488b6ad10206fb238bf5a81cadc5e06fb64be2bf02b2d594142", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219245, "uuid": "2fd7b28c-1f7c-4253-b708-8ecb0ed20766", "comment": "Malware payload (GoToResolve)", "value": "a5501be6ab349736b96f8d6ba50ec70e1f7ecd98", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219245, "uuid": "16a81733-be04-4c0d-9ee5-bec7ffc796cd", "comment": "Malware payload (GoToResolve)", "value": "4634f9b1d20c8298b48e7e5c6f8800f2f86a820379ca8d3e230e2c1ca5b89329ec10572121ebce675c24a3b964c785e8", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219245, "uuid": "557f09f7-2369-48fc-84b5-3d07ff451281", "value": "T1EA872217A2E61154D8BAD138CA6B9647FB723C06433066DF12A4B61A6F73BF01A7F314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219245, "uuid": "daa6cf03-29da-4854-9f6a-1e67ff17796b", "value": "786432:kfBBz66DIpCRkxjRlKjP1UrZ21G7KulNNm:kfBF66iGkxCtyZ2E7KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219245, "uuid": "9fb265ba-3f49-4f28-bf9d-196e06241359", "value": 37085184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219245, "uuid": "8b5d1e01-f802-41e5-a8ac-c2eab701e7f5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219245, "uuid": "134180f6-ae14-4e6a-95b8-42046a652f2f", "value": "todayneweish.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5559d3bd-53c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779222525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222525, "uuid": "380aab38-a9c8-46ed-aae1-7d559e0b5776", "comment": "Malware payload", "value": "cba635a1fae711aef7459da257e99dbf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222525, "uuid": "d6256430-a039-4538-897b-5c9f8205a78a", "comment": "Malware payload", "value": "23d1b91c21e0490805440f5e9d65477e79645ef5774b1169d5aab47e596ba760", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222525, "uuid": "027f7b98-4a3a-449f-b621-8f3e65dbdf16", "comment": "Malware payload", "value": "6fa6bfefb566e9bff9fc5e7bc501cb1b54c0b3ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222525, "uuid": "c76f83d7-b321-4cd0-85d3-3850237f726d", "comment": "Malware payload", "value": "037900c0e253e965edd21348e4654edf510279e54d52697fe40220f73ddc6b4cfbfca4663aef55ede7cc13c693c82b9e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222525, "uuid": "e2da379e-2646-4711-9393-cca442c44104", "value": "T1697412519C61A656C9AFEF398D3C26D1A022BC02A65D378F851BFB1C27CB7CC5E84325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222525, "uuid": "93a9fb9b-9e74-4398-95fd-3396c3da3905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222525, "uuid": "e1b88119-6c28-4328-82a3-d805880406d9", "value": "6144:OZa8fK8BTUS7Gvgn3Fp3SGmmE0sF5zoJsRDULtkPOHgvVIuJ05KrvzmFdvs3HKcQ:2PB4zgVpCzrOsRDYtKUGIuJ0588+HS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779222525, "uuid": "3dd66ba0-4162-4656-949d-6878f00aeab2", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779222525, "uuid": "dcbf299e-879c-4f08-b0a4-375d388c4789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222525, "uuid": "6e99309b-677b-424b-8e06-9bcd849556c1", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed003709-536f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779187560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187560, "uuid": "4a01d512-a79a-41f1-b96b-61099c9ecb3a", "comment": "Malware payload", "value": "5d85c6a99c1496eb3932b9fdd6cba3c7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187560, "uuid": "bb91c50f-c24b-49b9-ac69-54706ab107e3", "comment": "Malware payload", "value": "243b2fcac501b047f6ddbb736549cb4d857c65bc5de07471719e1caea83ad28b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187560, "uuid": "956be16a-ad0d-4a24-a323-16122d5710cd", "comment": "Malware payload", "value": "011e8437e2b1659a1d18c9b16fafbfaac5c84442", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187560, "uuid": "3d3b527d-5b4c-4f57-8b46-066a382faf40", "comment": "Malware payload", "value": "3457f7a3b77c821eb71f5df4096c7d91e2e34c9a4d864133b7163e5e4517755249941064ad74b7677bc44ddebead0964", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187560, "uuid": "93783769-98e4-41c0-9ecf-38af8266017a", "value": "T16FB5011317BFEDEB5E5839704A1704C746E85828667BFF3FA4C53AE631E87888685423", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187560, "uuid": "3b3f33ab-60c9-4727-aada-bb6278db20a8", "value": "96:+Tpa2ofAefEKJk1D9QjRslq2LxaaLDFck:ypa5G1D9Qj0rZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779187560, "uuid": "15e9ef2d-765a-4926-a86e-ec78e47bfc06", "value": 2271533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779187560, "uuid": "14979920-6753-4751-a2af-a05d8413fd9f", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187560, "uuid": "1ce60ad5-3b74-40c3-b869-c9eb7f5f0c4a", "value": "rrrrk9904323.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67576aea-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779219548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219548, "uuid": "b68add65-5670-480b-a74b-65191cda10ef", "comment": "Malware payload", "value": "fae8aed11efd44d7e9fefeb1e584a983", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219548, "uuid": "5c86a9e1-6e39-4bdd-b812-a5635b38255d", "comment": "Malware payload", "value": "24b3491912d2bf5957f96d5713ef78d5f58e72beefddcdd0a87460224b256797", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219548, "uuid": "40c69ddb-c10a-4f4e-8994-98c4b728f0e0", "comment": "Malware payload", "value": "168d419d7aabaa23de042bf2c03b98bbdf0f7a25", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219548, "uuid": "d3bd1b82-29c2-4cf4-94c0-53c25eed2d5a", "comment": "Malware payload", "value": "821d5044c07ada611aeb894b742ca3e287c64e343508f3db248fb3e2e6be36772a7d5ce737c9fac49d8e65607b5405ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219548, "uuid": "b261cd2a-2d5a-4824-a94f-6105b99d8740", "value": "T1E5E0ECFC205893275CE4E4A6F4D940817764C76149B57829E9845CA5C89E4A1B8563CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219548, "uuid": "df818660-8862-41dc-ae90-4ec417848f0d", "value": "6:QLdCqfWrXBdauQzIXH+LdCqfWrXBdauWVYzIXHNHLdCqfWrXBdauI5HF0HLdCqfI:QLdZfyB0IXH+LdZfyBkVYzIXHVLdZfyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219548, "uuid": "4f40c8e6-cec1-47bf-b2f3-4fea845c8c03", "value": 320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219548, "uuid": "33da961e-f6fe-41fa-968e-2ca521cef6bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219548, "uuid": "e45a850f-2267-44cf-8c53-7589834c73c6", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcabf24-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "3cd606f4-64e3-4204-a880-31904e4115e6", "comment": "Malware payload (Mirai)", "value": "1f51514a84d3a6e4d103afd70abb649e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "9bf1aab8-ec81-4bb3-974e-b86a9bfbfec5", "comment": "Malware payload (Mirai)", "value": "25150e49f6869aeb7f6e46812b83b41a5453cc24afa8013f6de839043e80be14", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "2a6ece34-e29a-433a-a593-d36638daab80", "comment": "Malware payload (Mirai)", "value": "a761074f6a3dc5ecd9ba3fb1595728cdffddc52f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "2c4865cd-5cbd-4556-a56e-a9016d8c1def", "comment": "Malware payload (Mirai)", "value": "dbf64fee0d0284e76ed4da5b2a55c8b41808f4bccc69fb46a20e98ffcc8f2eb75d7b924b5e1b0e793e2b373e758fe2ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219556, "uuid": "2b6b17cd-2d46-4b56-9c43-42d5d8ee199c", "value": "T1BCF2E1A512C9A07281F599B3D4B186F12D3B00F6D4E433919FA9824CE547713D9BBEE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219556, "uuid": "f5564a4a-5aa7-435b-a9e8-9d53e30da87e", "value": "768:YrFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6GOq3ws3UozO:Y/eRSnQjMgVuP7qtqxgtA5q1zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219556, "uuid": "5ac86f5e-df69-4a02-9f3b-bb17483fddba", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219556, "uuid": "b96f63d3-8a3b-4524-b6eb-c6a00e048440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219556, "uuid": "ffb7ff8b-378e-462e-b916-98a3c69e35d3", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafdbb46-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220548, "uuid": "d09120f4-aa0f-4824-a35c-69cd843998bb", "comment": "Malware payload (Mirai)", "value": "932e9d0aca53ec6acb009e92ab773fc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220548, "uuid": "447a3f63-fd58-438c-b856-dc7c2c2c9221", "comment": "Malware payload (Mirai)", "value": "264348f5046535da665bb8b0c616266533947c8363749c1b1c662c3c08bd517a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220548, "uuid": "a0f7615c-7894-496d-919f-ffd11bb3cc62", "comment": "Malware payload (Mirai)", "value": "b3d4b4034b474721646cc1e03c0f1f04e63e3dce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220548, "uuid": "00b15bc8-2082-4e1b-bcda-a0f141cb10ef", "comment": "Malware payload (Mirai)", "value": "f0c672c3b426b60da2988234c6ce4d7634c3b0e863488f00e40aba1fe91061c2d2d20e1b15c457029fb4caf99086f37f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220548, "uuid": "9aca4f7e-9ea7-4f2b-91a9-23c1f3064860", "value": "T1F5835CC0EA43D8F4DD4602B42177F73A8672F43A1169EE97C7A4AA33AC52A41E51739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220548, "uuid": "b288a767-f812-4503-b9da-47609b479ac7", "value": "1536:WSPhpqHDgS4X+YxqtFgarV9FHQ3ghHzxc7g3NNeI4xq0saBtlq3L9lahcYiM3JSv:WSpwjgPKtFhDFw3m9Eg/5aLlq3plDNks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220548, "uuid": "1f586a38-efd0-46df-b774-b80cf425868e", "value": 83760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220548, "uuid": "194378a1-8018-4278-a596-d0b3b178f9cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220548, "uuid": "917c4894-4278-4723-acf7-a24513e447fa", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e85e05-5356-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779176440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176440, "uuid": "1d08ea56-345c-4dc6-bccc-913f824e8370", "comment": "Malware payload (RemcosRAT)", "value": "9261ece698852f31045fc20d62052066", "object_relation": "md5", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176440, "uuid": "986fc8dc-3582-437d-9596-eca95960e99b", "comment": "Malware payload (RemcosRAT)", "value": "2654f70490a3e750ff82adca833c982e2a80e80a6181776a78a30268d56234c9", "object_relation": "sha256", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176440, "uuid": "b41b4ff7-2303-4f60-9ee6-200d5633b27a", "comment": "Malware payload (RemcosRAT)", "value": "13d320bb2f335db0674f1c069ee8b32f23382e2f", "object_relation": "sha1", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176440, "uuid": "9c4983aa-b473-4c6a-9b15-6759984a5089", "comment": "Malware payload (RemcosRAT)", "value": "3f63e1290df039c2b619723fa53bace5119d50e5eccd321d7ec6c860ef6e191f8d39e8193317e8aefc320b7f14056667", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176440, "uuid": "b53ddc9a-288f-4794-9714-248ba83d6bb5", "value": "T1B4F122384208576949B2226AAB48C549FA5741F30BBF2E51F8CC82355F7605DE13AFFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176440, "uuid": "eec23ef0-2542-408f-9290-4a1fdd9414bd", "value": "96:F9o11ft+114VSIoNckF073kmBWX/wAkqU1u2xBeH5af8nJvE:x14VSId3u/wA7UZxsH5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176440, "uuid": "55973642-0068-4673-a15a-04de2312f5ff", "value": 7570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176440, "uuid": "8b7f9072-02fd-45a8-9369-5c4ff7f6fb45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176440, "uuid": "55cbc13b-ad0a-4dcb-b4ae-0ed8bf33a647", "value": "loader.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea522e3-53b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779215185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215185, "uuid": "64fd1e10-dbac-4005-8bfc-9e4d79739be8", "comment": "Malware payload", "value": "bb9981ee80a6bad2ce072372eec391ca", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215185, "uuid": "e8ae823a-34fd-4881-bf53-0e405452c4ea", "comment": "Malware payload", "value": "269a98c5a2e16675eacd3490f382ac08d894737e629b92c1a69070cc471eed36", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215185, "uuid": "279c5c70-02de-4c07-8c04-16508cc34af6", "comment": "Malware payload", "value": "09c7965755ceee2efa91ffd324af9815849da528", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215185, "uuid": "241b6543-0d38-41af-b018-5c3db796d986", "comment": "Malware payload", "value": "cb37ddbdbfaf2080236fb8f70c5c9929ea89d776211951ac2b3648ae8c1cce53a31cf3a96e3f071496bf7986d291cded", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215185, "uuid": "7a91fc31-5a3a-4a58-a3d4-0a60609ec624", "value": "T1AC16E086FB04556AC4F6173319B9063116478D668F8387C76C44B67CA87BAF04FAABCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215185, "uuid": "238c56cf-344c-4b19-b9ed-28eb65f30e28", "value": "98304:A2y36mSffHZlN64omBa6Ln0nJOfyfL7FK+s/:QSHhJo6j0EyfL7FK+s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779215185, "uuid": "12243675-670f-4cfa-858c-c06520d73623", "value": 4265751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779215185, "uuid": "648151c1-83a4-4158-97c0-0fe375988e72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215185, "uuid": "b644ffab-661b-432e-ab7a-d864cd876514", "value": "269a98c5a2e16675eacd3490f382ac08d894737e629b92c1a69070cc471eed36.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86539472-5316-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779149163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149163, "uuid": "b8763d3a-f1cb-4b04-a7a0-938731677bf3", "comment": "Malware payload (Mirai)", "value": "05495e900c12e8971f99ee03ff918e2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149163, "uuid": "df4e4371-bdbf-4a1a-bdd5-be33f8d7d5d5", "comment": "Malware payload (Mirai)", "value": "26d9c21d84345e317d5611f8f2cfaf8557724d9d3bafa735e917d812496b058d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149163, "uuid": "09623732-ba13-4b52-9bae-a1ee2a6776f9", "comment": "Malware payload (Mirai)", "value": "d47e2b734256538c6fd5370cade2df75dc2a08fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149163, "uuid": "71198592-c435-419b-87bc-b74ea5833bc3", "comment": "Malware payload (Mirai)", "value": "7a26bb21e327e7882a6f8880751be0ae2f812c52b09abeec55f8c5c8c3303928bef5d87d3dd04648cb80da0895e94d33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149163, "uuid": "71c284c8-3c78-4e65-99d6-b22bda5bdbb3", "value": "T1D8143B02731C0A43D15B6EF02AFB17F183ABED5119A2A544F62EFE846332FB15549F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149163, "uuid": "613896e9-0214-4611-b490-787e660acad2", "value": "6144:3b6eFAjvxqcN4AjGpKmPwnZmTK4+Ehj681A2hNNmt1:L6euuAapKmPwZmTK4+Ehj681A2hNNmt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779149163, "uuid": "7870ce88-3c3b-4e4e-ac6b-43a03a44c996", "value": 208360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779149163, "uuid": "83a3a087-9852-444c-ba8c-42e4592f615c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149163, "uuid": "4d13118f-8ddc-44e9-a317-42d35465bb3a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6184f9-5376-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779190455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779190455, "uuid": "c981aaeb-4def-4a6b-847b-07cf8d25cde6", "comment": "Malware payload (Prometei)", "value": "b5b767ccfe37cc1eb95c2d5e6364ba24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779190455, "uuid": "114ab6cf-8ad5-490c-95b6-28ae6d669909", "comment": "Malware payload (Prometei)", "value": "27d3699d590c4e6ce8a904a507157d54cc387f59632c40ba1d85b90a84bc6818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779190455, "uuid": "eb97a68a-5057-428d-8f9d-8f6f90e05646", "comment": "Malware payload (Prometei)", "value": "2883904e21c7208e3a85bfc186b46d81e58c0803", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779190455, "uuid": "f9618e62-965f-4739-aa57-bbcceab1dad2", "comment": "Malware payload (Prometei)", "value": "8e717ef9eb5b80cd173b570fd10a428bd88ad575105d49cd26acb47395a19394266e21c307c459bacd5e14e2c2c73532", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779190455, "uuid": "612f1edc-0e67-4862-b35c-8e43c5f518a9", "value": "T1FF07AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779190455, "uuid": "cc228e7c-70c4-4d1c-9787-4ef26d7a4646", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQQ:cqYUQuVDt0TZEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779190455, "uuid": "2998f6e8-f411-467e-9aae-0e2a09eec67a", "value": 17989632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779190455, "uuid": "6461ed54-e98a-43b1-9f87-207d65c1a60b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779190455, "uuid": "1b71b5d5-03bc-4fb8-a6d3-4ba708a9c94a", "value": "27d3699d590c4e6ce8a904a507157d54cc387f59632c40ba1d85b90a84bc6818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4a4dbe-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219588, "uuid": "df4473ce-3352-4fa5-ac2c-2d23bf2655a7", "comment": "Malware payload (Mirai)", "value": "616aca6fb8589d619742c68ac3288b53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219588, "uuid": "20586609-18d3-46d7-add7-ab6c1ad5cb50", "comment": "Malware payload (Mirai)", "value": "2894af96991203ebd7df0fc93e347c7d0647c9ea9674fd1a4c35527c0e39a664", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219588, "uuid": "59a5542b-dbca-4a84-9643-3032404dfc66", "comment": "Malware payload (Mirai)", "value": "1dc521a739b4f25d6b30c8e534cebaaa4c14e614", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219588, "uuid": "98726a36-57db-47e8-a812-e8b745ff4840", "comment": "Malware payload (Mirai)", "value": "41d18742afe15acc2f58469153475c5ba297a36f6382ebc254f47932ad3449b7e4dca5160d830cb7fc7c1a7812992d42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219588, "uuid": "870343c1-7372-4b77-acb5-dfcc4790b1ef", "value": "T12D733985F987C6F2C447483041ABFB3FCB32D8A510B19B4DDF569F35DA33602AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219588, "uuid": "dff7f3b9-be80-48ef-9729-eaf8f3719366", "value": "1536:8A9Uqtm/qzBpMWI2TTeQmP7uW2wORzBbkivom3aJ2cdLNn:8A9U7KB+WI2TTe3PrXORzBbVvfcdLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219588, "uuid": "23f5049f-39bd-4fca-83a4-cd1c704072f8", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219588, "uuid": "c8673420-a8db-4977-94f9-e89c6d3f51b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219588, "uuid": "ef447ed0-4c7b-4d21-aae7-fc8d275c86e3", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fabbe0-534c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779172268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172268, "uuid": "d185975e-67e5-4127-b2a5-071daafeead4", "comment": "Malware payload", "value": "341906eeedebc756e761227158ce7300", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172268, "uuid": "dc6bff82-66e0-4b3d-8c81-6c103093696e", "comment": "Malware payload", "value": "29341511eb6e64c3463bab8d52704c289713c68311103ec129d011c8a9227624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172268, "uuid": "e351f28d-9292-421b-8c0b-464d1bc6db92", "comment": "Malware payload", "value": "74923bf74405164a4fef5dc0809b19424167c409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172268, "uuid": "3f3d0b9b-f7b5-44d9-93b4-bcced0980fc9", "comment": "Malware payload", "value": "2b421df30b805287586727da00725562e559c7ceae436d8e78cf2b91e5cf3511ac5a803033b489731fb45ddc8edacd46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172268, "uuid": "02d61c0d-54df-45bd-a62a-d9b4b45c7248", "value": "T1C405E0111D865658E6FF0F78C062095C77F0D44753E7EB1B2EEC80B8AEE7A85CE1A861", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172268, "uuid": "5661f21d-0e88-44fa-a112-b8a3a15dc0a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172268, "uuid": "662c2a28-b95c-4da4-88d4-f50672bde721", "value": "12288:URq4UdfA4KsHh/LC1xqVVWn4WfgbkNEQCvoGFv0GtY3G6ITM:Gi5VmHEQCvoGFFYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172268, "uuid": "5a6ce700-4657-454b-a6bf-6949c201d2ee", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172268, "uuid": "7e65e1ef-642c-466c-a55f-7c8780eb0fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172268, "uuid": "1ad755c3-062e-4e06-917c-2207c9ec45ec", "value": "\u00f3rdenes de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd11daf-53a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779212043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212043, "uuid": "34b0fae2-5e0d-4d99-8394-1e772a4a36f5", "comment": "Malware payload", "value": "49d93e96aaa7b9f0df52519df1254ff1", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212043, "uuid": "643f2a9e-8fbd-4dbc-be88-d632099b0886", "comment": "Malware payload", "value": "2980eacd89e46956d0c51a30b73aedc070254ad7d8d34daea3f68cf983e3de40", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212043, "uuid": "d59bbe80-b205-4bef-abc0-9491db03e07f", "comment": "Malware payload", "value": "3e39a1fdd2c60b645440c3643a6eec1a7aaffb78", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212043, "uuid": "bbf64b90-f030-4f0a-9d86-eb6b75203b89", "comment": "Malware payload", "value": "54492197a0d74e51adb406dece0a9024cb8ea242b5d035d3784dc5db5b7a607a781e7dc23725b0e6cbb29c7bfc314601", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212043, "uuid": "3b7cfe05-0fd7-47a8-8756-26192a69fd44", "value": "T13284234299A9D6ACFD530EF5130ED9C42315A55A800E9F3F2752E866EFCF6078381ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212043, "uuid": "4ca8df9d-d72f-4efb-a87b-3aa41f296757", "value": "6144:ITPo4TNhHh3YPKsKLrY348M94GUQbsQnZP1VgKM7mm8M4pcfdwA2JbpzsEqREqhd:ITQ+YPbo0UZYXacfjCl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212043, "uuid": "3d62235e-70de-4208-8dce-319389f8b38d", "value": 407359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212043, "uuid": "5675b5ba-1629-4506-b255-c031ef52b9c8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212043, "uuid": "7f7e4cf3-71ed-49ad-8086-384ea9a34446", "value": "SecuriteInfo.com.Trojan.GenericKD.80085281.4979.19442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee82ebe2-53a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779212044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212044, "uuid": "55eaef1b-0c07-46a7-a295-9dc44efd8e47", "comment": "Malware payload", "value": "f97f458b92ce3fd0fe6f245feacfec13", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212044, "uuid": "3714171f-d73e-4789-a9fb-91579a36a6fb", "comment": "Malware payload", "value": "2a3a1d60d2f78b3368e8bc5935b9a762a1555abf89ccd49b5d80e83622d079d7", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212044, "uuid": "be0864c1-63a0-4a6a-a3fc-05097df6addb", "comment": "Malware payload", "value": "c706f1e8bf9e82c0f163a83efdb65cb4239bc833", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212044, "uuid": "649f50c7-f717-4aad-b528-b661c22239ac", "comment": "Malware payload", "value": "5f7138c1dc56a8504cfc31057bd2afaecbb50e6ac2cfb83dadaca31524bed633b9d89b0b5934dd14d59de6811bc8441f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212044, "uuid": "2a0f87eb-a4c9-4916-8a82-9d38742273a4", "value": "T1848423129D949D6DFC430EBA132E96C02318A4ADC00BEF2F2756B462BDCF90757929DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212044, "uuid": "ff9a68bd-2e41-42ec-a337-655153845268", "value": "6144:ITPo4TNhHh3YPKsKmA4vJcpoGUQbcQn5bNPLUtfi3cKu7mU8M2pAfZw5QVQbC6Jz:ITQ+YPrvypoY5bNIiMzcAfpOJQCl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212044, "uuid": "1b4ca103-83aa-45d3-bcc8-aaee1ab6d335", "value": 407361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212044, "uuid": "dd33d3d9-f362-4ac8-9897-3eac01f1f814", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212044, "uuid": "df69f4d5-58d0-4528-bd2b-47ddfeea1d71", "value": "SecuriteInfo.com.Trojan.GenericKD.80083379.2079.22837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3356e894-5387-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779197557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779197557, "uuid": "760c672f-f7f8-4787-af6f-b1c0c85c763e", "comment": "Malware payload (Mirai)", "value": "487eb700d646a73d413137e8350654f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779197557, "uuid": "aa356ffc-6946-4f54-b0e7-6cf4a6b03b79", "comment": "Malware payload (Mirai)", "value": "2ab92d3455a528aba67a23cf446c0872c2bba8c4d4a4bab7deb54f146c998c8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779197557, "uuid": "90ec3730-2d51-4f77-84b5-bbb1d981b25f", "comment": "Malware payload (Mirai)", "value": "95ea5ab3114a95b66157e73b3effd2c7f15ff998", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779197557, "uuid": "85920e04-7931-473c-98a5-777929d6df2a", "comment": "Malware payload (Mirai)", "value": "9e9a690ed9e485763832fb18ad3f1595697298c3eda1fbb2809d64b04431ea2a59a1caca0afd3969ddf33da501cdef20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779197557, "uuid": "6ac8463a-9cd8-4365-9c26-a5ba2e314775", "value": "T156731A41BE429F03C5C321F2BB9F01593B16AB69D5FA3242ED35BF9027878DA0E27651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779197557, "uuid": "31cdc196-da70-4680-89a1-ab9d9b4a4b3e", "value": "1536:MUYQtaqCXsJUj9pLogG9MtfdnrZIEvQhIJR/whAj:V8KiRpLogGWN4Aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779197557, "uuid": "06f0a1ed-6b40-45b6-addc-6fd7fa70b987", "value": 75008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779197557, "uuid": "aecdef11-564e-4e0d-b9e6-08bd0869af99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779197557, "uuid": "3f5d097a-014f-4883-9905-c383f156ba04", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da842232-5361-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779181516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779181516, "uuid": "486cf616-c6a7-4043-aa63-b545611627bc", "comment": "Malware payload", "value": "c901c5853dcd7e5894c8833b106cc805", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779181516, "uuid": "81261bac-caa3-48fc-8358-2dbbbf1c183e", "comment": "Malware payload", "value": "2abef9c410a3a2675ac87b87a6c0afcc6e7ac3eb4ea79d78ed4fd12ae0b6f934", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779181516, "uuid": "429abcff-3231-4d06-9055-703ba5c77114", "comment": "Malware payload", "value": "10a14f448806167069effbec774385d02c4eef1b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779181516, "uuid": "3119ef78-c0c2-41ad-9e24-45db1e75af97", "comment": "Malware payload", "value": "26907c8f5acdae517eaef884a4445f0ff38e92eebf21d434644c769b9d63a15ac8f7faea41c76cb02c14dce17ed71648", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779181516, "uuid": "a2ac1d62-ad63-4d89-b1a4-d5fe5bf71ae2", "value": "T1A6251C3ADAE4000DE4B28B64FDB4045FA87A7F161A2DC94F51D4054F4E31A4DBB6EB2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779181516, "uuid": "dfb9c3a2-1379-47b4-af8b-c7b824fe8462", "value": "12288:ijOqF9FPg1/qu30lrKSTxSgrviEXpj91gh:cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779181516, "uuid": "61f04d17-b189-4f97-8ff4-06895ae32486", "value": 1035382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779181516, "uuid": "1ad64f5e-cd01-4eef-ac16-512524f05bca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779181516, "uuid": "fcb335f5-e046-40b5-b6de-79889c9b97f9", "value": "PO 02526 RFQ 416 L\u0130 90 Nio Supplies.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4764ee1-539b-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1779206444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779206444, "uuid": "d4f5d688-4454-4f49-aac3-71a8af45a9c1", "comment": "Malware payload (PureHVNC)", "value": "02f5d592925085e6eefc7f658ff9801f", "object_relation": "md5", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779206444, "uuid": "e180b661-178b-4e77-8985-e8e98972b8a5", "comment": "Malware payload (PureHVNC)", "value": "2ba597e8fd9de1795468c73e40decc9845f834ce711e9c1362d9952fb388af6d", "object_relation": "sha256", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779206444, "uuid": "4d969c84-acc3-4a35-8668-47f60fc70cd8", "comment": "Malware payload (PureHVNC)", "value": "1dd2b42dca3543356cba5d2c925d6ef6aa13cb78", "object_relation": "sha1", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779206444, "uuid": "cc1a06f4-fe0f-4e5c-9635-94512149a537", "comment": "Malware payload (PureHVNC)", "value": "8ee3d1fb2aa83ce7860159bd6458e35b170e6217678ec218096efb10b661aa641006ce0734077fdddb367986ffb64173", "object_relation": "sha3-384", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779206444, "uuid": "84de6b6a-a4be-445a-848a-c67c40166150", "value": "T12FE6A9A291B2D27DD7CACE156228E938C32F7C6913E58D17751B6D2E2A7071F0BC81D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779206444, "uuid": "503ad4c8-3421-40e9-aec0-c2c6db50f102", "value": "384:cMKEebM97dzcuEot82u/ES+W2mi6mPgxVGdIeg0PVL3A/uGu17u0lFXUxMRI1IFM:M5iJWxo4cbhXhm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779206444, "uuid": "71ba7bd1-a3be-4685-87b0-f55af91d2070", "value": 14834262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779206444, "uuid": "c4d7185d-863d-43b1-959f-2a7bf50b5eec", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779206444, "uuid": "6906c3c1-97a6-430d-9e80-d5fb8b6a53d0", "value": "RE00390380-R_Rechnung.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4cf50eb-53be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779221423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221423, "uuid": "cb5b78b0-7e2b-49d0-b804-ea4bed0eddd1", "comment": "Malware payload", "value": "a6b6428f1641b390f75a400e52844f1a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221423, "uuid": "d442c896-3567-45fb-8c45-19c309bff29f", "comment": "Malware payload", "value": "2c0ab7c94847d93be174d1f17cf47204347939a331ba763e2a24aeffa22aac9b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221423, "uuid": "18d672bc-61b4-4047-9003-5b9051401cdc", "comment": "Malware payload", "value": "fd4cab1ccb2498fbdf492e08bc04bcd847b8c195", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221423, "uuid": "ab063697-8885-4dbe-8000-fed47a0d6678", "comment": "Malware payload", "value": "22820208e97dafaedda6b471631c5db854d47ed1534b1190016643e10728a1a44efef5d36c9f6aa919f56d0fd96b8187", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221423, "uuid": "5cbb83d5-12f1-4c45-9c72-f229731e6eb2", "value": "T127E6338272880CDBDA834532C057D969D7337D560FA0D2AB4BE026A71E5B7D42E3FE94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221423, "uuid": "f7960e9a-3276-4f10-9b26-18c1fb507b33", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221423, "uuid": "b06546f4-2b6d-4671-a34e-0140ce143962", "value": "393216:eD85vz9RddqiLekdQJlBwF3MnG3Ul2axg1j2S2cs2kD+t5UmxRH5YH:B5vz9BJLdQY3MG1axgFYokDoxRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779221423, "uuid": "783676c3-d6dd-4449-a07b-4db7b885e6de", "value": 14935494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779221423, "uuid": "044d291a-8c2b-46c2-9fb9-23d96de455ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221423, "uuid": "d278e6d8-90d0-4958-b8d0-b74f6559c47c", "value": "bps.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a90e3e-537d-11f1-a769-42010a9c0008", "comment": "Malware payload (VollmondStealer)", "timestamp": 1779193452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193452, "uuid": "bc532b3a-7380-4720-ac07-2ed3763fbba3", "comment": "Malware payload (VollmondStealer)", "value": "d323395bd533d92bf076726a40daf72e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VollmondStealer", "colour": "#45E2F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193452, "uuid": "ffa49170-8f29-4e87-a5d5-bbb87cd8aab4", "comment": "Malware payload (VollmondStealer)", "value": "2c6c48588caf2bf96c86175082aa80ffa96f78395919962fa84824d5e523d2a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VollmondStealer", "colour": "#45E2F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193452, "uuid": "1d3665a2-3b06-4396-a9db-b372b6f6af0e", "comment": "Malware payload (VollmondStealer)", "value": "641e339cb4e7f3b6e17e6d3b3b9ff1c04dfc3d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VollmondStealer", "colour": "#45E2F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193452, "uuid": "666547c3-5eb4-483e-9781-239bc7740b68", "comment": "Malware payload (VollmondStealer)", "value": "01a612c747d1e7e6227c40c8af9156295bee117f71e1918fd2e78d08f47e9b7eeb5bcdf10ad51f1b9ff661c18e02add6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VollmondStealer", "colour": "#45E2F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193452, "uuid": "5e9869ee-87f3-46f2-8c88-b823eaae2b3e", "value": "T19B33E644B3FD8A16F2BF3F7D59B4A1104671BEA7E835E74E19C8509C09A2B448D60BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193452, "uuid": "ec0d1fe4-d2fe-4d29-932c-3648c3d5105c", "value": "768:L73wxSEul3OF1E5dyr23gXD2+ycsBTzPs0e0YyDyktH+r:fQhuhOM5d1gQZt00eGmuHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193452, "uuid": "829ec25a-18a6-4f0e-8455-8b407ab7536e", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193452, "uuid": "8d19035c-f46e-4643-b481-babf2af1d8a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193452, "uuid": "b7d8816e-503e-4e59-a946-ee0687ebdce7", "value": "2c6c48588caf2bf96c86175082aa80ffa96f78395919962fa84824d5e523d2a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065e050c-53c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779224110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224110, "uuid": "97fb3457-7931-4f04-bb85-54e3af70fd69", "comment": "Malware payload", "value": "ae7f4079417a6216ab9cc9909f25625c", "object_relation": "md5", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224110, "uuid": "bcd9261d-9bc2-4928-b1e6-adfc2b412382", "comment": "Malware payload", "value": "2ca3e5372f8e632015db35865d7154ab1399195c169f8cbf02439343ac80b34b", "object_relation": "sha256", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224110, "uuid": "a4720cfd-bf16-41ef-b414-54924eb5b4ed", "comment": "Malware payload", "value": "f21defdfeba6935eefcfee0fc5f3987a4140c3d5", "object_relation": "sha1", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224110, "uuid": "4c7064bf-1a11-40f4-b1bb-87ac89783df1", "comment": "Malware payload", "value": "9182a4d26b9c8ea87d0e251f4ce2c2784ed0dfea6ff59fca90db946fc6741cfeddd940686cad57161797aa06de4240bb", "object_relation": "sha3-384", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224110, "uuid": "b9920fcf-1ea7-4412-8ea6-e4fdd492492b", "value": "T174052304F3EC2751D7FA4F3C647986448A35F98A8C22DB9E2B8D729E89637905A31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224110, "uuid": "7b861185-1d4d-4442-a026-785b3f137188", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224110, "uuid": "8a8146d7-528e-4f81-81f3-f4618b9b967c", "value": "24576:GPjefN9cWvcFR0iPzmI78XUUgFsWcqw4I8:ymNOWvq0iPzmE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779224110, "uuid": "1babce21-4387-46d1-abc8-d2170f307af1", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779224110, "uuid": "8a9acfcc-a107-4567-a4c5-87c219d809c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224110, "uuid": "f7b9c8b8-650c-4f74-ad98-7c9fa9ef7225", "value": "2ca3e5372f8e632015db35865d7154ab1399195c169f8cbf02439343ac80b34b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4369883c-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "d819e0c8-361e-44f0-80cc-57c5cb22095e", "comment": "Malware payload (Mirai)", "value": "ca11c773e54de1923699930b539e1e08", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "961233bc-5d8e-415f-93d9-fc713ee7c83d", "comment": "Malware payload (Mirai)", "value": "2e11b9370f7907dc46bd271335cef0796feba1d1be675515d4fb19bd40f2893d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "b93a2087-3efd-41b7-8e3d-8cba15e6e464", "comment": "Malware payload (Mirai)", "value": "932222c12e32775f3d8523e84259d5f04947e1e2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "07fcdd7d-617c-4d9a-b6b9-3e536d68e6b0", "comment": "Malware payload (Mirai)", "value": "0120ed19a5d5ab93416e295006c4d11b86722daa8358b17927a6b5f4ccc7322ab2ce444e3174c5df72273c1c2cf34be8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220347, "uuid": "a4b1781b-f015-4893-be23-cc517a5e8c6c", "value": "T17053F8837641C677E14320F112EA9F221531FA3B6822E55FDBA97CB1DB241C1A62277D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220347, "uuid": "1db8de74-a824-4d92-8635-2b6adb36c347", "value": "1536:6CuP+QV3PiFUPJyxXIlTvB4g8HWwz92Npmh:6CuP+QV3PiFUxyxXSTvygrwz0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220347, "uuid": "949cbd3a-f502-4855-9d9b-96ccf09877c4", "value": 60896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220347, "uuid": "eba2f4f1-bb32-4295-8a02-585ded02d449", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220347, "uuid": "55c3a2e3-ab3e-4922-9d4a-25e7fd3346b1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4241a333-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220345, "uuid": "d995fb5b-f648-4d4d-a523-1c24b3d02001", "comment": "Malware payload (Mirai)", "value": "2a830ea9f47653a62c12c1777c8f9121", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220345, "uuid": "86d3fdd6-f634-4c23-a048-c4aaacaf6f82", "comment": "Malware payload (Mirai)", "value": "2e6b8b9d47d35eac4588740e9b07ab770318ef57d829cdff499280f936568a12", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220345, "uuid": "592f49dc-af89-408c-ae9e-b869e3761ec4", "comment": "Malware payload (Mirai)", "value": "9e22989e13e68465d60657f90468d63050910ff7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220345, "uuid": "700b217d-cf5e-4736-980a-c191ddf22ee0", "comment": "Malware payload (Mirai)", "value": "a99e308e9c18de1e74b25a30246f8cf06e5f14fad0085edfa1c89a25d76e0c33a1c830e8a69aecb06875a26e44a245dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220345, "uuid": "6b1ddeb8-e6a1-4e18-90a0-3864f3015c2b", "value": "T10A73E789FE05971BC7D272FBF78D038D762A1F69E3EA311599316E9033C5AA0643E120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220345, "uuid": "b32cae67-8083-48e1-887d-46d97209d4d3", "value": "1536:QLQ1gnXP0XH8LNapU6hQ//ZgmWXNIjavFrW5EItpojHipODS63:Qs1gnX8X8wVk2mW9IjxENHK63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220345, "uuid": "76977595-3f45-4bf9-8802-b57762eb52c1", "value": 78040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220345, "uuid": "3ad2c1c3-50e6-45b2-8b31-13fd5beb9324", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220345, "uuid": "578d4f2f-d83a-458a-a28a-39eb550af3ba", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8cc136-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219557, "uuid": "9628cc72-d961-42ab-811a-daf3fb459617", "comment": "Malware payload (Mirai)", "value": "77883c69b5818f3c257a3d838a3d1a02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219557, "uuid": "a46d0374-905d-4c8c-83e7-6485d6a2051a", "comment": "Malware payload (Mirai)", "value": "2e6ff2197a80ebcbb3966f2dde1b6b641eb215aaaa4d85aa4d183b7ab343a6c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219557, "uuid": "3b61743b-d2e8-459a-9bf1-8784394934b5", "comment": "Malware payload (Mirai)", "value": "1cda9e3f06bddaad1076abea280d874566b73aa9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219557, "uuid": "228b8710-69ae-4873-8698-e0e805fe9be9", "comment": "Malware payload (Mirai)", "value": "a0c89c3e76c2b4633d655e6a13debf3b2129a2453f99a4a4013a974ed7214407820c211366ca7cb203e1068f7821dda5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219557, "uuid": "d34b404f-b0e2-4702-a84d-5efb9250a588", "value": "T191030227D85B68C6D86480F2D757C0813A9647E4E4F932533350C9E5ACAB8EB38B8F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219557, "uuid": "a1f99bb2-33f1-423d-aa80-d2ecb6b46290", "value": "768:fWVVasPGxpBnekBYlk8i0fPkD+bk4nwx/RWUiQ5DuNTafi9q3UELy3:fWXasPGxplekBgTP654QwGIpavLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219557, "uuid": "8b44bba7-50c9-4444-bab2-a7551a9cfed4", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219557, "uuid": "bf917f86-62d4-45fc-8073-27b30d1136ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219557, "uuid": "90cfd7bc-6dcb-4e7e-a729-bb79e4b5bec1", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2827f34d-53c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779224167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224167, "uuid": "d50e8a0b-d332-47fa-af27-5bb04b7b83ad", "comment": "Malware payload", "value": "53a2d6a4d8adcef0f64e505d51d9266e", "object_relation": "md5", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224167, "uuid": "f69fcc2e-a5f6-4006-85da-4e6af9699cc1", "comment": "Malware payload", "value": "2eed0054f9c4c6c681787c0d427c68a07d6fd34063ff1fae8b3b226bd1d13d86", "object_relation": "sha256", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224167, "uuid": "ea9508d4-5d2a-495e-934e-e81632341c8d", "comment": "Malware payload", "value": "805f80d9d7c61c2ff558195c1c9ced24c8d644f4", "object_relation": "sha1", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224167, "uuid": "8c792ffe-2295-4786-82ca-855db34dbcb2", "comment": "Malware payload", "value": "1aeabc4786518f2697c529f6a4a6896e238fd5b12ae9361a068f0a9e440ef63de04add6f2a8bc2e527414a66657e9fa8", "object_relation": "sha3-384", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224167, "uuid": "703988b2-9064-464a-ae3f-0857103f687c", "value": "T1ED33D64D73DAF194D63232B446AE4408FEBEC8279A9943E4F688C5C63F76024616D9FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224167, "uuid": "82aebdfc-577d-48bc-a2c7-6c90a778716d", "value": "1536:w4H6/yXBnCMeDq5xLXcNST6LKGP8HnzHx6/:wcCMeDqwI6+U8H9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779224167, "uuid": "72a3b506-3839-4ac8-8fb2-55f1a678adec", "value": 52972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779224167, "uuid": "9f72c26c-7dea-49c2-9849-5ff27c716140", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224167, "uuid": "13b6f8ad-a1ca-44f8-9f12-11b80cbfce3c", "value": "Comprovante-Itau-2026-05-19.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55eff4fe-5351-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779174422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174422, "uuid": "f111800e-2e1e-45b2-a2b0-0bfe51be9be6", "comment": "Malware payload", "value": "b617c58c46ee27766207e566a0287458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174422, "uuid": "e029dd64-2542-4b34-82a4-0b5a8ebcc438", "comment": "Malware payload", "value": "2faa4d87b71cdd07a5a19e8bc51a90107ac58a8df0fdbff21c8fc2ee630d20f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174422, "uuid": "cac8b69c-b3fd-471b-bbac-f40f800e4666", "comment": "Malware payload", "value": "b8d570c702359fb976f6ac2a0d7959c4fda1a857", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174422, "uuid": "5403ec4b-564e-4335-9b21-068329327a6d", "comment": "Malware payload", "value": "875137d93a81be26825bfccbdcdcb2f5c9f08e4130f7a42f3f48c47ae8420c580ca8a6b9dee5d4d2ac7b9b135f267864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174422, "uuid": "66add2c5-ce7e-4bf0-9566-eefa0711f7f6", "value": "T1DDA4F117B2E570F4E567C23AD8910B0AE3B3B83657618FEF0354865A2F126D0AE39F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174422, "uuid": "1087232d-6e37-4898-ba22-39f41de8513b", "value": "75c410d3cdd17cf4a33ccaf94384484f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174422, "uuid": "eb7ca637-d76f-416a-b047-c0766412c17c", "value": "12288:1A8gcf+nKCR1I0vRLmPbIYZLZAVh74acml+fBiKTTx5OT:1jKtJqP1+Vhmiwx5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779174422, "uuid": "1e5d151a-7915-47af-a62c-cd5cc97862a6", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779174422, "uuid": "134f063f-541b-4717-81e7-5078041a96b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174422, "uuid": "35acd1b1-c4ea-4075-84e5-578ba51614a3", "value": "wmiprv.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87db4aed-5316-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779149165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149165, "uuid": "f980d6d6-e50f-4bdd-be1a-916edfbcefa1", "comment": "Malware payload (Mirai)", "value": "57168c215da87bcffbde471eb9e5430d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149165, "uuid": "0c7375bd-36fb-448e-8d6a-df7298a9e0e3", "comment": "Malware payload (Mirai)", "value": "312b9b552c5cf8ebe48d9d246e43ca78c40db43f4b01ed4d5347283354248a2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149165, "uuid": "5a09e9f5-b0db-421e-9d1d-3843f661ac5f", "comment": "Malware payload (Mirai)", "value": "8a8a37cef5758576ffc75dc4004f5b63ad0c9c92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149165, "uuid": "8d26f295-625e-4836-8f63-62741d6baadc", "comment": "Malware payload (Mirai)", "value": "5d914a3f4bf3dfb5d296fc18cb0cbee2780584a4b8cb95af34fceebf7e6a5501edc2722d0b6917a98be30db0ba922156", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149165, "uuid": "f9eacfc1-3251-48ca-8b67-08ca9bfaf6ae", "value": "T102341A02A9528A53C5C21B79BB5F46553733AB34D3DB3302DA24AFB42F47ADE0E3A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149165, "uuid": "71aa521c-3b44-4db0-a05a-978fff24023e", "value": "6144:fvRaxFoF+GfTacC0RmaGayiZE2uDwHnmW2hVDZI0/16O7Nc:fvRYoF9fTaqRPGaumnmW2hVD60/16O7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779149165, "uuid": "5a89c82c-4de9-4eb4-a693-f3d9ad0594be", "value": 234546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779149165, "uuid": "c723c1ab-3305-4146-80a1-05940328490e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149165, "uuid": "101e02e2-a52f-4de7-9c74-4b6586b405f0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc931513-535c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779179372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779179372, "uuid": "64855546-79a8-4280-97dc-51290706cffa", "comment": "Malware payload", "value": "4f5188665e47e97a47e1ac3c3fab46d1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779179372, "uuid": "1b334f1c-cf99-45b4-bcaa-efd89a8b88b1", "comment": "Malware payload", "value": "31a3edba54842b800291d75ff85e5a7516234f54afb45574ce1d2f96b09c048b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779179372, "uuid": "ef6dbbad-5933-41de-a755-74e250545337", "comment": "Malware payload", "value": "6cb9075c0a6c3abfab8fabb56deb898d5dc81c6e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779179372, "uuid": "9521bb4d-a5a3-47a2-aa95-5bb62bbeed5d", "comment": "Malware payload", "value": "d97fa1ba817ecec47d351468a7453ffdba49a9878615f04b0869d572c85355422ee983a30b6f1d6c3812571cf8c67f99", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779179372, "uuid": "722f1add-3ae3-45b7-99f0-f39a779d758a", "value": "T13452CF4240679B70D78ABAB91842874FD38B8A78A9CE6F214F02414196E97F78F06993", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779179372, "uuid": "a74651cc-3909-4dc6-b1a1-780541323628", "value": "384:hiT4bI0zNzZfhXTQN4oVCAS2FuZ0KAMta:hc4fzdkF5r846a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779179372, "uuid": "506eac3e-6b16-495a-a76d-35c0172d9f28", "value": 13693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779179372, "uuid": "1fc69018-a947-45eb-a601-2fe3e981f944", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779179372, "uuid": "1a1ab131-5427-4171-be4c-c4f9465b1ff5", "value": "IMG-996989470.png.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3de1ba-5369-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779184824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184824, "uuid": "3db95ab4-8910-4797-9aff-f15693c9f977", "comment": "Malware payload", "value": "1992d45e8218e865d725ab8e5b977eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184824, "uuid": "c0efadcd-6d82-44cf-bb98-909fceba4631", "comment": "Malware payload", "value": "31a99559f3c972d8a91772f17eeb3e0d3c472ad00764696fae9e66a79a510e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184824, "uuid": "60ebf4f6-2871-45f9-83c7-e51d5735736e", "comment": "Malware payload", "value": "7aaeeba19e685f4fd647aa9d422393cfa730c146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184824, "uuid": "3bf68a1a-3a68-475d-8170-ade6e3cf6da6", "comment": "Malware payload", "value": "2f58136ab5858c1c674b4a50780d7c35f6aa37be2f2b1c4241087da543821608b0f8862b2b55306d60fe68b8d043fb59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184824, "uuid": "f36a5332-b06b-42f2-8403-38686159783b", "value": "T198383377E5A80CEBF62DB7B0AA0BF473F4A506ED59E4B93C4B75C1249139A7000C6E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184824, "uuid": "af025405-ff7d-4621-a830-bc5703a74191", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184824, "uuid": "6930e39f-2a70-4275-a47e-4a84641f7501", "value": "3145728:7LaqeuFn44mS+xYTqk/gsGKyu3dUfTAlvZtniJU0Fg0:P9pFOKTAsZyuNCARn45Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779184824, "uuid": "9149013e-8366-4d34-90c0-6588c992595d", "value": 103332856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779184824, "uuid": "b1cd1a04-586d-443a-84a4-069615a022ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184824, "uuid": "79b747f1-6ef6-4a01-b322-3287a2b9f84e", "value": "31a99559f3c972d8a91772f17eeb3e0d3c472ad00764696fae9e66a79a510e01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8779ed8c-537d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779193403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193403, "uuid": "c159d913-ebd5-4669-933d-4540d723cc38", "comment": "Malware payload", "value": "1d8e9ca308893ed3896d32337e185d31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193403, "uuid": "e18e452c-e98e-4db4-853c-61d10c80003a", "comment": "Malware payload", "value": "32a90f26b236643efb6607fc8a02536e1df35c699ac04baee062300401b4df26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193403, "uuid": "80f1a6d3-3761-4ec0-bd43-a10e2971c68d", "comment": "Malware payload", "value": "00c64676f4292ad05bb8359812e531b2aa0df745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193403, "uuid": "55bce61d-eab7-4c41-aadb-a9d270627e5a", "comment": "Malware payload", "value": "e2a440fc6fc3e92be3a72ef95350bbc9d8faddeb25e7e0c4d1fb447a78ab1f75b44911770b12a409393120cf57104fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193403, "uuid": "da2400b7-518e-48e4-8d21-ad6e1c6a0aee", "value": "T11CC412067BE06B45C2A85675C0D3A93543F6A9CF3373FB0A3A5416CA6C857E0CD69B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193403, "uuid": "6da17d30-6ce4-4cb4-9242-fa07bcd6f7a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193403, "uuid": "178e3b41-4c83-4e3c-b068-33ed8e945f6c", "value": "12288:SX+qaHgu52samMNQAEqXJjJOTFyLRN6LSzJfgZW+SFKHJnvC5eM:4raHgU2s1MNQAEqlETF8RhqpSMNvC5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193403, "uuid": "e286d7cc-98ad-41bf-a5e9-54ee0b83d6be", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193403, "uuid": "eff94b34-06a0-41e0-9cc7-d3f94ea291a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193403, "uuid": "ae5780f7-e9a5-4912-a170-e68422cbade0", "value": "32a90f26b236643efb6607fc8a02536e1df35c699ac04baee062300401b4df26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fc0236-533d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779165757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165757, "uuid": "0b64c8bb-0be1-4bd5-9f50-3cd24870ce49", "comment": "Malware payload (ValleyRAT)", "value": "a1d396f76bb0f1a64f34fdccf2c99fe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165757, "uuid": "a2267581-5396-4a7a-8846-0b9d4155e40a", "comment": "Malware payload (ValleyRAT)", "value": "34463541425183b2a4654aed7c0a39dc0c334dab6cb6622c0a449662a8ff8606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165757, "uuid": "4bfbe143-3292-4d0a-a409-c42bfb70ee1a", "comment": "Malware payload (ValleyRAT)", "value": "46888a9b38211ab1cb93f63f8bde0b75915c2304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779165757, "uuid": "4cb66b64-332a-430e-9825-05a5afddbd45", "comment": "Malware payload (ValleyRAT)", "value": "db31b80d8b58abf7cb5ce7a67b87ab3df2b963b1dd99c57c2ccf351bd6862408e19833043246cb98e0aa7f81ea230fdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779165757, "uuid": "f76fa6d3-ba4a-4c34-a509-0f16d51005a0", "value": "T1C2068D83B2B55265E9B7C13486A7952BD6727C038F2499DF125CB3186EB36F01E3B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779165757, "uuid": "14641536-3ed0-4d02-b43d-5ccef6b81c71", "value": "f4ebb49bc19acbf0441a4e7b4b3620fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779165757, "uuid": "ec3b1886-7166-4b3a-9103-d8bca2a0be14", "value": "49152:ZmkDXrtkeSKReJYXRAUY2mwhWXs/72lciKGJsv6tWKFdu9CaPTvG7FDpHFhh6DhK:k+h/k8DZJGJsv6tWKFdu9CaiTwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779165757, "uuid": "d19f41c0-ebf3-4133-844e-32f56461c684", "value": 3724288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779165757, "uuid": "47f10200-9491-4be4-b9de-74f5ffa19606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779165757, "uuid": "221533f4-473e-438c-82e9-d8d3c3ab0328", "value": "2026.05.18\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bf078e-5355-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779176244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176244, "uuid": "a01a59a2-4fca-4f1e-81e3-b4e9606859f5", "comment": "Malware payload", "value": "3fdd74a65a0caab60c402cff10ce966e", "object_relation": "md5", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176244, "uuid": "955a68fd-4f13-46cc-8519-1954c236e827", "comment": "Malware payload", "value": "36e4b40a6f29bc1c2f55d426616ae78ca360f9d5a3314d3d44d4e5013d5e065d", "object_relation": "sha256", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176244, "uuid": "a2f5f96f-d524-49f7-9d35-d2db5ed0af2e", "comment": "Malware payload", "value": "c497e5a74fc6e62c4a0157d8ccb39dc6518b3a89", "object_relation": "sha1", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176244, "uuid": "8c02e038-878a-4547-b925-0eed9e7c0027", "comment": "Malware payload", "value": "8a34953e53de3102b421805c3bcbbf03812526d597c2cf81990b04368a86691242b05a7442aec73bfab7c15bc3971768", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176244, "uuid": "f22125c8-130d-47c7-a787-3fcb17ab7a88", "value": "T128C2F0ADDA79417AC29B027620BF52EB7D703E98632E5D2CFE41D48AF40D7842B12225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176244, "uuid": "9c97321e-d711-4d85-b954-b8097093a5b7", "value": "768:cIn9A8CUnU06t/g6z50x7T8rfJJQp+WFt:cc7CUnU0m/g/5AfJJQpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176244, "uuid": "53a141a1-c9dc-4c9a-a195-8ff9067edf72", "value": 26904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176244, "uuid": "2719d887-f379-4f0f-887b-4276c49b27c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176244, "uuid": "3fd0fe91-8b49-4bbf-9685-b98507ac3efc", "value": "todayvictry-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47da3ed6-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779168385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168385, "uuid": "67b0135d-8ade-4d02-9f65-67a2f9fdbd5a", "comment": "Malware payload (Mirai)", "value": "dedbddd830dd2cf3269311288d079424", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168385, "uuid": "948a18be-9b67-496c-a374-e0839062c17a", "comment": "Malware payload (Mirai)", "value": "3715fe37a6da5b6b31b5b3055ea128d631a8429a587fe10945a2efa1d70cbdc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168385, "uuid": "8d598398-9bf1-4d5a-99b0-10d206e5dbf9", "comment": "Malware payload (Mirai)", "value": "ddb59047df3713f243ed92abc67e817f6a9ef00b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168385, "uuid": "1eba3608-4c38-4aaf-b992-54d831fcc145", "comment": "Malware payload (Mirai)", "value": "59b200570a0c8e0500664b4750e56432b7e19d60e9f4dbabe615893e4c8acaf1c1af22ad60787e2c4728796a7dec7a73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168385, "uuid": "2ecef896-0756-4082-85ab-73170d0b90cf", "value": "T1D572E70769528AB7C4C01BBA6B8FCF18BB32B51197973302A709BF785F0675D1A1F608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168385, "uuid": "fdaae86a-df30-4b1a-be45-513251a7dff1", "value": "192:Eyh9Hfw/MGPYPy0koGlqmkEZx4eivdjCjtenzfVyI2OifKQBmxDI0PvnO5:Eyh9/wcPbA9Fx4eiEjtezNy+DIqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168385, "uuid": "1e083610-7e12-4fc4-b62e-0db5e2b87268", "value": 17001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168385, "uuid": "0a3f399e-68f0-4103-a058-a0bdf3799082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168385, "uuid": "7971a27f-c2ff-4503-92c7-20ffc5b656a3", "value": "dlr.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd36ca6-534c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779172365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172365, "uuid": "a2d957f5-8979-4ccd-b814-ac8de9ab2b9b", "comment": "Malware payload (AgentTesla)", "value": "6f96f0944d6d55b89c476d7f7d39a678", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172365, "uuid": "111c485f-fdf4-42d9-a5fd-685fdb5c5914", "comment": "Malware payload (AgentTesla)", "value": "37359ffc4c3233f5f6272d96739feb5c0ce10dabfe536a6c9c61c158c3aa08a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172365, "uuid": "d69a4ca4-9a08-4ee4-8dd7-1ce96e7ed75b", "comment": "Malware payload (AgentTesla)", "value": "9fdfa79c7bfc1ddd8a73e106c01bae053261974f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172365, "uuid": "c0f6286a-d2e2-46ae-beb1-0ebdf6b2085a", "comment": "Malware payload (AgentTesla)", "value": "a85683daef6bb40315f54db4b7dd4c17d9491c31d3b8436a83b771624cfece94a1d8db1b18febdd5616928be7b6977f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172365, "uuid": "af196d99-6bac-4c81-9811-1223ef4427e6", "value": "T1DDF5299226E6E223B360EFDA473DED30D80E454318498F14759ED73C392DE45A23A7A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172365, "uuid": "fcd9ca58-0beb-4188-849f-7e0f98e2d72b", "value": "98304:pw0l6xr13LgukRY4e66Z5NqXZPQGqnFt/4W2LDmOZzDi9Mju0OmfSicaOcgMZI2Z:v6f8ukRY4e66Z5NqXZPQGqnFt/4W2LDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172365, "uuid": "6a18d605-6107-43fa-be13-a030272f1961", "value": 3468274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172365, "uuid": "e8326d90-53bd-4172-be8e-471c127eb304", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172365, "uuid": "39d5437f-cae2-490a-9759-facc2a9393f6", "value": "Purchase Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb44736-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157257, "uuid": "d5fc30d8-816a-4d6f-962f-891c484d96d2", "comment": "Malware payload (Mirai)", "value": "87d513c7d03811a59e307f55f33d9406", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157257, "uuid": "1227e718-33a0-44bd-b81e-530454e88b2e", "comment": "Malware payload (Mirai)", "value": "382532451215dd8a3c5fa070ced106e02f3eceb33bb4ff20c1c3c1d800ed587a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157257, "uuid": "84a1a301-909d-4c8d-b4d2-fa4250aeb9c4", "comment": "Malware payload (Mirai)", "value": "775bf037ee301a3a916b44bad5a17333bc6834c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157257, "uuid": "769e95a5-d1f5-4788-ad12-5288a54427ba", "comment": "Malware payload (Mirai)", "value": "187d56cb4fd1ceafe1566419b0898dc25d99d53c5cbbf0a5881dfef11b3fd63bc3827d06674ff0303f27d3ba906b7542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157257, "uuid": "de79a097-0ccc-4b0a-958c-cf2139784bca", "value": "T17113F807B94680FDC0ADC374477AB53AD53335BE1239B3B63BD8FA12A986EA10E1D544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157257, "uuid": "eb420c46-a444-4e25-b7c5-0331aed9e2a7", "value": "768:HO5xyjKy5klOY5lYDJN+Tb4/BSgKSAnWVtmTWufBT7oRW:C4jKy5klH5lYFsTbUBSW+MtmTWuF8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157257, "uuid": "7f6bf14d-9b5a-4d13-828b-6f0b13ab7724", "value": 42752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157257, "uuid": "ba9aa009-4221-4229-9114-a24c6a5e8648", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157257, "uuid": "f35c263f-44d6-4ac4-9996-866cd39e2bdc", "value": "upperx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c35b706-5365-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779183130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183130, "uuid": "a0bf9452-85b6-4245-bcd2-6da8ba684ee0", "comment": "Malware payload", "value": "288a5ee5d93da9447d3d7a6cb7f88c31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183130, "uuid": "87e5285d-83ce-4cd2-925a-51273917f2e9", "comment": "Malware payload", "value": "38a64383b0b466bb996e64e2d485d72d00b63770fc77a739756cf5f9d241c49d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183130, "uuid": "9de6e28c-3a91-4fc8-8bb5-182c27dfc3be", "comment": "Malware payload", "value": "1b245da7730c28c2a395f5659289c8fe9c589e24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183130, "uuid": "34666a62-7075-4154-9d9e-055937a9770c", "comment": "Malware payload", "value": "34b1cdea30abbf6f2a8ce2152958a5e13211075eb87c06359f53d09d2d14531a2cb435271a324e67b8c2a3d56904dac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183130, "uuid": "e97a9ee0-04eb-409c-aad9-2754d57ffb27", "value": "T188334A1136A0CC67E9B34E301B3F6EE6DAB5B7A92354870B03509B5C796234D893D3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183130, "uuid": "fb5e5a44-641a-4633-99df-796e924828f9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183130, "uuid": "1a964773-650e-4c97-b556-4e691377c46a", "value": "768:xWs7Iz47FKM69CfYM5+VW8TgJXJP/376XgW9IYlJ/GDp1ujvc:8sC478MoCwvVrOlCLlUt1ubc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779183130, "uuid": "cbe17489-b320-40d7-b5f4-ac5b9d4e1c79", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779183130, "uuid": "48d8290c-55fd-47f0-a8ed-27f4905b7771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183130, "uuid": "765345e6-c0d9-471d-b0ae-93e74ad03181", "value": "38a64383b0b466bb996e64e2d485d72d00b63770fc77a739756cf5f9d241c49d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d820b5c-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779168529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168529, "uuid": "55eb1dd7-21dc-4f39-b3a4-e66cdbae4c57", "comment": "Malware payload (AgentTesla)", "value": "ec78e35eaf4145c4ca703f7ee2c64671", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168529, "uuid": "781b9d8c-4a03-4ac7-84b1-bd7bda31e814", "comment": "Malware payload (AgentTesla)", "value": "38c6adb31970b1d67a3d8f4a934c292054f29471deb5d3f7a78dbcacbd6775a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168529, "uuid": "bfa62b79-27c2-4e34-bef4-133e89982549", "comment": "Malware payload (AgentTesla)", "value": "f7c370d664d828c43bfe99f8b36139f9f97260cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168529, "uuid": "323817e2-818d-430e-80cc-eb11c16cd1f9", "comment": "Malware payload (AgentTesla)", "value": "2fe0820d05ace67353898b3092eaf9bf12ed4ed279a666750e37ca40f6980b90a73762a2c174ad6a93f050461efc30d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168529, "uuid": "bc8d7c60-332f-43c6-bdde-0c4938c6e4b3", "value": "T175A401542F7CCE43E6468CB45EB5EA6BC6309C428D6D5B03EF317D0DA8397C4BA89A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168529, "uuid": "ee598dea-b171-48f1-b57d-a9a9e00cbb31", "value": "6144:9pkXGh6aeKHGX2RK49s2RuUQH23WSzI0JSJJ7O98TNdUevz+Fp:0BGRhe2GSzI7LOIddLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168529, "uuid": "ecba8cf0-75fe-4bfd-bcb7-9be626637390", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168529, "uuid": "b04c534d-20e0-40d6-a57b-6aa68fe848bb", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168529, "uuid": "2efd5231-a9ac-4fc6-b384-5a2910a75637", "value": "order5886969689606.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dc2892-534c-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1779172132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172132, "uuid": "0196f30d-7849-45f1-849a-f961296df82e", "comment": "Malware payload (njrat)", "value": "d54171877c4b074be61b6c46a9c52f90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172132, "uuid": "ac4a72d7-a966-4e74-833a-82633c876fae", "comment": "Malware payload (njrat)", "value": "397a21465c3a7489bf6b5322732e174cd31874de18dec638d3ebc5bda0362004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172132, "uuid": "8e1fdd2d-e1c5-46f2-a2ee-3114cfe7c24e", "comment": "Malware payload (njrat)", "value": "27e28e25ed6a00e4ec99d66e5bcde0d2540ddb51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172132, "uuid": "67483d87-67ce-4c4c-bb05-64d495f70b57", "comment": "Malware payload (njrat)", "value": "b090feb1f079f9e9fd32382fa1bef222f071616ea9bb5e7d1228754a7474842f9fa04916dc88358dc3523418c7c2c6cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172132, "uuid": "9a04dd54-8e45-4ae7-93b1-fc18818dd4ca", "value": "T1781512BDB2D05F01D2A42979D5EB812403E76A97B633E38E3E5456E61D02360CE5B3CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172132, "uuid": "c2d061a9-cc9b-441d-b05d-6b0100cda847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172132, "uuid": "41395156-dcc1-4286-8881-1588cef075aa", "value": "24576:h9YTXa5EwAhFw5b4drmy+yGl5h17F7lyM+t5+uGg:/p4dyB1psfj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172132, "uuid": "86fb3d18-386a-47c9-8860-5a91ce222189", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172132, "uuid": "24a5fe64-fecf-4c4c-8e3f-aaa518fe64e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172132, "uuid": "1f8446e0-6257-4c67-b5c2-a683a18f2753", "value": "QUOTATION_IBF Groups PO-20260518048166 E2S A105N.pdf(783KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69459d5-53d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779231815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231815, "uuid": "ffaeb242-697c-437f-9e57-21bce1ee20d5", "comment": "Malware payload", "value": "c3b5cfcf6ebb01a1f8a0083e2e4660b9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231815, "uuid": "e8e9d25f-b21d-4613-bec8-abddd8d0795a", "comment": "Malware payload", "value": "39d74248320e4587fb8b73abf2a80973284ef7f6885b3c7bf438507f0f415783", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231815, "uuid": "ac2baab1-b895-44fa-8edb-57d53ed102a3", "comment": "Malware payload", "value": "1d1fee3627f777248a626eac0d119fc9ab723cf4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231815, "uuid": "df378d88-f3c8-4d45-9e38-0780c4b03b08", "comment": "Malware payload", "value": "27a03435989123d8389db8708becc7a77c923bbaaf1b9827561a3a8dd21791fed70596eacfbc9b0b1f8d7af1b1255d3a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231815, "uuid": "29a94688-a8c5-4851-90d7-945637af31b2", "value": "T1DFB25D0FB8154319D4E100B092719F7BC9B9A9B33788A8DBF38044CD5A686D6FC3695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231815, "uuid": "6f4d5ce3-62e7-4665-be61-765a898ad9e2", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231815, "uuid": "1be6e3e7-6018-4f82-a0c9-f3bb93019f56", "value": "384:iwthb/HJnv+UL7exaxdlLHMwXud2YLNL97cpHB9z:iwt1pewdJMw+dxc1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779231815, "uuid": "275f0d85-9190-41ac-8d73-00585e5bca85", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779231815, "uuid": "65338ede-f935-424c-82f0-ca4c0cd3a8ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231815, "uuid": "b6cf8c4c-7cbc-4c8b-bbe5-55ebbe6020a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd0434d-5396-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779203993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203993, "uuid": "1da1bc89-58d9-4888-9cd0-99e409ab5b99", "comment": "Malware payload", "value": "9d9ac85765e4a818a3ccabe2cf4fef82", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203993, "uuid": "89420248-b94b-47d0-ad34-e1d79f94cd17", "comment": "Malware payload", "value": "3a18072502c440c51cf8bf42f21fa6fa3216788982892868380c04818fb61291", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203993, "uuid": "17b17249-db6f-446a-9e26-8cad5824c7bd", "comment": "Malware payload", "value": "554e768fb5c750754c0871bd1228d819ba367889", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203993, "uuid": "0043b8c6-aa43-400c-aa54-b1b8feef71af", "comment": "Malware payload", "value": "dc8f2d9ae1f576a2b85b68b4ce06f105a0795a1a8d9abdddeff8cba3dcce977cd9d9eb0f49afce579a8566ecab7b8c2c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203993, "uuid": "878886c4-33fb-4d20-aa85-004c1394858a", "value": "T151E1A663160ED7B484B041422BFA680EFD85212355707C6CFDDC8444EF71B9D939D9EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203993, "uuid": "305c34fa-81ed-4125-b7ab-a27fc06def35", "value": "192:g9ZPhd70/9LKaShoT/S/nZe/x1/K/xgQCxNhNx:g9lhdCJRShoWQIi/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779203993, "uuid": "8fe6c6d6-b389-4bfe-a71b-e5c44f6ea959", "value": 7042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779203993, "uuid": "b9094983-cbf1-4e0c-a0f8-2596938804cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203993, "uuid": "9bc0aac6-1790-4f20-8ff5-c45b4e4d2e71", "value": "bill.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8f19e5-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219582, "uuid": "8e892cbc-126d-4c55-88c4-64e132a91371", "comment": "Malware payload (Mirai)", "value": "4cef6ab512a0b5cce072a59402555368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219582, "uuid": "33b91afb-edd3-4a2f-ae26-e599f51653ca", "comment": "Malware payload (Mirai)", "value": "3a27d3fe2e96cf4e8e31984ec4bbccc480e54572c0b9fa64b0e07c472317f786", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219582, "uuid": "2ad23ca6-0d82-417a-a363-180b208429ff", "comment": "Malware payload (Mirai)", "value": "a7c8319049c90929f29f3c31d14a76c669008148", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219582, "uuid": "38323fdb-9e0b-4e9a-ad9f-0ceb0abe8cba", "comment": "Malware payload (Mirai)", "value": "7ba4d253cf50d8f87ed0780f32b172c57e1ba3842e1ad588d1002ddf77974cc4c8d920503c632a50d769158e29ec631c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219582, "uuid": "8f32691b-45f4-4bd5-ad1d-17913ee95aa9", "value": "T1C613199AFCC24A3FC1C01379A6AE5A4D3721E3E5D2CB7607CE545B3136C660E1D6AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219582, "uuid": "6ae03427-a5a8-4158-833e-94c8f0aab43d", "value": "768:XG2/l2Geuo2SdeQxZE2hgoG3U6ZQ+PVgOJ4MmJdtBNCwtoOM:X3JuMQxm2htqzVgOjGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219582, "uuid": "669ba856-fbbb-4f84-91ee-96ba97fa2fd0", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219582, "uuid": "06ebb632-6fde-4045-9342-1c616f40afcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219582, "uuid": "facd4a97-fa3e-4eb2-a371-b97a4fff33e0", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90804b2c-5368-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779184399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184399, "uuid": "c741aaf5-afab-4cab-bc82-714db4c300cf", "comment": "Malware payload", "value": "1ed2de64a2128fb0b46bbd144e17f9a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184399, "uuid": "bee397cf-01ec-411a-bacd-aad3964ca4c9", "comment": "Malware payload", "value": "3aa8f65d5106039599974b025fb5985435e3604034a929bc8a1bae783c43034d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184399, "uuid": "a6cf042e-d8ba-4079-a724-326c9e5ea895", "comment": "Malware payload", "value": "d35ac40202d36f6c578931fd768eab4728fd3879", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184399, "uuid": "1877d880-6534-4ff0-b418-f83ebd1a0033", "comment": "Malware payload", "value": "2ac256e18bbbf256aaee5074b6a1fc9f03e8af951fb1e653df83648ce80b28722c3bad43cbcc87974475b4b96d5b0293", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184399, "uuid": "edd48479-7973-49da-84c7-30920deb1939", "value": "T1ED1833A3E224B2F6F1770AFF4647A5A2A0555DDCF258B330DAE0760832B0574CA1B9F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184399, "uuid": "20578a5b-19cb-4e1c-92aa-cf65f9b6c571", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184399, "uuid": "098bb0c7-53fa-4fae-aca2-00d662fbb6f4", "value": "1572864:pmhuPxGBArvpRV6FhNQauyQ/yjkxdAgHJ0MkzAghxFzQkJ2pagJxGMBFG+4lWpqu:pmhuP8BAbpm/unL9p0MUAgdQkIpp/GM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779184399, "uuid": "a6f8c185-fa5e-4d9d-833c-e4a411b41709", "value": 92262960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779184399, "uuid": "19be3358-d052-42cd-9b87-4339f3a34164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184399, "uuid": "aaeb1378-04db-4719-96fe-502c946702da", "value": "3aa8f65d5106039599974b025fb5985435e3604034a929bc8a1bae783c43034d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8a08ed-534e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779173282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173282, "uuid": "37b903fd-908d-49ad-a7af-aca9209c406f", "comment": "Malware payload (Mirai)", "value": "0d8627b059f2a74ad4e823b8ee16fd4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173282, "uuid": "80170641-e138-4772-8d37-c8a34e7a1a7c", "comment": "Malware payload (Mirai)", "value": "3bacecbb585a2e8c8f9d7195c57d1143cf3c7904271bdf41041ecdfe1315e1d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173282, "uuid": "c9c21d96-5c61-4406-b90c-6cb33a8073ec", "comment": "Malware payload (Mirai)", "value": "8d2515e0f02e1cbcc05e8fce0ff34551baa75815", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173282, "uuid": "95eb97cb-c8b3-41fe-9bf5-d2e983e68a5a", "comment": "Malware payload (Mirai)", "value": "716e92be71196623db6b4463a03f9a363f4a458bc6b3c66596d5e029e50136bce2e14423d53ad49686328b0911feddd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173282, "uuid": "aa60e06f-eb1b-48f7-9403-87ae5071ac51", "value": "T1C9436CC6AA43D4F9F923047210BBB7378673D93D1069DB82CB69D831EC53501A6AB39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173282, "uuid": "0237eab1-38ec-4066-8988-7e7a34163154", "value": "1536:4WL4eQRPLh5jW/Wd3lamysCJgMt9WOiOFzbGkkAr7zI9Xg:4WLfQRPdRE4y17tsOjFbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779173282, "uuid": "a3579c47-d95f-44d6-b1bb-84c38ce7fc51", "value": 59120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779173282, "uuid": "2dd8ee54-9187-44f2-a27b-1cb8659c0a2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173282, "uuid": "e5f6c65d-9760-4169-a455-cd4bd535d0a7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648853ff-5391-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779201934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201934, "uuid": "1a4e0c13-bb12-423a-8ab4-0846d6297ec2", "comment": "Malware payload (AgentTesla)", "value": "252af97310d92bbe972c083e8a1579e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201934, "uuid": "54641f2c-eaaa-4dd1-a4c5-c22d075a2548", "comment": "Malware payload (AgentTesla)", "value": "3d0528d8a3c331418fa64ef5350445a42a49338cfc1df453f42f54f66c5a8669", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201934, "uuid": "e6e15ff8-b3f4-4039-8d03-cfa8953dc61b", "comment": "Malware payload (AgentTesla)", "value": "7380a849ce6455ac6665a952a5443a7ad7bc90bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201934, "uuid": "6c10cf2f-b16b-47bc-a6f7-26454a74190a", "comment": "Malware payload (AgentTesla)", "value": "bd5f2205651b814ba7ee516c1cf29ed5c36fbe975a50753554e09cc49b06da8fe565f3612a427b47c9b96f15979daa3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201934, "uuid": "2ff694a3-5870-4d89-97ba-3d17893d8a39", "value": "T1D825126C5A49D10BCE505B7A4A32F6B6136D5DEDF800E3638FD8BDEBBA2BD101E05052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201934, "uuid": "91cfc81a-e433-40de-bcfc-d75956c68c91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201934, "uuid": "71690e99-f7fa-46f9-a20b-359da3a007df", "value": "12288:Dmy5sgBMXM8fH1hFiPDUyQgD5UpslQ5SwVqgnJ+YxrePbjaC5OTzcVeAphvOOGaH:d2NPpbgD5UWleqO9C5OTjAphfGvDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779201934, "uuid": "924c8bbb-0e96-47d7-a2fa-c69f58179c4b", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779201934, "uuid": "4d8ff7a6-0a30-40ba-995d-54d68a24cf6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201934, "uuid": "436e29d1-cf39-4922-bb90-41133d792033", "value": "P00155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06ed014-534d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779172963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172963, "uuid": "0e096c67-1c84-43f5-b38e-77ba121820eb", "comment": "Malware payload", "value": "29fd67178ae941c91cf55898224f849b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172963, "uuid": "eadc5fa4-c29c-4d87-9470-9dcb119c47d0", "comment": "Malware payload", "value": "3dfb2d3495e720507d8b8f5380a3564252f7e9774825d816604a19c493612b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172963, "uuid": "d6d8bdc9-97e8-4418-9474-ba92f7ae37f3", "comment": "Malware payload", "value": "6640493fd2f44eb0bc03fd31dde209b2bc8781c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172963, "uuid": "250fd947-15c8-483d-ac60-fb2830ea6f93", "comment": "Malware payload", "value": "4b0caf79ec2e9ad056d3167422b99af991fd056b8e24be1800ee6a7ee294dd48524295175b925fe47466885922b1697a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172963, "uuid": "9b118003-bdc0-4e1f-af42-b23fd88e73a2", "value": "T141D5F11BDAA002F0F4F74130C097264AF6E07545477A9E8F2AC948071B73FE6D97A76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172963, "uuid": "3cf60442-b7af-4b84-91df-99049573d97a", "value": "02eea8f8e288db017d585bcd14006f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172963, "uuid": "f1b33952-2e80-455b-8d18-089a396549a0", "value": "49152:6QAFt25brz/3rPHBw7akSNU9wv6Ia+p4P0+A3YWSVB/uNuiSb+LI5qQPCo6+PD:S/2hrzTPHBiSGwCCp48BSTmrI7zvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172963, "uuid": "ed4ed885-774f-4952-948b-c612a48c572b", "value": 2915480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172963, "uuid": "54ccd098-8ac8-4f29-81f0-1d897b93790f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172963, "uuid": "2cfc2c09-d34b-4ae4-8a6c-4c36e69afd49", "value": "3dfb2d3495e720507d8b8f5380a3564252f7e9774825d816604a19c493612b2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65549d95-53c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779222981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222981, "uuid": "07595a15-33de-493e-9335-38443e10630c", "comment": "Malware payload (Formbook)", "value": "bbff9e788dbc826a15f6a9f864c22e04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222981, "uuid": "beb103ca-3ebe-4831-be49-1e3d223aac9e", "comment": "Malware payload (Formbook)", "value": "3ed39ee940874cdd45d49c41d2408f6aac20d9fbc10fe1d97f3e1d60983987a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222981, "uuid": "dd1a9afb-44fb-4119-9ee3-9be27b639f4e", "comment": "Malware payload (Formbook)", "value": "5d07b8e079010f210071df40d3a88b7ddfe812a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222981, "uuid": "827a26e5-2976-43ac-a08b-894490210aa0", "comment": "Malware payload (Formbook)", "value": "b69288d83826f2864c70f51657b6075437fa2244207356bf56700444187372f4a26f13bbba76b11feeba0a0ee367eb89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222981, "uuid": "d492a472-0dd4-4cfa-a6f5-32aef82935ce", "value": "T14D45AD1DE38D11E9D227D534CBE65232E7B6785A0321BADF069AC2152F73AD02F7A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222981, "uuid": "b850dfa0-969a-47f5-bceb-d1cecf877ded", "value": "3e3cc0d07e80f21ad4fda2de97dc2a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222981, "uuid": "aa535647-18ea-4e39-bbbe-10e1918f22c6", "value": "24576:Jh3k7harZP7322uzZcPeJ1YmUrZi4Jjz7M2DXJVMuNUUxdx7kyert:Jh3KUn+ZcPeJ1Ym4iK7lV3NlhQvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779222981, "uuid": "033d68d7-8233-4a5a-970f-795439136018", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779222981, "uuid": "c07def59-ec1a-41b3-b666-2d6f3d22758c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222981, "uuid": "280444e0-beb1-4f5d-8fea-3507931fffc1", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e3dbda-537e-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1779193726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193726, "uuid": "62ac6952-e47e-4a39-85b8-806a526a4c1a", "comment": "Malware payload (a310Logger)", "value": "891cde21f33add07b1dbbbafa0fcf68c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193726, "uuid": "8de7956f-b75d-42d3-bf42-34f317d2b5f2", "comment": "Malware payload (a310Logger)", "value": "3ed43bfdcd6731ad438db4810e01cdbabe0800027e3ddda96127383c01c87153", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193726, "uuid": "b17d39b1-2689-4766-b8ee-b44d7e13a637", "comment": "Malware payload (a310Logger)", "value": "ce5e417144f128ac2dabbd5bb5294820a2e163a1", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193726, "uuid": "80607c3b-112d-46b1-9370-cfb5a74b19b2", "comment": "Malware payload (a310Logger)", "value": "92ac1945a4f2fa8c1452f24a13535e574ddbeb2cf07569bdde1f116b1cfa5016c500ee34afb1f64a5c3719d442cb8343", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193726, "uuid": "b0a073e9-ed14-4f30-9288-bef0bfa94501", "value": "T14E152357CD4A9A2A3C96C6243FA52C03564AE75C3EDD23D6409338F76BFB465C03A6D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193726, "uuid": "7672d897-9b63-4b8e-be9f-2183af6706bd", "value": "24576:BcwMiyHl0d0j6LC5m57sX74REP6rQj19CcerelehM+m7:ZMoC6Ck5A+3E1m3hMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193726, "uuid": "c1f3d6c8-16aa-4152-a912-1347f0c95610", "value": 909232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193726, "uuid": "51f03eca-e9d4-4c41-9468-fd541722bc1f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193726, "uuid": "8daff752-0f90-4f94-9b88-c5bd9849693a", "value": "Payment Contract_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589abab6-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157247, "uuid": "d095a8e1-bdfe-474c-9c34-95d8ea026797", "comment": "Malware payload (Mirai)", "value": "c9425e65443232553483697256366aff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157247, "uuid": "027aeeda-829f-46ca-85ca-d627c444bebf", "comment": "Malware payload (Mirai)", "value": "3f15e1aa24c954d90a3d1be083796fdb4d2ec97747bd7f1443f568c7cd0a9569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157247, "uuid": "3200509e-0f21-458a-aeea-3af75e30aae4", "comment": "Malware payload (Mirai)", "value": "e45fabd885e4224baaf3855a7a4ab5c6347e4d79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157247, "uuid": "41350ff0-8659-4688-9087-fbcd620c9b0c", "comment": "Malware payload (Mirai)", "value": "fbd17e68ce36a54888c135c5a8e03ad29f811af1afc8af644d1828cc2e57435d18d5917d840a47c6439888cb1af0a2a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157247, "uuid": "197213ea-03f8-4a1d-9f1f-b411b29d6412", "value": "T120131A91BC829513C6D4237BFA6E018D332623A8E1EF32179D226F4177C692F0E7B655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157247, "uuid": "05496917-6bfd-41c4-a6d6-15a21b2b8de0", "value": "768:PoGeguxMlBTlf0n3+mezK40lA0C8SazFXqTy9GM8gHLoK4KPN+eHbYYw:jegZzTlc28Sy93HJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157247, "uuid": "2ecb913d-7392-438c-81ff-abcd80f24199", "value": 44724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157247, "uuid": "509c76e3-51a4-471b-bc65-13a569c5314a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157247, "uuid": "b94a0e99-c2a0-4948-8235-86fec047f1c1", "value": "upperarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ba1197-5358-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779177586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177586, "uuid": "b217e593-6aa3-4a77-b698-b4c1168a74a0", "comment": "Malware payload (RemcosRAT)", "value": "e468a5acb706e41833cca6c2340c91b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177586, "uuid": "64ec5958-ac7e-4ce4-a3ce-719fd641144c", "comment": "Malware payload (RemcosRAT)", "value": "40601e22fac5d2c298bde4f15d85242ee401e3b346b030d66ce84d8a3ee934b8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177586, "uuid": "9dc1a99e-f098-430b-b2b8-a774fc3da93f", "comment": "Malware payload (RemcosRAT)", "value": "4570398a3c0746c22d6204a81a12dab865f0ae13", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177586, "uuid": "24266898-d9a3-4b3d-a9b6-b6d8348f9bf8", "comment": "Malware payload (RemcosRAT)", "value": "17fe628974d30d9eeefd9c1057432ed68b39f849f78b84c56ae072b5ba7f6c8e15592729a44e33dce9e89baa3eb006c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177586, "uuid": "e2cee2d9-66c1-4746-9d05-663775d8e135", "value": "T1AEA5125F7D96A1B6D041B12739CC287ECC6F25ABA87B87AEF1F584D2090C7511E98C38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177586, "uuid": "62c44108-b0ff-4369-a8bb-13fdc4479f62", "value": "384:SQ+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+Q+O:/l3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779177586, "uuid": "a95fc3d5-430b-49e0-a5eb-ddbc800649a9", "value": 2236112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779177586, "uuid": "3cf023f4-4cba-4c27-a261-c22138503935", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177586, "uuid": "f716cd8f-d7c2-4757-a0ca-a0d361148286", "value": "889017950847.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ca2653-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779168379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168379, "uuid": "1a98bfea-bb8f-4543-b874-78a59211d029", "comment": "Malware payload (Mirai)", "value": "75796a56249a38a775aadc9432de1bfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168379, "uuid": "cc245646-0e2f-4bec-a0fc-868d068ffd3e", "comment": "Malware payload (Mirai)", "value": "42316c5bcd81984878882bd3a9fcc88ea89d70046e55ba1f5458db4e2ec07625", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168379, "uuid": "89f85726-69dd-4a58-a0cd-17160432636d", "comment": "Malware payload (Mirai)", "value": "37a9d7587ff46ed819382f93f4969a7cf9134775", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168379, "uuid": "53017278-8bd2-4454-ac45-2f928ae2f172", "comment": "Malware payload (Mirai)", "value": "68f17fb7e198c745fc58857fffea717a45a87e6b1f90707e61dda22bdecf2b43f81e1b574472f13f301861c5b4086bea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168379, "uuid": "960b1eaf-4c37-48a2-9eee-bea1914bcb49", "value": "T10672E70769528AB7C4C01BBA6B8FCF18BB32B51197973302A709BF785F0675D1A1F608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168379, "uuid": "656a61ec-5ec7-4461-bc70-0af0da68181f", "value": "192:Gyh9Hfw/MGPYPy0koGlqmkEZx4eivdjCjtenzfVyI2OifKQBmxDI0PvnO5:Gyh9/wcPbA9Fx4eiEjtezNy+DIqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168379, "uuid": "430f7217-4769-460f-8ab3-0de6ddfb09cb", "value": 17001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168379, "uuid": "04647d2e-19ad-4e4a-a8be-9e30aeccd4fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168379, "uuid": "418f773b-bd9a-4939-b277-b550dfbe3295", "value": "dlr.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a346ba51-537c-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779193020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193020, "uuid": "d092218d-fb65-486d-ac6f-0a396025cca0", "comment": "Malware payload (QuasarRAT)", "value": "2e8bbfd8906733d522acb255406611ed", "object_relation": "md5", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193020, "uuid": "cb30aa27-0c94-4331-a704-7ba9612aac9a", "comment": "Malware payload (QuasarRAT)", "value": "42c82de3d3ed0cc0fb8c97bd20557275d6f92b901651aa16043e1fa35bff488e", "object_relation": "sha256", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193020, "uuid": "83704aef-fdfd-476f-82fd-0f8d8ff1db4e", "comment": "Malware payload (QuasarRAT)", "value": "c02f065690edeeab049b585dc651e31b64ac722e", "object_relation": "sha1", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193020, "uuid": "b7976605-0a39-414e-aaaa-1eac9d0d1485", "comment": "Malware payload (QuasarRAT)", "value": "1702f5f4b9decbbf0e5a486b95926c44355f6442d1d39fd794db6c1693fd82c33d55aa980cc8f07de048f457b23fca92", "object_relation": "sha3-384", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193020, "uuid": "1003ec5e-c413-427f-a456-b822ad1af1ef", "value": "T1EE864B01B7E49B26D1BF473664B210149BF2FC9A6323DA4A754CB1FA2B727001A5737B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193020, "uuid": "310637a4-5c9d-439c-b11b-ad50c25caf30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193020, "uuid": "433c50f6-2c4d-457a-8eef-ffee62687d6c", "value": "49152:Tf+7HoOWA0PMlJmN8UkruiWIKYqAFs6eYeZVmBumJzMbbmMqoBLPg4NOW:TG7HlQ6Jg8RrucFs6e/ZV5mJQbbmNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193020, "uuid": "4892baa4-6afb-4122-869b-06f8182d49ed", "value": 8359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193020, "uuid": "6f5a01bf-0021-4237-8a5f-a68d46b00885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193020, "uuid": "cfd44fc6-6745-486f-8a71-57230c9a7dad", "value": "42c82de3d3ed0cc0fb8c97bd20557275d6f92b901651aa16043e1fa35bff488e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5990e145-5370-11f1-a769-42010a9c0008", "comment": "Malware payload (Kazuar)", "timestamp": 1779187742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187742, "uuid": "76dd3c29-a0f3-43e9-bff6-ad08ff8c9848", "comment": "Malware payload (Kazuar)", "value": "035e952a9504894fb311aef75ab64aec", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kazuar", "colour": "#77BCC7", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187742, "uuid": "219895ca-e44f-40a8-abbe-5839de6e5479", "comment": "Malware payload (Kazuar)", "value": "436cfce71290c2fc2f2c362541db68ced6847c66a73b55487e5e5c73b0636c85", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kazuar", "colour": "#77BCC7", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187742, "uuid": "fcbb716c-c9ac-406b-a78d-63be88e7762f", "comment": "Malware payload (Kazuar)", "value": "78db2202722f8c5afd7ee135e620908d99bc3d55", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kazuar", "colour": "#77BCC7", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187742, "uuid": "caab149e-7d05-47f6-9af4-5b4b05587bbc", "comment": "Malware payload (Kazuar)", "value": "05f6e475d62c41e8c75fd12befaa4e6ffca9cdf65767902c82e309d0cb604c04af706f3c6bac4a757ec9256aac6cd26f", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kazuar", "colour": "#77BCC7", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187742, "uuid": "9315c3be-ad8c-4370-a6d9-e3d8b93906e5", "value": "T1C1954A0D2794B726C5AF6A3960A94138ABF8CA5373039F9717C05AB16B41F31ECCA1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187742, "uuid": "2dfd0481-d934-45c4-ace7-93f3cb829ed2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187742, "uuid": "20c82066-ef9a-44e3-b223-72adadc8e293", "value": "49152:V0DtrZZPwbbeGfMZoYauY95t4hVtAKiBuB0rVnt7:udZPwbbeSmWtzKiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779187742, "uuid": "7133f1d3-4b13-42e3-9c53-d8b605d3dc89", "value": 1910784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779187742, "uuid": "65f7d754-8cad-4a5a-9fe6-2c98f1b9df7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187742, "uuid": "6615e257-f1c8-46a2-a8d5-c50b5cb381e1", "value": "436cfce71290c2fc2f2c362541db68ced6847c66a73b55487e5e5c73b0636c85.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf3e833-5355-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779176365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176365, "uuid": "784f1df8-46de-4db0-9bc4-86b97a87c679", "comment": "Malware payload (RemcosRAT)", "value": "5fd0c55dc63382314901a99bbfb23270", "object_relation": "md5", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176365, "uuid": "9eb5f66f-eb33-472a-a604-8f297e84ea99", "comment": "Malware payload (RemcosRAT)", "value": "437861f36564b3c1fcaab3b15417ad58198b9cb7db9283632b83102f3399f52a", "object_relation": "sha256", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176365, "uuid": "bb7daaad-a870-4e55-8da5-0fcf63ab7a43", "comment": "Malware payload (RemcosRAT)", "value": "bb76dd0daf29c09f6637f4eb46a6d8186c578823", "object_relation": "sha1", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176365, "uuid": "c5f4f52f-feb2-49d2-924b-2da2b749b6dc", "comment": "Malware payload (RemcosRAT)", "value": "2a50e2ac13bf56d9f72fd7231a5c17dca7a19775d3e6a54feb2075da71cb35a97d338b3dcaa2cee70e1a2256fc8a353e", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176365, "uuid": "10a68d28-a31e-44ea-a8d1-b4d6ef9a1020", "value": "T1C5F121384208576949B2226AAB48C549FA5741F30ABF2E51F8CC82355F7605DE13AFFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176365, "uuid": "3277e14f-d91f-477b-858b-ecd56a414552", "value": "96:F9o11ft+114VSIoNckF073kmBWX/wAkqU1u2xBeH5af8nJKE:x14VSId3u/wA7UZxsH57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176365, "uuid": "4c08042b-c11c-4b42-bacd-940297a2bf28", "value": 7575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176365, "uuid": "48974c2f-ce6c-4431-b9ed-a506b46964a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176365, "uuid": "716b9da1-7606-45b7-923e-80a84df58a2d", "value": "loader.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c21136-534e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779173408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173408, "uuid": "c31886f4-5b97-427c-92e4-51b58ab7fdd7", "comment": "Malware payload (Mirai)", "value": "25d4d8c70d8a039c13467fd0a0736c0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173408, "uuid": "a4a0a373-40cc-4309-b225-2979e08e306b", "comment": "Malware payload (Mirai)", "value": "43e8d5cfa5d151c406557e1caa97b7a2b048b9c6123a864cd4690b04daeccc26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173408, "uuid": "cf669698-78ac-491f-95e6-b466248dae03", "comment": "Malware payload (Mirai)", "value": "c8ffc85c6eb6be9f23e89b89e9314e8108b33bd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173408, "uuid": "29f2fcf8-ff48-423e-a967-c24c59d6fceb", "comment": "Malware payload (Mirai)", "value": "471fef18e0bd4e5170512a70fc76a574bd86fd093b6a31a61e109a9eac91cd9c8236044661c8fad370478c804e5b91cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173408, "uuid": "1d34b580-a128-4a2d-9e6e-01a9c692bf7a", "value": "T1E293F615EB610FF7D86FCD3706A9070635CC955712B93B3A3674C928B64BA4B0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173408, "uuid": "6a1cc41f-afe0-4147-8f2f-41e23bfcb9d0", "value": "1536:Ptq6XiMAQdj4dPYo7yUpIW0xy+3ZKGJSbV20uGjNjDkhIiR/Er:PtqbMvRif0xt3wZNjDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779173408, "uuid": "13713d3c-7cd1-41ba-808b-b296129749e9", "value": 93976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779173408, "uuid": "870e559a-301e-40c0-8f76-0bd7b70578c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173408, "uuid": "4d5bd3a6-cddd-4142-a481-83407f03fe3f", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af768b4-53bb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779219850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219850, "uuid": "7b5f39c0-6aff-4f96-b390-0d0489f11107", "comment": "Malware payload (AsyncRAT)", "value": "73b85f4e5145868b2e3ecefff7391115", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219850, "uuid": "7e765811-f9ee-4a03-8a40-befbdea65f1a", "comment": "Malware payload (AsyncRAT)", "value": "44285aa905260b91338398c20807f4fbc0d0cd191d23553fa7f060f15ff4718c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219850, "uuid": "8364d050-c02a-4ffb-be66-0f94746268f5", "comment": "Malware payload (AsyncRAT)", "value": "a7b933514419930128127655ad293a8c8d0799d4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219850, "uuid": "1e044615-e3c4-4037-9c6d-8784665cdd66", "comment": "Malware payload (AsyncRAT)", "value": "d3bdd778f3373da856edc0d07416a5abb2285c63b25fbd06519a3020187be3b857e8be4975f8f7e1e74f19ddcdc449a1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219850, "uuid": "98e79b36-11a7-45f0-aa23-29201c4a8091", "value": "T109834D487FE50959E0FE5BB018B92663C735FB525803D2DF14CC19862723A9B8D827EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219850, "uuid": "c8c1e2eb-501b-405a-942a-1dd90dd977dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219850, "uuid": "ce72b1b9-cec6-44f0-9c5f-68c0c91565b6", "value": "1536:GGmjgEoyKnPsI4TbJLol4q8b3zfXgTObh0erJJe:LGoyIEIAbJLoKNwOl0M8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219850, "uuid": "c7fbbae5-544f-473d-8cce-8460b28b6b68", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219850, "uuid": "f46bd68c-a402-4331-9db9-c66673673e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219850, "uuid": "7bb81b47-7aa0-47d0-8c02-84caa33847a1", "value": "VAL-VIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ade0d2-5316-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779149167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149167, "uuid": "88bb57b0-a5ee-4364-a367-a8a18ada5270", "comment": "Malware payload (Mirai)", "value": "e686f4657d494d5cd5c5ddb8ef3056b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149167, "uuid": "cdf0fbc4-6761-43db-90d2-f1668ca4ef79", "comment": "Malware payload (Mirai)", "value": "453fcb42c40ddd27f7e91fa52c1fae0f56841f55190d920f7c3d6beb5fccf993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149167, "uuid": "1d8d0ab5-4068-433c-84f5-0ee13bc424d5", "comment": "Malware payload (Mirai)", "value": "4f0990a63037d05173ac371f57e23ea8847339aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149167, "uuid": "9c0b542e-b755-4a71-8780-1ae6500b0d70", "comment": "Malware payload (Mirai)", "value": "01e1feead9ffe59d0dd537b8453cdbc496ecf1f832adf101650964cd6ae8ba777a612a90098da55681eaddbd06c59b37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149167, "uuid": "5f069def-0707-4ed8-ba88-a9564ca48db8", "value": "T16F243A07B5D08DFBC4C6CBB90BD791318973F8291B22664BB7A8FD951F0DE986A1C604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149167, "uuid": "97c554f7-26f5-4974-b361-2fecc21ecd6e", "value": "6144:6I1ii2uaPcHEVPMX6LDXDpqerkvKHg+heN9KAM7pNNle:6P/uLRWNkvKHg+heN9KAM7pNNle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779149167, "uuid": "2fca4657-8f86-49d1-b7a3-2f99152fb825", "value": 229611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779149167, "uuid": "c4081349-2cee-4659-b53d-31586c341072", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149167, "uuid": "4e679957-f7c7-4079-8598-2b52b11ca447", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e947e2e-5363-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779182141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182141, "uuid": "0c7bd6da-e4a4-4887-9e79-1288f0c2d9fe", "comment": "Malware payload", "value": "730c424183af6342b63cf72846ade141", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182141, "uuid": "31893af2-29cf-47cf-972f-98dba23b7855", "comment": "Malware payload", "value": "457ddc9e71444372c64ea33f538af53d4d144644607de4e4cb3d2833c5686313", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182141, "uuid": "0807b738-b318-4cf9-99a7-7ccf9c14adaf", "comment": "Malware payload", "value": "a5b08aec3bc9c0025a2e3a77d70d5c6d21041801", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182141, "uuid": "64241ade-9d4e-4a82-be29-b9b12bc329ee", "comment": "Malware payload", "value": "be9e3ad3677b4ec349357695862a8318d2b3315d30575fe84f5cbda8f6099ff9d5fc1de2d067f9669ef9cef810ed6a02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182141, "uuid": "8adcee36-5b62-40c6-a86e-7b49fef154ae", "value": "T1B101824516E20F27CD92327E37E28B5C6791F8330866C745B20CA8BE0F522CE2DB8E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182141, "uuid": "fb582759-4e67-4ab9-9218-a1e4d909fede", "value": "12:BFFmFmFmF/EDrACpQCQqt8ZP/fzaXMXOXKX2X/mXY+lXrmXZly2nXLWnXZgQl:7FmFmFmFgc17ulul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182141, "uuid": "54f4c2af-1543-4f1b-b9fc-aacbe8fe8f2f", "value": 759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182141, "uuid": "cda75af0-20f2-4ac3-9fe7-f4a13df775d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182141, "uuid": "e465e1dc-ab9e-4307-a823-cf1c10e54c79", "value": "dlr.parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8beb08-53ae-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779214294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214294, "uuid": "d007bd64-2b87-4230-a511-db6f7e74336e", "comment": "Malware payload (NetSupport)", "value": "2b5d6bb9b0925a8ddae834ed89d4f305", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214294, "uuid": "44a03a93-90e3-4ffe-8d9c-9bc029bac96f", "comment": "Malware payload (NetSupport)", "value": "47cae3c0b59f0e6a33e7aed184fafd9b978b049a00a88ce1e93ec1ef538fff67", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214294, "uuid": "2691588d-8bde-494b-943b-ba8a6b33ce38", "comment": "Malware payload (NetSupport)", "value": "2d6784ba31ada56dc6128f38ae14727b3eb3570d", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214294, "uuid": "9a49fddd-5eff-4246-9a46-689b0c02506b", "comment": "Malware payload (NetSupport)", "value": "1d2f561c794a9b6dca6eadb68cdbbda2295f92973fa9bcae3d854b110ab9d628846fabb9c91c74f62327a009b40e37ca", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214294, "uuid": "99f1acfc-9734-465f-9f0e-dfa81575ab24", "value": "T1A9130E36EA92E88297D83D00C876FC59616426B1CBFBCC5CF78C6AFDB081E115B5469C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214294, "uuid": "00da73b2-5f01-42cd-b3c8-09e73dd07271", "value": "768:J2ZkfkFjXkk/HD4MrU7SQnppFROQW0Ab1sRuIgTFhx:gkkPD4b7JppmQrKTFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779214294, "uuid": "8579ce6b-1bb7-4a30-8b5b-c8e338986d0b", "value": 42731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779214294, "uuid": "9c20e118-810c-40d1-819d-b1f3723cc65a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214294, "uuid": "b6a6e579-22db-4cdd-8753-f5a005e63ace", "value": "update.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58d3674-53aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779212808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212808, "uuid": "9a40a93c-6f75-4fb0-91c6-952eb4722626", "comment": "Malware payload", "value": "89658d3986921a5001cf59882cccf539", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212808, "uuid": "5fa16bb7-d830-4770-9219-7e48c38b0e6f", "comment": "Malware payload", "value": "48f4a98e5d51096c3b2c6879a0c4721b7b986c47052570fafb5510a566a8f897", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212808, "uuid": "cb0a6b75-660e-4350-b877-313e4151a651", "comment": "Malware payload", "value": "2cdeda3d75fd5efdb56c98258aacebbaec02fb45", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212808, "uuid": "16071c0c-f900-4bbc-98d3-26277754635f", "comment": "Malware payload", "value": "e129bf28fdb33450e463d1fb9ae8204088dc62b34eb56b5e14ba687e6f853fd585ed4e29bef834eb699eea78f1bb76a3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212808, "uuid": "d64bae14-b07e-4dff-acaa-6346bf94ccd0", "value": "T198E0A2A73080602DA2A7A7D0EB1E089B0DAE1F262DC1C662802861E07E412FE4319CD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212808, "uuid": "f87060ca-4d64-419c-bb2b-b17d4a497247", "value": "12:ufVXf2K1mtXKoyw6Xv7HHL8gMwWbDdIC7n:qV2Aoy1XrHLmwWbB7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212808, "uuid": "5868f34d-db97-4c9f-bc90-60eef70367ad", "value": 429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212808, "uuid": "4d8683ff-311e-47b7-949f-548f7be33c9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212808, "uuid": "250844a3-bebf-4c8a-9e7d-a247b6f94be3", "value": "fc3fc16e3dc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e482367-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779168396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168396, "uuid": "2401ef8f-e91a-4b82-9ee4-697163807a64", "comment": "Malware payload (Mirai)", "value": "3816e96f3a07c54d380e7eecb4a1cd4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168396, "uuid": "b37b942f-4c42-42c0-95e4-08d172d46c93", "comment": "Malware payload (Mirai)", "value": "496242e254f645a43d1355e9081f4e58f63c069eb5cad4ad38dd6fb0b8c8c18c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168396, "uuid": "5bbab25b-174d-4f6b-87bb-e1cd69260336", "comment": "Malware payload (Mirai)", "value": "c1d104e1a04f861df3e4f194c85dca4adfd22ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168396, "uuid": "5cbc6e22-0253-45b1-931e-05401fd9cff3", "comment": "Malware payload (Mirai)", "value": "ec2ebd4ae5afc20c350e31d18f4fd13d36b1e84ada16210583a15b67f4925c41845cfe5f16894c081caf6a1319e9791e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168396, "uuid": "e37b62fc-4b50-4922-bac0-ec215417f5bf", "value": "T17D52E9136DE17FBBC9855BB905A342700B53E8354F032B6B342AA8B84A07ECD7D5B354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168396, "uuid": "692bffad-e8e8-4493-ab32-d0ce4503e5ad", "value": "192:rCJY+wn0Mj/Q14cqBRa7P9a71wOZg3WmJUuFaKZ9jCHlAj7SIfrmmDIO5vnO5:mJ7MCqBuiCxU/FwSwbDIAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168396, "uuid": "996028d0-d36f-41f1-9126-adffbcec98dc", "value": 14093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168396, "uuid": "1794fc02-8608-4c53-be82-bd7a63e4a5e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168396, "uuid": "466b1dbd-7a04-483f-ae6d-a94b59954eaf", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417c42a9-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779220344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "4314b031-be3f-4c4f-b34c-4d010b54ccae", "comment": "Malware payload", "value": "758e9a7803105ebd4521c88d5fc7ac0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "81caaa64-eb75-4c52-b0f1-478481c76567", "comment": "Malware payload", "value": "4974aae04758079e79c33715f6d12cfde035c6959cf22c87a43e16fb6326f7de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "5133f39f-8dd5-420f-ab90-e4cb0b03ac66", "comment": "Malware payload", "value": "f875239b00e7bf35f23c2c4dec2b6c0cc600c878", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "5b980628-5569-4dbd-9d2e-d349ce99ad21", "comment": "Malware payload", "value": "0de8dfd6ce983c4d68ffc9c6078ed32b15adf0ece16f922868163a537c664be46028df24c70d082d2bef8681ff5826c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220344, "uuid": "3810c64d-3994-4952-bdee-e9b3ccc437fc", "value": "T15583E789FE15971BC7D272FBEB8D038D7A2B1F69E3E6311599315E9033C5AA0643E120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220344, "uuid": "6dec67e1-ef6f-4a9e-a619-47edfe80a419", "value": "1536:vQFgnXP0XH8LNWJYOZD//ZgmWHtDeOEIgxNafjBWm6OUovjK3:4FgnX8X8k1j2mWNDeVUWijK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220344, "uuid": "a0886091-582f-4580-8fc7-a290105b707a", "value": 82136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220344, "uuid": "76245ba0-97bb-4fd7-92fc-d6f092782a59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220344, "uuid": "d3757e65-dc79-4ce1-8342-680ba275ba27", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88361d2-53ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779214557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214557, "uuid": "8a02b5fb-8f70-4a28-a153-8efdacfb8e7f", "comment": "Malware payload", "value": "ff0d2abb0a4ea26987b00d2d0f21b020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214557, "uuid": "f5eccf29-58fe-44e6-b889-2f644150f4ce", "comment": "Malware payload", "value": "4a81b3dc6bfdcfeadbf1c0e918b40766525fa6fb1edb732ba765bc25eacdbabc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214557, "uuid": "84076ed0-4020-40f7-b16c-f0cc4e6b73e7", "comment": "Malware payload", "value": "c82bec65ff1e76b30e972d0da2e905aa694c556f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214557, "uuid": "84c746ac-5e94-4fb2-a193-b9fb2266d376", "comment": "Malware payload", "value": "63f596500c4f4c6003052195d31000551291d6f6f3532a82797f62de47cbfaa4ceb1f8a4ae0a6d3668e59097c33a2488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214557, "uuid": "53cfb6c5-a4ed-4a75-8ee0-6d242e5b6f26", "value": "T146348D03B980E935E57E003408A6AEE7456DF9216F20DDC7E394DD7AA9307C1B631BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214557, "uuid": "2ab2b485-b54e-429f-a9a1-3cd5c896808d", "value": "87b971ade0061e13aa9ffb12134340d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214557, "uuid": "f82e1570-a7e8-4add-a6f0-63ef0f4e85bc", "value": "6144:EMMtGUnWSvdy6wwuM4jyRC7F+Z1s+W/VOBIvua+iUl7:rMkUJyP0QTJ/VymUl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779214557, "uuid": "08345660-d46d-48d4-afb8-d8ccc9ce709b", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779214557, "uuid": "acf47c67-ebf2-43cf-9f1a-41ae0cf8d7d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214557, "uuid": "c2e35fd2-4624-465e-a1b5-c105d585c130", "value": "katyusha2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65586e18-5351-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779174448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174448, "uuid": "07cacae2-13b5-4f7b-807c-2d335ff0ed4e", "comment": "Malware payload (RemusStealer)", "value": "fc4628f35acf2b7766c9a01284f4fffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174448, "uuid": "a7d0ac1f-3ad1-44ef-81f2-e02d3894977d", "comment": "Malware payload (RemusStealer)", "value": "4b0f0759f4e63c162e541f9930997ade428e3ec56b7dd2b5a7a4cec22e6661c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174448, "uuid": "1bbc0ee2-a9dd-48e1-a0a3-f8d71a8648df", "comment": "Malware payload (RemusStealer)", "value": "cf370f30911c053333c7f53d7e9990a0abca2c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174448, "uuid": "07e3771e-5ded-42e0-a80d-d54b902a8ced", "comment": "Malware payload (RemusStealer)", "value": "69394429ca2fef5fad535642fbad7a0db007479f4e697800c6e2d016abbe3b7b7c8050c41e8936b4c744d17a344a6112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174448, "uuid": "57c9db02-bbcc-4bb4-9a1f-ac232b295741", "value": "T19B147C4762E921D9F1738238C9659A53EB71B43613209BEF07A0861A5F237C2AD3DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174448, "uuid": "663f55ac-05fb-4f57-b01d-9b61ba3c24f2", "value": "0be878847a955d68de7730bad92f9303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174448, "uuid": "bf429e01-17a4-4f4b-bc00-86d8b8fc7ce6", "value": "3072:sfsrCqGlUZRNpkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:sfeG0QyrWpAKhhvORHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779174448, "uuid": "3f45d711-641b-42ac-87c5-975567c14c2d", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779174448, "uuid": "94259c79-d22a-47a7-a40c-5a4b468fd74a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174448, "uuid": "e461be5a-515f-494a-83ed-413b30a71f6e", "value": "crkhost.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b004fc-534a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779171690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171690, "uuid": "12186976-c7e4-4dbc-a774-a2a0ccbb70ae", "comment": "Malware payload (RemcosRAT)", "value": "1aec0921ee643c4020db3ebab86a3cad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171690, "uuid": "349f42fa-a9b6-4f26-b8c3-46955a12400a", "comment": "Malware payload (RemcosRAT)", "value": "4b9ff0910337bbe49fffcc2e58c3386226d7168341a5e885cbc0c72a3c40e492", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171690, "uuid": "027e3c48-3869-4040-be69-bcfdf4b66d00", "comment": "Malware payload (RemcosRAT)", "value": "cdb852c64661add5b89b500a7ba1959d87f493c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171690, "uuid": "41dfbbe5-1029-498a-a528-e54da402483a", "comment": "Malware payload (RemcosRAT)", "value": "4bd639572d74764f072e777d24c80f540ecb072fd8e114ce101cc6d8a9eb8f3689d9014a4f35a76a702218378cf966f8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171690, "uuid": "92729c22-1785-43c7-b15a-5462c9f9cd2a", "value": "T1F0361A7C525CDBA1E5F5D732CC2DBAE05A1C60235DA9EE26542E0AACCAC4F03371C997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171690, "uuid": "5426e12b-c5e8-476e-822f-0afaa4b0634f", "value": "98304:Bilu7jXTdBCf43VOFJB2kVQr5jTfOGviGCJq/AEaSASP74N6sm8MyKCx+BKfIVt:HbL8M4w2SCm8Tpf6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779171690, "uuid": "527533f0-25d0-4c4a-ad87-7f65dee537aa", "value": 4943397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779171690, "uuid": "c3a82aca-ba69-4ed3-be5b-b621f72f76f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171690, "uuid": "0fb2cf34-0e81-401c-aa1c-5ad94a60afa6", "value": "Purchase_order_request_229384905172026_UG1-10005532_doc.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cd38bd-5355-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779176217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176217, "uuid": "90d8adc4-43ce-4fa8-8c05-38c66d0504ee", "comment": "Malware payload (RemcosRAT)", "value": "0fb5b5827488c6e5a65524463ab067f3", "object_relation": "md5", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176217, "uuid": "1cd39b2f-b78f-4153-a3f2-8c93d0da1c34", "comment": "Malware payload (RemcosRAT)", "value": "4bcdd2fae46935f5a4e88b808c6117b816a23e00e131992237e871cf818aec36", "object_relation": "sha256", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176217, "uuid": "ceea40e3-ea3c-44b1-a94b-9f719391526d", "comment": "Malware payload (RemcosRAT)", "value": "eb98fd79ddf0f699be50d14b7e176d7852664100", "object_relation": "sha1", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176217, "uuid": "64ea008e-09ff-4925-b8bf-bd843dfc2d79", "comment": "Malware payload (RemcosRAT)", "value": "3892b19a68e01e92b8f7f2361b9448756b301395381ec84520102133ba840168e87344c889b40653e60220c5f7b2e338", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176217, "uuid": "c4c84360-3705-45cd-9fba-e68722bf73b1", "value": "T14044234D5C9E885ACCEF38A29915508FCCAA57F5E40B4060CD7FCABEE94447375C88AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176217, "uuid": "d079ce2e-d1ea-413a-94ac-e4c61dff66be", "value": "6144:XnUt3xNwtOUVl0nUgm9c1cHaZCFupC7ORDMgliSmbTcm8Zdtz:XwBPMwUgdsApmOHCncPZjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176217, "uuid": "1983f7ce-a694-4950-990e-cc1b6231c2e9", "value": 276341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176217, "uuid": "dd21ad64-c435-4e04-83a8-f46a3c05c77d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176217, "uuid": "76e6af0d-d2fc-402e-aefc-b29675672612", "value": "jubilant-octo-winner-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4bd24f-53d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779232894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232894, "uuid": "3ce19f75-182e-4085-a7bc-4839a8f90ce0", "comment": "Malware payload", "value": "a9277a3fe4f981b48dbcdb5858dafea3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232894, "uuid": "cfbe80a8-8d25-4d13-8d1a-5785f8882bf4", "comment": "Malware payload", "value": "4c77e062efb59095f6e7f05698a31d7648388567a0d7d39d1059570421864e86", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232894, "uuid": "4bfc6993-9e4a-47fb-81cd-3f54fa7c310c", "comment": "Malware payload", "value": "13474e32b4a013f98f8d83daf0962b877ec4ac6a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232894, "uuid": "b8209489-c137-4e9d-a7ff-9cbca721625d", "comment": "Malware payload", "value": "e6567114e9a080c5e72b664cab32897d6d21fdc620bde66d8aebb63f630ca3a9c3cf7b5ebe8565b39eaeb2b347562aea", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232894, "uuid": "01ced0a1-f67b-426f-b405-2f66f5a852dc", "value": "T1EF32F72CBE854331D3A049B458798357653C6273E783E3EFF737968E49962498840E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232894, "uuid": "0ef9b86f-cf80-49f5-a0c1-6bb8cb529f33", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232894, "uuid": "30018cfb-29af-47fc-92c1-2b5ad52e3716", "value": "96:u4dRo4Yz/9PYz/mUJU9LsB2dS/z1DIGx+ZQXygziTwQBoPFJxGE9mZ2FFhxC7tC2:uao/WuLsB1x+eXNPFJxTEZmFhSCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779232894, "uuid": "60e52e3e-a2e0-41bd-929c-9a9960cc1424", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779232894, "uuid": "91d180b2-492b-4077-9e97-e2214e8c613c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232894, "uuid": "47215d4a-99e0-4129-a89b-76069efd45e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fbea52-5358-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779177351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177351, "uuid": "b1190e21-00f7-4d75-b718-a41785c41482", "comment": "Malware payload", "value": "1bf819b8f11f9089ce04dbab79e58e53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177351, "uuid": "d2aee6b0-44d2-4033-9aa8-37fed839743f", "comment": "Malware payload", "value": "4d6a44f3db200ee1ee9085f07e63c09b8154a6f7f6a35d0124a556165844dc98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177351, "uuid": "7ef95001-bed2-4063-9340-b9a907c30ca3", "comment": "Malware payload", "value": "e5c31660e782f6871b9847dea0df2eeef5f305e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177351, "uuid": "1eaa088e-e12d-45b0-8cd3-5bd84445e0d8", "comment": "Malware payload", "value": "23065e62f88d6c4a8f0a825c529ab16d4f924abe3b9c2f90e21bb8427f978ceacc004326dcac2eb6870bbad203eda1db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177351, "uuid": "00c92fb0-1d07-40db-9113-2df84e53cdc5", "value": "T1A6C63358A3C00967E8D7613C9EB2C2A1E391B9112722CDEF1BD1177A3F77664483E798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177351, "uuid": "bd5856ed-7365-4dce-9ac0-24b7f77699ce", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177351, "uuid": "e551c86f-f54a-41c4-a1ef-b2f1e99bb814", "value": "196608:ilF5LKl+GISOsrsW4gXySntTFqq8N3tHHs+AtlmDweBrvziVWXFn11DgctE7g/:iRLK0GISHrNtZq5XHHsxtEDweBiM1lL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779177351, "uuid": "0128e346-f412-4a04-802b-034155fcf6e7", "value": 11958337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779177351, "uuid": "e169ca35-ccd5-4376-890c-0bcc9b096de4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177351, "uuid": "e6beee03-f852-4745-8ed5-fd9c77389e59", "value": "Feather_Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd4fc71-536f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779187533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187533, "uuid": "b044490c-230d-4bb3-8fe9-188a5d174a79", "comment": "Malware payload (RemcosRAT)", "value": "18fc2126e04912adc890a1e3b2a8128e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187533, "uuid": "ba519609-34d9-45e6-ad4d-708f7a7dc4c8", "comment": "Malware payload (RemcosRAT)", "value": "4d83dc8b81b82789a9dbac1afce8d6feeb3f90c3c82e10af5a65113efd5919b1", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187533, "uuid": "1fb40dd6-bb30-45fe-9ac5-6eefd6600c0f", "comment": "Malware payload (RemcosRAT)", "value": "07430a2892920c49fdb4ee6bda7113da9a80506c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187533, "uuid": "e5c3be14-f472-490e-b38c-6c07ffa5fc87", "comment": "Malware payload (RemcosRAT)", "value": "08abd064d297487d6591b364151e82ea6a3ff342d4443749ba0c6706b7944f1a5a13c8a728b3f065fb720502c6b5bb25", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187533, "uuid": "431f8f40-d6ab-499c-bb59-51ce3fa3e60e", "value": "T1CCC5A7327EF8E13646D9A12FB2DC6E0CD4618F8375B2AA99F1E188DDF041B34952B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187533, "uuid": "c951cd84-0eb0-4533-b661-82d29b95467a", "value": "768:1343434343434343434343434343434343434343434343434343434343434346:FR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779187533, "uuid": "f9bc15a7-e490-4730-99a4-ba73e9528a3f", "value": 2675045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779187533, "uuid": "27b83961-a393-4d97-9c61-b9e6a9511fe7", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187533, "uuid": "571ad5f7-3763-49f8-8078-1f9d79f74d70", "value": "FEDEX-MR-26-20329 TS-ELE_M10-M26_GENERAL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e970d0-5350-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1779173945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173945, "uuid": "c26f1d91-2e08-4fec-8282-4785ffbe4fc9", "comment": "Malware payload (GCleaner)", "value": "88ba79b67457f556fb58424e55e72432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173945, "uuid": "1b8316a3-2707-4cff-a3a5-3eb73294eac8", "comment": "Malware payload (GCleaner)", "value": "4d9b2d99ebd8f7c2d7dff0f5f97add26937236e535ed1f36fca38d8cc5263837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173945, "uuid": "0ba37196-2804-4bd3-96ae-c8371e671d12", "comment": "Malware payload (GCleaner)", "value": "6851d44df151644e8fa2fe7173cf2dbc2ab81ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173945, "uuid": "a229f815-fe80-47db-8c37-e023221787c9", "comment": "Malware payload (GCleaner)", "value": "03c1355e0b9360e04e27c20b7f9bde677282e0fb2844fddcac6e01325a8e43b9b53a96c1010d5ef14f6987134d28304d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173945, "uuid": "fdcc80e3-8412-4542-990b-60c97ea621fd", "value": "T1A4146C12F693C076E9EB093059719B9A8D7DBC60CB94A8DF63901CEA4D707D0933BA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173945, "uuid": "b08ff0cd-49e3-440e-a434-a73259eaed25", "value": "effb97a05db1fadcc20444166d9f6e68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173945, "uuid": "631913dd-103f-438d-b926-83b3b4a59523", "value": "3072:b9wZH1LIcR7AnOt5Y9XB6Vwb1+WpbZBoFyIp0BHwViSPRzTVbs7IY:5wVLF7bt5Y9gCbXpbvoFyoFpw7IY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779173945, "uuid": "1dc3329c-9c99-4f50-aad1-b4b622882896", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779173945, "uuid": "f58b697a-f62b-4f3c-b1b5-e2a2de41385a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173945, "uuid": "86bdfda5-2ceb-48b4-acd0-224196909c1a", "value": "4d9b2d99ebd8f7c2d7dff0f5f97add26937236e535ed1f36fca38d8cc5263837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c203fc82-539f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779208104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208104, "uuid": "12d04430-52c9-4cda-b671-35eb7504177c", "comment": "Malware payload (Mirai)", "value": "02a7693ca6436996e98712e91289ac7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208104, "uuid": "c04c36fc-0e37-4d2b-900c-e82ff3201f6e", "comment": "Malware payload (Mirai)", "value": "4e40c615586896cbd3913a65c7db9e276c17f54bc916638ae4d2a474e9fb09dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208104, "uuid": "492d2aed-fbcc-4c0a-9976-82e76845540c", "comment": "Malware payload (Mirai)", "value": "32e88fa6ab6297780e9a2053418829af1e54449b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208104, "uuid": "61079341-65fd-47b3-ad26-757e089e8d4a", "comment": "Malware payload (Mirai)", "value": "f8777ee0199944fec31d38b0c1046dfc0306ed99bb934952ce1b6f5398bd2ef9c00a817bd3db5df23112f70de40ae0ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208104, "uuid": "b7c3bfc2-4c49-4caf-b355-19a215bdb2cf", "value": "T18D836CD8F683D8F6EC8301705077EB768B73E53E5129DA43C7A89932DC61940DA2A79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208104, "uuid": "22eddc05-d9ff-495c-9dc0-1369b52e04ca", "value": "1536:nOroOCUm7lO3u2vZAZQ819QJ535B9KCbjJwmMZTSaS:OfCUm7lO31AZQw4vB95btwmc+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779208104, "uuid": "98a600bd-920a-45c2-a53a-5660437bfbb9", "value": 87976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779208104, "uuid": "565d8a71-4802-4f82-97bd-3028ee33285c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208104, "uuid": "0ae056ec-52f8-4a1a-9776-0c051744413c", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60142817-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157259, "uuid": "90261765-78d9-4186-a379-800b0ac1966e", "comment": "Malware payload (Mirai)", "value": "c2f5085e338910ffad89d65155c39897", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157259, "uuid": "ddb6d95c-09f3-42f2-86bc-fbcc6ce76511", "comment": "Malware payload (Mirai)", "value": "4ef4745dd219d096a39548d22e3b35021a60e7336e8a468115468266b1b45560", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157259, "uuid": "b21782d7-cf34-45e5-9256-cb7e5240b264", "comment": "Malware payload (Mirai)", "value": "1b83949f688bceb34ceb5c2faed9a583e70b1839", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157259, "uuid": "7eb36ded-62b1-4a1a-aebf-1e702e8c8db8", "comment": "Malware payload (Mirai)", "value": "d6729526e970176c80089fdeb08fb2912386ecca9b3abf0a282e288f7f36a999d05978c02e94b26887461b078ca0a1c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157259, "uuid": "25cf441f-ceb5-4db3-8102-fce1868b1921", "value": "T1543153D635207A665226CF057ADBD91BC2A984CD329FF3FBCCE6042CD02854CF965A23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157259, "uuid": "f3b8d558-f01f-47b3-9f69-68745b5a6ce9", "value": "24:S8Aq6bdNI0CFwbLKwl5SqUa6Y/bPRbrQ/oD5y6Ewnip5Jf6vE51TE7:3KuSTRb0oDwpXZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157259, "uuid": "8d622551-dead-4359-a4bc-c660b98c211a", "value": 1788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157259, "uuid": "5473bda5-4221-4cc3-9989-cb5144daf780", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157259, "uuid": "9a951fcf-c2b8-4977-a815-e3eeaa4c502c", "value": "dck", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5ea8a2-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "d20a5fa4-7cfa-4fdc-95bb-a3b97f26f5c5", "comment": "Malware payload (Mirai)", "value": "1c04af0959ffb0cf101580b9b4302507", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "448b0216-8d71-45e2-b212-78c2e911d5d5", "comment": "Malware payload (Mirai)", "value": "4f5bc3352d5cabcef734a1b5a51e86f73f4732f5e588cbc4809f6d4b211873a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "917009cc-f539-4790-b4e8-5455845f4723", "comment": "Malware payload (Mirai)", "value": "5c9d8a400b1bd6e2eac7ee540c5bb7d51b56b0d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "f55968ae-6f4f-4ee5-a5d4-a31d73bbd0cf", "comment": "Malware payload (Mirai)", "value": "4ff8eeccc9fe4c2b0b9144ee7042793da52e3f4a1591e5866adf20b7cd67399f93e073a3242a404601a916a3fd0fc12f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219558, "uuid": "d1317bff-2a6a-45b1-916b-2bf0345669cc", "value": "T10483198AF800DD7DF80FDBB74463490EB931E3910A931A377767BD93AC721A54826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219558, "uuid": "6623c50d-b9c0-4261-a80a-6b203d9ce18f", "value": "1536:wv7sC9KZb55+W8aEtoPuYAht8f489k0rTUhrIpu1HT7ot4O9I/nPaGD:w+5NELdht8fsnrCupQ9I/PaGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219558, "uuid": "e39f3fe8-553e-404a-908e-9f52ffc8e757", "value": 84956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219558, "uuid": "d572b6de-f002-4e60-a1d2-cbb4356f8da7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219558, "uuid": "0dfe3a07-58b7-4eba-83c1-ec56c4695cc9", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddf2f89-5394-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779203453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203453, "uuid": "d83774b0-8a5c-45e4-a611-9aef6c0d112e", "comment": "Malware payload (LummaStealer)", "value": "667370a5ecbabe9b78508223488f4a0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203453, "uuid": "8694350a-37a6-4d77-b3a5-ae0b5f3558e4", "comment": "Malware payload (LummaStealer)", "value": "4fb3129786468159035c45d81fcd7ba10f8591191d664da59bd0f26701d91ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203453, "uuid": "f9b801a4-0323-41f2-a156-0bd250cf9839", "comment": "Malware payload (LummaStealer)", "value": "253922389138682f4878534d8c5b6c1bb17e6c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203453, "uuid": "626bfd31-7d68-432e-9f0f-e6faa5a457bb", "comment": "Malware payload (LummaStealer)", "value": "1c119e85784d2373a779e484029bf5419551acc76e4c163cffb1f7ca1228d1984b69f5667165817c572e07651a5faca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203453, "uuid": "9f15f63f-dce4-4387-9c0d-ccec10ac796f", "value": "T129748D4AE7B748B1E5470975229FB33F9B2416144328CDDBDFE0CB447A33AE26539A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203453, "uuid": "a2841383-499a-4124-a301-c7a780d15cc7", "value": "ca3a076fba7ffaca03c5cbb10ca69f8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203453, "uuid": "a1aa3ab0-eeed-44e1-aa84-9ae26dba1911", "value": "6144:YRLI6zZvCw5/8m5RtUHD2zSnK90dK7KDhAoK4Yeh9bDvJFeO11WX:ATj50mhUCzSKGPlAoK4YehVvJFef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779203453, "uuid": "8e48c8b7-a4ff-474c-99d4-3dd09be206db", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779203453, "uuid": "076972a9-55cb-4493-afb0-526ac7f93a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203453, "uuid": "02919199-58bd-40c8-a0dd-69d042b1fadb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a792b01e-53ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779214502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214502, "uuid": "86626179-9f81-42d3-9048-6a2338e4661f", "comment": "Malware payload", "value": "47c857e7308c24d467361dd8b64da3ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214502, "uuid": "e82d9dd9-3845-4da0-b4ea-7caf9fa3b46f", "comment": "Malware payload", "value": "4fde6806002194fde924adc29000ec8e594f9394f099b2af82aaba7a479e2ea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214502, "uuid": "4ea96966-5cad-44c8-b8d6-1a8219cd2c31", "comment": "Malware payload", "value": "5ba73c00401c2e37ef8d407616a6ee766d93a5cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214502, "uuid": "243ce91b-5999-43a6-a817-90f68f2776f6", "comment": "Malware payload", "value": "558e5ce788ab568c203ee8708204c8c7be1dbeccf56055901f2d2719d1e41b475b6fb444a0de8c1da9586d2874ba44e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214502, "uuid": "df788e80-8595-46d1-9252-3131a7a41e3b", "value": "T1FEC31292B012DD72D90213F6B997C54BE7BB0315C8352FAFE971EA16693230438E5E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214502, "uuid": "a1ce9b03-ffaa-4046-9fc4-83da7c864240", "value": "b53d0005d2486b1f94e36c926d61e509", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214502, "uuid": "ee48087a-cb6c-4df4-a339-7b1b238621c3", "value": "3072:nqUVZOJnWg4zmHaSGUNkgkR8CsMzwVD7nmxo4XIE:3VZHgsm6f9spfy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779214502, "uuid": "cd5e0235-7c00-4be3-94f1-2ee77f7910a0", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779214502, "uuid": "eaa7b4e5-95c1-4713-bc8e-1263ba54c719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214502, "uuid": "27ab2a1b-c345-44e1-9995-0d830f03a9e9", "value": "katyusha2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d29e900-53bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220739, "uuid": "0d25c769-2ab4-42ac-8c22-d2bebfc07315", "comment": "Malware payload (Mirai)", "value": "ebd31be62613324d90a8d1bb96543a5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220739, "uuid": "d7c086b9-6fc1-4669-9759-d8640fd6cfd1", "comment": "Malware payload (Mirai)", "value": "5046d573a6c4882399489bd9288d24eba556d529482a11712b8ca5a5199bc761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220739, "uuid": "3fb005cf-30c6-40bf-9821-5508e7335810", "comment": "Malware payload (Mirai)", "value": "4933cfe841ef76a0f21c9261e4fb8a0ea690970e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220739, "uuid": "d734eb23-d775-40a7-afba-6fa337ab5d6a", "comment": "Malware payload (Mirai)", "value": "3b7e8d72a758d3821d851ae4cd148baaacefd12a584dec14b2b82ced5e371d89765e96cbe45179dbb677a7ad53a51749", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220739, "uuid": "577c62ef-0adf-4a24-b1cf-d213a6b1809e", "value": "T18F82D0B0B64DE833D670EC71986989D077639BBDC2B2B13311610234FEEB18AE274599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220739, "uuid": "44ac8466-004a-4477-807f-a4208a380505", "value": "384:ugB1HuKhQG/bgN9cnA9ZK6Fc/bFqPQMTHePNFn8hymdGUop5hIZK:uBIT/sN2QZKRpFn8s3UozaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220739, "uuid": "c55fa8a5-2978-46bb-8a12-168709353e14", "value": 18756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220739, "uuid": "f69b1895-2dbd-42d4-9651-191dc040ce16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220739, "uuid": "78712d00-7db6-4f1b-a044-66d0d42d097d", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7719af7d-53be-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1779221293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221293, "uuid": "184b38a1-ec27-45b9-914f-f124cddd1fa4", "comment": "Malware payload (Amadey)", "value": "51529208cf2d2f0ac362473e0ed6f9a4", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221293, "uuid": "ca23b4e6-c09f-44a1-95cd-a2b0490a1a7a", "comment": "Malware payload (Amadey)", "value": "506942bd1cb3947955dc5acf42db00c671b9aceccb7a8b909a06cbe2a5984aba", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221293, "uuid": "8effd38d-75ed-4e31-bfef-f58e95967fb7", "comment": "Malware payload (Amadey)", "value": "8d057de5147e69e268b66e855e985784abf6dd1a", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221293, "uuid": "2829cd4c-e4ff-48b9-8494-f03f66e2617e", "comment": "Malware payload (Amadey)", "value": "3604135b33f695803e0cb1a8a7a0998acb4c91a47268ebfb8f163ac73c1e36e1c6b35c12139bda0817cbc16c74df268d", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221293, "uuid": "957ca0e2-b18d-48ce-9f0f-c59bb3247d1e", "value": "T122D30AC6BBC69CE7DA06123885AB8329133CFBD51B839703493972351F136D0AE9B657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221293, "uuid": "beca2674-d706-41c5-a38b-c9c9876dda5e", "value": "1c5620c15dd0d860e30f2aa225c910de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221293, "uuid": "500edacb-f2af-47f5-a3da-8f5223dc6abd", "value": "1536:/B2dfDwWLCJjMJDEXa4IBM5Yo6Pmh55/XMX7FjGnx4xKqEHXER2xLiM+xX6CY:/IxD1LOKDLKvg7CHXGRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779221293, "uuid": "4823865e-8cb4-424b-8685-7a24feb52f50", "value": 132185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779221293, "uuid": "33f46064-9819-4a30-9fa5-3220c0fb8a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221293, "uuid": "601f2786-64fa-4981-af68-aa78e514a512", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026c718f-5341-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779167410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779167410, "uuid": "518ccf97-ec79-4ccd-ade5-c7f22b9fb179", "comment": "Malware payload (ACRStealer)", "value": "0d8650f4870cd980f9bec1a3dc3a9a29", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779167410, "uuid": "85467c75-6ac4-40d6-a980-6705d416cc56", "comment": "Malware payload (ACRStealer)", "value": "50a59da91e7fff3b12463804d7f22e12a135f05b0df1015e4e05162b654b62e3", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779167410, "uuid": "05872988-ba78-416b-b22b-c176f3dd313b", "comment": "Malware payload (ACRStealer)", "value": "f7621ef5c0a058f0f81c2d6d4e53bcaa85459a0d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779167410, "uuid": "ce5ceedc-f7eb-46ff-9c55-1e1ade5a8b7f", "comment": "Malware payload (ACRStealer)", "value": "b10276578e851477b9382e06522c5fa6afa8a80073cce413036492f9763420c844e5cf7400f99e58a4dedc810d7cdab4", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779167410, "uuid": "1a272c56-8584-46d1-ae60-1f09ef5042e9", "value": "T12C75125062F4D126D9E286BAC8A30EF76BBEBCA2CB94576F10987C7935721D0193D307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779167410, "uuid": "b467bb5a-f560-4a20-9720-e0253d62777d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779167410, "uuid": "735c941e-f954-437c-86a6-8623ad633e0e", "value": "24576:7jfij42vQod4VkkQru8YwO3AsdNJW5Sbx4sYS3djKAHBSBqwpd:7jfijfv74qbHfO3Rdxnx3djKAHBSBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779167410, "uuid": "81847911-4f45-4337-aaee-99c5e9072848", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779167410, "uuid": "2ca1b122-4e3e-45d4-abc7-e518f1c187bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779167410, "uuid": "c7a0274f-60a9-4704-85ac-965be9dbdb1d", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4148a9c9-5351-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779174387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174387, "uuid": "a1568e26-c32b-47bd-a577-3649f4a01579", "comment": "Malware payload", "value": "8f83454f9d886d62b7c23e5113c9d065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174387, "uuid": "abfda00d-9784-4aee-bbb2-21abe665ffb8", "comment": "Malware payload", "value": "50bedcce920e304289c781a632e2ac7e143554ed4e9c33d06a24f74b92f07c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174387, "uuid": "eb7f4663-8621-4fdd-8926-52acdb2f2fc8", "comment": "Malware payload", "value": "d677330d81c674e29187d55d1ef941e2ef0eac9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174387, "uuid": "c694b6ea-3363-477f-859d-6ea665b4b9f2", "comment": "Malware payload", "value": "d594734779d51193af5029c50d16de695c217f8b2ca48dc276e0e8220691951c688c7eb5cba4a71bbfd1c1fbc8dab8ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174387, "uuid": "9b3808e2-1a86-44c1-8c31-96148d2b5225", "value": "T17184F057B6E630F9E477D23494520A06E7B2B8355BB18FEF03A046165F223D0AD3AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174387, "uuid": "6fe42b63-bf06-4f07-828f-06c61cf54553", "value": "75c410d3cdd17cf4a33ccaf94384484f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174387, "uuid": "18bfd27b-8e5f-49fa-b887-6540b4535778", "value": "6144:xP57l+0QZZ/81+ggMdE6sbpfvTpfyMYd75QjEIeo5cmZ1YW+u/mCgu5EYfhE3KKc:xPNl+T8kgVdE6slnT4PQjPe7Tu/mCJEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779174387, "uuid": "cf30e2b8-9699-46eb-a749-c8f70466cd16", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779174387, "uuid": "142080e0-5195-43eb-bd3e-1b419e065964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174387, "uuid": "21ebb2bc-d52b-4f12-80f1-37bf39881f36", "value": "zfgeto.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73a61ba-53b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219280, "uuid": "d5422f0f-f87a-4e41-83d6-2ef847caad0b", "comment": "Malware payload (Mirai)", "value": "6bafacbd61b68f799c0bea4f713d4abf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219280, "uuid": "7f0ca95a-129b-4906-bb42-7c9be7dcbb08", "comment": "Malware payload (Mirai)", "value": "5150b601a6265d4c1a92098b9e68fd7e939a3e568bc23062fec8603b6f1b195d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219280, "uuid": "9e427d5b-c7a6-4b4e-860f-8fd76220610e", "comment": "Malware payload (Mirai)", "value": "a9c825e1aaf9de1b1bab89850a195a1e1520d855", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219280, "uuid": "d7dd1e45-0b78-4102-a617-660e9222192c", "comment": "Malware payload (Mirai)", "value": "41101d04312faa5171246d0e8047cc046f732e83a9b88071fc36ca09f61d38bc83fa782e9c5fab49aa68d9d004f99bd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219280, "uuid": "e7ad16a7-5f20-4416-b6a7-fefcaee0cb44", "value": "T16DE319CBFC00DDBEF81AE73748130909B230BBA145924B376257796FED3A1990567E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219280, "uuid": "7bd7c334-0aab-4706-9edd-fc522008b23a", "value": "3072:QUJsmFWdm7qc35GD4Wn2FCBjTVOjbisLcBGxKtDEzyX4Hr:AmZb35GcW2CBj6LcBGx3yXer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219280, "uuid": "f48f3b86-bbaa-4858-9272-c29a5e083009", "value": 148076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219280, "uuid": "53a3641f-5bcf-4396-9083-6f92596ff772", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219280, "uuid": "f2f33e55-614f-47e6-9c96-1583bf5e1562", "value": "micro.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535be0e9-53a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779210495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779210495, "uuid": "d24422b8-c835-4bad-b138-ef4171972194", "comment": "Malware payload", "value": "48f1d2132e80f9d1f079e9cb236a5d2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779210495, "uuid": "2690c95b-b04e-47fd-a9ba-4171b4e298a5", "comment": "Malware payload", "value": "53671d85884f0f0969cef79c889795d624cd98411280bdf22d1c68e72c1717fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779210495, "uuid": "dea71c60-08de-4e2b-afd9-3388166dcbbf", "comment": "Malware payload", "value": "c0ca264deb0428ad1e167aea0c610b4bfb0ffeba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779210495, "uuid": "bb6683a9-ad1d-4775-8865-fb49196b7698", "comment": "Malware payload", "value": "3e6c2ee1d54dda9f9d55a48dbf2bc3aedb6a6e0f3844d45ba9b666cd427407d6f6c94d6496cd665e10ff3d33aa5a0bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779210495, "uuid": "d861ed3b-9618-406a-a402-59be39987793", "value": "T18265F10223EC9F58F8BE9B795175051887F5B11ADA26EB2E3D9C80FD1962B41CB42373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779210495, "uuid": "5ab3da1d-cda8-4371-a40d-454fca50a136", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779210495, "uuid": "50435a93-07db-43dd-9676-f9cc557618fe", "value": "24576:J3brfQUoZNKedcYIesRiVZus+TCuX9S9FbCo63oyfJuz0ay+3Xx:NrfPoCeQsQ9FV3oycDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779210495, "uuid": "56388a8a-0689-41c6-b523-dcb41e40d252", "value": 1469952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779210495, "uuid": "24896e52-64dc-4fd6-b5ee-5101fddabcda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779210495, "uuid": "e160a240-281f-433a-8148-294bd29b8099", "value": "PO NO 6000023770.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8587c495-5316-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779149161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149161, "uuid": "b7438a50-69b0-4d1e-af06-796bc67defb3", "comment": "Malware payload (Mirai)", "value": "35cbc4fe9a7c5cc00d9e25d6ccaef203", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149161, "uuid": "8ceda0a7-4619-421b-83cc-abd5752a7ecc", "comment": "Malware payload (Mirai)", "value": "541f56f389a9c330f0963c9c8ecef39ee4860bf817ace2862acae4c97d837cca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149161, "uuid": "56f92825-d555-4cda-97d1-a5e12787dd0a", "comment": "Malware payload (Mirai)", "value": "194f83e5869d7d4d280035a119cea0834480f0b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149161, "uuid": "6746ef4d-c2c3-40c1-aa35-2905b7e5188a", "comment": "Malware payload (Mirai)", "value": "a5f48e715c4ca9c0d57c66d5d9802a5e89e23859b3a4af3c42f8a6aac8d8c4ba0dd8d4857a430d37a0a3538cdbd16d74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149161, "uuid": "4b252047-e693-4b49-a9fd-4e32795cd866", "value": "T1E1549C57EB068C6AC15606F84E8B074D1773C0005F1BDBDB7A2C7A386E936DE9C5A781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149161, "uuid": "276855c2-ea0c-4a7d-9695-a908a1ba4a5a", "value": "6144:p8wQXJ2eJ8683DEz4VhCwACodq11WfsI0zKrmOO4+:ARFY44VY3dQ7KrmOO4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779149161, "uuid": "336c72ad-f852-4a78-b6f3-56be08ae5510", "value": 295312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779149161, "uuid": "562c3a31-2df9-4598-861c-3f792f744d88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149161, "uuid": "a07a5b1c-6011-4a7c-a0df-aa5cc4681b89", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507eab8c-534b-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779171836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171836, "uuid": "554a54a6-2278-422d-b82d-2ad7794c6088", "comment": "Malware payload (MassLogger)", "value": "b364b5f9db799aac3b5fe7b5b1c2f7e0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171836, "uuid": "837dc7d0-f990-49e3-b68d-0de4a1004fc2", "comment": "Malware payload (MassLogger)", "value": "5480921331f564a80a1e4d1811010328bb20e1b8a0dcdd771e928a9874f52cdb", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171836, "uuid": "a3340a99-8b33-42ad-b73f-51eadd67c66d", "comment": "Malware payload (MassLogger)", "value": "b36b5cf890278032049c7d43d3f8b461ecbc2550", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171836, "uuid": "c670a430-b5a2-4423-8542-cfc7215bb050", "comment": "Malware payload (MassLogger)", "value": "abc632ad821579d63b19da3599d8a790f23ceab9462ef49d08ce57bf60b2b181165d815b3d01051c36966bc9f6ab85a9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171836, "uuid": "3e691d58-bb57-4fee-8940-7a523e8b9339", "value": "T15DC5ADF21C09D6A54FFAAA03CA5C9F362E49DDC0B0C1DB8726106E945FE39F904F6664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171836, "uuid": "b2874491-7a9d-4d99-9100-a0650835dc36", "value": "96:E5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5n5nt:5p74bPX7LeCPX7NC2S7+cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779171836, "uuid": "f5433d18-49b6-48b1-992a-6d63eb8f4a4e", "value": 2559765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779171836, "uuid": "4afaa307-edbf-4808-a8d9-f3c0d2c55e77", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171836, "uuid": "8514ba3b-1881-4838-b82d-064a31bcdc08", "value": "dekont.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62e3ee0-537d-11f1-a769-42010a9c0008", "comment": "Malware payload (ApexTraderRAT)", "timestamp": 1779193454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193454, "uuid": "038bc34a-16e7-40cd-b42d-47388630ea0b", "comment": "Malware payload (ApexTraderRAT)", "value": "56f4d6d304d557a776f77168365da246", "object_relation": "md5", "Tag": [ { "name": "ApexTraderRAT", "colour": "#B3C05E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193454, "uuid": "521de2ce-80a0-4750-bf60-724c08d04eb5", "comment": "Malware payload (ApexTraderRAT)", "value": "56451c81aa5eee2501515bf839299ad5302b5f6b80a727fad4880ed36302b957", "object_relation": "sha256", "Tag": [ { "name": "ApexTraderRAT", "colour": "#B3C05E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193454, "uuid": "ad1d2b27-9bbf-4817-a727-e0e564651372", "comment": "Malware payload (ApexTraderRAT)", "value": "b47e74bf8536088a9cfd6f42672c7f378143f602", "object_relation": "sha1", "Tag": [ { "name": "ApexTraderRAT", "colour": "#B3C05E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193454, "uuid": "628e02ef-8c82-49b1-881a-dbbdb85ea083", "comment": "Malware payload (ApexTraderRAT)", "value": "4a2f9c991614b2daa1fe6a510c3b710467fa03a48be9c38bec4270ba0f4efca8ca945c03ed56bf99ce5526bd844f0a82", "object_relation": "sha3-384", "Tag": [ { "name": "ApexTraderRAT", "colour": "#B3C05E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193454, "uuid": "521d9009-c693-42c8-a208-e7bcc8c3ef4b", "value": "T15A654B47F26399E8C56BD034866757B2BA30B45901387E2F1E99D7311F72E909F2EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193454, "uuid": "33f0aca4-1713-4f62-bba3-e209f57f0664", "value": "85a8703c69c031185346604b58ff06c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193454, "uuid": "6d13d151-c867-4943-8845-5dbeda34caa2", "value": "24576:QXQbjwYvx31kuVRAGXWe48/ginzDMYIb2tZbFCUU13zk4v:CQbjTvbkoXWGginzDM7ocO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193454, "uuid": "3f2bebca-b49a-473a-b278-4a4c3f262959", "value": 1474560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193454, "uuid": "61022ec2-200a-475e-9822-2d711a8c901c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193454, "uuid": "8000bf6f-f2dc-49cf-996b-3fbc1baabba7", "value": "56451c81aa5eee2501515bf839299ad5302b5f6b80a727fad4880ed36302b957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18387ae3-5368-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779184197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184197, "uuid": "490789f6-5f6b-446b-a4f8-0fdc194b552f", "comment": "Malware payload", "value": "81604803c635ecc39cdaeb4c0da1474b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184197, "uuid": "c9c22662-d676-405d-b337-2a2fc2c2efd4", "comment": "Malware payload", "value": "56d8a5a33ed1e2be85637b05d07a0b0db04a8565fe7a2616a2c6e9061699dac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184197, "uuid": "fb92c568-35ef-4151-82a6-1f57189be59e", "comment": "Malware payload", "value": "a18bc249f9e9731cbee2bcdab3a9a84e503df0cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184197, "uuid": "05541494-c4f6-4a9c-a872-04e35ad0a3ca", "comment": "Malware payload", "value": "c12abb5bf973a75a39a27273ca085aaa141784ee671a2de8e799132170012798a607dba415f8eed63db73490f28f28b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184197, "uuid": "f26da060-e592-4e10-b78b-d00195506f1b", "value": "T12D08333FA15F283EE5A95A3436B793105A3B6D61600B4D2A95F0F90CCF361B05E3E74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184197, "uuid": "aa85021f-cacc-4a81-8b93-1710e5b193ef", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184197, "uuid": "7ae67276-6ffc-483e-9529-7c0680190434", "value": "1572864:xoHY9GNgtZ2GJBehlLDuZ6t6qGZFYMiQ/zBVKyNEHqB6bzJ+6:649n2GbevDnQMM9/zB4yCHmG1+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779184197, "uuid": "3ec0cb93-4740-4b36-81d0-88eff3320835", "value": 80500592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779184197, "uuid": "e1e62ef7-0431-4f92-8c1f-c902ddcd2a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184197, "uuid": "e444fbf7-220f-4716-9c3f-94844095cbd0", "value": "56d8a5a33ed1e2be85637b05d07a0b0db04a8565fe7a2616a2c6e9061699dac8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9667d8-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219557, "uuid": "98ccf8ad-a25d-4a99-916c-badc608e274b", "comment": "Malware payload (Mirai)", "value": "71b4ecfa92a1c5e3821ff425a73f938d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219557, "uuid": "4108ffc6-6155-463c-9ec4-e07cc1e5c815", "comment": "Malware payload (Mirai)", "value": "58141edbb86d6be31b936e4879850a155295fa87606b83fcb46fd5abeb4629e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219557, "uuid": "0449d353-d0f9-4992-80a8-eb421e425836", "comment": "Malware payload (Mirai)", "value": "a594470e2c480c529b136866c8e6f10f9e1c0301", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219557, "uuid": "db46e4a3-c161-4709-af57-8b260e8bb67c", "comment": "Malware payload (Mirai)", "value": "4f385afc384690eeccb4c738106c843e6c81ce9c030f6915e2021fac91cc9e013ca72bd0d5a3c707ba4ee440203bc583", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219557, "uuid": "cb63751e-bc65-4abd-a59e-8532a0680f97", "value": "T1BB530263C9032878D7237A77B7E04FC3FA0D8B32B699643A21517194FAF457128612DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219557, "uuid": "1277cefe-072c-4617-91e5-6e7bead4b3df", "value": "1536:O7XduYshWhq/HIEy6Og3Nwz9hAy9zLSM5Tfv83KJGTb6R4N:QdpssMPR9w4yxLXTX83K0Tb6Rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219557, "uuid": "ed9aa296-a5fa-40a0-b374-ebcb8a433947", "value": 61848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219557, "uuid": "bab5793b-c6e7-4adf-84f1-8d2324a1de92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219557, "uuid": "bf318443-4fdc-49fb-a98b-a27e4fb4d9a7", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9e3d13-5320-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779153656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779153656, "uuid": "2f2b5ddf-7a6a-4337-a22c-9a1113c77742", "comment": "Malware payload", "value": "722a1fdcfb0d870f894971a611361600", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779153656, "uuid": "73a89778-e9c3-4d36-97b4-457ead70e3c9", "comment": "Malware payload", "value": "588c2ffe0c88c064bd9aad488d475f01f2b4839843976d0355536ee2d1fbb62c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779153656, "uuid": "8266a8a6-610b-4ffa-8ede-849d346d2863", "comment": "Malware payload", "value": "a140cf940e98d9641a08f9dbbeaa804809129fe8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779153656, "uuid": "b26392e3-4ed2-42fd-8d7e-c29b0e2327cb", "comment": "Malware payload", "value": "088a663914c6d9df0ca45eb6b219c243d8cc581c415b3f898d6b11405be93acb58e16406e0f82cc4a722512302435d31", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779153656, "uuid": "ba269e79-de3a-4694-93e9-7cc7450d2d48", "value": "T11A1463D04ADA01E6971A5C79CDDF18003DF4240B2D6EEAB03EAEA7403F76D1D87616E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779153656, "uuid": "96c81c51-a3ef-4520-a4e6-a938c6c6d354", "value": "1536:PhZ6hkX2SWC3//fKuGWfluUv6SO0Gm6VShCm5+TH1GK43xXW46PusoX0A4Vz6ctt:zJ3hioEhfUAzWqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779153656, "uuid": "3a810d6d-eaa3-4ee4-a93b-d6a997a6d697", "value": 200697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779153656, "uuid": "9c91ea7e-e2eb-4718-a849-0b055221ba8d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779153656, "uuid": "e2c121f4-e7a8-4dd0-b824-c90ab08138c3", "value": "Quantum_Photos_Canada_614.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5527313e-5363-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779182152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182152, "uuid": "8e1d7c27-0e7a-4300-81fa-4d62afad9234", "comment": "Malware payload", "value": "becd166adb9b381ec2b86382e48c6356", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182152, "uuid": "7b4015e1-04ab-4678-b65d-56a239cf36a4", "comment": "Malware payload", "value": "5a89127d0a576046555f4445f065dc60daa6a068115a37edae5320c015939f63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182152, "uuid": "a6caa2c5-acb0-4274-9356-e84042dcfd02", "comment": "Malware payload", "value": "1813d7508b7b75325a3562e35db9b31133e4945d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182152, "uuid": "ea2b37c1-f6d3-40ad-8c1f-31dc19c99ce2", "comment": "Malware payload", "value": "9343d524b8ea6d6a6910c4fbb550c4789d98de8a25959574a95b490ff2aaab8c7c8378a7340b72403b2fd167b1b48b0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182152, "uuid": "38d76d68-9901-480f-8d97-e5ff6d0300db", "value": "T127016D1527CA2F53CF8FA3F715A68725A7E1FC278E639787B21469A09E162C13D20A10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182152, "uuid": "6b6de3ea-f2b9-465d-bc9f-de95f4f93bb2", "value": "12:BByWXzzDFmFmFmF/EDxgi8QU38XfqbilKXQK:3FTFmFmFmFgfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182152, "uuid": "981d2d02-96e7-4f90-8f6c-8abcf17f019b", "value": 725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182152, "uuid": "0bdfca04-580e-4aef-915a-f8403b7579fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182152, "uuid": "c5dac766-7746-4772-a51c-d5fb59f6a430", "value": "dlr.pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1519281-537f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779194413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194413, "uuid": "d4cbac53-7bb6-4fb4-8272-151b5b750697", "comment": "Malware payload (Mirai)", "value": "c3d4f582985cbbb65329ced25b4b9cda", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194413, "uuid": "82b8bb8d-d130-40fa-8517-337dc265aa47", "comment": "Malware payload (Mirai)", "value": "5aa73ced970379a966d96c95211d9483f1d75c52070acf25d08f874aa999f65b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194413, "uuid": "805c9699-1028-4f04-8ee6-50ef21f20e69", "comment": "Malware payload (Mirai)", "value": "4820ee8b6f699b6e0844476252cb166742dcb291", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194413, "uuid": "010151db-f20f-472a-984d-f7b15645ba76", "comment": "Malware payload (Mirai)", "value": "934e836ab388f6a9ada34f3a75ae4cc4c386f84837f04fae3ea4b1cf0535f6652f22e15fa67f9a6e3c11d25eb3942f1f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779194413, "uuid": "be4d556a-f42a-48fc-a735-5773cb2599d1", "value": "T107513CC712E155326CB7BE23FEB9CE5CB1C1559218E63F2899DC34A596CCE88B044B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779194413, "uuid": "7329cfff-ff43-4363-b45a-ecd8cc2f5282", "value": "48:ipjqjhmlpjgjnElpjxjCXlpj1jePlpja0jazvZlpjaWjaFvjlpj9NOj9z4gelpj5:iImlMEl+XliPlEDzvZlEZFvjlP0z4ZlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779194413, "uuid": "21e4c855-4bf2-4cf9-a13f-cd2a84b7249a", "value": 2929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779194413, "uuid": "a92266b3-5adb-46d6-9128-cd2606042fde", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779194413, "uuid": "e88de053-5e2c-4fd8-a638-e965f4f851ff", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c622df-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779168382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168382, "uuid": "f4c44a22-043a-441d-bbdb-5078ba296025", "comment": "Malware payload (Mirai)", "value": "0a2d250392a91d61e075500aaa8568ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168382, "uuid": "b99f01af-df54-4978-9c5b-4ff2eef99168", "comment": "Malware payload (Mirai)", "value": "5b116872e8d538263b7301996bb0f7b7d3cdfb335ac5f3ca73241e4326dce213", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168382, "uuid": "c2e852d9-e80f-4ad0-af7e-97fcea70736f", "comment": "Malware payload (Mirai)", "value": "ff4d4f75f46a419978b7753d2316b3e67e755897", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168382, "uuid": "d3831918-567a-4fa0-a06b-fa270416d795", "comment": "Malware payload (Mirai)", "value": "e056f9c5f051793b2e3d53273b5cd79dd24bb00778b8c8fdf36d4efc062bd0fc97c77f6c66dc6130fd23d32915a4e482", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168382, "uuid": "830cbdcf-2880-402e-8a6c-6b6579bed91f", "value": "T14162D5217223E9BBD449A7BA85C34321B5B1B91A4A57272387327E788F377C03877B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168382, "uuid": "522474b2-9d3c-4cde-9596-165810c40f44", "value": "384:/MI8QqsX8GE5AIwUw0X9z6JSW4rODDIDY:/M7Qh8GE1dw0tzrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168382, "uuid": "b274fbb5-27e6-4486-bb77-0c269d516c12", "value": 15672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168382, "uuid": "129fa139-47b1-4368-8800-40147f15ae80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168382, "uuid": "ed4617da-ab18-4e18-ba00-0eae092eb925", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2276e3-537c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779192879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192879, "uuid": "99fedbb2-3798-481c-88b2-4accba631dd5", "comment": "Malware payload", "value": "0ba251b9e0ca0d93954abbaaa9365590", "object_relation": "md5", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192879, "uuid": "c349c2c4-cd3f-42fb-8c9c-244086ad72aa", "comment": "Malware payload", "value": "5d2a2c2695bc838b3d43c8d300427111005186f6e9dfee24bf8a8136e705bcd5", "object_relation": "sha256", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192879, "uuid": "8f1387b7-430c-4c38-b04a-51a9da5ac968", "comment": "Malware payload", "value": "eb5130cc5cd847568a1bdf23d917734e025ecc53", "object_relation": "sha1", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192879, "uuid": "e8e80213-6c93-4ccf-b64e-6c22f1f0e385", "comment": "Malware payload", "value": "f8d9bfd6997a5035fb2b7ddb0b99c03373ad6622ac5795bae05fb23c33f92bf2c7688942342ccfbc4d52a3cb346a28a7", "object_relation": "sha3-384", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779192879, "uuid": "52004ac6-77c0-45fe-968d-cf40d39a97f6", "value": "T155351029DBE90319F5F38BD0BDB44452A83EFF66291DC95C1190068D0672A0DE9B9B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779192879, "uuid": "fd3adbae-0e9d-4695-b758-c0359ae59888", "value": "12288:aFMY0Prb+UcJajWZSO9low60/l+qvgBf9JxEczh9vEj:aFMY0SajWZSeYjPHPvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779192879, "uuid": "f5a763d3-83f6-4727-91bd-80e491b3e8ad", "value": 1076938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779192879, "uuid": "67a7277f-266e-49b6-ae00-82bc465bb7b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779192879, "uuid": "b6da4d43-afbe-41f2-b2cf-798fc2145de1", "value": "PO-000806758_Bita_Supply_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29f2e8c-538a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779199166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199166, "uuid": "312dc16c-84d2-431a-954a-e7bb0909bfe1", "comment": "Malware payload", "value": "3dd1087ef88df2a5efd91f2d6bd2fc37", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199166, "uuid": "e2554c90-53f6-476b-8585-1df5ef9829eb", "comment": "Malware payload", "value": "5dfd481f28167c106af570df03893518d0e63d2933f7226f382c255336bf39da", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199166, "uuid": "d1e1bb77-69ad-470d-ba03-6011d69804ca", "comment": "Malware payload", "value": "352a593e4ce381d6bac66b92bf7730af3630da5a", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199166, "uuid": "6e6da7c3-9d2a-4ef9-82e2-93fd1bc611b9", "comment": "Malware payload", "value": "884a73228622dd2ac292db85c5ef4aa854ed29079fa08937ec23d0600270443b08189e6677d0036fe716bedd321dbb21", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199166, "uuid": "8139ff9f-1dc1-42e6-8a69-da2af3147800", "value": "T1BE144F5C89FB1052E65F2D254BEF003237E2A9432968D8407ABF73904F3ADDA12967D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199166, "uuid": "65489f93-1f08-42ea-abe9-7e3b3aeb1786", "value": "1536:3JOkFR2M0aYzofBvT7gJSuy35yZXV+3u/GATePtA/yhmYUV4mxHSY7mF6ORRIUMt:wovuugoY8L6u3j1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779199166, "uuid": "8218ff3a-dd03-4864-876b-fb6fba9b0c68", "value": 196144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779199166, "uuid": "99159104-c71a-4a92-b89f-d0dca1b4f1d2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199166, "uuid": "0b07a250-e1f6-4037-9541-0713e51f5984", "value": "Summary_Primary_v4.5.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a403e3f-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219580, "uuid": "77e7173d-f237-4b01-ad48-fd2d5aeb19b1", "comment": "Malware payload (Mirai)", "value": "8bfbd85820bd53864f6667b10efaedc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219580, "uuid": "d4715d30-2ded-4b51-9eb2-ad9b6e1c5502", "comment": "Malware payload (Mirai)", "value": "5ff64d01f9a228513b92ec590444c68223be800ced2a1387f0f1f23e138b5a32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219580, "uuid": "7aeaed0e-120e-4b8f-a5fb-c6656375c0cf", "comment": "Malware payload (Mirai)", "value": "f39e7ead41cb18b24aea68768c0fe7a4d02e9c63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219580, "uuid": "d0e40e41-3e79-4dd8-9eaf-611f395cb6a3", "comment": "Malware payload (Mirai)", "value": "e13821b31e697be37373d7296b07397ddecb305f6c96ec21adb0312563cc53111ca10e3935826f7b704af2d24e872f40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219580, "uuid": "7a612793-cc2e-47a5-87ce-594ab1a83441", "value": "T193733A55FD814B23C6C1123BFB6E068D3B2653E9E2EA72039E259F2133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219580, "uuid": "6c3d8ac0-b851-48b9-a41d-e97196b36011", "value": "1536:OZWLxW3i3jV9ZJpcO72Rbu1U+qhxp8f8vNJ:OZWLnJpcO72RDRZNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219580, "uuid": "6d046d43-d88e-41a0-94c4-f3bf68da9744", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219580, "uuid": "1df0810f-c90b-4406-8724-b8ddbb6b047f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219580, "uuid": "b9982f4b-1bf5-4e29-8409-bcbb37c0edcf", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81679e45-5328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779156886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156886, "uuid": "369b2bf5-a10b-4eed-99c9-9e63090afdbb", "comment": "Malware payload (Mirai)", "value": "fa4d4f98ca93f3845024f13291e54e77", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156886, "uuid": "180a035f-55e4-4bfe-8ebd-fe83c51c3e64", "comment": "Malware payload (Mirai)", "value": "6005a4a07e70f8cd542bd56b0b849e54ac7fa5828a0c008ff95148fec141c798", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156886, "uuid": "21b0e5f7-550d-452e-816d-0eebf0bb173b", "comment": "Malware payload (Mirai)", "value": "82750654e7ae46088f54a94b6bd80722085779ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156886, "uuid": "0aa4fc4e-8288-49cc-ad16-465857a63282", "comment": "Malware payload (Mirai)", "value": "ae12b5969ad8bf66e48f27613458b3016c6c1d72d22bbdafa7d9eeff7a2f1758490f716589b7d685ed85903b9ac91b14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156886, "uuid": "9eeac426-8411-4814-b3a4-3425d1fbe549", "value": "T10101FE62A54303A6C190B135DB3DB3329366C057192DF8A83288FC124F5CDB86CF165E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156886, "uuid": "326b1a5c-d37f-4866-8623-10a78ff22fd2", "value": "24:EmzwXHHyKVGZCgzC0NfsExsdsHVbBhEYDW3lzYDW3X:EKwXHHPGZDC0NfsExsdmVbLEYK3BYK3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779156886, "uuid": "5171843b-ed18-449f-98b8-4facedf4cc7a", "value": 793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779156886, "uuid": "e6110921-9f62-4495-8ab2-925c554e68dc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156886, "uuid": "23ca74de-9e51-4bcc-b7c9-632a8941ebd1", "value": "bz2xb9.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c6ccdc-53c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779225673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779225673, "uuid": "4b0ae149-a3f2-4c32-b272-2a8c4f08ca58", "comment": "Malware payload (Prometei)", "value": "2a64c35e65ffa24801595310e4e4bf11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779225673, "uuid": "dbbfa8ae-6126-42f0-978a-feffdc747967", "comment": "Malware payload (Prometei)", "value": "61194b0afbd90ad65a4f509c10dc6afe28f7588c01f04aadbe7cc80cb8fb9894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779225673, "uuid": "ae9e05f2-fcd9-4c1e-9d41-46474182cd1a", "comment": "Malware payload (Prometei)", "value": "6381033273f6e6bd2cedf6684e918abee641b108", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779225673, "uuid": "8bbaa19c-d00b-455c-8d86-a80322a0aaa4", "comment": "Malware payload (Prometei)", "value": "5856461d651ded986a0841a4af72866fb6e03c2aa9eefcf80df93605358f68522a063f008ffce1bf41a3f3f173574f58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779225673, "uuid": "0fd53722-97cc-4793-8738-50955498fce1", "value": "T1AC9423F4D3779B9AC5872A758B7AE381C6747D555BC70849B3ADE9330138322A750C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779225673, "uuid": "8ec82e15-6e83-4a46-aec6-6117ed4e4ee7", "value": "6144:3584cmYYMg0EzyNP34/Aam6xbQJPlViUWxUzgFjVyBXH/0r1HTUcm6hEB:35843YYXyi4am6OPj7WaaVyJH/0ZHTBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779225673, "uuid": "03917df7-dfe4-4efd-a318-9a39fbdae7ed", "value": 436142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779225673, "uuid": "2df80109-13f9-4022-87be-cc567226d12a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779225673, "uuid": "90f3f306-50a8-4769-9d6b-1f9edfb3764b", "value": "61194b0afbd90ad65a4f509c10dc6afe28f7588c01f04aadbe7cc80cb8fb9894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ec36fd-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157249, "uuid": "2f817887-98d3-42b6-940f-7726949178a7", "comment": "Malware payload (Mirai)", "value": "648a136f5ec6c7e960a1b107f4c0cefb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157249, "uuid": "62944454-812a-4a87-aa81-95d63d4e80ee", "comment": "Malware payload (Mirai)", "value": "627cc90fa904cce1ef93c46100d9eefe326674263a4aeb95ceb61f3be5788c9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157249, "uuid": "ba449cbe-0136-4d9e-902d-0562c53646c7", "comment": "Malware payload (Mirai)", "value": "acbe614e6b925a7226e0971a92cfeefdcca7c859", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157249, "uuid": "a222a45c-fc07-4042-b134-46c52422d9d3", "comment": "Malware payload (Mirai)", "value": "1bfd50653a6d261a84ff36f952de9ca322ada843f1bbcf5cb88cb3f07abf61b70cb7b7e49c7b8cae2db4166de4c8d662", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157249, "uuid": "2d78ea0d-a5ec-4cd6-b69c-6f7771461aa5", "value": "T124035CC8B903DDF8FC1606F42136F77A9BB7F07A2128DD9BC39995329C42A05A5062DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157249, "uuid": "216fc0e4-3a76-49f1-a058-821fcdbf4ddc", "value": "768:wZT8epBPi4gJW0KMcjp49A9/YuEG7pBqjPi2EgouBnk6PyJiE9Ee4V:wZIezPi4gJW0KMgp49Ax8aBMPi2FxBnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157249, "uuid": "22375aa9-9f4e-4ea2-9f48-7275f07c5caa", "value": 39356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157249, "uuid": "40b1188c-5be4-453c-88c2-3822eb52af68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157249, "uuid": "35b8724d-010f-4b45-9b62-99e3547c2f32", "value": "upperx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edce032f-53d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779231800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231800, "uuid": "71440380-947c-4251-a629-66074bba369e", "comment": "Malware payload", "value": "76d936089bcfb40a7b1f8b0d264535ec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231800, "uuid": "ee770d72-d625-4771-aa9b-d79c9b3efc34", "comment": "Malware payload", "value": "63b7697d4d637585da8de4d8672f7cb042c02c6e37c6421d938c976ad5ad5ace", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231800, "uuid": "00e36269-9b47-4889-95c1-533d0a01681a", "comment": "Malware payload", "value": "5abff5e1cc5b3a1f9a993a09556ac1448d4d0446", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231800, "uuid": "77629fd1-6004-4d56-ab92-2221ebbce851", "comment": "Malware payload", "value": "9dcf3f2754279326cf2a68f5ef3e9e43099c5c2f6f6407b253d5b83ec3d1ac32efe56b8e3c18e31b0ec05f81c4d5d8bd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231800, "uuid": "07e403a4-82cf-40fd-836f-6c3dd18bfa50", "value": "T150B25D0FB8154319D4E100B092619F7BC9B9A9B33788A8DBF38044CD5A686D6FC36A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231800, "uuid": "f6755bd3-b888-4271-890c-ddd8bd67870b", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231800, "uuid": "816d099c-8897-482a-8d8b-f7d795118f6d", "value": "384:iMthb/HJnv+UL7exaxdlLHMwXud2YLNL97cpHB9z:iMt1pewdJMw+dxc1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779231800, "uuid": "108f0ea2-02fb-4cf5-8900-ec69b912c614", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779231800, "uuid": "8002c8f9-6394-4224-bcc2-33a773da0382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231800, "uuid": "d48fb7e0-5216-44dc-8a35-5d04af4fbd16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37182cc4-53ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779213884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779213884, "uuid": "b57e539d-f3a4-410c-9a7a-2ce2be509ba5", "comment": "Malware payload", "value": "d5191c63df7b0bede31e5464ebc3e465", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779213884, "uuid": "e816b656-5a30-4824-b0c9-15a79368deb1", "comment": "Malware payload", "value": "64a9263148d49bbabaf13b68fc461c93275d5d7f852288ccf00d1b25e39069d3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779213884, "uuid": "1e402635-c2ef-4b36-92e5-fe47761695b9", "comment": "Malware payload", "value": "c6cf8c72590415c21d8e11ab552f1c42272580f2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779213884, "uuid": "54f8316e-d3b5-472e-b81e-d8ab26886035", "comment": "Malware payload", "value": "2b76f394baea60310eb0b3dc0298a0bc763c7880dc46aa5422b98f7e90a2f8e950b57652543c7e31c29cf7122667a40d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779213884, "uuid": "36ca9515-1433-4151-b590-6daf0d64a514", "value": "T10DD5F086BF58A52FC8B704320FAA937536578D168E839B476558372CAC736C80F59FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779213884, "uuid": "62374f03-a374-4623-a06b-9a0981d5a555", "value": "49152:q7bmrPufnQ5uZPwCi1e43tfTNEhERF8+8dK6VyTKLxhmUDCS4kwL2OgxJ3r9WG1:cfnEuZye43tf6mF8+8dK6V2K/JeSdJ3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779213884, "uuid": "a44e720c-540a-41ae-950b-c7aa49a07bd2", "value": 2944053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779213884, "uuid": "e3083986-33aa-4d47-b0d4-46b4de873845", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779213884, "uuid": "32c1bde8-5cdf-48c9-996e-14787f7dfd3c", "value": "64a9263148d49bbabaf13b68fc461c93275d5d7f852288ccf00d1b25e39069d3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2abace-5393-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779202757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202757, "uuid": "c837ef91-7f99-421e-9b71-195b20f5cd3d", "comment": "Malware payload (Mirai)", "value": "76b8eb1176c13e67caec418184f9e6b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202757, "uuid": "e04ee99c-d84a-445d-86aa-a6bd1e8a4e90", "comment": "Malware payload (Mirai)", "value": "660289e593ff8180cca4bdba9f1dfa51a3139d450f2ab81ac5f310ce31ffc24f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202757, "uuid": "7b4973ab-ef6e-4818-9640-dd3af704fd8b", "comment": "Malware payload (Mirai)", "value": "cbc0d40a6c72f5ff773cfbc3e2c318174d56b87f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202757, "uuid": "f71f9b30-0ba6-4d12-b1fa-4d493ecfda18", "comment": "Malware payload (Mirai)", "value": "e91a016269042aefba20f202d0c546f8297035dbfb88a4c0e6e3f4a7e2e20c87916bba75da893d9fcb8ad9339089f521", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202757, "uuid": "7343c08c-abac-4b16-8e17-9bc0efd6927b", "value": "T123631B52FE429F03C5D221F2BB9F05583B16AB6DD5FA3242E935BF9027878D60E27211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202757, "uuid": "a76d200c-89a8-4439-b659-e4188096ae4f", "value": "1536:vibXbA8Eb7h1J3a+A0i0J3cWa12hISR/w5Fj:v8Uhn3a+xJD2Fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779202757, "uuid": "509d671a-18e8-4fc1-b832-e2041f39674d", "value": 70912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779202757, "uuid": "60c18807-e36f-4fba-ac27-16c77fbb208a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202757, "uuid": "4d75e4c9-5afc-4e2a-8a8a-0da0ac9c0388", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faea0cd2-5366-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1779183718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183718, "uuid": "25e44055-a4d7-4030-a559-dfc25a093d0c", "comment": "Malware payload (WeedHack)", "value": "dc340b044560d1ab89c9ce91dffe1819", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183718, "uuid": "65df0295-ef76-4002-b8fc-7e20b55db723", "comment": "Malware payload (WeedHack)", "value": "66dadee4771e42b0db0237e113cebf65d9432127f26cd631b34855e93e14441b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183718, "uuid": "43b237da-c4e4-4f6c-a6a1-cc1af0699715", "comment": "Malware payload (WeedHack)", "value": "d097fd06460a9608a93d707592248083ab65b41a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183718, "uuid": "51513314-e153-4493-b5a1-a3f9e9162b0e", "comment": "Malware payload (WeedHack)", "value": "4a42a3744155643784de24fd40c5964b0bf02322bc7bae022d0976cb3085ce5456a84cf52cb77362c3ac1dabd479af83", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183718, "uuid": "e450c0c6-f1cc-4768-9775-04d87f0c3573", "value": "T1E94401116BF0C57FE443D1B96F00A2337E7A8988C05E754B65ED8AD20C61AF71E4AB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183718, "uuid": "42c9a202-50d2-4c37-82b0-c9f215809792", "value": "6144:mfjRCxNWBYyEHuPeCHlS1tSbBTCv9qu/HFExk:mobWBBEHvCFS7Sd2MuvSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779183718, "uuid": "ac6e6b47-1890-48a5-9e7c-3fdc8a734d95", "value": 266409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779183718, "uuid": "051db813-2730-4414-a859-1ff52bf26a03", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183718, "uuid": "200d15ed-aa2f-4f14-b5fb-8b04c9871378", "value": "Argon.Addon.1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc3300d-535a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779178515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779178515, "uuid": "0c28bafa-0d76-4916-b638-23d16a6788da", "comment": "Malware payload", "value": "dfed31b5b959591d21de4a44c9c049d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779178515, "uuid": "81efc070-11f1-4ceb-a2a5-4dc50dc3966d", "comment": "Malware payload", "value": "687dbf7841ab9a9b303a7b481633cced1a93fa3aadb9a6499f8d060f1f495a7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779178515, "uuid": "41699cfa-d7dc-4663-89e1-11fde9d2f6da", "comment": "Malware payload", "value": "3e2379e1d40df24f0b051497d1f4f7fc1520e411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779178515, "uuid": "3f5029fc-fbbb-49af-aaeb-8ac89a384d8f", "comment": "Malware payload", "value": "c4ca1846fc1712c5e14075532a8efbe460ff8dcea9df6549fda8df73647c331de9adb0494e46a107aa94c6e28f1d4a77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779178515, "uuid": "7f765135-864f-409c-9fa4-4145f8f3672d", "value": "T1EAF4A0180F94852AC05E027AD06DCA1C4FB57D1AE186E75B9D85FCEE3D72393CA126B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779178515, "uuid": "2137a6c1-06e0-4b9e-9c97-1e2db6073533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779178515, "uuid": "bb296740-486f-41d5-a022-9a96b7574894", "value": "12288:OG/QkB0KIHwoUOzjSCtSDyt3ik7yBKVflAxm1619nwE:OG/OljtCyV+Kkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779178515, "uuid": "d95c264e-7d39-4134-92e8-09651eebb411", "value": 765592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779178515, "uuid": "0c94bc3a-6ef0-40c1-a637-64660b6a5ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779178515, "uuid": "39a6e038-05f0-473e-8ddc-4cdc23cd5736", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8322c3d4-5316-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779149157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149157, "uuid": "797864a4-3ec1-413f-9e51-30e3eb5229f6", "comment": "Malware payload (Mirai)", "value": "6fbef0dd6726cd0f0597d01e8b553e99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149157, "uuid": "0bb27af8-3206-4df7-9a3d-ef57978c3a65", "comment": "Malware payload (Mirai)", "value": "68c29e1f11677884de7adea21f0fbd74c096177d660b7628ec8b28308b78088e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149157, "uuid": "a34d09eb-a37a-4d07-985d-49a9e2adacd1", "comment": "Malware payload (Mirai)", "value": "dfbebc3fd5ab3c8cde21193f91e5d6913c29411b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149157, "uuid": "95bff8b4-112a-4ad2-8a46-b9cdbc1cf6ca", "comment": "Malware payload (Mirai)", "value": "8514d0c5e0812940219b20f4110277ebe56c779f450dc7ae8b414ab9c24272c265cf41d9fac521130556d76f3c6389da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149157, "uuid": "4bdf5501-7602-42be-823e-bfa790ea563b", "value": "T12BC35BC5E793D4B2D8570B7001ABE7394631FC621329CE2BD76CFFB65E22682B446618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149157, "uuid": "7c4c49e6-832e-4168-95af-858d447d240f", "value": "1536:WpMn7QBkX/+wQHH+Eiqnbp6iizypS8g7RkV97dzUJ31Q6tNR5cz+rJ//dct0LiXF:LnEyXsnspii2g0mu8ozWJ3dcJXWfSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779149157, "uuid": "e3c67e10-7f97-454c-9dde-909899145d34", "value": 119444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779149157, "uuid": "0ea5e858-f8c3-4833-bfeb-6e9f2c839dd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149157, "uuid": "c88093d7-4a49-45d7-a76d-8b9fef144709", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32278eb-5343-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779168646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168646, "uuid": "a805ed2e-0210-44f4-9ba1-ee2e7658f2ad", "comment": "Malware payload", "value": "4546646eb0184f23e8e55e641c562327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168646, "uuid": "17ea9fac-fbc2-4296-95ba-0866c4b4ae8d", "comment": "Malware payload", "value": "68faa54487597df3f49b5a922973fe4ae006ac2da9ffa50313b580b89fad4fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168646, "uuid": "400626d4-3071-4995-ba90-40e889960f91", "comment": "Malware payload", "value": "7e4649f8b410afc9d7a0f5ee2aa243cb620766df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168646, "uuid": "dac4f024-b643-42bd-9bb0-8f8c0413b30a", "comment": "Malware payload", "value": "dd4bdd6ed3a251b4f830cdedaa6ca84869f84337577bb587abe67ae931dc853eaf26ac6e92ac6a532d64590c1dd704bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168646, "uuid": "1450602c-a0b5-46ca-8184-2cfc492b615e", "value": "T104164B07E852C8F5D095D93DC57652926A21BCACDB303BDB2E40AAB02F357D0EB75389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168646, "uuid": "ed5fdf0e-d632-45f8-ab7e-769af63203ae", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168646, "uuid": "8ae25abd-79ea-4108-ae86-80cfc28a121b", "value": "49152:tcoMAixvrzXT6PfV08i+1vJVWDcyc0VP:t4bLTh+1LyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168646, "uuid": "1e82bad3-5c2f-4a80-829b-fb3d6cd775e9", "value": 4123136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168646, "uuid": "3967a1f5-6a95-47b0-82b1-a3eee60e2613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168646, "uuid": "86cd483a-80a3-4b0a-a910-99dcbb8f6f4f", "value": "4546646eb0184f23e8e55e641c562327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257fad62-535e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779179924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779179924, "uuid": "34b29661-5fc9-4cbd-87d4-a83fd8e511d4", "comment": "Malware payload", "value": "7e148b9c4728a2ca898202909b1dac75", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779179924, "uuid": "e08a1c18-9f0f-40a5-baab-8c1502ac015b", "comment": "Malware payload", "value": "6af7dd257139760f999bee998bce1ab3a7a8200a5d2e3567832e10851664f583", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779179924, "uuid": "a1ad6d62-87e8-4b29-b75e-33cbecb8c757", "comment": "Malware payload", "value": "fa1262ffa59463696064df3917697755ded125c5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779179924, "uuid": "93282451-f029-4e34-a5df-c92067e84a31", "comment": "Malware payload", "value": "bad78c12f97028bd56ec266ecfe71a696cd31fa4c62a53d2f9ecfcd6e77767479b097cb79b1b821af5d8f1a93eaaf523", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779179924, "uuid": "e98cfbde-01d0-4400-982d-39df4c2373aa", "value": "T141A18E19D099F25BF0076F3EAB28B363A17E61FC854D05478E202563947D1E8850F486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779179924, "uuid": "7eb23e38-e324-4c4b-8c9b-5308fb97f7c7", "value": "96:eiLui3IZqXrTGYcQgBdTqqMnPfxJJozXoIV16pAZ+r5IN8ze9l+fW:zLJ3BOYfkdT5MnPZsz4e4IE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779179924, "uuid": "8ea3dddd-8d6b-4c0c-b219-73cd2dcb9100", "value": 4793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779179924, "uuid": "335edc2d-42c4-4614-b3ca-cdf2490a0b9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779179924, "uuid": "39b63e5f-2d7f-4599-80e2-b0c4c5df6589", "value": "IMG-937160996.png.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4adb1057-537e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779193731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193731, "uuid": "5ed3e555-33a0-41cd-aba8-68809ee5881e", "comment": "Malware payload", "value": "b1bc25000d37b1cff8f63bd82c36b183", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193731, "uuid": "4d4e9ee5-1826-4465-bd6e-75a9bf3ece79", "comment": "Malware payload", "value": "6b46c225b3a2f9ffc7140e9ae7a9e27bb38c28730cfa557b704e4825447f249b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193731, "uuid": "87b24070-70aa-441e-83da-14d1c0ab4e7a", "comment": "Malware payload", "value": "6e824c87067c4ba80c9a2dd7c01b3c833eb77eea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193731, "uuid": "3b6bf3cc-5552-47e3-bf30-432b5563e715", "comment": "Malware payload", "value": "84ef741f1a812b9762d6df70666e10b13bd6ece41f6750c352c9bc0671882944245930a512c355196188b1f0ced96825", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193731, "uuid": "66121312-e27e-453f-8cca-921ee2e9e5ab", "value": "T1E5351DDBBB134AB805722838781BF3D4DB26A080DD025465087BEBCFF36E75B455A768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193731, "uuid": "6d8ec808-b53d-4b55-9295-cc5e973e94a9", "value": "384:j57n4fcqyzkDwf8wayeBy/6JuJcS+FdyI+mGY+ZGzG5vVbWmOJYfymZm00kWpw9/:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193731, "uuid": "923fb640-5bd5-415c-afef-1fe47dcc6abc", "value": 1098088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193731, "uuid": "fde8e1af-d07d-4baa-bb3e-cbda22455e5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193731, "uuid": "a234a1d2-376c-4b51-8931-5270a7bc732e", "value": "DIB_NEFT_Payee_advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf7e269-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157252, "uuid": "aba5daa0-4df6-483d-88ce-824ab13c14f6", "comment": "Malware payload (Mirai)", "value": "269b8889d9614c932e5560d064518f31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157252, "uuid": "135c91bd-8c7e-41fe-8b88-14d60b002c7f", "comment": "Malware payload (Mirai)", "value": "6bc133276ca529863571f49aeea200ea88720827afd2c99450278473cc467c6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157252, "uuid": "0142aca9-9345-44b8-9d6d-b05c88f2623d", "comment": "Malware payload (Mirai)", "value": "c7e67f79a3cc2bbd6a71df18efbaa33967ca2941", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157252, "uuid": "42f59f3a-289c-49c3-8102-4a317f0fff77", "comment": "Malware payload (Mirai)", "value": "71e25b1bb431f19dea7c774bb3f97cafc14da280e86ee22e369cc0b2756d0af3e451cb35b2293239351241049b6af7b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157252, "uuid": "04f8e8f4-98c4-4d88-adc5-01b5bc01185a", "value": "T11F132B42322C0E5BC5A66AB0293F17E093BFE9A020F4F584655F9B868675F371087F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157252, "uuid": "8599db8a-1a46-4ad0-8ec6-0dfe586646da", "value": "768:MsjMsJvYFu14F0WAGuRcTnWrdalcGyhl/k8BbhoIAgdD:PJwFu14F0/5RbplZPAcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157252, "uuid": "bf702e64-2082-4fc9-95ea-20eb5a9afce6", "value": 41892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157252, "uuid": "d1504c7c-5892-408d-aa35-f09e2a460e78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157252, "uuid": "a72d9ec0-f1c9-466b-bbe1-f3123d0be51a", "value": "upperppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a343429c-537d-11f1-a769-42010a9c0008", "comment": "Malware payload (ProjectX)", "timestamp": 1779193450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193450, "uuid": "068cee01-50eb-4545-81f4-80d3808bf524", "comment": "Malware payload (ProjectX)", "value": "9b6d56e15db16d7c333b5098e2688bc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProjectX", "colour": "#DE38BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193450, "uuid": "d529da21-6b92-4d9e-bef5-6eead20d01bb", "comment": "Malware payload (ProjectX)", "value": "6c61de645d8533597fd62b37d99fecc78058831a7c230f108f771c551631be6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProjectX", "colour": "#DE38BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193450, "uuid": "967d23ab-8bcb-4736-b758-fa0ada28c3a8", "comment": "Malware payload (ProjectX)", "value": "f79a1e181e3b366468108bc5362df7494006761f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProjectX", "colour": "#DE38BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193450, "uuid": "2b47f28f-9a00-405e-b195-304ed4efcc7f", "comment": "Malware payload (ProjectX)", "value": "4677c76dbf03c45006b6d62747948137d47a277201cac79819a18508b78d8716dd3e0694de72d49a06e3f649b34054c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProjectX", "colour": "#DE38BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193450, "uuid": "bee6b683-4fb4-4f34-ab6d-fd265ff53d78", "value": "T119F61217E2A654DCC52FC17493A7E373BDB0B4691035BDAE1AA4CB311E31E50A72EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193450, "uuid": "4a0b9000-3516-486b-90a4-a4d36c282e2e", "value": "4eb5c78b35fd365874232d6558752ac2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193450, "uuid": "07297786-f870-4f0d-9f94-473e64395564", "value": "196608:flGqreM8mdmKmdmKmdmKmdmKmdmKmdmKmdmKmdmKmdmKmdmKmdmKmdmHgyJ8ea:zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193450, "uuid": "ff0146e2-33ac-4ce1-8f82-b2c299608709", "value": 15728640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193450, "uuid": "0c74c200-ad7b-4ea0-a4a0-5759554aa596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193450, "uuid": "360bf11a-6b61-4c32-9686-17e34fe4cea6", "value": "6c61de645d8533597fd62b37d99fecc78058831a7c230f108f771c551631be6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1bc896-53c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779222214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222214, "uuid": "254ee151-813c-478b-b727-9ca558ee49cb", "comment": "Malware payload", "value": "9e7e474040503dae44295949a3ffcc8a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222214, "uuid": "95a39ed4-6ef7-4ba4-814b-79275c810b13", "comment": "Malware payload", "value": "6d0ddbde8a5d13ccbe2b900c4733cb32554c6f31ca69958998f3908b1e7f36e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222214, "uuid": "33b6dbc7-8233-4d72-984b-10530a08a084", "comment": "Malware payload", "value": "f6bc620925783b807f9bdf197e201e5dc2caaf50", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222214, "uuid": "9e60d11c-795e-4f6c-a7bc-c28085ca55ff", "comment": "Malware payload", "value": "ced61e63573e185a80da74ef0a5c8b5742a79c8e3c082372d257278b67df6a0565a6d92e7ad32136239bcea4557a7d00", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222214, "uuid": "e824bd13-b501-4fa3-a407-3aa0f9b1bc02", "value": "T17918332431C5AA87D365B6B7A7E164F26C477E08B2D9C1FBD4FCB74D6681A232C04236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222214, "uuid": "b42d78fc-bb75-481e-b44e-4e4c0a1b7a39", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222214, "uuid": "47a1807b-0ee5-42df-9815-59f3dd7b68fe", "value": "1572864:JXY0W18leoHgdg9K05W4NLzKgqGW4qHHH3hrDcOOeysdqTrEIlr7:hYnpS0/05WNgqL4qHn3hr4B+oTrxlr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779222214, "uuid": "58e8ff9f-103c-4eda-9538-0ff51144477b", "value": 84939938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779222214, "uuid": "2ca127a7-6673-42e4-ae15-5208a7affc52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222214, "uuid": "8e1fb804-b871-43a9-9388-c093fa8f2043", "value": "teste.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f55705a-53d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779231507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231507, "uuid": "f9e55295-e13c-4bf6-91bc-e5b7afab486e", "comment": "Malware payload", "value": "7875adbd9c7df584f331235e49147735", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231507, "uuid": "760dc0b4-abc2-421e-a73a-c137f8746c90", "comment": "Malware payload", "value": "6ed1e5405f45f9489f2b45de5a3126817ee3654507389ca97c5e2eecdf7b8bd5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231507, "uuid": "c8213a81-3447-42ab-a0e8-b896aeeacaf0", "comment": "Malware payload", "value": "d4b429a771cf5ead6834f678c3369c6c4397fcf5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231507, "uuid": "be67f91f-3c84-4e0c-b37e-5eeeb7321815", "comment": "Malware payload", "value": "0c7a2613cdcc2b42d0dc41799d835bcc16b837f38fc324ea759fe9fd0894cfec0a8c96d13163827c70a7e62f06aa1f67", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231507, "uuid": "05568f9b-4969-465d-a623-9e3b3f18aff9", "value": "T1B7136D6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231507, "uuid": "e2f902fa-f3d1-459c-875b-db5b532b5375", "value": "768:er9NyXsZztCKw9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:oHusZlNco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779231507, "uuid": "c58ea91f-a841-4b59-afb6-f75a3c6c2ded", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779231507, "uuid": "d2e870bb-a12b-42a1-ad95-65e8362b71f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231507, "uuid": "6c91feca-bdd1-4b16-8781-bd00c222b3c2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7ed571-5363-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779182142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182142, "uuid": "8055af06-2943-4a63-a294-d12f9ebdaa6f", "comment": "Malware payload", "value": "32765c6399228414dc5b0e350366b2f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182142, "uuid": "dc8f9857-e5ca-4ee3-a874-a642eb780c89", "comment": "Malware payload", "value": "6fa047aee0aceb290625221e15aee3ac7441ad1340e5c7c0bdf40a62dc0f6c49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182142, "uuid": "0c5f5c63-12e7-42bd-858d-b80a8f2e165f", "comment": "Malware payload", "value": "97eaa315027fb25d5e6c080350eb3b3f93fcca39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182142, "uuid": "13b6f048-af0a-415a-8be9-5ddeeec3e662", "comment": "Malware payload", "value": "3d91d35df3135375ac08a0a2990eb2a564948b6d3a19e02c1f447975c4c985d2ffd9f2efe33d1d036476f0acde6a75fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182142, "uuid": "3456a8ca-7d6b-458f-877a-24ed372beb85", "value": "T139E08CE593CC2D22CE24123DA00307200B21E816A1A1AB17134586125C073B51CACA80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182142, "uuid": "81307876-df4d-4d35-b6fc-c1a2ded465bd", "value": "3:Bkkk/tnlklhlRt1lt//th1tl1l1R/Xl04/X+ltllvlmildqCKlQ9RcHol8lE8lcw:Btk/t+lT1o4/KBlxkCKlQKIqn6ylEvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182142, "uuid": "6ddac401-4e1a-4f37-a886-7bcc20563092", "value": 368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182142, "uuid": "b04dd561-39d8-4b16-81e2-eeb9f167cc27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182142, "uuid": "97a12c74-67b2-40a4-ad5d-6d90239b276c", "value": "dlr.parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe64a7d-53d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779231803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231803, "uuid": "f2759779-1bf9-432c-8404-df14dfa20fd6", "comment": "Malware payload", "value": "0ccc357aaabb8db8202727da869c780a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231803, "uuid": "9dc16ca6-75f5-40c5-b7aa-b997582fb3ff", "comment": "Malware payload", "value": "6fce2d53e931b85fcd6da86d64cf1f932bc78bf6715e9716e12ce78b2c7bba9a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231803, "uuid": "aade79a4-2e76-476e-b34e-63430d3343e4", "comment": "Malware payload", "value": "9b7560801390290b0f2a6794f7837e63af0639c5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231803, "uuid": "3e34ea6c-1bc0-4a2b-9b01-74149e715d48", "comment": "Malware payload", "value": "8d71ffd0f77a72faa496f532f46d22060253c3ad8b23c12628d2806886dcb71b7474fcab0e81555249f3b4da01df821b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231803, "uuid": "2ba20e9b-1661-4ba1-992a-13ffbd1605c7", "value": "T17DB25D0FB8154319D4E100B092719F7BC9B9A9B73788A8DBF38044CD5A686D6FC3695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231803, "uuid": "95a122f9-0452-4f4b-875e-0638d71dbb73", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231803, "uuid": "8e28fd04-d7ae-4e18-a8ed-e97d7cb54fe2", "value": "384:iXthb/HJnv+UL7exaxdlLHMwXud2YLNL97cpHB9z:iXt1pewdJMw+dxc1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779231803, "uuid": "5f738cc5-6df4-4ed4-821d-e5582907b469", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779231803, "uuid": "e9fcccbc-0b02-41f8-96d1-5a87f9334c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231803, "uuid": "e7f5fad0-8f2a-4242-8d7c-9b1e7dba0425", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293592e3-5388-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779197969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779197969, "uuid": "ffaaff68-8ef1-4a8a-a441-00439f98dda6", "comment": "Malware payload (Mirai)", "value": "1e3c4eae184f3392676b96b3fd5f1cd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779197969, "uuid": "afbe9e47-1427-4b3b-86f1-f6c6c77664e0", "comment": "Malware payload (Mirai)", "value": "6ff612ce6d56f2211fb9142c36cdce8eff4a08e7be1ea7edb18df957471140b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779197969, "uuid": "bc650220-e870-4c04-8b42-b2649d51b263", "comment": "Malware payload (Mirai)", "value": "cd047c273734c477ccac92f2b62a309cdb1a5708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779197969, "uuid": "02a4b333-703b-458a-9af2-b36e41e92a31", "comment": "Malware payload (Mirai)", "value": "84187898d688f6588823a84893ce81b36bf3322ce78808f899a6321f0bc418806d76e085c8b0ff2879b029e97348a23b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779197969, "uuid": "1005929c-63ed-4da6-a226-933b8b706c59", "value": "T15F730A56BA428F12C4C311B5BBAF414D77137FB8D3EE72129D20AFA067864EB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779197969, "uuid": "22e06ea8-a07f-44ae-83d3-2ed51b2d81b7", "value": "1536:bo+nNHiiBLfdvnujoA5K1bwumtratWPXQ1MhiG2lP+Z7/n5OYHhI7R/wfa+d:P8K1UumtratM2lP+Z7nMMa+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779197969, "uuid": "7185682a-0813-4550-8dcc-8d32924af73d", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779197969, "uuid": "a83529c4-9efb-47ec-95e8-068c6ce9f1ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779197969, "uuid": "99fdb01f-bfe8-4907-a486-438f75212a39", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1eedc03-534b-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1779172053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172053, "uuid": "d8b522c0-3fcc-43d0-be68-a7d55888a5d6", "comment": "Malware payload (DiscordTokenStealer)", "value": "d653f0e009dc22f73feb203111c1c2f0", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172053, "uuid": "8a8bf0fa-8f30-41cb-b33c-1a958811fbd4", "comment": "Malware payload (DiscordTokenStealer)", "value": "70917a67f3eb6c48746cfd06002a08fffe35008b46507ff9fe883a2944cf67f2", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172053, "uuid": "e47c9e36-f702-4081-8e11-0087a20f0298", "comment": "Malware payload (DiscordTokenStealer)", "value": "b5baadcbffcc0be7ac43d2ed1553dbdb40a71bda", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172053, "uuid": "87ee3598-f73e-444d-b448-38f51ce969e9", "comment": "Malware payload (DiscordTokenStealer)", "value": "13661fcab322eab7c237e0fb5cdf6f21ec0595c523815e43342b29587434789e1c461e5f1b0e1535deabc0e1ac020d7f", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172053, "uuid": "9a2b2e03-c11a-44e8-891f-7fd8654b3a2a", "value": "T1E6F5275303851BBDF68D0EC9C94B255B20F2D4677D251298EBB36EEBBC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172053, "uuid": "3be508a4-e8f7-46eb-a10e-ebce41ae1f1d", "value": "1536:EJc2R8w3ZHHBDX9QMu3dzYBZI1Lb00WMGbxi5EhGLHIgj7vze5/qIjtk37RK/jqJ:EJc2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172053, "uuid": "a737086f-78aa-46b7-a284-1cd16b9b1818", "value": 3499662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172053, "uuid": "acc5d83d-d1fa-4870-b416-395f5e8ac7cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172053, "uuid": "f3a2d7ed-27c8-4314-8955-de2679edc9c9", "value": "DHl Commercial,pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb771a73-5355-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779176418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176418, "uuid": "3c3e25ec-81f1-484e-aaa4-9acc4b54d89e", "comment": "Malware payload", "value": "a82e020ef218e0682f80ab3045ecfc06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176418, "uuid": "88fe3101-93ee-47fb-835b-c5171a65b804", "comment": "Malware payload", "value": "71a7d0004e317f6787844347acdf4c910938820fd3f5476f6bd4bd7aeca34273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176418, "uuid": "400a3ced-7206-4bb4-a6cc-40d948245e50", "comment": "Malware payload", "value": "4baacc6946988eb9fd552a627fc5c4f21067ebe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176418, "uuid": "4ecf32d2-2227-4d5e-8b95-1db47f1d4040", "comment": "Malware payload", "value": "38c69fd6f73e6dc34e6f963b6e6fd763044b01a7bc95b6a7c35cd69c20d8c350b3982bb9ca8c5b42dbd9a17fbe49bd88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176418, "uuid": "56901c95-3646-4335-bc6b-715fbfee8f6c", "value": "T14A55A54BE7B611D1F4BAC139A562322AFC7234A58738D7D792859A0E5B30FE4AD3D700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176418, "uuid": "034f7944-a4d6-4a62-9885-99de04db3480", "value": "0a98343311b070c6ce1a4debb2e92254", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176418, "uuid": "c9b9754e-1785-46d2-b528-8b6b89fda647", "value": "12288:NXH1DLdp3T9dZBTYRNY3EfxnXxM3dsRSiXhkypdQwcmemqvw9E8:jLdp3T9jd3dsROypdQwc/I9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176418, "uuid": "f6b0ad99-1583-47d8-ac36-7e1cd06ce4be", "value": 1298944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176418, "uuid": "b3a27890-289d-40c9-963b-16a42d26b7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176418, "uuid": "f1ddf4a1-6ba6-482a-9450-2dc40cedf826", "value": "nigga.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f5d86f-534e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779173023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173023, "uuid": "c2feb6a5-b067-47a7-9259-5d48aa37a639", "comment": "Malware payload", "value": "1ef1d3e3a62bc1a7bd9f487a0637dc32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173023, "uuid": "d84ea333-6a06-42ca-a72f-8f95b39cacbb", "comment": "Malware payload", "value": "720af381f6e895fab38894a5dcec76cd7bae37153c0e81b38852e1cb0b14493b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173023, "uuid": "bce62e31-7814-4220-b77a-fe69a4f77546", "comment": "Malware payload", "value": "4255cc8eaae9333aa20a2083d389355addbb03ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173023, "uuid": "9f229ed3-810d-42d2-bb6e-13ba9fe0217c", "comment": "Malware payload", "value": "32c5cb63e25c543b5b99962fc642dde3039a4f7f9b98f387c36ee08e2aaebe1c26f2fb0cd1180ebb22f20773289dac4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173023, "uuid": "8de8dd76-c46e-41e3-8432-29685a66b7e0", "value": "T1E4B423A159385FC3DC2B6D3975C44D6B4FA9A2D2D6D28C1A127598220FC23620F7F1BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173023, "uuid": "bfc59154-0392-4aa2-9fa3-e3ca2bd2c17f", "value": "20a720514c007b14af707536a6a9cbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173023, "uuid": "3cbec520-16df-462c-b19c-88eec83add2f", "value": "12288:Mux8n7NAM4/R5Qtjy7QmW7p9L35wptZpCTgAU/y:MCC7NCp5MLJ4tZqgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779173023, "uuid": "f0e70ff7-cbd9-457a-81ea-df0d4b4ea106", "value": 496688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779173023, "uuid": "e932b44e-e2d1-4f22-85d1-17a840c988dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173023, "uuid": "991d618a-c4c4-4302-98eb-4e239399690b", "value": "720af381f6e895fab38894a5dcec76cd7bae37153c0e81b38852e1cb0b14493b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83eadd77-5316-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779149159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149159, "uuid": "8b38652d-3051-44d8-9737-3da71704e30e", "comment": "Malware payload (Mirai)", "value": "d5a15d0e104a12d6b409083db7442e7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149159, "uuid": "ab286427-6688-4112-a988-96f60229baee", "comment": "Malware payload (Mirai)", "value": "72557b6a7ae7f1dfdf611e1db058b4996d11856f83b56590f68b1b0337e7acdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149159, "uuid": "e04e83aa-6f8d-4226-b651-746648960cda", "comment": "Malware payload (Mirai)", "value": "567739a5cd846623afcb625957b7989f773cc5e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149159, "uuid": "e26569c9-bb98-4f3f-8b99-5cc1121f3fb7", "comment": "Malware payload (Mirai)", "value": "364546365bd7599464304f5eef8d39187643f57dabc610532292e515466c23624411000adc9f510d54f5fe7ae5464815", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149159, "uuid": "5c95bd83-cc2d-44ae-985d-d9de78c6f026", "value": "T10D243B46AA408B13C4D72BB9FBDF425633339B54D7EB23059528AFB43F8679A4F22501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149159, "uuid": "aca71d08-b19b-4098-8222-3511ca31c8f2", "value": "6144:E8jQPQg/cr+G86la+91cnaudt9/hF9KHPJJoM/R6zGy:E8jMs+G86aI1cnaudHJvIJJ9/EzGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779149159, "uuid": "4fbfd457-d8fc-4728-a824-33f28ef21277", "value": 214185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779149159, "uuid": "688e9d6d-2ec2-49a1-ac07-7a6d56e25feb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149159, "uuid": "dc57a54e-b97e-4056-ba2f-3810b147507b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bb15d9-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779168380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168380, "uuid": "49f4a9a3-81cc-4de8-8fa5-42688a230f7e", "comment": "Malware payload (Mirai)", "value": "e4fe206dd3ed820daeb75b90fc1e926b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168380, "uuid": "c5273e55-a44e-4e86-9962-10de74b59570", "comment": "Malware payload (Mirai)", "value": "733cdeae9d79ad2569d1886986caafa65a33bf0fc228eb6d2aa0325fcaaf62f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168380, "uuid": "5f6994b8-f1ac-49b3-9251-533e292785b5", "comment": "Malware payload (Mirai)", "value": "e318e24ed338005ee1d5b23dd753d4f790fa154c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168380, "uuid": "9d486a1e-cacb-4e89-84ac-6a12b5a3a6b5", "comment": "Malware payload (Mirai)", "value": "4d77f71d9ef5fd86dddebaf614f419f4d555fc45c52872ea3fa3c8d4f49ee7e7747fde4b9a5d5b507ad8ea3914823796", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168380, "uuid": "afd14cfd-2e5a-4c10-ae19-4f378111ba84", "value": "T11042C403D6C2EBB7D6801BB957570B245633EC272F036E03A7697DBC8E46988612B74C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168380, "uuid": "772ceee5-587c-4cd7-b5b1-19bfb888e458", "value": "192:fS3Hx4CytZBbpOPYyBu3QrHKKL0VxNPCxJ3hTmvgPDIuPYavpu:fS3xqt/bpOPXLrqKefPCxJ3QvEDI8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168380, "uuid": "d489b409-24db-4789-9d4d-a03a8a3f5788", "value": 12644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168380, "uuid": "cdc8afc4-2a2b-442e-b402-0a1c744e7192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168380, "uuid": "452c7a5a-8d2f-4ac0-8665-d230dd94656d", "value": "dlr.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc5d8a9-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "dd0146da-1352-43c1-8ec6-bdfc378a031b", "comment": "Malware payload (Mirai)", "value": "8c2da2d7fc658ca5e387e8682499ebdf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "44b75d9b-6eac-4823-ba5c-adaa6bd14ca3", "comment": "Malware payload (Mirai)", "value": "73d27e2759a439763d2d2a5e0a03958335556f0e21f1c47a348b013934533464", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "b43b47dd-a303-4c67-adaf-d2d710647e27", "comment": "Malware payload (Mirai)", "value": "d49a8a9cc996e5973546c189eda0e8c2436e13ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "83f7901a-57f5-4aae-89fb-399ef0acb782", "comment": "Malware payload (Mirai)", "value": "56f7037a202e075bd4a851c30171007b1b0b98d8d9865f20cf45fa6ba8c6ecbd33ea050c27889c480ebbf78bb6bf5393", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219556, "uuid": "8b799a84-1253-407f-8dc2-f89baf2186d0", "value": "T144B3AEEBF64715A2C85243F013C79F8E3E232290AE57E4E76D1E167B19760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219556, "uuid": "b21a0eb6-8cc8-4bf9-8aab-a735eb57afa0", "value": "1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgDA/LWW:8YSZ3e8ZE3MYlphDgDAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219556, "uuid": "1550c5d6-d745-4c0b-bb10-b02b44e9611d", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219556, "uuid": "33f88f23-5028-44de-9335-3681c48cefd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219556, "uuid": "d7cf626c-9968-4bd3-8192-84979e0a9873", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbf6c34-53aa-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779212820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212820, "uuid": "da2b7cb5-7d78-4b95-b689-085a31eb2bbc", "comment": "Malware payload (ConnectWise)", "value": "f6b5a137e38e0f5afd7c8e409a42090a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212820, "uuid": "2e5ce1a0-c849-4e3e-ab67-b1fd47c5d194", "comment": "Malware payload (ConnectWise)", "value": "74c8a0bb2007a459b92f3d0c39ddbc3585e23c39e4d68838fbb47d1e1ea960a5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212820, "uuid": "239ba071-65a5-4a9f-b72a-1f607fbf8085", "comment": "Malware payload (ConnectWise)", "value": "7301ed70dd54ad1cf62397e15c43a630b2553e97", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212820, "uuid": "b80a8584-b3a8-4767-aa9f-e3ac0502e12f", "comment": "Malware payload (ConnectWise)", "value": "b84cc741d52c385992e42ed86c776cb0004f844cbd9d0f5be3953e9c9894328d8e26a70ce23f791756f0b1e545f4102b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212820, "uuid": "dad82d3d-5e8e-4c42-ad28-dff30281dde3", "value": "T151D61211B3E595F6D0BF1678E87A92655631FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212820, "uuid": "450cfaa5-e0cb-4019-8cb5-bb0a65788e23", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212820, "uuid": "7d84ea21-11f2-4abb-8938-8b13a3c52d09", "value": "393216:hCXvI5MvHxMJwCXvI5MvHx6CXvI5MvHx3CXvI5MvHxk:hZ6HxlZ6Hx6Z6Hx3Z6Hxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212820, "uuid": "922889d1-4589-4545-bc6d-dbff7b5531c0", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212820, "uuid": "ebae7251-0bae-43e1-a0d2-a89a02384ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212820, "uuid": "b7baa9b9-ef95-4974-a223-ba4ffe087599", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae216b8-534a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779171504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171504, "uuid": "8b036ffb-8357-47dc-bbf9-1412481ddb69", "comment": "Malware payload (Formbook)", "value": "078e9c088d73e5faec5fbd4b1c1de224", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171504, "uuid": "a3aaf276-b0a7-4bdd-9bc8-fbf556c7c07b", "comment": "Malware payload (Formbook)", "value": "75ee575cc86a57e93d55b9be3e947352836fdf166feb227551e1c5c673e4fb60", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171504, "uuid": "736d2cc5-7173-4637-9a14-a48c66d4d2ed", "comment": "Malware payload (Formbook)", "value": "84fec722f61753fd378d8fb66d39f9738cc90ef5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171504, "uuid": "a24540a4-41e8-4387-b256-2cedc48f6125", "comment": "Malware payload (Formbook)", "value": "bb724c5b643972631c66d231b4e8adfe01a92fae4bece74ea86afae739e52abc6b83940ec95cfe58652f01148e25b003", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171504, "uuid": "9399dae7-b314-482e-818e-ea7eed58ce61", "value": "T1ECF6B88F5877223BDF682462541FE62AC6B5FD0868DCF1242D12D44C5EB02ACF9DBB91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171504, "uuid": "ea714de6-530b-4503-baa9-a6a2d404195f", "value": "3072:FqFGCO5N+jzQCDYR16ikqciPhLe6l3xg83LsTouRbQOh3XLeYIn0Kdu0q0TXTXhF:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779171504, "uuid": "f0a1a678-cc72-4151-bb50-abac60cfd865", "value": 16364040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779171504, "uuid": "b33bf7f5-e1b8-4915-8c6c-d562a13773a5", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171504, "uuid": "a7abd7d7-3dea-47bd-b8ea-01e58b2b4dee", "value": "Payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515ccd08-5363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779182145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182145, "uuid": "7892aafc-7a8c-4062-9c66-f208da251b65", "comment": "Malware payload (Mirai)", "value": "c0f5e74a86c249ad54bded7cdad6804e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182145, "uuid": "dee821b6-4929-4ff5-a56b-758c46da3294", "comment": "Malware payload (Mirai)", "value": "7acdc33bdbb5d173165cb9e686fa0d12024754705b3876df1be6da0c7b887a74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182145, "uuid": "e08d39f4-9506-4701-87ea-9865d3649e3e", "comment": "Malware payload (Mirai)", "value": "7223e17b66b9272bae36b084962ab23970091243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182145, "uuid": "2b6a463e-34d8-4977-8462-1add9b972837", "comment": "Malware payload (Mirai)", "value": "a1baa309634c87d43a55faa5cb1065c5c0b2930f959b5277669a4458e71573ce29e1f5c2787ccb188c6db859d181dc43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182145, "uuid": "ac695709-03b7-4ec9-9f75-ad57d7a13d55", "value": "T151732893F800DDBEF80AD77B44530606B231E7A64A831B76A357B667FD360951822FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182145, "uuid": "bb084e80-f685-4a31-9bba-aeab64938e73", "value": "1536:zDeh0i6ft1UQKaEMknj5ANE8FRP3y4LxZii3sgHbi1oo/+rE0J9opXRayIX:zDeL7JMknjGxqkZP35o/+rvKa7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182145, "uuid": "041b04ab-9870-4409-9dfc-387384a6a725", "value": 79420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182145, "uuid": "75e5e8cb-457f-4be4-b35f-089a0b1985ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182145, "uuid": "d42549be-d622-494f-808d-4df9a35b439a", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb3a746-534e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779173009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173009, "uuid": "7686fbca-e451-4ef9-9301-28e37eba1938", "comment": "Malware payload", "value": "0cbde5008b359306d3f13fd4078430cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173009, "uuid": "a077bafa-23a8-463b-af2a-74f758f1532b", "comment": "Malware payload", "value": "7b773e889e2d5db3ed61ff503832fb245c789abad98a5e7357abaf72e54139ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173009, "uuid": "2e97f2af-5fdd-46ff-a92b-6f00f06ccc83", "comment": "Malware payload", "value": "b678fcca11a04e4f1fb82f587ad945e9ba6b9da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173009, "uuid": "ea8ee306-636f-4eed-bccf-005440ebc059", "comment": "Malware payload", "value": "884d3fd46f53fa3493d934656ee3aeef7b33b0a1dcb1137ff39e33d4da03d9733ea4ad48bcbd61a3f0261d4b55bdc3b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173009, "uuid": "e7621284-6d4c-42dd-9c85-21167928bf6a", "value": "T16FC6F19578D181BDC462C131E38A4AFEF0DA355A4FBA492B7FC609022631D95CCBBB71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173009, "uuid": "88b650e9-161c-4f68-b4ae-ca8544c6cc26", "value": "80711d66098fceaea3b1916f81043aaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173009, "uuid": "295e88ab-aaf1-43be-9b78-ed7b1f8a993e", "value": "196608:kidS9CTWgs6xmJCWORdYVhftHNjQMqGuaw/VIBaXKiOYV:fSuw4WORdYVhfLKFCgXKiOYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779173009, "uuid": "b9d42134-0198-4312-8db1-a40eadd7dc0e", "value": 11651768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779173009, "uuid": "159a73b9-5b2a-4d10-811f-90b65909b988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173009, "uuid": "38e13a70-4605-49bc-b6a8-396ba36c1435", "value": "7b773e889e2d5db3ed61ff503832fb245c789abad98a5e7357abaf72e54139ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd0b2af-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220552, "uuid": "07fd5378-c1f4-4b4b-b074-ff6dde7aec39", "comment": "Malware payload (Mirai)", "value": "5996a780c0524d28faf0eccd13b4b369", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220552, "uuid": "12980f49-7e64-44d3-9530-dabb96933264", "comment": "Malware payload (Mirai)", "value": "7b799dc76ca28b018de1effab5c6e66f4e73a17ef91e79680008c4fcdfb87ea1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220552, "uuid": "c45ce4f0-4cce-4ffa-a4c4-7b8d8027f379", "comment": "Malware payload (Mirai)", "value": "14f6fe49b36586486320de632534a6a6cda86a08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220552, "uuid": "6e6debab-81d5-46d9-a29a-c91af5a380d1", "comment": "Malware payload (Mirai)", "value": "63ab82dfeada636e02dfb5dd6b55a273ff6908d305baa3adf075390d703bce61fbe1afa8087f99715a5124736d80d684", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220552, "uuid": "498a60bc-0059-4b26-8bdb-cbbd8cc7d2ce", "value": "T158C3D81E6E118F7DF36983344BB38E25A79C33C626E5D681E15CD6102E6038D646FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220552, "uuid": "3fed52cc-862d-457a-bad0-e59e82f66b3a", "value": "3072:6GCM3zgxHMkxpExi5t3P01aUbaaEGELJaN/D:6vMkpxp0Yt3P17JHaNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220552, "uuid": "9a2a0f81-0b1a-4857-abee-e1cc229e8470", "value": 122868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220552, "uuid": "fda3a051-2cc8-45d5-a7cd-371e8a068b62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220552, "uuid": "8c9727da-566e-4808-ac04-d55d8435b484", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46979f7-53b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779218496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218496, "uuid": "8cefc9a8-cb71-420f-9228-9ade45502a58", "comment": "Malware payload (Mirai)", "value": "d15ff9e0cf516acfe495d0f993d6eb5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218496, "uuid": "fb787318-6d3f-4ebc-a9b4-8ff9e7412f8f", "comment": "Malware payload (Mirai)", "value": "7bbd5d39fdd5ccdbff406167061cad9e5078c1b82a900063480f1f7dfaf45831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218496, "uuid": "b0375fda-0d2a-499f-be57-28a9b97f1ce9", "comment": "Malware payload (Mirai)", "value": "bc50c705439a783740f59d7b01aa023a96f68f29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218496, "uuid": "90abff4c-0877-4ff4-ba38-9d0549d98244", "comment": "Malware payload (Mirai)", "value": "1556ff0c769629fa88fa9e4b1d0ef5e56453edcdb0db267e715093af5aeb1accf14e7fd04dd11d2d7ca6a2a366bb730f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218496, "uuid": "68939f94-54b3-4c22-85e2-c78758e974f5", "value": "T16BF34A46FB804E17C0D61779B69F43153323DB6493EB73069928ABB43F837AE4E62605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218496, "uuid": "78f21694-1e79-4171-b292-f4c9472e4a21", "value": "3072:0y8hPgyS7DhaJ9L6NNnoYrPSWDxXAmz+3L/KQTm:8gpvhaJ9L6NNoYVxXAmCL/KQTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779218496, "uuid": "c31e0279-15e9-497e-97d6-c97c54475a7b", "value": 164200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779218496, "uuid": "5dce9648-be77-41ba-8c0c-fa7dcf7a1415", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218496, "uuid": "fa941339-e7b1-4c6d-8e36-99acbe83e878", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d61b956-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "ad0d90b4-c477-4ff0-aeeb-b4018f3fef9c", "comment": "Malware payload (Mirai)", "value": "c80b1e88a8cf1a40b97cc67cb3e799d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "37b96575-9efe-4d18-bf20-964b60d73508", "comment": "Malware payload (Mirai)", "value": "7bdf1ce436c0b57bdcc0201535aa73cfe050fcb1108a5642f6698e77a8e4e0c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "5934b772-c0f0-490f-9ca2-76fb22fba7dd", "comment": "Malware payload (Mirai)", "value": "69c6aded0d93e71855fb005f5e1300912794ec79", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "faa98d3e-96d3-4f72-8826-90a9dcdbd2f7", "comment": "Malware payload (Mirai)", "value": "f9bb3b786025799d5edc6ae64849cdaa4aeee44bbe37d2abe1154ab10b591a713f591b8a0ad89abdd6a8ef1e5f9cca93", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219558, "uuid": "51ab3056-3d52-40ba-ae1c-42facde1253d", "value": "T1B103E07C490404F5D57BC17BA3EC43A0B53A039E6541CE563150F6A7EA0E9AC78E2AEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219558, "uuid": "8a8e2b17-3da3-41b0-8dd6-a6ed708b82fd", "value": "768:lgN29x3ZpzZ5VjNuvtE54Fe7GbxBDbYsPs4P51avJgGlzDpbuR1Jf:f9xJZZNKNFjBfRUMoVJuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219558, "uuid": "3d96efee-b72e-40ff-895d-ad8a8f432959", "value": 38076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219558, "uuid": "4f167994-383b-40e0-9281-eed28b16e502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219558, "uuid": "5d3fd355-6691-4e30-9cae-4bf22d0bf3dd", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1d42fd-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "92335c21-9175-4d07-a25f-875779a4d0e1", "comment": "Malware payload (Mirai)", "value": "e1926bd1896147d9638453bdcb1603a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "274366c5-f633-4aae-beb0-ce53e675cc54", "comment": "Malware payload (Mirai)", "value": "7bf9c46948020d50f46fca6974f6b0767f9404fb66a8e36f174ef82bbcfde944", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "fbfe3007-5164-43ed-9922-38dfbdf71ad9", "comment": "Malware payload (Mirai)", "value": "610da01eddb5cc42761beaf54720d48de8fba244", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219556, "uuid": "7729d4e4-f110-47ba-a885-426cdb529659", "comment": "Malware payload (Mirai)", "value": "f5df53f59b82b52a0258f6381ebea3ed7b32b0c56e46c6df2d30df23afe1aefd7b51c04fdadf1fb8ac37144d3fdbcea6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219556, "uuid": "e7b6f853-b9f6-4e7c-a1a6-5900014bd368", "value": "T18B92D03041277CF2C3512433A72F8A02995543FEC6FA317B236469A4D79594F1EA554F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219556, "uuid": "7147acb2-edc1-4824-8b44-4a9b5391e357", "value": "384:kn3CFDMsFGg7EMUTmli2KvZw93KmQxPitrsnIns0t2dfNH8bnPKI2XphymdGUopw:KCyEPgoKRwZGx04nIns0t2qPPGps3Uoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219556, "uuid": "def7d420-9ec6-4a9e-a020-ea99f51029d7", "value": 20540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219556, "uuid": "49aaa2cc-b4df-4cf6-a6eb-c52863c7f588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219556, "uuid": "73ee5a68-5805-406b-879e-fa74db919552", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f634468-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157258, "uuid": "e829044c-f62b-4548-a88a-17793b35a4a4", "comment": "Malware payload (Mirai)", "value": "5b284f65b81408b7caa7a08b7156df40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157258, "uuid": "9d259f1a-2190-408a-9e08-635eaec764cc", "comment": "Malware payload (Mirai)", "value": "7cd1d037e07aae06ee395005504aaefa652d463ab3751609903f3a71aef8e7be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157258, "uuid": "b1af40c5-0c3d-40bd-8c53-0f52f8c09f69", "comment": "Malware payload (Mirai)", "value": "40f276d89348ff72fe1f92e2e994cf53c97d4096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157258, "uuid": "ca9ce4ae-73da-4087-a4fb-01d01bb43dee", "comment": "Malware payload (Mirai)", "value": "0fff72f1be5ea6c01b016ee01a0e8006863a2371f2f9de7bc4fad58278e9acda2ee9e918a2f607b29a320628660de023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157258, "uuid": "a5bb7583-5861-4cdb-ac9c-893761878d79", "value": "T1751318DBB4099D7CF85FEABE9413490DF631375550830B2667ABFDA36C321648D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157258, "uuid": "0d05bba5-b454-49be-bf83-e82b30188ac2", "value": "768:Rne3hoZSQh6a5fZYNCYVTOzV7ajhJ0m+w95/S3U8jLZ:5uecQ8SYNT9Ozdaf0m+w7/SE83Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157258, "uuid": "5b3ffa21-293f-4f9c-9e9d-8f670c63ee6e", "value": 43600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157258, "uuid": "faa23a6a-8a3b-486c-8694-2010b7c275ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157258, "uuid": "f1bc267e-ebe6-4666-bbd6-97d750e0bd4e", "value": "upperm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40eccc0-53c7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779225287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779225287, "uuid": "4dca2a36-519d-4505-955a-395b410bba20", "comment": "Malware payload (Formbook)", "value": "96f69919f9618bec5a0430706c4c5a6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779225287, "uuid": "eb808beb-057e-43ad-9b9a-843f12863ffc", "comment": "Malware payload (Formbook)", "value": "802fadcbeefc3795c90d0b0e0f5c38feba3a86334b6f33a8d024330ecae010e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779225287, "uuid": "14a453f6-d218-4f6d-805f-bb36a7fa2e91", "comment": "Malware payload (Formbook)", "value": "51d25eba2d93f9306dc9ffb373a3551a7c34421e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779225287, "uuid": "e486877b-5439-45b6-a846-d92a7164a569", "comment": "Malware payload (Formbook)", "value": "269ab693efb7955d99f14dcf6554356ee0135a4ee2149ea7ae5f7d0168a39d4d38ba5b4cf1553d1cdcdc9368122e7012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779225287, "uuid": "05a580d6-ca04-489c-96b4-feeff27bf821", "value": "T1A62523B0AB88E666C997C7781E71D3324B781E5CD711C3078FEEACFBB8195706825681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779225287, "uuid": "58a54b75-feca-4309-87d3-8551ce2f8eb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779225287, "uuid": "6726b53f-d11e-4622-847e-9894f14a7629", "value": "24576:JUKzVaKOD3n4AyDdg+0KxQ1DVGzd4seWFXTvMzOc:dh+8VDuuxuDKdX7FXTkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779225287, "uuid": "53d2b0a1-9a10-4bd4-81ec-1465eac0d233", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779225287, "uuid": "531e320f-2373-4428-9370-22dd4f9ce2ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779225287, "uuid": "29d59627-fbef-48d9-abd7-6ff23edb5598", "value": "Ship_Full_Vessel_Particulars (5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360c9eb9-536d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779186394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779186394, "uuid": "75e4d869-2af7-4f5a-b806-43c52c4a15c1", "comment": "Malware payload (AgentTesla)", "value": "9ea663a92838a25ac46025a10acbb1b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779186394, "uuid": "57670748-cc7d-441f-8247-3a953d42f95c", "comment": "Malware payload (AgentTesla)", "value": "807d3cfc2030faa4d73101cb2ac8a801610bb53846538e59e0846c9848f1439b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779186394, "uuid": "8294eb5b-0f7c-4a43-961f-e4197b9667fd", "comment": "Malware payload (AgentTesla)", "value": "0c3ee2d63a00844f09c5b29c115f3507a0f23588", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779186394, "uuid": "fdf9750a-9d1b-4992-abfb-cade8339eb56", "comment": "Malware payload (AgentTesla)", "value": "ec8a9fa6ceaa741ce1be8136e6f9ad023091c06e96551415d0971bd54a8da19249c13039df079fe9949101ab71fa567b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779186394, "uuid": "f893a32d-32a2-4078-9b89-6ddc6504d864", "value": "T15A5412163340D4F7C64441B05CBD8B7B9AB786B831852E8B5F64AF5BFEE2162172E087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779186394, "uuid": "83053359-87f3-4b24-a8be-6e7355f76676", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779186394, "uuid": "a23e7262-7019-4e2d-b038-e9701962fc8e", "value": "6144:89X0G7Hoo89kQRC5OLYGV/p9/sKaRv6Pd:S0IHooKNgGV/p90KaR8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779186394, "uuid": "2bed6ab3-d125-4364-ad07-fba03c5869bc", "value": 296144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779186394, "uuid": "c88fb122-c3b9-467d-b3f9-19c06e06e0ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779186394, "uuid": "761b4cae-9674-4526-aa62-f724f25b6211", "value": "Zam\u00f3wienie_Nr.26051811930293033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1878f0-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219561, "uuid": "a7f00956-a6b5-4ed4-be89-5bd274f79a41", "comment": "Malware payload (Mirai)", "value": "d6f60cff519218c491fc81a44bf7b4ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219561, "uuid": "72e6910c-8fe7-48f9-8a15-9fb8120e57d9", "comment": "Malware payload (Mirai)", "value": "82ac71a2efbdd4c1ae95836585d7ddc8c6777e93744e86a9fd97632ca403bbf1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219561, "uuid": "b221d98e-cea2-47cd-a855-e286f63e43b4", "comment": "Malware payload (Mirai)", "value": "733bc37276ff94fe6ebc032a6857a506108723f5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219561, "uuid": "2b55af6d-827f-455e-b8ce-668f490d70fe", "comment": "Malware payload (Mirai)", "value": "a5cbc35636df74611c477902132c1aa8f568e6a9acde0f9ad9980a5a9ae2ca34e6ce2f6324119a586d188ea1d67763a4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219561, "uuid": "95621ad4-80a1-4208-98c4-2b510ea12ddd", "value": "T1D4734B21F9391927C0E5A17A21F74B23B5F643CE20A8861F3E710F9DBF615403A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219561, "uuid": "e97d33ed-32ef-46f5-beda-377ce9693127", "value": "1536:0km4j59k6XTXypv4u4YF7tR7SYm5BHxS1H1tTAfT:7PQbrL7SYOBR2AfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219561, "uuid": "59251ea4-c66a-4b25-8ef0-249a62727efb", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219561, "uuid": "3206c9f6-3520-4924-a565-cb3d0700d93d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219561, "uuid": "2ef5cd2c-6b3e-40d5-87c7-73e817625d90", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9ee212-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157253, "uuid": "2625beb6-f621-46ba-972f-c9b24007adab", "comment": "Malware payload (Mirai)", "value": "5c16c371a5586ee3e8ada5501a7fa3f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157253, "uuid": "414de699-a2b8-4573-856c-6506f96c30f9", "comment": "Malware payload (Mirai)", "value": "82b2d959f05dff769caf3609d40624c268940ea47181dcbc0ef1fe9e09f06dd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157253, "uuid": "fbcd3cc9-3af1-4b34-9df4-de116aaea663", "comment": "Malware payload (Mirai)", "value": "b30c3b012aa7599bdb13c5c244b4c21884686045", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157253, "uuid": "b2302295-3636-48c6-9a36-440cdaef43a9", "comment": "Malware payload (Mirai)", "value": "bbd0dec289df381d80bd1a479fa7f83b48bb1633897c3964a33d15f42937f0cbd0f66bfd46da6a32ae50450678611c33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157253, "uuid": "79608100-f7c8-4043-aa97-eea0586e6356", "value": "T1DB037DBAC8296DD4C5594274A8358A7C2F63E110D3833FFB5A4585A68047EFCFA0A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157253, "uuid": "5926a092-5474-4688-bfa1-71d730e683e5", "value": "768:MaFf2wtYwNSKvPnveeddMi0EN+DGrQCvofi3SCqf:Ma12wtDVzOwJQ/fkSCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157253, "uuid": "6cf57a30-6660-4b7d-a432-ff1234444261", "value": 39204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157253, "uuid": "fc1d66bc-73e5-49a9-b73e-1a164c68ff9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157253, "uuid": "60d498d2-cbaf-4de6-93c6-13037ba73b79", "value": "uppersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e598bcaf-5355-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779176381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176381, "uuid": "5dfedcce-e3dd-42ac-8e95-7a39379d4827", "comment": "Malware payload (RemcosRAT)", "value": "4ec99b4bcf6e8475d157dacb3f213503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176381, "uuid": "cae61e3d-dfb8-4e0c-a780-1525163c9633", "comment": "Malware payload (RemcosRAT)", "value": "83dc1316a2a9f515187cd82024fd616d85f4fd9b8880a2a0b2480216a97bab24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176381, "uuid": "3cca269e-d412-4a3f-a384-397bd3e24ec1", "comment": "Malware payload (RemcosRAT)", "value": "a4ffe5659d4f43b20ccf6392f2a0f9b3df418e7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176381, "uuid": "d45ee23a-1dff-43f9-a0c6-5204977483ba", "comment": "Malware payload (RemcosRAT)", "value": "47308c4e57da98fa2ffce992d24b8a0a1ec05cf56955b40d6a13ee20d704a773617df0436103e6ffe59bdaecd6d6b6bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176381, "uuid": "aad7de4c-34c7-4441-9dbe-94dc5302ea69", "value": "T1CC55A54BE7B611D1F4BAC139A562322AFC7234A58738D7D792859A0E5B30FE4AD3D700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176381, "uuid": "b2eda0c6-4419-4faa-9f45-1f754b932735", "value": "0a98343311b070c6ce1a4debb2e92254", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176381, "uuid": "d7bf53de-0fe7-4e11-a6a4-4293f783e769", "value": "12288:d+H1DSds3T9fZBIYRNY3EfxnXxModXRSiXhkypdQwcmeyIvw9E8:ySds3T9xiodXROypdQwc1I9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176381, "uuid": "66970287-0431-4e14-9f27-4df58cafce7d", "value": 1298944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176381, "uuid": "c97e4818-79a8-4277-8b8a-cca92ffdd150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176381, "uuid": "85c8e92e-562f-4bc4-8a48-1e2ed866946f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7a8f14-537c-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779193014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193014, "uuid": "80680943-6ebe-44a4-a767-55fa0f76f7d6", "comment": "Malware payload (QuasarRAT)", "value": "19f02e8a06575b861138f20fe8fcdaf8", "object_relation": "md5", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193014, "uuid": "9df34b34-370b-4d20-a20a-fcdba5c835ce", "comment": "Malware payload (QuasarRAT)", "value": "83f6e0c42e6adbe7cd9f799b4c673dc40ada3f386be2e1ee829d8da1c2200f5c", "object_relation": "sha256", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193014, "uuid": "21a34b98-6603-4c2d-834c-5abce98dd78e", "comment": "Malware payload (QuasarRAT)", "value": "f311bdb4a0b9a379e3216f6295b4b471f18f30db", "object_relation": "sha1", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193014, "uuid": "c3c28123-174e-4a20-af0a-846f9f29b15f", "comment": "Malware payload (QuasarRAT)", "value": "6bb6bfed30b2623c5c5e876510cf126cedb06ed263a670b1b13cf101aa72962265b08bc9ed8188dbb6adc48decd5475c", "object_relation": "sha3-384", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193014, "uuid": "762d8343-a31e-4a65-b10e-21048250adb6", "value": "T1CC55CF9137E84627E1BF2B36E4F0150757F1EA467B22EB4E2290A7AE1D937409D407E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193014, "uuid": "12c07e91-477a-43c6-aaf9-ecccb1666e8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193014, "uuid": "482a10c0-f4b0-4301-a000-6da46dab04ad", "value": "24576:PWQ+qY3BUYvSWHIPbcNK0KKfaOwI55l2SRqUx0+0NRYz/zZ7:PWBUYLEgKKHwCB2B+z/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193014, "uuid": "1aa6f428-0d98-4866-a43b-02065a9ee681", "value": 1381376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193014, "uuid": "d6f02d00-6511-4109-92c1-fc1a81f2da52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193014, "uuid": "0eab99c0-33b4-43fb-b2c9-f8dc599fce01", "value": "83f6e0c42e6adbe7cd9f799b4c673dc40ada3f386be2e1ee829d8da1c2200f5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c55c362-537e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779193733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193733, "uuid": "05c669a4-131d-4216-abe8-e09178e33020", "comment": "Malware payload", "value": "492afca09a526a3df3b1d5211abfacac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193733, "uuid": "bb797b28-52ab-4c31-aaec-24543ad5e40e", "comment": "Malware payload", "value": "84b98e05674daa9e352e0cccd2ff95dc820443cf49ab2beac3ad5cf36416418b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193733, "uuid": "e0664266-efa5-426a-93b3-85a4af396de5", "comment": "Malware payload", "value": "d94df1361e172b241690ccba38a6fa63487a1bb8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193733, "uuid": "3b7ab43f-5c50-4bef-bc81-450cad27d270", "comment": "Malware payload", "value": "294933940e32d9ebbbffec554a2f2d4a4bd6800b1c5fcd622fcbfed0be2f1ee683e559fb0b52c31f55218ad3b96306a3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193733, "uuid": "8df4c38a-7ce7-454c-a6c1-566c1218dc20", "value": "T132441A243AFA5019B1B3EF95AFF474968D6FFA733B0A945D1050038A4B23E41DDE163A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193733, "uuid": "1e83a96b-f706-42cf-b648-72897b5e59be", "value": "6144:dC+Rw6b6LJ6qmIfD2XPeCpUB1AZwjB6Nge6Ld+:ZRw6b6FNmIfD2WUeGZwjAg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193733, "uuid": "803c282c-2d68-43f2-b913-7bfeb415e9cf", "value": 268920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193733, "uuid": "9a224e56-c2e4-43df-b62f-f8c59c2d9616", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193733, "uuid": "54192d35-f79f-4078-b0da-0e6ae011deea", "value": "Adjustments_for_Revised_Quotation_Chemijos.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67857070-5392-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779202369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202369, "uuid": "66be0357-1bb6-4510-9d50-850531c0dfc5", "comment": "Malware payload (Formbook)", "value": "a30a7880cc8a2f480570a57762531d24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202369, "uuid": "513907ac-a530-4410-b750-22f7eb82b0fe", "comment": "Malware payload (Formbook)", "value": "84bb8fd63ad8ead98ae8b9a53da43d2501ae94a64ee25ebf248909078452b95b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202369, "uuid": "c5a87c11-2316-44ff-a104-11a9da105ff1", "comment": "Malware payload (Formbook)", "value": "9e076f2f45897234210cdab1579c4b05866916fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202369, "uuid": "ce701fcd-e85b-47b1-8b72-f71ee6e56c08", "comment": "Malware payload (Formbook)", "value": "c75554006c428be23350400e7971ce92b15f3fbc74b3796ef70e9585542e54b26daec4b9a54a08cf26218769e4652b60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202369, "uuid": "f1c960a1-59dc-43af-8d3f-e77125d480d5", "value": "T1A575AF1923DD452DE4F9EF385B32379406B1FC2598B2D30EB748A3797A26A905E8C353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202369, "uuid": "9eb4fb50-65df-41f6-97bd-9f476799e856", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202369, "uuid": "9043b6c5-7379-4572-bc28-96cb43f2ea90", "value": "24576:42ToPCmQui1rBgc+9loyfJuz0sy+3AMgE5J:XToYusyoycVy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779202369, "uuid": "eabfa9a4-7809-4f8d-be8f-362274965835", "value": 1560576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779202369, "uuid": "98ea5b3d-3101-409e-9eb1-4ad66ce7db45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202369, "uuid": "621fbb67-b70b-4efc-907c-04fdca5a8eb2", "value": "Quotation Request.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce47a18-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "f383a70b-cdd9-43f5-a638-a01853142d73", "comment": "Malware payload (Mirai)", "value": "b5b0f73eb57e2ee7e701a3b63c174c39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "894c3fb3-bb3c-40d2-b2a5-f07c0e7c2f86", "comment": "Malware payload (Mirai)", "value": "856a1b65650e5b6bbc782cad58cc7f7d3bd195199bb993eec3b17981273def97", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "1916cd8d-35ab-4efa-94ed-fd40dd67e0af", "comment": "Malware payload (Mirai)", "value": "669dd247ee0abd2a6a54f3da906c67979d2d6138", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219558, "uuid": "1a9d4585-d248-483d-9b83-3df59122a443", "comment": "Malware payload (Mirai)", "value": "973ab588fb4426fad09ca6ef6e0f1927b3789bf10b73b47727cb314db7c4f41287ceff73d272442ffb88fede33b56d41", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219558, "uuid": "73648287-fb23-4220-a602-eb0b79fa018a", "value": "T1FEF2E1078A748B58E2FFA13C09BA661F5A01772CDD045096D798363364B0F2D73B9AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219558, "uuid": "fdbb33ef-1616-4c15-9b2d-284baf5bd035", "value": "768:BW/zEpEYEgHE+Tc0F/NVvsvrDN7yGjjtnjcPOkVVz5nbcuyD7UHQRjK:E4B1E+Tc0FlVv4NWGjamkf1nouy8HyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219558, "uuid": "005c7696-edcb-45ff-ad67-9095b359f8e0", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219558, "uuid": "a8f28fd7-1a04-4874-adc9-058fac10e585", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219558, "uuid": "42a464a3-5fdc-4829-b2c4-ebef4553d35a", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d61f7a7-5392-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779202432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202432, "uuid": "6751ad29-841d-440a-ba7e-4680a6098d9c", "comment": "Malware payload", "value": "2c6fd22edad5e73e86b52285ad1ee2c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202432, "uuid": "22cb4307-cea3-44b4-b830-96790fb9891c", "comment": "Malware payload", "value": "86a46b68115608314009981426d6d876dc6f1fde3bd0af798c7a7ce104e6a6c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202432, "uuid": "fbef5e31-9065-4b27-915d-b504f17d9635", "comment": "Malware payload", "value": "1695f4014e67da25125cf5cf2e898cb1e737647d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202432, "uuid": "c4e213fc-b707-4c4d-8a60-046533e9d405", "comment": "Malware payload", "value": "5a0185027714d8af36f2bf11ee52c6f904a997776c9ae5e859aeb759d141b9913b55f3d5b50da810a42083020039d283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202432, "uuid": "d04cf243-8993-48a8-b169-d2e7fb7cca88", "value": "T107369D03AEA620F5CAADD630D5BB555AAB61B80D073523E31F24BE741F7A7C0AD72704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202432, "uuid": "11acea97-9c10-47cc-b895-f6daeb661cc7", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202432, "uuid": "d60be071-1a61-485d-be62-21ad91f9d7ff", "value": "49152:8mUfiInGwBCa+V0aJNS+7xJfGgE8Cm8bXx0DFVx/1dDYYH8zXdAjnT+D3fDvO291:8mBGtDTZetNTmeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779202432, "uuid": "43170eaa-4bfb-4f3c-a1e6-f4f8987ef664", "value": 5055168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779202432, "uuid": "faa56d35-c622-4d61-bd25-e27aef3ee8e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202432, "uuid": "67017b8d-d627-4f7a-8bb8-6f89577cbed3", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80db71eb-5328-11f1-a769-42010a9c0008", "comment": "Malware payload (Fuery)", "timestamp": 1779156885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156885, "uuid": "9703754e-d5be-4fbf-b41a-eb29aaac74f7", "comment": "Malware payload (Fuery)", "value": "f29517374f5de0d43638a88cdb5c6f07", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "proxy-module", "colour": "#F0A277", "exportable": true, "hide_tag": false }, { "name": "td", "colour": "#DB981D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156885, "uuid": "1456203f-43c4-4305-b53b-c90ea6d9f9cc", "comment": "Malware payload (Fuery)", "value": "87f5abb11e29ec59a4301c17c39c47713fdf4507b2923cef30eb4403657131a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "proxy-module", "colour": "#F0A277", "exportable": true, "hide_tag": false }, { "name": "td", "colour": "#DB981D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156885, "uuid": "6f87eb12-fb7d-4f18-b27f-de607c6b0274", "comment": "Malware payload (Fuery)", "value": "f138c535de8cd8863e10e6ee38ee41805903ad0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "proxy-module", "colour": "#F0A277", "exportable": true, "hide_tag": false }, { "name": "td", "colour": "#DB981D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156885, "uuid": "eb26861d-c350-4926-a3af-980beb67df48", "comment": "Malware payload (Fuery)", "value": "28d4e4df60ce97bc55f76113eafb7503e02b8bb36dbfa9d0656175b1e5974464dbd88528bec336508fd505f57e2a1537", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "proxy-module", "colour": "#F0A277", "exportable": true, "hide_tag": false }, { "name": "td", "colour": "#DB981D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156885, "uuid": "983e533c-bb79-4304-b9bc-265bf490b15e", "value": "T109343922EEB45C3AD06007794CEADE67583F7B206A25481B69E40BCCFE346715D29B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156885, "uuid": "2e8a4ad4-822b-4d13-8e75-8baa888271fc", "value": "2daff74cdd8a0c59d9189225a1e592c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156885, "uuid": "f04da388-7a48-4933-b7ae-5de530900f04", "value": "3072:qK/699nih46eJbmkIxqE4SCGKTvQik/tAUE/dbwtkDo5HC3her5z:qK29DixTCNjo3idbWARe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779156885, "uuid": "5048aac3-d894-4246-9ec4-a82cdd25a5f5", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779156885, "uuid": "6ed0f884-3c00-4d47-86e3-3d514b33207a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156885, "uuid": "02ad3403-9ae2-4df7-b325-9fa134c6b426", "value": "dae.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b54011-535e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779180191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779180191, "uuid": "5103cf4d-8dfb-4690-8ba5-315987dc83ad", "comment": "Malware payload", "value": "efb849e03779420d5cc08b900e222a41", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779180191, "uuid": "c819d3e2-0491-4996-a393-41ad06a3f499", "comment": "Malware payload", "value": "882c9ca86ceb7d3d2c34b5d1fb08a70bd668a1b6b7eedab448319fb73985587d", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779180191, "uuid": "fc06a18f-f7b2-4319-a4c2-a5b9a4cc72e4", "comment": "Malware payload", "value": "72e26ddfaba24cd635fefbf002f32e282b88067e", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779180191, "uuid": "98bb9299-4ee0-4dd4-831f-007d687754c9", "comment": "Malware payload", "value": "2348bd68f6f75ee3bea901f7524f4315e7fa35c1549a50dfacc4c039b68c375d6560862ef3e41aaf59ee962aed37ca94", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779180191, "uuid": "575fb400-a6aa-47a0-bf77-a369785864df", "value": "T128E3BE8126EC0300F1B6FF35DEBA6B85487ABAD0ED71D36C4A60CC5C1962641EE75F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779180191, "uuid": "8c834bb7-a82f-48de-889e-5b75ad6683b5", "value": "192:F/E/FeoRrT/FeuHFGndm/FedAqGndX/FeaZ7huUz:F/yHGndNGndLhuUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779180191, "uuid": "7b999b25-d8da-49b4-a917-42e0657ab203", "value": 144012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779180191, "uuid": "7f1e174e-62c5-4ca1-9f10-d416942642e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779180191, "uuid": "76b4a969-de3a-420b-a454-3e310e585af1", "value": "Scan001.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5347dc06-5363-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779182148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182148, "uuid": "9008081e-96ec-4422-bbf9-31c688af6f54", "comment": "Malware payload", "value": "c44311c6625841424117e2c511b9f6da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182148, "uuid": "f32634ad-8a58-4d65-9bfc-87fad4afe93d", "comment": "Malware payload", "value": "88441c178b39b82a8baa3d7287e5038936271e1b049a85bf114dd356ebe0c9b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182148, "uuid": "9ff82efa-4942-4eea-b0e6-6d4913952050", "comment": "Malware payload", "value": "93b350c21c539af08ff171e2fb05d77462d6632e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182148, "uuid": "6b85f60c-d35a-4e9a-a2f8-25cb64f072f3", "comment": "Malware payload", "value": "51272feb3342a57c63254710a8271219a12b9eb2ac8cc149b95b6c9fdae8357f6f49bac95d66491c8c0620417fdd514e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182148, "uuid": "767f45e6-d8e5-411c-bc00-339a3b9d20c2", "value": "T11801920653D64FA3CA9762BE26A387245B60FC2308B3AF46731C7CDA0E132C53D64710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182148, "uuid": "50dd8c5b-eadd-4e75-8284-a6744c3702ad", "value": "12:Bnls+XRTFmFmFmF/EDrgiJWQnkt8ZP/2jTtXilKXQK:FljFFmFmFmFA97CTtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182148, "uuid": "a92052f5-52e0-4863-9876-39fc358b7c59", "value": 725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182148, "uuid": "6f8dabe0-68a4-41d9-96e2-75642d35fbf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182148, "uuid": "ff7b550e-d61c-424a-9ee6-eec1d75a4357", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e499f0-534b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779171932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171932, "uuid": "f8eec04b-c8b5-45da-88ea-05ebbd6aa190", "comment": "Malware payload (Formbook)", "value": "975b010e684b3b9a0e93b61687d4e049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171932, "uuid": "4667d71f-9594-4009-8037-dfc9976f1610", "comment": "Malware payload (Formbook)", "value": "8885f3e922ef08f8d1c4a0f45712de6b080a92b364ce9164ff31759cd531ead8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171932, "uuid": "9bfe1ea4-08c6-447b-bf3f-d0af67d7b800", "comment": "Malware payload (Formbook)", "value": "53de5d7a0690b6dd316aea65838c4ff42b62d195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171932, "uuid": "1326f7cd-fd0a-41f2-be14-5c824ece0204", "comment": "Malware payload (Formbook)", "value": "da5866c080445741d7737f996f07a61aab0680f4b3ee039809014f4c18d4140f1ac0ca07157d67de0b66d8938d72a71b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171932, "uuid": "159fd75f-5224-4ea8-99fe-c9caee95a958", "value": "T1AB2523796758E687CD360BBA09A0E23503B11D59E921D3DBCFEDBCEB341A36264045D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171932, "uuid": "f570127d-4ba9-4749-80d7-006524b21177", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171932, "uuid": "78ff72af-c26b-471f-87c2-361d29796c33", "value": "24576:wCA2OvsWCquoFaudth1bvS+pUcTsiS9STzIrIf:EsWMZudt3vlklSIrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779171932, "uuid": "7e389dd9-6c9e-4b47-90be-b93679a8a32c", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779171932, "uuid": "71af79d2-29c9-4998-9709-8d5181204d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171932, "uuid": "a37962db-44f8-4209-b4fb-7a86cff6c474", "value": "New Company Registration form &\u00a0\u00a0\u00a0 PO'FB2150204_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf438e9b-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220555, "uuid": "e46ed04d-2fc1-4ca5-8dbc-d90ac1d89601", "comment": "Malware payload (Mirai)", "value": "40288044e89e8fd3240314ba36be5dce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220555, "uuid": "8b367ed9-8029-48d3-8604-106b4f130b60", "comment": "Malware payload (Mirai)", "value": "890481208a78f50c985dd3c0805a9d09833e38f4910d229147a8f9bab46e79f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220555, "uuid": "48946da3-5664-4be8-b235-cc90850d66bc", "comment": "Malware payload (Mirai)", "value": "3b3e869295fb5b1a6e7e2281858acea4f2788fba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220555, "uuid": "c04087cc-1a99-47af-9bf0-b82484324459", "comment": "Malware payload (Mirai)", "value": "d03938d364794cde9e307ea788f09df839fb90cebaaf298a4daf325bedea7099de55702af85054743b643488de1ce564", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220555, "uuid": "b6cd59bc-e8d9-4147-b830-cff321f3a40e", "value": "T191213E9C39E5367A3568CD4CF2A3EE05D01BF1CF32960636F6C8B5366C98214BA26F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220555, "uuid": "b512a7e7-3881-4e55-9dd6-adcbe3ae6be4", "value": "24:QvQhBh9M0oy1Jd7q8riiFKGbxJY7LxrinFKXbC:QvQhnooJiaQpiFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220555, "uuid": "e605cc35-411e-49d9-9a64-456577052f3f", "value": 1129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220555, "uuid": "88077320-adba-46d3-a254-6fd880cc1a38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220555, "uuid": "07ca839d-581d-43f3-a7de-71d8a97c755a", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5725228e-5363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779182155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182155, "uuid": "60ff8f8d-ad95-44ce-8dee-8da6a58234fd", "comment": "Malware payload (Mirai)", "value": "f747909e121ef8ccf1c534df5d86b1e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182155, "uuid": "e39389a9-287c-45b5-9e6e-74ba9d347927", "comment": "Malware payload (Mirai)", "value": "89b3c3388b7aeec32f6b2fbb27b67a85c6864b8c8b6fa35eea97890458405cb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182155, "uuid": "d6ed6687-c2b4-4c72-90f4-9647510de150", "comment": "Malware payload (Mirai)", "value": "4c7dc4eb3247d4c17ae930ebf96500f4d2946e5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182155, "uuid": "76e189a9-10e3-47b8-8246-ea945ed78b44", "comment": "Malware payload (Mirai)", "value": "1426f101aa9a9a1409fc8cc3143559b3aad100455fe6957e5c81e68fbd3171cdbd9990dde089f9d5f5469e04dc8d897e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182155, "uuid": "62cd975e-68e3-4d57-842c-2f471b0417eb", "value": "T1A2930846BA419F12D4D621FAFB9E414933136FB8E3FA7101DD20AF6023C69DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182155, "uuid": "6c305dc0-2950-4397-9b1c-8944b5585dd2", "value": "1536:X8nIsO4uSypGgXF0Oas9clzTBTTgANlSBiWb0UxH0eZzzYHurhIUR/wNAf:NmgXFhas9clzTKtb0UxH0e1pgAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182155, "uuid": "ff27bcdf-06c8-40bf-934a-967e06f1e9a0", "value": 94080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182155, "uuid": "e5f4a919-82c8-4751-ba59-86eb88fb1d41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182155, "uuid": "96d86a42-d3b4-4417-801c-014c0773b51d", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3af91c-53c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779223207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223207, "uuid": "dfc1dc8a-1023-4c38-9d9b-4e3901e281ba", "comment": "Malware payload", "value": "5d9c95c021ec988e5f34bc5de71ff1ec", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223207, "uuid": "582b86ca-0718-49d2-9cb3-e3ff3d38bf43", "comment": "Malware payload", "value": "89ce12317cf464998bb88bad97e58aae34c29399eeb343c7605b1c55aedee1a8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223207, "uuid": "a5804fc5-b268-46e1-a49d-7fec0be02792", "comment": "Malware payload", "value": "918ad636523d70b8d6432adc7b54d0539509fb56", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223207, "uuid": "0355c6c1-1ad4-4e35-83b0-a0efc03c19a8", "comment": "Malware payload", "value": "b91f01b72b77fe1549be5fb709a18d1f5ba9b8e738eadaf49a39cef9b20d04643bee4f7c6aafe76bd34fe018c5505b05", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779223207, "uuid": "53968853-3b06-4b9c-b212-0e7feb40c339", "value": "T19507335878632A7FE27E4834D1D49F64AB3CBE258B218B81D365F50C89B7C9032F6746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779223207, "uuid": "620d8460-364e-4fe8-9871-54823083dc3a", "value": "393216:Kt3GpJiLnoHmGfu0Yg+WG1eQqGR7Jpln9FBVkUaykmMOTzqt1BwDoIrleztjT:vjizzGfu0YnLjb9HSUhkpft1BwDJgztj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779223207, "uuid": "fd82a47f-56d9-4d65-988b-d93b1ce17490", "value": 17616896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779223207, "uuid": "e42a61dc-700b-4324-80ea-3fc6bdbd8cb7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779223207, "uuid": "a01e61ad-d9f5-4f2c-931d-1268b4e6a294", "value": "CNCSyntaxGold_signed.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eba2639-534b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779171806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171806, "uuid": "692a8dc2-32a1-4ca4-883c-b99ba53f2418", "comment": "Malware payload", "value": "791589d8021f4593141ccc9139803103", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171806, "uuid": "71d50493-82fa-4610-acb7-ba59ed5bc356", "comment": "Malware payload", "value": "8b38648319fed30176a688858aa230f604d8559309cb59f9120d0e21593e5fdd", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171806, "uuid": "edbff195-d47a-46e0-be6f-061c777009a5", "comment": "Malware payload", "value": "a5fd4083779634bad9d270f742f83fb0f5b54b28", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171806, "uuid": "9462086e-05cb-40de-b8b6-5bcafd2890cf", "comment": "Malware payload", "value": "8516a28ac7530377d53e6d608371407fe76d37ccdd0876c5f7d4e47184122cafdfa5a5705cee1a7b589da455343484a9", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171806, "uuid": "7bd3aceb-09e8-47b7-a64a-cf5553654cbd", "value": "T1E014E0B1684B46B6E46522775F2E826282CE0BC79538B23258CD78E2CF6313FC63DD15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171806, "uuid": "ed6a1b9e-f124-47b2-bcf4-c938daedb6e6", "value": "3072:kyOxCq8tfN5lNXlEMDoJDPDB98UK/dpowSqY3psPoLxzTayoeXf3aIQP8UOIOZ7:kHxktl5lNXlEMsBkUK1pownvPo1zaek0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779171806, "uuid": "bfcaaa7a-b2ea-435e-a76e-da8ba3a52e03", "value": 191578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779171806, "uuid": "21dfcf4c-38f6-47e5-93d3-b7b8c657a920", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171806, "uuid": "901f4672-38ed-42bc-8eb3-db18b118299e", "value": "BLXDraft.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690fd561-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "227f8c3a-b013-4454-8c7c-4036ccaa4e31", "comment": "Malware payload (Mirai)", "value": "03685817f133bc308602688f669e2152", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "9a3a844d-1c5d-4b77-853c-aaab5ac82b7e", "comment": "Malware payload (Mirai)", "value": "8c0638118b3ca2952c5ec2e7399f699e696f777981d1576cc77ce7781b304c69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "48eeaea2-6cae-4ac3-ae84-ec04b27d0ab3", "comment": "Malware payload (Mirai)", "value": "6593d0100d73f567b08a0956d85ed2c1f9b82f36", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "25c195fe-5163-4428-949b-1d46592be3be", "comment": "Malware payload (Mirai)", "value": "380c65f8117d69b68a65c563ed3c848c6043be636a4535819ea3f39a945a8104fe1ff1c75939250c1e3d3857ed863b99", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "c5915b72-2117-45b2-a0fc-8655d4e2c762", "value": "T1CC043A02771C0A87C15B2EF036F727F183ABFD5116A6A680F21EFE845372AB16515F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "c417be36-5b15-4dc7-ae49-478799db0220", "value": "3072:cXr2prqx1nFoUicObENwt3k0jJ3ComSEJj1/WZK2mg65ZRS:cXr2prqx1nFoUic0EOt3jjTmSEJj1/Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219551, "uuid": "fa605a1e-baa3-48f2-a5a3-e59a446204a1", "value": 177237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219551, "uuid": "10f9e1f6-812f-4404-95f5-0be6cc4bc835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "15e6c210-b04d-4216-af51-53cfec81cbab", "value": "mynode.ppc_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9b685a-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157250, "uuid": "ea6b87bd-e69d-4fc7-b48f-8b12f399231c", "comment": "Malware payload (Mirai)", "value": "a94cc809ccfddfa16e8b297f9ee79b5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157250, "uuid": "dcd490be-103e-4385-8dc1-55b0843f5f3a", "comment": "Malware payload (Mirai)", "value": "8c1a4551875c3178da248817353976b68d44174ecb9e73d9ded7c365bb2f6bfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157250, "uuid": "411de9d1-7897-4cb6-a70c-fe7ab7e862f5", "comment": "Malware payload (Mirai)", "value": "57d6a7b9e5e60ed97646a740191f75a253cb5b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157250, "uuid": "7d45aca6-4a12-4c7e-8b61-7534583433a1", "comment": "Malware payload (Mirai)", "value": "228736e3bb700fa52f14923d8dc7a8a30cc481ff8870ecc6fd94f3460cf61ea6c0b6efcf966062a6df684634aab2cfc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157250, "uuid": "e1e3973a-71f9-4999-a556-003c18f55b9f", "value": "T19943710ABF650EB7EC6FDD3709A9174524CD651B21A87B3A7D34D81CF20B25B19E38A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157250, "uuid": "83260986-cd0b-4b84-8f26-819aa7e7670d", "value": "768:oLWu89xw1IlGGIunNlQodMR+e2KvDVuh3w6h12pcS5+46kjU4Z/ej5dIne2el9e2:oLWu8fwgIRkkLg9gzi9S1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157250, "uuid": "3e78b408-817a-425f-b1f9-612485687b80", "value": 59220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157250, "uuid": "ae27bac1-b350-446b-b6e7-d27a606f80c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157250, "uuid": "e989e786-b44a-4753-9bde-2e8b8246f2ea", "value": "uppermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4383df6-53b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779217583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217583, "uuid": "b804e0ac-6d2d-4a33-8d1e-25fd666a6603", "comment": "Malware payload", "value": "e35950d7ae2347921a3a9b02b4d3db51", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217583, "uuid": "4363cf2d-03d0-4a40-a855-3d55d8811451", "comment": "Malware payload", "value": "8d5bcaaf52d15691df333905c4e86c7b5eeebd8d7d7727b28d8da96d5d285202", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217583, "uuid": "1d2e21db-8e70-4e78-be37-0d31c20416a6", "comment": "Malware payload", "value": "1c1b6507c2824bd294afb5cfa40a9a085c639450", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217583, "uuid": "739d9c65-3216-4d9b-90e9-862fc6087c73", "comment": "Malware payload", "value": "bf5effd89a0e7c22d8dba5ea123a50f05078c697f9758eae5586bfd7bd4563d94cb842679f7c5b16f588772b039d2b0e", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217583, "uuid": "40b13b77-3465-46d0-b01f-8e6ed02a5c28", "value": "T181145118D8A500B5DA7C393B459F8A4E24BD3DD32A78EA423C1FF3885F35C5160E5AE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217583, "uuid": "3a14b89f-d58a-46d4-bf69-34a593ca4269", "value": "6144:0E+8888FFFF3333RRRQ+0M+0o+0T+0nky6kyoky+kySqICqI9qIAqIilVMlVElVm:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779217583, "uuid": "6306103b-7173-4499-9b80-1440ded48142", "value": 202973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779217583, "uuid": "a0fbb49a-bc21-45c1-8f85-4e0a5aaaea79", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217583, "uuid": "410e98d2-5783-4048-9117-52688d7ed213", "value": "Omega_Audio_Canada_1305.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd6165d-5393-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779202758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202758, "uuid": "baf29c65-ae29-4bab-9b11-36b42bcc5275", "comment": "Malware payload (Mirai)", "value": "712975b66986b4680d78933a711dcb31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202758, "uuid": "8cbae7c5-30c4-434a-95c0-3c4dd783401d", "comment": "Malware payload (Mirai)", "value": "8e9ed71bc2d3db942be6386f8581a9176d67513b6a23ee11f20bf8d702c98ac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202758, "uuid": "21b2b047-fccd-41ae-8312-153fb3821fbe", "comment": "Malware payload (Mirai)", "value": "14b807255ced9fa6a52ae143bbfddfbd935faae0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202758, "uuid": "c0cda90a-5daa-4fde-b414-012d4d08980d", "comment": "Malware payload (Mirai)", "value": "cac3d237c4d5f27e74dd620ea6ce3f143c5ec84bc87a4ef1591191fdd2711fddea7cfa330fe717cc7af60d4ca03100e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202758, "uuid": "474f7c03-0170-404e-98f8-2ebbbdad5a5f", "value": "T14C930856BA419F12D4D621FAFB9E414933136FB8D3FA7101DD20AF6023CA9DB0E76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202758, "uuid": "71786ef0-da1d-4155-9f9d-2787def4760d", "value": "1536:P0nIsOg7O6prgLFix+aEd8tLrRTkzNlq5imojMMBHE/ZrTYH+ThImR/woaf:sfgLFiIaEd8tLrjNojMMBHE/95zaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779202758, "uuid": "c16ebfcb-3b5f-4949-ac33-4c26de6928a1", "value": 94080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779202758, "uuid": "6069a453-ca3e-4c20-b0bc-8539ba5e2c21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202758, "uuid": "70032c0c-32c0-4c90-b105-7e21f19ca3c1", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb44039-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220549, "uuid": "7237327e-21c9-4582-b6fe-243feb7831a4", "comment": "Malware payload (Mirai)", "value": "3aa86b9bb0681ca99773c272544c129c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220549, "uuid": "dc42a1d3-aae3-41ed-84c8-b9de97fd59ec", "comment": "Malware payload (Mirai)", "value": "8ea8992bb342d910e6f07daa975594023ccf788d19c03a30a850ade890e4e41d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220549, "uuid": "25e56aac-c281-4184-98d8-b7de34a57f08", "comment": "Malware payload (Mirai)", "value": "3e40d27db0b33c74b4c7f8f5e026838823905e50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220549, "uuid": "8847008a-5aaf-4daf-8598-4506385d7b80", "comment": "Malware payload (Mirai)", "value": "2989b505cfb40cc248dfbab2f05b19de9356e2ec1676c9e95afbb7cd71da13ba293032106fc42f7f52cd6db3d792e0f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220549, "uuid": "52f18a3b-287a-4f0a-9e20-0bc97c25c59b", "value": "T158934B81BC919522C2D423BBFA2F118D332663A8D2EF3217DD215F21778696F0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220549, "uuid": "dea7375b-5367-406d-b236-5b1af1d7f1eb", "value": "1536:WmIwP7PLWJfcO0OW86Jta+a07CfA8go3MYNuO7qrU5y39oYM/n9+jD0oXWyjjgX:/zP7TsJW/u+aMCfA8xRuO+QzYM/E3NXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220549, "uuid": "12e2334f-9807-4068-909f-3839acf255f7", "value": 95960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220549, "uuid": "c15e0430-cb2c-4a87-a005-ee678a53171f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220549, "uuid": "b3578ad3-6998-4c58-a7e4-cfb8eb0566ea", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b9d44e-5367-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779184131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184131, "uuid": "8ee98a86-fa99-4f4e-8f61-c11725d4d54f", "comment": "Malware payload", "value": "346e83abadeb81086ff242c680eff182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184131, "uuid": "055ae9a2-0e06-440b-8dd9-6241075e4499", "comment": "Malware payload", "value": "909099a2fbafbac8da494b8e40f2dbbf9e50699d62a7ff660612572736f14f67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184131, "uuid": "01c4fef4-5bc4-4f90-a2b5-42be31dc6040", "comment": "Malware payload", "value": "7d37f238a6e93c07c4f6aea7fd34b6d074ce4b14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184131, "uuid": "ad48e363-0310-4e45-b74c-dd4174bbf564", "comment": "Malware payload", "value": "d0249f0f5a3000f0b312ff94ba4d80fa8aeec162c10fdb15a6e266ff7304e8a703c0709979cf11a3aec47aeae9555ef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184131, "uuid": "77ae089e-fb63-4334-9ef2-0f34754d8804", "value": "T1AF1833A3E224B2F6F1770AFF4647A5A2A0555CDCF258B331DAE0760832B0574CA1B9F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184131, "uuid": "5ff016d1-40fb-4cad-9764-62927b7e30a1", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184131, "uuid": "a3a9fb05-71e8-4e77-adfa-30844a064b90", "value": "1572864:gmhuPxGBArvpRV6FhNQauyQ/yjkxdAgHJ0MkzAghxFzQkJ2pagJxGMBFG+4lWpq8:gmhuP8BAbpm/unL9p0MUAgdQkIpp/GMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779184131, "uuid": "8c5d39a5-10d9-47a8-838b-d1158d5fd47d", "value": 92262960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779184131, "uuid": "074d214d-5db8-49da-88c9-56f77106bb00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184131, "uuid": "f6504f7b-8fb1-4c88-88aa-e53d46a790c9", "value": "909099a2fbafbac8da494b8e40f2dbbf9e50699d62a7ff660612572736f14f67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b4a47f-537e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779193741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193741, "uuid": "f7eb8385-d033-47b7-8199-aa874ca57788", "comment": "Malware payload", "value": "95f68e3e103440fceedcfaec37ad986a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193741, "uuid": "71969672-8569-4adb-8774-ab893b6bd526", "comment": "Malware payload", "value": "91f803fc231ec7e7b33a2a7fbf3858d4aa1d31874525e1b5f8ce4a52e20fb109", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193741, "uuid": "d6803275-71dc-4a8f-ad83-47a1c4f7d4bf", "comment": "Malware payload", "value": "73aa97c883b1587babd71389aa8cf09c3692ab3c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193741, "uuid": "319d58cc-92d1-42d0-8286-f0268ccad20f", "comment": "Malware payload", "value": "ea1c2b8deaecffb308afc58e69c6f266201d850377dd1dc39ae47d4df52200071be1e6139ddaa72fbe0983c20007e36b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193741, "uuid": "46a42322-839e-4b22-886c-6fddfc5a89ed", "value": "T1BFF19EADB84723570E50EE16346A530F4E865CE553C3732AAA8C1BFC1904CF812CBADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193741, "uuid": "c1c38c1c-534f-4bd8-b86c-efb0ce8364b2", "value": "96:3b90iryTCXW7HZZl/JGbanagNnUMWXCe8QgEQIKM0Rkhqknsog9M3tfffV4Pw1Tj:5u+XW75bhWGagsCdQkQ0RkdsIfHSPkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193741, "uuid": "f69ba753-6449-4991-b6f6-9175a8e45e49", "value": 7455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193741, "uuid": "a65e968b-7d35-4c2e-9259-067f4b83cb5b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193741, "uuid": "2f28d25d-e733-4e49-9c38-10032be74e8b", "value": "N1K_TT103080725.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc39504-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219584, "uuid": "a7038209-66e5-4e13-825a-cf6db17c79a9", "comment": "Malware payload (Mirai)", "value": "92c1d7747fbcfeea7071cb17935338a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219584, "uuid": "302c87b1-6167-4cf4-b40e-6d72a8e60e4a", "comment": "Malware payload (Mirai)", "value": "9264c73da2f80cd1f5a4b19cb2e1b9259c62a908d82837bb09491066debae580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219584, "uuid": "a3456173-d23f-46be-8569-133f4a35c2a5", "comment": "Malware payload (Mirai)", "value": "115864918ed84e55713ced7d668a591e6a0d51e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219584, "uuid": "e1a6a1c9-87b3-4fc7-99bd-94c3415b8c02", "comment": "Malware payload (Mirai)", "value": "554c932503e1b2649bcdadf7a839053601a8b1fd6dd8e088db7cd1061d9aac582402058aaee60089f887e6f4c439972b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219584, "uuid": "474014d2-3475-411c-8c0a-665a1948d0d4", "value": "T1DF83285AF9814B11D4C512BAFA1E164E371347F8E3DE72239E24AF3037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219584, "uuid": "f3fa70be-9a69-4ab9-8f5a-9cc9db4f029a", "value": "1536:Gpn2EgaNGvcV+2sE/7iMPUNBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYt+:BVE+2dmTEZCSHYMactW4Bi9gnS4V0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219584, "uuid": "1618d7eb-eded-4346-a46c-344fac9a851b", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219584, "uuid": "01c0b743-7654-4ff3-a636-4eaed591a5a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219584, "uuid": "0066cd23-6557-4cb8-8643-85226f3aeb22", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cead0144-534c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779172477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172477, "uuid": "181ed5a2-cd0f-4a62-a225-92257085a9b5", "comment": "Malware payload (AgentTesla)", "value": "7b9c1583a2fa1a5115a416a33e2d94cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172477, "uuid": "7659704a-96c7-463c-829f-13d370aaf632", "comment": "Malware payload (AgentTesla)", "value": "92b8ded444bf0b7adf710d81a6c3d9c101b962a6f440c0bc1fa3cb1bc66054e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172477, "uuid": "8a92484c-65b1-4c38-bc12-ef7ef3e78cb3", "comment": "Malware payload (AgentTesla)", "value": "b4e6ecd9ff5b2a137011b809ea411f0ac30ea548", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172477, "uuid": "5344d75a-c0c2-4bf2-bdca-4acad2b00f6b", "comment": "Malware payload (AgentTesla)", "value": "cd5590c17d7f2d28f57727e1be363bc416be8e2c99ddb3872cabdbf877340841261da1ca67fbc336daa806ec0b63033a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172477, "uuid": "9bcf7efc-f1ac-477d-bb37-b309ad77ef93", "value": "T108B401543F7DCE03D2858CB45EB1E9ABD6384D824D6E4B038BB17E0DA8797C8BE48641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172477, "uuid": "1ab37c1c-41a8-4459-8bef-c538c37a3c6b", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172477, "uuid": "5d15d9b7-1564-48ea-9d58-ade9eede57aa", "value": "6144:apkXGh6aeKHGX2RK49s2wWzZKKcLJnqqKkE/1vLgY5AE5lDcxlrq6uaP4o/OITs5:7BGLTSNqqK5h5Z6u2m09K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172477, "uuid": "55260ba1-83d1-441b-8d69-46577bee31eb", "value": 523960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172477, "uuid": "51097a99-33b1-4208-aefa-ad2760ad89ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172477, "uuid": "3164c92a-33fa-4485-8289-0436437fe502", "value": "10045_2026-05-19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0222caba-534e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779172993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172993, "uuid": "a489f785-5b7c-42f2-b16a-033582cace15", "comment": "Malware payload", "value": "2149c3e93f5b457466a4c578447b2606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172993, "uuid": "deaeaeaf-c5f4-431a-a543-aa9d1139b011", "comment": "Malware payload", "value": "92e232305326e7e8632407425747c2d4d0a1401574f761c5461e2453393cc8cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172993, "uuid": "5209fccd-32a1-4f14-9554-b8cc59d17c4f", "comment": "Malware payload", "value": "b4839fc69ed781ec76f613fbeec8498a1210f525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172993, "uuid": "8d3957f3-1c6b-42ec-9907-3611ea773a64", "comment": "Malware payload", "value": "ab1d2c0a5608d303fd52e8ff734cafceb0026f32025c576d287ccecb1c65b87507ce2d0789b8a3cdb868ceffee402cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172993, "uuid": "7a640993-a0e8-4a1b-aa8f-e4bf5e8886cd", "value": "T1E825231993D2B4EEC056E1B376EB5372D673F91012266ABE1F90EEB50F80D81372C529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172993, "uuid": "8d78907f-2be2-489b-bc89-69d1bff6692c", "value": "c1f4184fc0d8e903ea01b5e3159c8812", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172993, "uuid": "40c7f89f-aa94-4aee-abc3-0b74a79b4851", "value": "12288:UGrKzjTDzjTDzjTDzjT87rbL7rbL7rbF/8ybUyuqgtRPCPFsq/fizI8x9dTwxm8/:U0TgJLWlisACk85v735Quor3Wng6Oul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172993, "uuid": "236a5861-b2d8-4992-86d5-3d1031863505", "value": 962512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172993, "uuid": "25d4ff26-1b17-49af-aeec-7ee337918302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172993, "uuid": "635f6b81-de25-4b4f-8c36-6c57ab3710eb", "value": "92e232305326e7e8632407425747c2d4d0a1401574f761c5461e2453393cc8cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f286448c-5355-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779176403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176403, "uuid": "d072cadb-be85-4ebd-b205-e406d8d0e822", "comment": "Malware payload (RemcosRAT)", "value": "b56451fe65bba9b74978b29d13632f07", "object_relation": "md5", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176403, "uuid": "7f76b753-01cc-4d1d-a892-a04f5df6d539", "comment": "Malware payload (RemcosRAT)", "value": "930a0ee28bf06c7b94509b61a49a374d29880611f81b05bad6559d445802d7d9", "object_relation": "sha256", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176403, "uuid": "3d692708-68c9-4345-8240-0159ccdcdd7a", "comment": "Malware payload (RemcosRAT)", "value": "d62dba0fed85475664ae909e90533fc4cf082a77", "object_relation": "sha1", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176403, "uuid": "eec8baa5-baa2-448e-ba17-07f4bf43e8bc", "comment": "Malware payload (RemcosRAT)", "value": "1bb1d326b483a275f864e186cf1a953631a343bf276fe2293df8ff92b0f988e97157b2e63447dca516d69cd8756a655a", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176403, "uuid": "49f25e9b-23de-4086-aaed-52b2d65b8535", "value": "T1A9F122384208576949B2226AAB48C549FA5741F30BBF2E51F8CC82355F7605DE13AFFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176403, "uuid": "70acd7fc-fa68-40c1-95d2-8fda917cf495", "value": "96:F9o11ft+114VSIoNckF073kmBWX/wAkqU1u2xBeH5af8nJLdE:x14VSId3u/wA7UZxsH5T6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176403, "uuid": "6a5f1721-52ed-4776-9ee1-cbb35bb22c71", "value": 7560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176403, "uuid": "6a4b1c68-82d5-4bdb-949a-000419a298e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176403, "uuid": "3b510f02-1e7b-43fb-9724-4e8dfbc7c891", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c46b258-5369-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779184794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184794, "uuid": "8f2e48d2-2565-4ed2-86cf-099fc66d21ea", "comment": "Malware payload", "value": "72d2c310ac003b0835cb207862f3dc96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184794, "uuid": "b8a587ac-15ec-42cc-a10b-b411915f3e65", "comment": "Malware payload", "value": "93edb88ef3ce2a51e44d9f63aec21ea99b709695e2b2a09871fd4855fc1c0502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184794, "uuid": "598977d1-8131-4721-8b12-08a38924ee17", "comment": "Malware payload", "value": "87b6f100e2e624b1d1d19cf0bfd6dfe55a3ecae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184794, "uuid": "4afe19b9-037e-49a2-bf26-c7cbb958dc6c", "comment": "Malware payload", "value": "073d0b66adce32f8217d0a5ad98551f9f93cf7955786358f8d757f2a20525ecd1b1013248b0a38d171130812e85f82bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184794, "uuid": "cc9cf5c5-0f16-41cf-8076-5052f3f065ea", "value": "T192E733EA329B3819EC26973D988DE65ED1EBEC41C03793494154B7F11EB83164F8A83D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184794, "uuid": "5d64f00d-2433-414b-b185-94da5a0768ab", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184794, "uuid": "76679fee-05ab-44b4-b033-7c355000aa44", "value": "1572864:Ihc9/hPf+kKF1jO6ZPnEfkWEQQSciBzv6fr7Wp/g3Ydf:Ih8J+7FAgQfcYv6D7WpgSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779184794, "uuid": "e8ead36e-d8fc-45ba-bdb1-f74a6312f2d6", "value": 64627440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779184794, "uuid": "011f342c-f0b5-4ab7-b5fa-a7af9a3d4438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184794, "uuid": "bbd60e42-f3dd-43f5-ab5c-766dbeee0a0a", "value": "93edb88ef3ce2a51e44d9f63aec21ea99b709695e2b2a09871fd4855fc1c0502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6508f5c4-5359-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1779177883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177883, "uuid": "6595a708-6bd2-44db-811b-5d9dd0b84598", "comment": "Malware payload (ChromElevator)", "value": "650a3e0166bff1c66af68901d95e5a02", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177883, "uuid": "dc77ea8c-93c9-48e9-afd5-de7f1ca64776", "comment": "Malware payload (ChromElevator)", "value": "9408dfa7ca622d0db087985ff6d4288b143e4e4a11c7a734ea4e151b73de8d00", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177883, "uuid": "c4b57213-8b26-40d4-a560-78e6db46d481", "comment": "Malware payload (ChromElevator)", "value": "f40cfc3be4a3da4e6b6a34b9f5a4a524d64fd6d9", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177883, "uuid": "7d6d96a3-e356-4692-9605-016f2a12d596", "comment": "Malware payload (ChromElevator)", "value": "839393edf00c8bfd12ceac3c27f2e899aaa00c4d4019b3d2fd532d665419b0981863373a13ca906754851b3f52af150b", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177883, "uuid": "4f997f8e-fad7-4bb0-b1c7-4cf0d59d7837", "value": "T1DDA78C0773EA01A5E5B3E1388AA74103D773B4675731CBDB329D02552FABAE09A7E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177883, "uuid": "4ad6299f-3896-46b2-b182-dd07ed31d8dd", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177883, "uuid": "2ba5db46-8424-4722-97ad-de2c6ba262d5", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfb:fMguj8Q4VfvYqFTrY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779177883, "uuid": "c6f41e0a-67bc-44cd-8e5a-72ae77ba49e3", "value": 45303966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779177883, "uuid": "41467452-6d3f-4114-a2b8-7e92cb081138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177883, "uuid": "bca226d8-6926-4b0a-bf07-6fb3aa8ac0a8", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f611d087-53b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779218929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218929, "uuid": "f7f4240a-ac58-4b2b-b08e-65efe0155a88", "comment": "Malware payload", "value": "ee19856d178baf866eb01f9509f35fe4", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218929, "uuid": "ff64e6a3-9170-4054-936b-cf1b44ccdcd6", "comment": "Malware payload", "value": "94de088516e94c697363703f855cd1f8d50453b362eca4e626f0621645998bab", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218929, "uuid": "ffa1b70b-0f4f-465e-8ef3-1c651fe229db", "comment": "Malware payload", "value": "d55c54bc3ca9d094eee4920b0fe86a2dd35e3d88", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218929, "uuid": "89e83aa2-6278-408a-8121-4d34b7a47f69", "comment": "Malware payload", "value": "1bc2ada5d086d34dba4af4ade807f971122344373a554b6ad67cb1afa625abfef5e6380b912f9b9ce7a0d9319f4b67e4", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218929, "uuid": "02b6358b-20b5-4d60-93b0-b3cd5ad7ac64", "value": "T1B646F141B3D695B5D0BF0638D8794266AA34BC109712C7EF57A4BD292D33BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218929, "uuid": "a399fa50-0c92-480e-bf9c-2e5ea3991fb8", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218929, "uuid": "8455d95a-1c31-420d-803f-97a25a39e1dc", "value": "49152:dfmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:Ors6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779218929, "uuid": "898e4c09-9146-4ac9-bed6-3f8cd5071806", "value": 5651488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779218929, "uuid": "8df75da0-3055-4692-8155-a757de9fc78b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218929, "uuid": "1c7a9aa0-f252-4c3c-9806-e665a49faff5", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07d842a-539f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779208182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208182, "uuid": "ce45e398-50ad-4e30-b509-9f7a90020348", "comment": "Malware payload", "value": "f82d5f876993d2859deefa10ed50a695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208182, "uuid": "173ac9da-230d-4b22-ac51-96e8ecefdf35", "comment": "Malware payload", "value": "9626bba0b108243a5e32a0fa648008626e8edd3d1101de8e980f15734e6b4407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208182, "uuid": "64f47f5a-cf0f-4ba2-bab6-b0dd973b7e72", "comment": "Malware payload", "value": "497a8608a6819a91508d4b995cf2262a004130de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208182, "uuid": "abfacd9c-d9be-46fa-845e-35a4a39ad9dc", "comment": "Malware payload", "value": "7faac3a3a97a008ca2fe223d9e6cc2b73eaca5d625d2e711cd331674dd74cc1e29110a40d28f60ba1a1b64666aca85c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208182, "uuid": "9b92b4b8-941c-4cad-a3cd-68b2bea64df2", "value": "T17C162903B46144BCC0AAB63494E67940AE213404E73977971BA36FE12E767D26E73B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208182, "uuid": "d94abd72-3201-4a83-ada7-26b033884f92", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208182, "uuid": "2a03ddbc-db93-4dc7-aab9-eb63f973ab04", "value": "24576:3O1iJRBMUdIhgmuDKNEOUB+Y3EwsYfkmNfvGdwRzgrPelesX92KphhHv:3OozBtIhgmbYdsYfkmNmdwB3rhHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779208182, "uuid": "51900ed3-39e5-4469-be6c-adb6982fca29", "value": 4042920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779208182, "uuid": "a5bee387-fd92-49ed-8177-f11b8d75027a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208182, "uuid": "62e1662d-820d-480d-b4ff-34bcc187809b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa0614d-534b-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779171861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171861, "uuid": "a32bc203-bd09-46e6-b823-f736e2e3dc72", "comment": "Malware payload (MassLogger)", "value": "df02955ccbd8055f6b6e9241732ea1e3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171861, "uuid": "4accad03-78d5-4793-ac8d-53f23ed10617", "comment": "Malware payload (MassLogger)", "value": "96f60585414fcf0960b25b271b84d0cedb94858b94d01be4a348e2b1e39953c5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171861, "uuid": "f8af7bf7-2540-4883-9fac-75098f84dfab", "comment": "Malware payload (MassLogger)", "value": "3b325307406aab2a06ffa26634aa5d2510e48cd2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171861, "uuid": "7974b36c-1085-4018-8059-c4d7c4f92f5e", "comment": "Malware payload (MassLogger)", "value": "05aa6f8bb0d28536fc96d7c9455f45f923dea83c4fde576bcd02cb7c253d2557c9b9e3838c7823189de138039ce31ad7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171861, "uuid": "524d4be2-6431-46e3-b957-d8a4c6e56f43", "value": "T17EB502D7B4EEF4D2C74EF2414C8C250E9F62705E91E24492391A7FF7A30968EB0665B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171861, "uuid": "40dc6000-bf40-47a7-a69d-b1fb552a5dfa", "value": "192:opI4kS5jS7cVc7/YmcTEJoc3jtEYmcZcDwJmtGxUym2cmmHILcaUcXL/YLDmWZcv:o+i8/I0PXCmlrvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779171861, "uuid": "bd158aa0-1308-4771-9573-fa6e861c4542", "value": 2292611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779171861, "uuid": "905c5275-fd50-4392-8672-5bfd22ee026f", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171861, "uuid": "045ebbc2-eb2e-4445-a6cd-e9928dda37b7", "value": "rckk99057332.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2b9407-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219560, "uuid": "4cf205d0-3313-4314-b65f-8133cc0f041d", "comment": "Malware payload (Mirai)", "value": "786523ed316b98ef8a4a9e65fe3b6711", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219560, "uuid": "b1d727b5-1d51-4e86-8ea3-cf39899e1eb5", "comment": "Malware payload (Mirai)", "value": "971f611052a509f40b379fcd6b6ff4b8afeff005a845fcd81d9269fc739f684e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219560, "uuid": "dee613e3-3386-40f7-b124-e85a08247015", "comment": "Malware payload (Mirai)", "value": "bac336aeb728a918dce34d0acc1a30e7e1c6f4c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219560, "uuid": "491f7e16-d363-4fb4-a32b-1419ef5508f0", "comment": "Malware payload (Mirai)", "value": "b8f2040b56ca3e26446dc28f9dbcc9fe64fc3ca6c3e3e0399e8c9e923e41829fc7e722a3762a084834848aa580b72477", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219560, "uuid": "a7294a20-5316-4847-999b-8afb8358594f", "value": "T157F2E174D5998FD2EEDA4FF02AD193D97BE81E4B1711CCA33002CF919B065018ADAED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219560, "uuid": "670d914c-ab0a-4cbe-b003-1dc701e880f5", "value": "768:+eDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu28nEhK/y4uVcqgw09r:+CRocD0Lu/PWUWr/iu5EEy4u+qgw09r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219560, "uuid": "739971b2-0d0e-4ff9-85b1-234718c358a8", "value": 35140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219560, "uuid": "4dcde984-c76c-4d20-a548-28bcc89c8147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219560, "uuid": "02729cd5-b37f-4390-a7d0-f30e61e2631a", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72003a3f-5389-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779198521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779198521, "uuid": "23cc6105-5f39-47bf-8f6a-e7535174b8ef", "comment": "Malware payload (Mirai)", "value": "c017d2c275501bdb99aea3429aa19dd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779198521, "uuid": "fa7072dd-bc39-41ff-9503-82ff9a02dd80", "comment": "Malware payload (Mirai)", "value": "993198ec2862c8a6eeb84cadcbb31c83257de633de9d0ea735800a190a9bd576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779198521, "uuid": "b91a6afc-b841-40e4-895e-5f3d74c630f9", "comment": "Malware payload (Mirai)", "value": "d33f0d0c83e5a08773c205ea83e1868811158af6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779198521, "uuid": "d4e7cd1f-b586-48bb-ab46-543012b7f912", "comment": "Malware payload (Mirai)", "value": "b9e21e31106f3585948324ea8ef6bc3d0ac7d8536ca58bb2943d5caeb2367d679e51d4cce133df7312f75af784880368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779198521, "uuid": "428e943b-4a84-4929-b02e-ecab91d01583", "value": "T17493F705EF610FF7D86FCD3706A9070635CC955712A93B3A3674D928B64B64B0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779198521, "uuid": "ac49aefd-95aa-431b-9e1a-d63e3442af26", "value": "1536:cdq6XS8N5qjBvRIYrC00I20SyNHZ6W2CrV2EuWjtjjbhIUR/kr:cdqr87gE/0SeHJJdjjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779198521, "uuid": "2f90ee79-8331-4c6f-95b5-cced9f4be73d", "value": 93992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779198521, "uuid": "0f277dbc-5401-4726-938f-3e72dd233cda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779198521, "uuid": "d05c7d30-836f-456b-b872-cfc8f1ef2d34", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d026fa-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779219551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "96be7cc9-c7aa-4e67-a015-b698e396cf67", "comment": "Malware payload", "value": "9c58ae480719b22b534f27dd269ad8d6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "d1aafa3a-b28e-4905-ad72-6380cafcc441", "comment": "Malware payload", "value": "998c7a403d66dc5aa537359e7bade0736cc4a9a4d2d0e02cad51f4b48ff3677b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "603f1438-c0c8-46a3-9955-035266eb1594", "comment": "Malware payload", "value": "565600595a6b70885ae68fbd099925f0cfef20a5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "8266331a-7c16-436e-8dc0-107031d8620e", "comment": "Malware payload", "value": "2a58bc72acb3382bf201d62d44aee17bc58358dbbff0eae985151b106d4eb56ef839b496b95d5d36e79c9266710a1a0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "cb90dc92-976e-456f-bdf1-1eefd80adf17", "value": "T10734E7076BA14EF7C89BCD3306F6860124CEF45725A46B2B7374DA6CBA0A94F49E3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "76cea3d6-610c-45ad-a609-8252a8680fe6", "value": "6144:xPicwG2jRT1DdLTJORbTmuiNCt1YwlsVIsvwMd:gG2jNjTJ+TmuiNCt1YwlsVIsvwMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219551, "uuid": "701ba8e0-3bd7-486c-84f6-5b3647f908f2", "value": 237476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219551, "uuid": "fe7adf2b-f9fc-4287-968e-331c73cdae68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "9fee0561-9074-40b0-b341-cdce2705479b", "value": "mynode.mpsl_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac34d06-53b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779218480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218480, "uuid": "91a047fd-4ce8-41c7-9e5c-7e52221c78dd", "comment": "Malware payload (Mirai)", "value": "8d42f859084b22aafdd1f1b42e0d2aba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218480, "uuid": "cbf1d667-7e22-49e3-80c5-f7893c43f746", "comment": "Malware payload (Mirai)", "value": "99ebad6a485880d9c1b4f5c1ee3deba935483280702215bfbef4f674ef3d1b86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218480, "uuid": "778362e2-40db-4440-9171-c540e8d800d9", "comment": "Malware payload (Mirai)", "value": "e9ab115a28e388bacc9da25e7aada27b2250501b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218480, "uuid": "d9d76321-0f29-470d-9c30-3f7d3b2503bb", "comment": "Malware payload (Mirai)", "value": "926ff4c8c5b2d984e63ee17d8dbb9766916b9615418745a0dbbcc00597fad60a3db6f92bb0fd9d94fdd6b382624b6e30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218480, "uuid": "699b4bc7-36b8-49be-9f22-66e7c2867948", "value": "T104430159A77B5CF0D95A8B71DD709442CFA5C750B19A3A0233DC933870BB402A7CAE87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218480, "uuid": "6df7f50f-3fb5-4845-bd1a-8dddb0db3d89", "value": "1536:BDnb+bWlF4hX6x6ss71v9hLEIDQ1LinBOiCGAu/Xlb:Bnbcdh6xfsZVhLEIU1LfGVVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779218480, "uuid": "9db1f294-7476-48bf-8d97-4c8b0c06bb89", "value": 60444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779218480, "uuid": "8537a479-6410-4ec7-8b48-fe48f4918f67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218480, "uuid": "9264cb4c-bfbd-4750-ac9c-7e7b0c345e97", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d6732f-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219549, "uuid": "7be4a1f0-75ac-4148-894a-a1a9e9266977", "comment": "Malware payload (Mirai)", "value": "964c58893e0ca83f8052bb64ca821d07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219549, "uuid": "e79f5cdd-5b98-45b6-975e-0644c30bff75", "comment": "Malware payload (Mirai)", "value": "9b2386c76483558d1ff9ccd02e6ed96c8b756075a5cc0efceb829eb4cc567f88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219549, "uuid": "b4c844e8-d0ec-43f0-8ff0-82bf9b07bcbe", "comment": "Malware payload (Mirai)", "value": "2a2058947b2795c779a3b1eb90771f09ab84d187", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219549, "uuid": "bf7fec39-5956-4ace-a431-e76ccea349a9", "comment": "Malware payload (Mirai)", "value": "f84d0cce8aa3a98fa2247e7a2da06964b86bb8de48dae1e09f63374d8a21c38292a1257564670865a6aeee2a4e9fb646", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219549, "uuid": "fcc9f437-0672-44d4-9bf2-33b8c2baa059", "value": "T11A14090295518B93C1C21B7ABA5F425937336F68D7DB3302AE28BFB42F46B9D0E2D511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219549, "uuid": "4d03ab2e-69e0-4899-be0f-fd07a7876cbc", "value": "6144:lcbQXyWvaTeiy0ufHKFeDEHSmWd3mwZf0cwgIif:lccX5va6H0uyFtHSmWd3mwJ0cwgIif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219549, "uuid": "028c8497-ba1e-4d7a-91af-5266a2dcf469", "value": 203852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219549, "uuid": "0d865352-0bfd-4cf3-a3a8-a92d26f52a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219549, "uuid": "08c4fcc9-3b90-49b7-85cc-5c4cdcf013fc", "value": "mynode.arm6_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43145215-53c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779224212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224212, "uuid": "792c9849-85f2-4a63-88f2-99305fc5cc67", "comment": "Malware payload", "value": "5439b63b21336e865ccba5524bf8b474", "object_relation": "md5", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224212, "uuid": "7e40f57a-7106-41ad-8846-5de67f7cc9ef", "comment": "Malware payload", "value": "9bb18aa7ef3377783fd0b8f86b164d80824a880cfca2176dc8842bf6229f39b6", "object_relation": "sha256", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224212, "uuid": "745d647b-fdaf-4d4f-ae3c-d769c5b3c96e", "comment": "Malware payload", "value": "1baf9bb256ce23ec06742fe1f419d092f4cf86ef", "object_relation": "sha1", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224212, "uuid": "d9f37337-2bcb-4cc9-9e81-7052c59dc44a", "comment": "Malware payload", "value": "8143526b19fb3ff1b58a2c719ab20beff7b5b9567d38bff2ea374181d686fb1c5076e035e60c84ae48c1cddba10160c2", "object_relation": "sha3-384", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224212, "uuid": "66db7c95-5896-4b99-98cd-e669f24f8f97", "value": "T104C1BA196BD80636C8FE07BA94F357432570FF41CE565BCF49C461166CF37641A263A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224212, "uuid": "76c4eb90-848a-47f8-b51e-a13e8fe272c6", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224212, "uuid": "9f4d45a0-9de6-47e3-a4f6-4c988534c6d3", "value": "96:C6/BAMFk8ldI0OqXjVO0WaWWgWll4PLNEK:CupFXaVqJPWakW/4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779224212, "uuid": "904c3b5d-f363-4050-8427-3cf890443281", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779224212, "uuid": "1549901e-c8c1-486d-9e24-11d0f7f89f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224212, "uuid": "1fcc97ac-d704-4932-90df-db39104bc8d9", "value": "9bb18aa7ef3377783fd0b8f86b164d80824a880cfca2176dc8842bf6229f39b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a14f780-53d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779231874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231874, "uuid": "0e4ee8e6-fce5-44c6-8e82-0a27d5dc3e78", "comment": "Malware payload", "value": "666e764e3e258930870f597719cf35b1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231874, "uuid": "fc6934f4-827c-47fd-9b65-507c7bfa1e71", "comment": "Malware payload", "value": "9c6c4a99b6ecdd00ed1e2932e31aea63becfe3c0bf0289f333264eb4768194ad", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231874, "uuid": "b171910b-d07c-4bdf-9418-af0d9c2f23f3", "comment": "Malware payload", "value": "10bc1d312790a8b7dd019ccfa4db4e7cc870926b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231874, "uuid": "57911fb8-a744-4ecc-95e3-68a8746574eb", "comment": "Malware payload", "value": "a8c6fe78ee2d706737253d10c363264a5bbb7791e0e8b2b9e6402657392b966366db55067978cffa6baf47f361ff259d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231874, "uuid": "531561a6-46df-4117-8247-dd22e86d0b48", "value": "T14FB25D0FB8154329D4E100B092729F7BC9B9A9B73788A8DBF38044CD5A646D6FC3695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231874, "uuid": "1354f72f-42b7-46b0-b72f-5f1d54b7c49e", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231874, "uuid": "3d594d62-50b8-45a6-b1c7-537f416a274b", "value": "384:iWthb/HJnv+IP7rGNutdlLHMwXud2YLSLf7cpHB9z:iWt15y0dJMw+dwc1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779231874, "uuid": "77dcae24-46d5-4d7f-aa0e-fc2a6d364b8f", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779231874, "uuid": "8b10f488-9e64-42b2-b285-7b2bc7ecf054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231874, "uuid": "e8c4b6e9-d81b-4cc3-a5a1-0e254f4718f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc82add-5327-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779156502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156502, "uuid": "37f8ec9d-b0c5-4556-8924-cf5e878e6aa5", "comment": "Malware payload (AsyncRAT)", "value": "7991b9c6629b9032e2d10d8e2b0a21b6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156502, "uuid": "f954168d-86ee-4148-af4a-3da0c1b5b116", "comment": "Malware payload (AsyncRAT)", "value": "9c9e5be6e5556b7c01220256aa557e599c762aec1c79973d0f839608802751a8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156502, "uuid": "fed6df95-7859-4b9e-9a0b-adfa43e113a9", "comment": "Malware payload (AsyncRAT)", "value": "03bbd46935756eb092d71008903cb65128f2942a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156502, "uuid": "2c0d6dd4-c424-45bb-af4a-651c1a8ced48", "comment": "Malware payload (AsyncRAT)", "value": "8eb47340fba7ee4baec22b482436524ed631e0b1e363757a825e325e67ddf01e13c8a5b974b38ba71bd010a0c2f379b4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156502, "uuid": "13a5e606-6e27-4264-9f2f-9a1f06b69d20", "value": "T146232B0037E8822BF3BE4F749DF22145857BF6676603D64E2CC4029B5A13FC696525F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156502, "uuid": "9ff3ec84-ffb4-4712-ba53-939d308d78eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156502, "uuid": "d1e0e252-7c42-41cd-b8e1-7daaab88b52d", "value": "768:Tu7fNTdMEGBWUZDurmo2qrKNOd5ReK8yZPIVB5z9Ue0bzYK7jsaIgBLBDZMx:Tu7fNTdjN2kReLJVBARbzYKXsavddMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779156502, "uuid": "c3527f90-f532-4eba-9295-26ce9ea60c6b", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779156502, "uuid": "fc8b4355-eb0c-4a94-9bc3-c477d080b272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156502, "uuid": "9922644b-2b73-46d6-953f-9abd433b6d70", "value": "SayGex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef01ec3-53b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779216447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779216447, "uuid": "933248ed-a638-41bd-9758-49660ec7d28e", "comment": "Malware payload", "value": "49242575f213d665b54b403168fa6828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin", "colour": "#8AF348", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779216447, "uuid": "4faaff13-988d-4178-a72f-075dc8295d08", "comment": "Malware payload", "value": "9dc129be20fa669fc730b8364b83ecad913acd1ad1706b9deb670dbe104fde12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin", "colour": "#8AF348", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779216447, "uuid": "38e949ba-c407-466d-86bf-d917c8297afb", "comment": "Malware payload", "value": "f1c38844b84e957dad31e90a9c59ffe00a9b8ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin", "colour": "#8AF348", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779216447, "uuid": "5ccb837e-9790-42a2-9f21-13acf9f9df8e", "comment": "Malware payload", "value": "b5c865df0e703d92cdca5c9d0750de4ccf034c2c6c0aa07ba08aac0e3e2f6d1e752c3f5a77c05e1fa004d84f04b91337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin", "colour": "#8AF348", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779216447, "uuid": "e6ab71de-1318-42eb-9eaf-a9e32d960261", "value": "T1B728C58F1A6A5983E0C2437E10D1A588CB91FB3D56B7C9B4ACC5D09E544E9F8433F39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779216447, "uuid": "bfe2831e-214b-4684-bb84-12116c118e92", "value": "00670d17960be47fe34b76072bf9faf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779216447, "uuid": "49a77299-5b4f-470d-9290-986714c163f4", "value": "98304:kzUrewT2eqGoS5xa6MWYlKn4jTLYaI7aSXxG2OcxVOo:kzUykvqGosVyK4jbShG2lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779216447, "uuid": "099c5bf5-37b2-45ed-9629-8c432e785d6a", "value": 97944064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779216447, "uuid": "050a068b-d2d3-41a0-91e0-3bcd34f4af76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779216447, "uuid": "23889b91-ae36-493f-ba90-2b0c331e319f", "value": "dfgsdfgbvbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec57efe-5355-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779176235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176235, "uuid": "afb37255-63bd-4c55-862d-0e52e0fd62a7", "comment": "Malware payload (RemcosRAT)", "value": "45f3730255c7be9f51d8c69d86362a55", "object_relation": "md5", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176235, "uuid": "c77eec74-6866-4501-81a0-cf61e2321fe4", "comment": "Malware payload (RemcosRAT)", "value": "9dff7bdbf628a35a24c1ac936bcea1637e2d83cab257f473d4312eb8490484e4", "object_relation": "sha256", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176235, "uuid": "4a32887b-c66e-4c79-9695-83e74d45562a", "comment": "Malware payload (RemcosRAT)", "value": "a733323e8d73ec73c6c78375dc08c92ebd77a503", "object_relation": "sha1", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176235, "uuid": "d8e714a7-83c9-4012-8fc7-c6c2a171a1db", "comment": "Malware payload (RemcosRAT)", "value": "e3d220bbcf7343ba1094b046507e286a880e92aa5d53f9e0bbc77673ff209dfef6ce7008bed0fd35e26cc37afd112f20", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176235, "uuid": "cc6b0884-4049-47d7-bc52-4bf2f064f6d3", "value": "T10AC4230CBDAE4C2A89EF14C39894C12F8DA88911955F4875DE7FCAE57FD00B7B60582E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176235, "uuid": "79ad0d47-275f-4736-8a0b-f5bb78a83aaf", "value": "12288:n2KJJW92vLaOe1QcBbcBPMwUgdsApmOHCncPZjE:+9+LbyQMOPIgdsAXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176235, "uuid": "ecb4dea1-04f4-42c1-b979-6dc42a669427", "value": 571372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176235, "uuid": "21746ba0-ce7e-4742-9187-4f5845256e26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176235, "uuid": "147fe3a2-17e6-4e27-81d0-9c20abf19d4e", "value": "rammm-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522becc0-537e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779193743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193743, "uuid": "e60e3caa-5a59-4e7b-a812-59d0cd845698", "comment": "Malware payload", "value": "63bec0e290f35e846b8c4e3a9f87da55", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193743, "uuid": "4427475e-995d-43b6-890a-a50fee5c3de5", "comment": "Malware payload", "value": "9e309f2bff7faddf39dcc5e5b61caa4548d124064a905c842794eb97adb89590", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193743, "uuid": "f26a9bad-f3ab-4294-b718-9723837d361d", "comment": "Malware payload", "value": "2279d4bfde34c4a942dc0a6520e88cc55d6a7c8a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193743, "uuid": "f001c1f0-6652-4c12-b0ed-03a23c5bcf05", "comment": "Malware payload", "value": "f3684f67a92ff6c9d7b66de5da9d96bd01f093e7bae58270090190ad9b351e2e8f0fe8b5e840ac924e7a0a82b2544b20", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193743, "uuid": "9542d191-c68b-4d6d-adff-1168c9d48064", "value": "T188745A0353FA4609F0F35B98AA7A50614A77BE9A1D3DD02C11AC250D5AF3E18D8B67F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193743, "uuid": "98adfcce-bb14-4e27-afac-93312ad27c34", "value": "6144:Fk172jTjZREj+kRDTQt12y806kv8lHuO4aU2BKlUQiNt2x63Atpdq/L0Tftg0LvU:FkSvvklQtcZkv8V4aU2BKlFqkQOdq/LV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193743, "uuid": "580c8f9d-3598-4495-9a5f-49b42ee512be", "value": 355732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193743, "uuid": "353f5611-b57c-447c-8114-e33c4bee8ed4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193743, "uuid": "8f6e51c2-1403-4a36-b40b-47fd39c5caab", "value": "Purchase_Order_PO2603-00127.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb00adb5-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779168605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168605, "uuid": "5eb187de-faab-4c3d-bee8-6b6e79bdc2db", "comment": "Malware payload (AgentTesla)", "value": "4b1eb9db3d2011ac0169c3dde1f7d962", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168605, "uuid": "395e3cc2-89d2-4380-bcd1-6dd0da890f22", "comment": "Malware payload (AgentTesla)", "value": "9ec6a5d1bcb85ba852a1dbbbaf3f04a3ea2cc3bfa188f782fefda1a2c47288c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168605, "uuid": "46a5197f-6fba-42e6-a48c-0ee4ba21e039", "comment": "Malware payload (AgentTesla)", "value": "41287d7484ca874577d1aeb617048a668b0a0507", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168605, "uuid": "5c8a5c12-8683-42dd-9aec-33b05bbfa261", "comment": "Malware payload (AgentTesla)", "value": "a04ba57dc1f6733a1f818842bbbe92f8958c0a09d029d1c19e197c7a0a74848f52e01586469badd3d9fd23117a8b89a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168605, "uuid": "8f4d18da-e2fb-456d-b4f0-7a13561934e2", "value": "T1DD06065113A6A172B361EB9E563AE930A80F144315DACF15315ED3387A1CD0BA36EBF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168605, "uuid": "f9c1fea3-2b41-4d6b-aeb1-dcebee716711", "value": "98304:y+gkc6+hIydMidXOogLcPWZtT9B1N1MGVzHPvz4vVSX7LDO/:y+gkc6TidXOogLcPiT97oczLfXbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168605, "uuid": "6d24b2b1-3b10-4d3d-ac02-1b6bfe6f7986", "value": 3672831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168605, "uuid": "527669e7-b307-457d-afac-93fc2c753a06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168605, "uuid": "820c963b-71e1-46f6-85b3-0a9de8411e74", "value": "PO0012321.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e26ac97-534d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779172610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172610, "uuid": "6e0ab382-db8a-4211-b655-f021ab281798", "comment": "Malware payload", "value": "6a965ec6f2f7686b7271612cd1571b8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172610, "uuid": "4cfe3576-bd05-4736-8a7a-44506cd7cdae", "comment": "Malware payload", "value": "9f3ce3d7106ff5927cc1460edcb2ae6cb41c899db8c7e99f30090241945610c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172610, "uuid": "0d9020c0-8f87-453c-9107-45b2b66fe4bf", "comment": "Malware payload", "value": "e94518c5b3b487cbbfa79278f439ec51906db8dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172610, "uuid": "c49a28c6-c2e6-4f3a-8a13-72230621b4b5", "comment": "Malware payload", "value": "c15b054bc85cdf1a20f5c722de2bc9166e5fc8bf7016141687b4266b5bc3307d0f09485df3aba3029ee6713bd74656d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172610, "uuid": "43d7ee9b-f0bc-44dd-86b5-11533eff60a2", "value": "T1D85733B075E1C4A8D0DBD0B029B29996DD276EA246F0767727D2FF0DA37511812F3A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172610, "uuid": "e62131a6-7bb1-4cc2-93f6-f248adfebaa5", "value": "38d4b68557ae7e505debeb099bd62b82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172610, "uuid": "f9f0d691-2340-4724-8c75-afff90b7aff2", "value": "786432:59gK54YEfBF9J6sr9AlZgFNZ8Wb48Xxy4swa7:ce4TBF9wsr9cZaZ8Wb4yxyXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172610, "uuid": "ac1d0a34-d220-4d54-987f-8d0ff3ce3943", "value": 27821059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172610, "uuid": "a0d536d7-6ce0-4343-bfab-a5dba58af6ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172610, "uuid": "4b1d985a-118b-4cc4-bdab-b5254bc0a34f", "value": "9f3ce3d7106ff5927cc1460edcb2ae6cb41c899db8c7e99f30090241945610c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56153b8-53b8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779218928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218928, "uuid": "11e166fe-3d1e-4357-9e60-76ae58557a50", "comment": "Malware payload (ConnectWise)", "value": "3ff2d0103858cb85d6703c396da7a65d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218928, "uuid": "a61cf1b8-2982-4ae9-a099-530434c059a6", "comment": "Malware payload (ConnectWise)", "value": "a02da700dbbf8a0589788a1fdd25bd30e95fc5eaa9a4c4107a571ba431683860", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218928, "uuid": "ca760628-6a2d-4d5e-8c0b-3495d4f0809c", "comment": "Malware payload (ConnectWise)", "value": "cc0da5b39101fed35665d0d9ca8243cd1f4b13b6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218928, "uuid": "6d7c196c-19a9-4391-807e-f302f543f133", "comment": "Malware payload (ConnectWise)", "value": "cec68d20fb2fcce8c2c78977185560acaad4b028d406150f0025196ebf8cb76310f2745689420cc580029188bac13078", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218928, "uuid": "dad495d9-5ea7-4390-bcd2-c56d8414592b", "value": "T1ED46F111B3D995B9C46F053CC87A52AAA674BC048312CBFB57D4BD693D32BC05E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218928, "uuid": "cbb5dd42-44b4-4130-a754-11c737cf6c6b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218928, "uuid": "df7d595b-bb7f-449b-8d31-053c949a2acf", "value": "98304:0ps6efPi1Evc4/I7Od0jxRGsYh3eqQumU73tcs:kfefPdk4/lGjxlYpeqQzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779218928, "uuid": "f885a90c-1828-4719-a1cc-ecc4b649ef9b", "value": 5509200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779218928, "uuid": "7223f5dd-9d95-4d8e-8d38-cfc2c2b5d467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218928, "uuid": "f9205559-9c1d-47ff-bc64-8a27a377923f", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfdfb3b-5368-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779184337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184337, "uuid": "a11fce3e-30e8-4008-a36d-234ba9772247", "comment": "Malware payload", "value": "1731439d717d31d4f729e068c140a1e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mahu-Agro", "colour": "#293157", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184337, "uuid": "ac4e1496-93f5-4a33-ae1a-be4b0b2030c2", "comment": "Malware payload", "value": "a120efa5b13b0d4ecc8dca7b070a037c12fb5576214b848df7b0effb113783d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mahu-Agro", "colour": "#293157", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184337, "uuid": "635af399-8676-4195-af5a-997aaadb1534", "comment": "Malware payload", "value": "4c5c75a3fb35325c6aa3c79f0daa7b38513aa26d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mahu-Agro", "colour": "#293157", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184337, "uuid": "d7c733b0-d0e1-4b0a-a8dd-67874d6d3cec", "comment": "Malware payload", "value": "234e7376f901b664ab546525e227ef076409b559e87748b031af7ccfeb2a1273813e8c919b18f9bd953eb2d28ea89420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mahu-Agro", "colour": "#293157", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184337, "uuid": "d4607678-07c0-4c6b-87e7-eca565980501", "value": "T166383377E5A80CEBF62DB7B0AA0BF473F0A506ED59E4B93C4B75C1249139A7001C6E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184337, "uuid": "06ef74b3-693a-4d64-baeb-caf3eda40f03", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184337, "uuid": "be9404a6-71da-4eff-8521-0cf44336e224", "value": "3145728:CLaqeuFn44mS+xYTqk/gsGKyu3dUfTAlvZtniJU0Fg:U9pFOKTAsZyuNCARn45F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779184337, "uuid": "754dde7d-1b0b-4efe-a0c4-3c9bf1948619", "value": 103332680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779184337, "uuid": "b8782e7b-5bc4-4367-a30c-4de3f04527e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184337, "uuid": "8b148020-5ad5-4703-87f7-608f0a188279", "value": "a120efa5b13b0d4ecc8dca7b070a037c12fb5576214b848df7b0effb113783d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b07d5e7-53a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779208388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208388, "uuid": "58a3889d-6969-4dee-b86a-3bd2da8c2047", "comment": "Malware payload", "value": "1ffa5c2fab8ce23fe967abe26e84c8c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208388, "uuid": "2c8d2b8b-b0fb-45bb-8c5e-56c041d7e905", "comment": "Malware payload", "value": "a1642305a8b349548f7e0c622d85904dc059a5273051ebca89d73215f0d67414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208388, "uuid": "983edc4b-082a-4a3f-8ff4-880ed353a368", "comment": "Malware payload", "value": "7b3f5c9e6e5cb9edb7a3aafc0938bc9ba294cf53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208388, "uuid": "06367c1d-5db8-4c88-bacf-bf835d09a1d2", "comment": "Malware payload", "value": "8599b972eae5ab071d634a33a64b5776ff8b6315b3846ad3134fdfe0a4e2c89f40b9f082d614bc77058f41134bebf73d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208388, "uuid": "0a894918-f96f-40c7-8d26-0ee91be06504", "value": "T1A3E623E694D572E4C9D74A40A24B57CE70E1F11F4ABA6C283BCB1C426A31F9B4349E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208388, "uuid": "4e5cfd01-b7c6-41ea-a78e-c7a645d6add6", "value": "0228dad0ad216c3cd897a4c422ff4693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208388, "uuid": "1448528d-49ce-416a-9d37-df837faf2c25", "value": "196608:uwFiA0LBSerDvqYbEManjCxYfh7uAXNQQGOqcfGkvDp/pD9KZUcbkwNba:t2AsjfbRanWMZuArv/99Qrbkiba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779208388, "uuid": "04fe967a-8d2c-4c0b-b530-96bcdc88f565", "value": 15178752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779208388, "uuid": "a7c14e6a-f2ab-4d61-b1a0-9afa10b5d508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208388, "uuid": "33a2a438-1700-4c5e-9047-f9ac154ec90b", "value": "Cs2Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c26fb45-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779168393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168393, "uuid": "8385741c-a4c8-46e8-acc5-9ceaa18b840c", "comment": "Malware payload (Mirai)", "value": "47350f12bdf55c18916cdcb9f3d1eb81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168393, "uuid": "5579858c-d6bf-4e88-ba18-480a16c605f0", "comment": "Malware payload (Mirai)", "value": "a1d62151e9f3e54c3ee42b80ba01366f3119d81ba5563dd0e003f132e5a6e58e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168393, "uuid": "c3a25719-996f-4ee5-badb-8d1e55e26d92", "comment": "Malware payload (Mirai)", "value": "65b0d1dcc6e8db73b4bfdbfc7e87d7113136e311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168393, "uuid": "33171613-3e82-4c21-8617-3d6ff0e59cbc", "comment": "Malware payload (Mirai)", "value": "23191d0afc2727faf5a6e9d1d3f530a0190ac582ba9ccabc970fc8b254d0e2d0c996b29363951584837378c9282e9d2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168393, "uuid": "6ff1c83f-9ffa-40a3-a472-3c793d49a5f2", "value": "T19072E81358D389B7C8C1077F6A8F87183723AA14939333129319AAB45F477AE2F1F959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168393, "uuid": "c0b0db75-b7a7-465a-b525-7c0bc2873d7e", "value": "384:eQndJNcwWWjiNgXx4emwYME9bwbCZjLmCbUxDseoX:eQndJywWkilhvMK8bCZXmyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168393, "uuid": "ac3d9edf-4a19-4635-bd85-63e3e78571b6", "value": 17301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168393, "uuid": "47c33e0e-bcb3-49d3-97a1-7c7d41592cf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168393, "uuid": "03854c45-e337-4178-8fa1-4c4572cf1013", "value": "dlr.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774eaf0f-53db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779233748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779233748, "uuid": "d195b08b-8db1-4f22-bb00-c19220b0f968", "comment": "Malware payload (Mirai)", "value": "f7aa098d08b15716fefa1e3974c0924e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779233748, "uuid": "fed7b7c4-fca6-4424-b9eb-0fbbdce34a00", "comment": "Malware payload (Mirai)", "value": "a31a8d7d5f83a0c737be21f4211fc33867f9141643be35aac0a599c807c8f2ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779233748, "uuid": "4cd34b73-306e-408d-b847-33c09d047812", "comment": "Malware payload (Mirai)", "value": "720135c79c4f94eb10c9ffabfcfa8c4f3420a3dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779233748, "uuid": "9ecce4e4-029f-4442-8ae6-ed7773ca3a80", "comment": "Malware payload (Mirai)", "value": "23acfed6ee9d4e9302958e1738c56e815d6566d85b1c02b08867b66599a374627b8da57141bd3b7b5b64d5477cfa53f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779233748, "uuid": "d0c6d292-c212-43fd-a007-5c4d06d37546", "value": "T1B7C32882BF43DAB7E55310F001B79B310B32FD3A5822DA96D768BCB199925D0E61637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779233748, "uuid": "68c11007-e3e1-45e8-ae23-24bb21482061", "value": "1536:mmWYyt1l+kxj3/TIaTthxo3jZ/mEM+AzLuAuX3JKzuQrBvl9+Or:9WYAS4/TZJhxo3j1mEyHL1vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779233748, "uuid": "026c7f01-ca21-4011-a45b-c710d1d0b777", "value": 126492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779233748, "uuid": "1e2535b6-dff8-4af9-a311-60371199dfd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779233748, "uuid": "7012f0b0-d675-4c55-b8f2-ef9f9991c8aa", "value": "wife.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e1b366-53aa-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779212833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212833, "uuid": "351f8d7d-34eb-4feb-8978-977e9aa3297a", "comment": "Malware payload (ConnectWise)", "value": "916c5ba14ea56174cfc58f0f01ffb08d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212833, "uuid": "2ea67bd0-5370-46c5-acac-b18fb82f679c", "comment": "Malware payload (ConnectWise)", "value": "a34fe3bce3774a3b6e6127b2b88a660c9c39129f2c4e38f8683b2a9a4d3abcd7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212833, "uuid": "a78db3cc-edea-43c6-bfbb-541bd4e37fbf", "comment": "Malware payload (ConnectWise)", "value": "5fe3cb4f537f0876fe6462c3cb39855beed8b2bb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212833, "uuid": "30580843-e062-48ca-8193-065c96b3c10b", "comment": "Malware payload (ConnectWise)", "value": "2f0f48d7b8f9ecdf64580bf67f98ae054433fa91f8ef0dfc5490cab9b415253dfad0c1135208714ca6881fc59d449486", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212833, "uuid": "3734de86-6677-4f68-8f99-d87894325061", "value": "T174A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212833, "uuid": "e9c94cfe-60cb-48de-845d-7eac61270a63", "value": "196608:anCtVYqI5MvbWEpKkqGIJqKAnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqcnCtO:GCXvI5MvHx2JiCXvI5MvHx6CXvI5MvH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212833, "uuid": "c698664b-ad6f-482f-88a2-a72c1a839b87", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212833, "uuid": "c11ad0a6-1ce0-46ce-8386-5c004c3a9c7c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212833, "uuid": "fb3f1649-3c3b-4fb3-bf64-f4098306ea0d", "value": "ScreenConnect.ClientSetup2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83fcd09-53d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779232649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232649, "uuid": "fade0488-a0e6-45ce-a484-421d43bc7024", "comment": "Malware payload", "value": "7a44f0b104dde313917e30d8d2aa8ab2", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232649, "uuid": "1c8a6b65-1013-4691-9094-17831acdbec1", "comment": "Malware payload", "value": "a37300c49b9c516902a9240a2ec7b4fab75c951df277aa1896043ab0dcec4506", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232649, "uuid": "f784c11d-595d-4757-ae89-dd668919d975", "comment": "Malware payload", "value": "3516180bb39f497e0208f1a3bed3a8cf9b5070d9", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232649, "uuid": "33cdcce1-4383-4fa0-9ad5-c80ce9ab37fc", "comment": "Malware payload", "value": "bbb52910d075af514f0d33fd936f64433d67e62e52e32dc82facdacc8aa8cc021eaaf33b9ee28a70fa022b037ba83466", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232649, "uuid": "6179c86c-b49d-49f7-a004-dc627ca21504", "value": "T14A86BFB1D39139C1D86B885FFD2D5768C2627F39BF0BC2D6540CB6636A63296DF82804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232649, "uuid": "717eb6f1-527d-4213-87cc-1ce8775a8388", "value": "5b3ebef3da244b3ac4de5a75d6d1e4c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232649, "uuid": "dda7f740-ed9e-4471-a3f4-f06fead5fffa", "value": "196608:K8pOJKg3mN4cVKCIHLGnNdxgzJn4t4qe4cpZWAPjO:K8pOH3mN4KKFLWvt4xsAPjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779232649, "uuid": "82f07e65-94da-4208-bde0-eef900fcea2e", "value": 8116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779232649, "uuid": "8d3b0829-9d39-4ab9-8fcd-3203df25c2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232649, "uuid": "e7d37b77-33c8-41b4-a5e9-6ca2b4346d06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8714a3a0-5316-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779149164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149164, "uuid": "64480bb1-9449-45e2-bae9-a598fe875b62", "comment": "Malware payload (Mirai)", "value": "2aee19d94d51a2d4938a5cfe27ad9e9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149164, "uuid": "872d3109-a318-4dc5-993d-8d5d00bd0b46", "comment": "Malware payload (Mirai)", "value": "a4c715f71a14a62a7f652fccfb9fd4bf12ee42bd3bceb278598cc615fe9f00fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149164, "uuid": "91a48030-20e2-4f17-87fd-42c973ab8033", "comment": "Malware payload (Mirai)", "value": "452dc5282bd04daac448f45f2661fe72a4de3236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149164, "uuid": "f8f2927d-d5a3-4c27-a022-1fe98aed30f3", "comment": "Malware payload (Mirai)", "value": "497f7fb9a3b63e1cae2bf15ee79ee28a8ae38efd5e587209a4fef7bfa349577ff661499a93918cec97b8d9cca490d2b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149164, "uuid": "545f2c87-750a-4d8f-a960-7539be929481", "value": "T179145B23A8A55F97C1865FF662B38A740743E8154F430FBBB62AE9F846039CCB509774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149164, "uuid": "2dc4b217-b067-4961-973c-bb22571b2a37", "value": "3072:VaZ+6KAAHErwOgm/9B5WPowRW6XzSILLk6D44+rhhxz1AMhONflN:VaHsHQwOgm/nQ86WIk6D44+rhhxz1AMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779149164, "uuid": "ddf54f58-2901-4409-9269-a536cde29aef", "value": 191977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779149164, "uuid": "6ef59d74-b96a-49f7-8ae6-33f3a4f7f8ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149164, "uuid": "77ee9325-620d-4fc5-8e4b-6d551f93dbcd", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d439b5-5370-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779187951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187951, "uuid": "0daa9dfa-2c9d-4e31-aa9b-67037a815936", "comment": "Malware payload (AgentTesla)", "value": "6c050d4033ee9f27e43dbd4f1f1057ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187951, "uuid": "ab37f5e5-1aa1-4240-bf9a-d9eddf39c198", "comment": "Malware payload (AgentTesla)", "value": "a4d595934c03e1736022f75f96d22cbad7556bb349d818fc68ae1a09b93bd1bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187951, "uuid": "b19bb597-1f86-4fd3-8ffe-1ece7e67bc94", "comment": "Malware payload (AgentTesla)", "value": "dd79517f64709e8f7babfbb953dac785cb8a1414", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187951, "uuid": "9d013963-65c2-411b-959e-e21d5da5e53c", "comment": "Malware payload (AgentTesla)", "value": "a8f329adbaffe089addcc3cd253d4fe6bb49a4b0b1b07ee68713c7576c6e40dcba820131611b0ddbe81963495652304c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187951, "uuid": "d61b5230-f576-427b-ae1d-ee65535ce820", "value": "T1D3063950532E94B0E66DEB2DD536B660494D204311C9EF2D34B91378BB92E17A3AF8F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187951, "uuid": "a1656bc4-8246-44a8-948f-1bb99b9bb24e", "value": "98304:uCDOcsvkqo2js/uTanuVLRd++2b/+/1OIkNvt1TCJj010x2YtEDiqxLu48IZ2wG4:uUZ2wnd/+/1OIkNv2J4I2YtEP8K2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779187951, "uuid": "25b3e803-976d-40fc-a207-b9154734e697", "value": 3691039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779187951, "uuid": "2e490fd1-30de-4b46-b38c-c9ed24ede38d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187951, "uuid": "31dec54a-9633-4449-b087-fd2b9d6f3f24", "value": "DHL Express Shipping Documents-pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2c6e1a-537d-11f1-a769-42010a9c0008", "comment": "Malware payload (HermesStealer)", "timestamp": 1779193464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193464, "uuid": "b55042b3-3aec-44ef-a868-2955e855d60e", "comment": "Malware payload (HermesStealer)", "value": "8aae69ac8495b7dd192131992b8383f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HermesStealer", "colour": "#9059ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193464, "uuid": "a46e180a-07bf-4735-a75b-27660304a561", "comment": "Malware payload (HermesStealer)", "value": "a56a33a0ee570e687952c60428ea7a8975dd6c71d375c7af3f66c65d4bd7921e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HermesStealer", "colour": "#9059ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193464, "uuid": "acfb21ca-a3f8-4d86-9592-4b1be0d3773e", "comment": "Malware payload (HermesStealer)", "value": "da52a030270da7640c3b6b2a906500556c1e7ef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HermesStealer", "colour": "#9059ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193464, "uuid": "2ef2effe-0b63-4e44-b93d-11db5214b636", "comment": "Malware payload (HermesStealer)", "value": "e1bcca75c1a9de3e14f7edd8097fadb526b0d95d877db7f91898e342c3e15424452d84b5980a5f983b72ff091cecf1a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HermesStealer", "colour": "#9059ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193464, "uuid": "310acf2d-3fa4-46d1-9555-c177489e81c2", "value": "T104858F1BA3A400ECD0A7C178CE166607E7B2740517759BEB16D086EA6F23EF15E7E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193464, "uuid": "71768a92-0fcc-4882-9fcf-0b4a7ef8c6e0", "value": "7d37e657d3029ed1b89b8fa16a1e3cca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193464, "uuid": "75dd5195-01f3-4290-a344-dcf65c5d534f", "value": "24576:9io0kfkuq+l+DsbGp2jo2PhtPubVRkOs9/8s1pFPJN3j1JeHcnZ6:Eo3fkuq+lSsbGpMD29ds17PS8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193464, "uuid": "ab49d586-5684-44df-8522-8b14a74956f3", "value": 1749504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193464, "uuid": "4ee22568-98b6-491c-b4cd-010d27c0d107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193464, "uuid": "ee2af9bd-0c4b-44c1-a95f-f6ae094a35b3", "value": "a56a33a0ee570e687952c60428ea7a8975dd6c71d375c7af3f66c65d4bd7921e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d4ba17-53bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220777, "uuid": "9460a42f-bc54-4c86-8b84-9e10e392de18", "comment": "Malware payload (Mirai)", "value": "ad4f024186a066684ab4d81e3beeb26f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220777, "uuid": "6035dae9-23aa-4fb9-a3c5-bd014ef41c96", "comment": "Malware payload (Mirai)", "value": "a6feb0c766167be56b8aac503dd687f5553ff838833340ec5a367bc450e23e24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220777, "uuid": "fa7a316a-0a96-4bc5-9c22-f480f64212ba", "comment": "Malware payload (Mirai)", "value": "918bbe59c6dbe35185c4234a9d01083d55948454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220777, "uuid": "ad5780c6-7dbb-4261-8bf7-a6f0f6d5ccbe", "comment": "Malware payload (Mirai)", "value": "e05eb01a1a2f55cbff5d26b918de7a8109f8f6ecb597a1df9b23b1a472088e9546b735b972b029d8e15ccf0ddb74abdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220777, "uuid": "f6657a96-8b60-42af-8f17-9a1adbbe9a27", "value": "T13603F781BC828A6BC5E0137AA56E519D3320B7F4C2EF7327DC214B14778691F4DA7B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220777, "uuid": "00a9c82f-b1d9-46f9-a933-25d444896d6f", "value": "768:ZAq/eoCUyYwwlDJ0vg8vIPwLrEOHAAu5dQhp5oENpBayd:+q//sYwwlCvxIP9OH1un+oENp4yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220777, "uuid": "e90864e5-6c22-404a-9027-53363b99d9dc", "value": 38604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220777, "uuid": "a5868de7-93ac-48d8-855c-ce1daa0c1648", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220777, "uuid": "e918073d-69d8-48ea-964e-b69f1c7abece", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b77706a-5368-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779184417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184417, "uuid": "eb306846-7ed7-44db-a997-c40217632b65", "comment": "Malware payload", "value": "c113432d9ac11d111d82f675178ab807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184417, "uuid": "d2229f16-4457-4c61-8772-85406d93e7dd", "comment": "Malware payload", "value": "a730609b54dc1e57fba7d537ef3ecd9da760731d9c1f05054eed0b694eccd225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184417, "uuid": "c735a65d-6baa-4cb3-917f-90e695dffd7c", "comment": "Malware payload", "value": "262fab02aac613bf9baf26d6c554559ebd1a725a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184417, "uuid": "c87ed738-f4e0-4d7b-99f3-d2d58ee45bab", "comment": "Malware payload", "value": "8fdfd26d21673c3e5e43a1b1d45a1095224090877d9490911161b95178b7330f6a903343d94a0f8aca272aa6dede5041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184417, "uuid": "1c17d641-2d08-4668-9ea7-bba0e350f12c", "value": "T18B08333FA15F283EE5A95A3436B793105A3B6D61600B4D2A95F0F90CCF361B05E3E74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184417, "uuid": "2d6b74cd-0a58-4caf-92db-6ccf0ec019b2", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184417, "uuid": "e4840ed5-20e6-45b8-8519-d4ec2564368b", "value": "1572864:BoHY9GNgtZ2GJBehlLDuZ6t6qGZFYMiQ/zBVKyNEHqB6bzJ+U:K49n2GbevDnQMM9/zB4yCHmG1+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779184417, "uuid": "b13a30ef-24b6-45cb-be6a-85ec6d9279bb", "value": 80500776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779184417, "uuid": "f18e64de-1429-45ea-b42c-4ccf2ab29b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184417, "uuid": "fc24c380-d050-4e01-a6db-1114f150d5f1", "value": "a730609b54dc1e57fba7d537ef3ecd9da760731d9c1f05054eed0b694eccd225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78199173-5392-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779202397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202397, "uuid": "189aabd0-b667-4051-b186-4ce77c425a1a", "comment": "Malware payload (Mirai)", "value": "8799f381c102b1ae1b6460a5a54d2dab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202397, "uuid": "98e0daa2-eefb-4942-80ef-fae7ef25ae56", "comment": "Malware payload (Mirai)", "value": "a7460ad1732862025e45104bd7eb2e838e7cd84299f0c57772dd3b5290dd5ddc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202397, "uuid": "a2c9b01e-50a4-4ddc-966d-16ac39bd680d", "comment": "Malware payload (Mirai)", "value": "54628b8216418b8d0fa0006d54f06d7d5eae2d55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202397, "uuid": "7de3ee03-630b-4b17-aa56-27969530b781", "comment": "Malware payload (Mirai)", "value": "2d5ae3c1fdaaf3b2d9cd3c7420a589a026619a2383207b690a8b30ba6f97585f82e8e0dde0328c5c7cf31a322e49c011", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202397, "uuid": "424cf95d-909c-4b35-b003-a1f63dfeec79", "value": "T1F0734B22FA760D2BC5C4A47661F34725F2F6438624AC8A1F7D720E8C7F24A503257BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202397, "uuid": "83078b84-03f4-4253-b1d9-c0a0e7795472", "value": "1536:LKmz+U+YkcV+7QdtCgUN+A5Gawg2xZtYGxIkh/2Y:+C+eZREPNfGfY5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779202397, "uuid": "b8039287-4379-479e-a551-44e9cc0d2846", "value": 75968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779202397, "uuid": "1de1a2fc-703f-4c38-afae-d6fc336e8a82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202397, "uuid": "f0b1c69a-e306-4c57-afec-f06de523c709", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f7600d-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "cece49a3-2dd1-48d4-add6-9e3d7cba8a08", "comment": "Malware payload (Mirai)", "value": "5e8b772debd4ffe1dba58de303bc52da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "6120c754-baa6-4afc-b64c-42f680dce632", "comment": "Malware payload (Mirai)", "value": "a7888509edd82db227b46f82bd18709dd5cd97133b8913b89219d320415d843d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "358ae026-0c09-408f-a688-d99a54512d55", "comment": "Malware payload (Mirai)", "value": "f55ae4e9a13a8785cd230d6a05b58aee3e3914a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "2ce918de-3efa-42bf-8860-43b7dcefc43e", "comment": "Malware payload (Mirai)", "value": "b9dc17b4f91626046789d8979a5606b8951b7eb55706f85aefac77bb8767882e32b372388c0f6b479f373186212b914a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "22e10441-ad37-4289-b8b3-dc73a4797cf3", "value": "T1DD34961A3A22DFFFF568863007F38A3057E9259636E19746F26CD71C1E2028D681F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "1ab34680-b823-482c-8f1b-a61670a6becf", "value": "6144:tm9DLN89gc2AJGujmXiNCt1YwlsVIsvwMd:GLNirmXiNCt1YwlsVIsvwMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219551, "uuid": "8c976583-abb9-4315-a252-e9454d038914", "value": 236679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219551, "uuid": "384d1084-c684-4829-9187-1d316f83f34a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "22d8675a-a224-44a5-bf57-983d98a59442", "value": "mynode.mips_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bc720f-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219594, "uuid": "47dda265-ac3a-4131-8119-823718cfaa35", "comment": "Malware payload (Mirai)", "value": "ceedce6424facafc7b5d6b211499a6f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219594, "uuid": "db158ac6-a22a-4e54-849f-d12d4c9398cb", "comment": "Malware payload (Mirai)", "value": "a78bfdefe7dadb9202bd03ef8716d0f73c4f46b649852fce2829567f62c869d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219594, "uuid": "43ac90a1-55dd-4dbd-93f1-df9c86623d85", "comment": "Malware payload (Mirai)", "value": "4c7355fdc4d94ee4df04896b1927f6360e34b2e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219594, "uuid": "9180b924-52e0-479d-a1ad-1b919f1cdb76", "comment": "Malware payload (Mirai)", "value": "ff463b868ead46efe46afae8fa7374fde844589fe29aab9734240f8f27dcaca55072a645f4014a6fe2c0ed9ec3ddb462", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219594, "uuid": "0117ec80-0765-4247-80dc-c8530fce53cb", "value": "T131735B41B3880D43C1970DB0363F2BD6D7AFE9D122E4FA852A5F9B4691B1A33154EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219594, "uuid": "11295574-165e-47ca-ab3f-b2c4096930d0", "value": "1536:uJE+FvWG8T9mCFwUzQz4ln7IHl+94tCy/f7Z6t:uJE+5x8TTRkg7IF+7gZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219594, "uuid": "02bbe3ef-1f1c-4ba7-ab07-d2e1116fa6cf", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219594, "uuid": "a4c44bfd-93d9-4ed3-80ba-f217048e907f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219594, "uuid": "ff086294-15d5-4e0e-b59e-666afed18261", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca634c6-534d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779172957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172957, "uuid": "be19ba0a-a456-4c88-afb3-7d8ed5bba484", "comment": "Malware payload", "value": "2c0e4806bdf7986ed47a50b3a1914186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172957, "uuid": "d784198a-bf3c-49cd-b17f-bb7d92722991", "comment": "Malware payload", "value": "a7c4549aac7ca0041caef0d14b8f3ae0030e602b7a2853b8a7ae39312eed5482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172957, "uuid": "f01d9676-a04c-4709-bfa2-b0ca8f6ac2e6", "comment": "Malware payload", "value": "bd1e385b99578d3b7312c815dc57c66a470896d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172957, "uuid": "43909f73-3dad-498d-8a4d-7818cdf044fa", "comment": "Malware payload", "value": "5dcb0105f53d2eecbc90244fcd05ce51d823a87191ca4eb6cc185fb9c0d4ce79c30d94be923697cbdc09b46b78cadfc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172957, "uuid": "d55e82eb-6830-4a31-badf-e9e23c8dfecc", "value": "T139A533F380FC5E74DA65DBB670EA9570C22B31792245E687C118CAF52FF2BE29241D21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172957, "uuid": "e4df4eb8-584d-49ce-be80-cc7fa2ed95e1", "value": "5de1161f1727be95c20869d54605a2d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172957, "uuid": "8c890ee2-0020-4531-9011-f786815fd7ac", "value": "49152:eNWvKLNSRYaaRFM5d3QQxEzx1vGuEU3Wsu0:eovKLOarPQxEzxgsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172957, "uuid": "ef2be8f6-2490-47ce-bb8b-3c5649b02af5", "value": 2090648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172957, "uuid": "119d9dff-b818-4c18-a043-58898c70b06d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172957, "uuid": "449e411d-3eee-4881-aaf2-2583509716f8", "value": "a7c4549aac7ca0041caef0d14b8f3ae0030e602b7a2853b8a7ae39312eed5482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b79782e-537d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779193329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193329, "uuid": "84762bed-bc67-4ab2-9543-0a4d9772236d", "comment": "Malware payload", "value": "70a2b765dda3f2bc823a5ce815e67808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193329, "uuid": "42f40ef8-5d75-441c-86ab-0a80c419b81b", "comment": "Malware payload", "value": "a915f3fc1b16a26921fae81d06542f90f2036207a5289d91ba32b80eb39949ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193329, "uuid": "c2ea5d53-90b5-4160-8352-b5ccc42b62da", "comment": "Malware payload", "value": "7fd170f6efd0a5a96124807a4035a8420b9a6423", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193329, "uuid": "6b1eb088-f1c9-4dbf-bba1-a95ab6e78fd2", "comment": "Malware payload", "value": "8c05713d7d5ba36092cd4a362083a2b3ae9361003e30d6d9749d171879fa7900ec6a26f5cd17a3c0640063a05e7733d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193329, "uuid": "d10bcbee-ed46-4e22-8692-e750b582649a", "value": "T123E25B637A5B4172D29002F51567ABBB827BFD300F5093D3B7D4AB2E1E381D1AD7284A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193329, "uuid": "69c42e3c-1ba1-4672-abe0-c8fe367fe373", "value": "a68587cc9a8fef56e7262990d042b5c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193329, "uuid": "4fec5c40-ca10-4442-9d81-804be63662b8", "value": "768:ZNT0Oj8/nq/FhgLGbLLzneLeoD0F7Pnd:Z5Qq/FhgLGbLveaF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193329, "uuid": "c1b2630b-e8e3-4903-ab11-b4bc4a9ba58d", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193329, "uuid": "497345f0-d9f8-451c-b5d1-0dce6cfbd3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193329, "uuid": "d9bcd5e4-27c3-410d-8f21-84216fa851ba", "value": "a915f3fc1b16a26921fae81d06542f90f2036207a5289d91ba32b80eb39949ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69265e83-53b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779217404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217404, "uuid": "7a95152b-467a-43aa-997f-d2a58521074f", "comment": "Malware payload (Mirai)", "value": "1d4fa93ae3b0ccd59c416892935b1db7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217404, "uuid": "de78756c-0225-4b95-a48a-6dcea493dfb5", "comment": "Malware payload (Mirai)", "value": "a9a89bcc5b1ffd22eb5fe1dfdd337ba4d7967c8e58a7ee10eae46a9011efaadb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217404, "uuid": "2134b1ef-eaaa-431e-887f-01fbba338a7d", "comment": "Malware payload (Mirai)", "value": "4b1f0e56ec3959fda53c0f7428297105708d3317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217404, "uuid": "809681ad-2a99-4c87-894c-5ecbb90b29b1", "comment": "Malware payload (Mirai)", "value": "0479e03b1b30ae24f3ef68c55c2a9bb14e73ada8f3ec2f1bcc5ab95f5f266a84ebc9030b436d1e18ab8de1480f8db0e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217404, "uuid": "90668c3e-b971-45c2-990a-ecc953278a49", "value": "T1A2E3F946F8819F16D5D112BAFE1E024E37231B78D2DE72129D246B347B8B87B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217404, "uuid": "b75279f3-c153-4f5b-bb18-3db8db91c0eb", "value": "1536:+nnL6g1a2T/jiyXw43j8Ib56neL5vHXylt+1TPzqaS3Uof2UiBoxSMnXxbQY5LdH:fg1rT7vCel/XltqaXoxSMnXxbnpdVoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779217404, "uuid": "a67a3241-6bf9-4053-b317-3b8300d3d223", "value": 145872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779217404, "uuid": "6782a61e-d40a-4045-8231-b246df5b9668", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217404, "uuid": "e01c462d-2e7a-48bd-a0a8-4adb552acf82", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86c8893-531d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779152334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779152334, "uuid": "97976561-bf46-4ba3-9c87-a7566e4cf96d", "comment": "Malware payload", "value": "6a5e923d588336eb78528e44ec9f9bb7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779152334, "uuid": "ecee5f6e-c8ec-4465-a4fe-10b48bc25ce9", "comment": "Malware payload", "value": "aa84a8e6cdd687d30f709a70b1274c577012073230bfc3df296c94732814b6f7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779152334, "uuid": "5ffc3352-6063-425a-85b8-968288c3477c", "comment": "Malware payload", "value": "2cdc569d439824fb3d8fda6cfa9ced1bb9a24b93", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779152334, "uuid": "ad4b731b-7d75-4f0a-b31b-0648eec68091", "comment": "Malware payload", "value": "5ad0f1280610cb8b2ad3963f8401c8d7a3041d2059672520cb0c0827cfd910f0be8f7d722b9c3ff610be2f7eb90a20ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779152334, "uuid": "93ce91c7-13da-4acd-9a15-61bbc1e2aa38", "value": "T131136D6526953C25AE99883B5D7F2F0CBDA983F2304491DDBF8A3CF18C15A9CE318719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779152334, "uuid": "19d3ca64-efb1-4fdb-a105-06e081219145", "value": "768:4r9NyXsZztCW9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:mHusZOco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779152334, "uuid": "b595ac54-d796-430c-a824-30b4164d2e83", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779152334, "uuid": "6e148565-f7b7-400a-9d86-5f4ab785fb4a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779152334, "uuid": "3ccc1504-ef29-4c41-a645-0957e519ec20", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566ce53f-53c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779222526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222526, "uuid": "dce3e575-ff78-48d7-af94-a28dd99380e8", "comment": "Malware payload", "value": "ea1d720d80fa35a466588cba3afb304e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222526, "uuid": "a0daf273-b42d-4eb5-ac2c-dcc13382fcfa", "comment": "Malware payload", "value": "ab57d68527b85cb8ca12247b2b9f0d6f7d0cda2e9273ec70aa4cc1c9607f52ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222526, "uuid": "d0920a00-ec2c-4ac3-9d9b-c08ec9ab1265", "comment": "Malware payload", "value": "f77d80cd6290813e1eb5aabf1a5722d22a0a41e5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222526, "uuid": "7373e467-50be-46c4-9393-6a2b58e829c1", "comment": "Malware payload", "value": "54ad7a94f43ff359d03225a40d7a94e69bdf5d5168b614c376a2ec8424ebb1ec6aa5ee53b60344957fe164a8a89c6e2a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222526, "uuid": "a76389c0-25b2-42a8-a5ac-04638c817944", "value": "T1C8E53363287E2B34F9AE02FB3427F55A3F86EFB589C18304552F6AED811556F874C242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222526, "uuid": "fe240e6c-c32e-4a97-9d82-0f370e5dce6a", "value": "4a8aec2de7adf8dc5f3a67679a8d04a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222526, "uuid": "0c27e4ef-8137-4353-a317-96596bbc35c2", "value": "49152:TsAfU3RcQWUcs+03o3Ol+JG6LuaUl4xpFEPamb7luCrQVQ+Bo5/QiP4abc:gyXU5k3OAbuaBpqPaW7gC8To5/QiPTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779222526, "uuid": "c4473cdd-5d47-47e7-bb50-49ca958def25", "value": 3025408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779222526, "uuid": "42e22569-13ce-4622-8706-9719c4d46794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222526, "uuid": "9de61ad0-6bff-4f26-93f6-de0ed38a969c", "value": "Build_protected.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d82070-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779220344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "b6943b60-b973-4c75-91bf-48a4d395d278", "comment": "Malware payload", "value": "fb420c0297039a442dd97cf1a585ae0d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "642e2c94-3997-4b71-a21f-df7a3f152c47", "comment": "Malware payload", "value": "acda41b419e1644f00620033f14c61d568934b8af30d88013f558d037f513ec9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "d4ec4960-1533-4a39-94d5-7e59191c813b", "comment": "Malware payload", "value": "70023ffe3c44bf495a03980ffde5b72b4554cc58", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "aad78d46-11e2-494f-a919-de6e1ad150fa", "comment": "Malware payload", "value": "e77c1b5e8e65f29c6dc71dd4f9d10df3652db3558072042b023bdf84b93281de3ba255b02bf7e8d48f752c98054f4c95", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220344, "uuid": "86972bd5-e6ac-43ff-a5e0-dc94ae8a518c", "value": "T145A3F949E9116B19C6E232FFFB8E428E73135FA8F3EA3025CD305B6133C5A964A75521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220344, "uuid": "089dc4d8-ef82-4e14-be84-5c76e73e3070", "value": "1536:B3FnXD8i99IrfoYfUq9arqjgl+mlWlzyZRiQJs6nFVn4mMQ56Y7r2Mgh/:BhD8brj8q9arqjgll1nFVn4Dc6U2d/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220344, "uuid": "7b9c6a47-3dad-4be7-8aaf-402272fc19db", "value": 102976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220344, "uuid": "bd6d3770-c413-4d7b-9d5b-8b9afc8e6d9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220344, "uuid": "164aa1c5-35f5-49d4-93e0-5f35d814909f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f289d3-539f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779207819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779207819, "uuid": "4ef2f650-8734-4cdc-aa1d-7aad1fb9401e", "comment": "Malware payload", "value": "70ec172cad4225e4c27e4d91e1eb5bff", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779207819, "uuid": "31b5311f-7b69-4208-b37c-4b1291715cae", "comment": "Malware payload", "value": "b0795720a58fadabaefbfd66a77bbbcd55638449eb25293c2f71097c404721c5", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779207819, "uuid": "954abcc9-8390-4efc-866a-b2cbe45e8795", "comment": "Malware payload", "value": "a7a7518e0f42795a3d144f7b75f8747d3f964b1f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779207819, "uuid": "8630d77c-98d1-4252-a520-a3795858e04e", "comment": "Malware payload", "value": "1b5a49a614744b42c3e1b0c15466d68f06f3e0919247ae63ffbd0bdf564bf0ae9c777c330359b649f318d98eaa4c0e6d", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779207819, "uuid": "b93bea83-cbfd-4335-b892-6493a7cb0063", "value": "T1C1F533E20AF0919ED58B05F823B69E6654B66D882DB103DB57063FBC3C30D369F52972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779207819, "uuid": "ec49b2d5-0021-4eae-ade0-8403f847f3db", "value": "fa126bcc999cbcd3f3b7fdfec61631e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779207819, "uuid": "6ec42e44-5dbf-41f0-9e1e-3461beb668e4", "value": "98304:nMxDa4DN97BgPRp0N6xu6l/Zz+bXsZBRW0:nyDa4DnBgPfhu8Zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779207819, "uuid": "e5862f6e-08d6-4284-be3b-1080e992183a", "value": 3356160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779207819, "uuid": "f0698652-88db-4ed6-83a1-2174adff7e82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779207819, "uuid": "cdf43cf7-d4b0-45c4-950a-f655ada99508", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c0d61c-537e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779193746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193746, "uuid": "1156d39e-5357-481d-978b-6dfde16c2d95", "comment": "Malware payload", "value": "c2f53e4d1f2bb0473227702eb535f97e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193746, "uuid": "b5e20daf-7cc9-46ca-b739-0055412e76b0", "comment": "Malware payload", "value": "b15da71145d6239a23eb1ea7d885ca7f146e355a293c0db8f7ca31167392f9ae", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193746, "uuid": "ec1263d3-a14c-4ed1-a902-caae350a2808", "comment": "Malware payload", "value": "8290fbe67ae6948dcdad58f7d6d95489dfe548f9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193746, "uuid": "fb7217a1-3131-4fa6-9fbf-940a09b56db3", "comment": "Malware payload", "value": "ec3b85a3521dc7d4446542169ef129b9a93c89abab5c0eab99f41f5ed1911ed3cf65d0b4fdd97a7a208ad520acce8460", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193746, "uuid": "53f5f7ce-9bdb-4f0a-98f8-5966fff2a482", "value": "T1477415ACDDDC0638E6B7D65CDC988A4368936DABAA0CF90501C037DA1737547BD81A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193746, "uuid": "447c6f2c-475c-4e04-91f9-eb0c8fd4361f", "value": "6144:kzZvMz3rSGdiE4gqqXRxkxYvm+nDoSJ2hf/CM/lXWe3r2yeD+e2D6dyY:sZ0zeDuR60m+nDoXtAe36J2D6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193746, "uuid": "cee50534-9723-46cd-a304-d59e10205b12", "value": 358824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193746, "uuid": "55bb085f-b864-4914-a9b5-209e39ba4eb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193746, "uuid": "36824030-daf9-482d-af6e-4fadc8d01258", "value": "PO-003727_Updated_Order_Sheet_20260408.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55eb7d1e-53c1-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779222526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222526, "uuid": "76d333a8-f3e2-4653-9b85-85f54160ba12", "comment": "Malware payload (LummaStealer)", "value": "27f8cc979e50bf50b27bdfca945a3ca6", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222526, "uuid": "7c0b3eae-3355-4c9d-b549-96ea35d0b43a", "comment": "Malware payload (LummaStealer)", "value": "b312aa01446c95a067558b1a8da4513db28d313529f06da1a076bb85a87719e3", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222526, "uuid": "a6340403-0ae0-412c-8961-61da621f889a", "comment": "Malware payload (LummaStealer)", "value": "cefdfeefdaf6a18ae4c6fe3c1eca1f1f41cb23e7", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222526, "uuid": "244ebe35-30b2-4a89-8809-5f6e1d1139ab", "comment": "Malware payload (LummaStealer)", "value": "7fe2e8d6dfc03d7e02aeb080627f79c13104170c70b954e1a3f6aea8b910576fac5374d7de792083445541412f2da45b", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222526, "uuid": "87c25d12-86d7-4972-80eb-47e79a424903", "value": "T1FF746CE6F0655CB8FABC59BFBCB10D4E20F89148CDA579695ACE3B191954BBD38000BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222526, "uuid": "440b688e-43ad-42e6-ab60-14087ada0d06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222526, "uuid": "be09eafa-5a06-4fc4-857f-84dcfe5e2fc8", "value": "6144:G+4JQjmYvcFoGg7Cor3uN6dLWeHigvP1YuOttNF+1Zqr24U:gJQjm7Fo3tr3uN6BWfgvPWRtt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779222526, "uuid": "2418651c-d06b-45dc-b792-55180705cce6", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779222526, "uuid": "bdf638d0-17e1-435a-9a2e-a4cfd3f892cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222526, "uuid": "6c2974b6-7082-49d1-a70e-f364e56a3788", "value": "boss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3940223-5395-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779203839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203839, "uuid": "c26776b4-509e-4ef9-ae14-753e4322e24b", "comment": "Malware payload (Mirai)", "value": "023495c6b3abac8ccf002f2976525c52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203839, "uuid": "654c4f07-9ff5-4374-9cda-0bc00aad2f22", "comment": "Malware payload (Mirai)", "value": "b32e31d3c3f62291c3016cde5e0a14cb2a281026fb1f8878e07fde0513d26783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203839, "uuid": "3f750fb8-6cdd-4c20-9baa-bcaef409e70e", "comment": "Malware payload (Mirai)", "value": "e2c33ce93551d6d7960713226320f510f8ba661b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203839, "uuid": "5aa225b9-11c4-4034-a62c-cc4745b2579b", "comment": "Malware payload (Mirai)", "value": "e78b72cc87f6654af72060a367f6a0dd99f5aa99daf24c86b0eaa2dbb96360a20e6b4363ea6894555825249c0875c661", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203839, "uuid": "1cdb3bf5-a533-4d18-af47-4a075ecd776e", "value": "T1ED539D63C93A1D58D16499F0B0309F3A5723E55082871FFBAA65C379A447EACF2493F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203839, "uuid": "1d6a3d45-944c-44df-9004-45ca00f933e6", "value": "1536:4vh7rKQovr+KYo02/jClCfT0VDzRhIuR/2J:4J7mHjxYmjClumfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779203839, "uuid": "c94f5226-91e4-4747-8ac7-37b95af5bf71", "value": 63424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779203839, "uuid": "4344070d-5f72-441c-a4fd-a9eaea9f75e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203839, "uuid": "2e738e3f-8af7-45ad-aea0-b90075c75f79", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24cab79-53aa-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779212829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212829, "uuid": "0afc60e0-52b0-411e-8c39-6c13aa4ce675", "comment": "Malware payload (ConnectWise)", "value": "f17ef45c3c3e10e35e3cb9f6783838c0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212829, "uuid": "bd40ac6a-674f-4557-bd3b-e8c27e776fd8", "comment": "Malware payload (ConnectWise)", "value": "b39c09dd4883c025afaf4f09f0afb2217c616e3d522e63ed027cb2095ab94b8c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212829, "uuid": "8d349d74-ce3c-4a4c-9440-ffceb04a0081", "comment": "Malware payload (ConnectWise)", "value": "b6865679c39e762b6102c34e5e940706f5329180", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212829, "uuid": "22704a5e-a064-41cf-9808-ac0e3b6683b7", "comment": "Malware payload (ConnectWise)", "value": "0921add7d5506a7793649ecdceeb0d52b5a9bf01aab023e180f1dafb32f1d62e66b88533ecaf728bfe8639fb41a969b8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212829, "uuid": "6b4149ad-741b-423e-a215-fb3914fe0c01", "value": "T1295733002BEC65DAF2734734EC7726B00579BD629F13E02F4619B81E9531E94AAB2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212829, "uuid": "679773c2-37f9-4e5e-8fe2-47f7dee7cca3", "value": "786432:COvjx3v19Ovj9OvjoOvjDOvjDOvjLOvjd:C+9v19+B+U+X+n+n+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212829, "uuid": "523f58a4-022a-4946-b8b9-ca70c314869c", "value": 27602944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212829, "uuid": "4b6189ff-a080-4d0d-af1b-ea47ffcedc78", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212829, "uuid": "afc1b645-9b82-4133-a749-0ad8b1614d50", "value": "ScreenConnect.ClientSetup3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84057d33-5353-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779175358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779175358, "uuid": "b9bca4d5-5868-44fd-9eef-e4b53f857ede", "comment": "Malware payload", "value": "471c1001ce3eeafdfab368ddc5ad9289", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779175358, "uuid": "ce53c2ed-bca2-493e-9232-3831e8fe6a8f", "comment": "Malware payload", "value": "b454c5e46022d715abac800f152972c51222d447ff0122fc6f872a4b8596c9f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779175358, "uuid": "c2284407-9c43-4574-bb5b-db3d97651183", "comment": "Malware payload", "value": "f0cb30a97dddf98ff89d2d026b97b92f86f5d6c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779175358, "uuid": "532b626f-ab2b-49dc-b8b5-bbe7179cfcd3", "comment": "Malware payload", "value": "881335440943ea04720e62337d4bf1af40dc2eeafcd1ede67686752e10f897f69ca74611aae21ef850eedb8568ecc54a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779175358, "uuid": "ff0a8285-b691-4757-bed6-108bff83500f", "value": "T1BA085A6262AA05B5E9FFBA3495E24D13DE72BC076B3081CB3348173A1F736E09976711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779175358, "uuid": "232fa319-1893-43dd-bfe9-27f1efb13666", "value": "c5e9c9e811d7f2bace32dad58f8f3f62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779175358, "uuid": "44aafcfe-f19b-4c66-8dd2-c87171b44bda", "value": "393216:oAsN5fijNgTxNmDJdAJr/NYeerl/CAvYXJu1ZzlxlO7EnmvwjfIZVFxep8MI2w/2:oJUfzDIj20mvt5m6dG/ubi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779175358, "uuid": "af242725-5cfa-425a-823c-1a47732dad9a", "value": 81248768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779175358, "uuid": "baaec592-4f2e-4e5a-b638-7ef817663bf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779175358, "uuid": "c512265d-5d38-4ced-be5d-b86dba8ec512", "value": "Loder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad44dc4-534b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779171987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171987, "uuid": "7a72eed5-b7c2-4574-a4b5-d1bd8fece8d5", "comment": "Malware payload (RemcosRAT)", "value": "59fdd6567736c9ccff9dca06d41c65e5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171987, "uuid": "ada4283f-347f-49cc-890d-c76beaab86c4", "comment": "Malware payload (RemcosRAT)", "value": "b514c50e515fc5cb5f17625be63284f1d0d8dd86c36edc44b23c8e8bfd7ea3ba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171987, "uuid": "69a0f190-1c8f-40cf-8e06-67b8e0ead51d", "comment": "Malware payload (RemcosRAT)", "value": "1ede453877a7f2aa13f826e65939ddcd95067cc9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171987, "uuid": "803cba67-cb2c-4ed6-bb74-68632ee35d54", "comment": "Malware payload (RemcosRAT)", "value": "8a423bc31378515fdbb72918c5340a2b823e740dc9599c2d2cc2c10184b43aec1a489a76a8ccb0cf4b3184aa431aa44b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171987, "uuid": "75e2a3dc-0f4b-4a6c-aa42-67bd944aff23", "value": "T1BAA5021370622685E301D3969CBE3D69796BF956938A13ECC1B019CD84AFD3125E2EF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171987, "uuid": "8b4a238f-5500-40cf-a5b9-ea70616b194f", "value": "48:7dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd/:VxuosqqTyxJCKrFzHshHBoGyem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779171987, "uuid": "6870e1ba-87e5-4000-96a6-ae11338f6307", "value": 2267993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779171987, "uuid": "44e9ebfe-ba8c-487c-b6b5-85384fb0b290", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171987, "uuid": "dd44fc3c-88fb-4383-991d-33f36880b4d1", "value": "Order REF No_1152341#18_05_2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17b8970-53b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779215807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215807, "uuid": "30a0b7ae-254e-4b09-84e1-a5a5ab49a329", "comment": "Malware payload", "value": "ecbc0b147c030540ebfa1d8a420a0704", "object_relation": "md5", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215807, "uuid": "b393d871-6335-456b-8753-4c888e1f879d", "comment": "Malware payload", "value": "b5d774bef59b8d6d4d8b0eb7a9673ed6e6f2ea51e28d98374951124a92322b48", "object_relation": "sha256", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215807, "uuid": "2e0e63fc-2fa8-4851-8e41-2eacfddebcfe", "comment": "Malware payload", "value": "9fc1bc749de50bca1c53a3ff033e2d22469ad904", "object_relation": "sha1", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215807, "uuid": "24067fa0-58d9-4bf9-8492-e5abe24aea8d", "comment": "Malware payload", "value": "2cd8052ae20465b5d040b1338d88fec0397bcec809123a5eb659c3ed2d2eff62c449862ef4bf8d15b8181294a258d198", "object_relation": "sha3-384", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215807, "uuid": "7f2ea082-eb7c-47bf-a051-5a7ff72b9214", "value": "T1CF052304F3EC2751D7FA4F3C647986448A35F98A8C22DB9E2B8D729E89637905A31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215807, "uuid": "a664de67-c244-4461-aff3-8c71182a44e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215807, "uuid": "5cb1b1a3-26e0-4697-ab10-fe733124bdab", "value": "24576:GPjefN9cWvcFR0iPzmI78XUUgFsWcqw4I8b:ymNOWvq0iPzmE6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779215807, "uuid": "a0304d66-2de3-42f9-ab00-8eb3342713cb", "value": 831532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779215807, "uuid": "35813228-0b41-4eb0-b5b9-f353b45fdec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215807, "uuid": "257ab566-1d7c-483f-9d4f-ca3e42891bdf", "value": "b5d774bef59b8d6d4d8b0eb7a9673ed6e6f2ea51e28d98374951124a92322b48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebd17a3-537f-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779194140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194140, "uuid": "599b776a-7049-4a1d-b5b0-044dbd3c2f31", "comment": "Malware payload (MassLogger)", "value": "c91e0eddfafa8d62670ee9607fc7ccc3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194140, "uuid": "d7737762-36f9-450d-8da9-e0e409d4bbbe", "comment": "Malware payload (MassLogger)", "value": "b609a59e93a5eb963b2308d9d7d88770dd386c2e3c8e11fb11203321203fccdd", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194140, "uuid": "66159c55-e1c7-4e29-a5d9-f6587885f8f0", "comment": "Malware payload (MassLogger)", "value": "19500d99fe2ad21b13cd0267e764a3de770bb2ba", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194140, "uuid": "c288fee7-7692-4236-a2b3-139da8d99371", "comment": "Malware payload (MassLogger)", "value": "57ce038ccaa4f8d7d9237f28f797bff3ba2f628cb27cf97d36528066e45ae2bb416bac84a9c717f730a7f12804091cc9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779194140, "uuid": "e6fa4802-df9a-4637-b00f-19638bfebc65", "value": "T15AC5EC3D8B8C3689FDDF74C651A09ED0FBC6E97D4AC2A55CE46583734F0725822A0A38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779194140, "uuid": "f2ca607d-b730-4db9-8c15-53e7a023c224", "value": "192:fvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlvlY:tB/pfwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779194140, "uuid": "2faef5b2-6e9e-4754-ab42-950c698b304b", "value": 2529598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779194140, "uuid": "c7090eae-c7cf-4516-942c-545d725a8ec6", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779194140, "uuid": "cb705a3b-12fd-48d1-8b37-67d9a7d438e9", "value": "SAS -1126055.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe5e258-53a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779210006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779210006, "uuid": "06db4c85-ad68-4fcf-aaf0-a1bdf1f2de1b", "comment": "Malware payload", "value": "4d004eda32265e2ee93c97c555f6138b", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779210006, "uuid": "0e868bc3-9d77-45b6-8aed-d69a7d5b90b5", "comment": "Malware payload", "value": "b68900825aa54300717205cb70aacd19554a3c7f0db14922a8d311d5f590a740", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779210006, "uuid": "8d045d5d-c95f-4644-8597-57f605ef66c8", "comment": "Malware payload", "value": "0d0d01e0a73a4c1eee8be3b8eae513850bd74e67", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779210006, "uuid": "9d7fb358-96c3-443b-8b01-e548d269908e", "comment": "Malware payload", "value": "4885ca2b96595835c16235ea87a38b4c13a4eed887ed4e500f930493ea5a3f25a1bc31a0cbd583fdcace0a3a8257ed93", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779210006, "uuid": "ac9402f0-a533-4518-a291-c47e1077e5d1", "value": "T1D8042347560DF5928F59227910463BE9C6350FE3B0B3319FE5B632A0D211EAB436ABC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779210006, "uuid": "1db284e5-21aa-4efb-82f3-599c16e3e122", "value": "3072:ZJ86VwWR+260RelaWJ9HAxFj1oHyEjQwxeNstbEvTIXGS5F7N4FQIr++97PD:ZH7eA69HgFjWHbntUnz33bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779210006, "uuid": "6810125a-ca8b-43dd-ab34-a683bbdf27b2", "value": 181181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779210006, "uuid": "6da4620c-3d00-4395-aba9-5214d6f301ad", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779210006, "uuid": "1d537408-5240-4644-8d15-4ccfa31a4300", "value": "nNARESCO_CONTRACTING_-_Document-2844992498478_Supply_Inquiry.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f0d6b1-5360-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1779180750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779180750, "uuid": "21a15fc8-14ca-4c87-b628-e7bfd3f48981", "comment": "Malware payload (Smoke Loader)", "value": "7feeaa2ae078adb6e16237dcacf5af80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779180750, "uuid": "122dfd27-5f8e-4582-9b12-57aab8ce672a", "comment": "Malware payload (Smoke Loader)", "value": "b69a80dfb4c92d29c0b5767cb9717c5498cf27794d9ca6b394deec9873ce0cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779180750, "uuid": "2b5715e4-a790-4ca8-bad0-b203a3ca0555", "comment": "Malware payload (Smoke Loader)", "value": "27bbb0630c6a2249dedf0c057d4532f298a6c79c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779180750, "uuid": "bff82115-2fca-469e-8fc0-69404f1e69cc", "comment": "Malware payload (Smoke Loader)", "value": "cdc441bf404819918dad3ec62d16f36b6081c07256f57a28fadcd3ea4fcf61786a40aed5dea8823110d683618bd23aec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779180750, "uuid": "416bffde-28a8-45d6-82ad-4340014b2c89", "value": "T10C94E1C8DDB7A6B5E29E56BC0469E34BE47F8853342720C9470CA89F064B17F2AD458F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779180750, "uuid": "d203771c-5102-431f-9f72-9d52de100bc0", "value": "0533a57ed8da28fef6c6273af538a067", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779180750, "uuid": "8333bfee-5eb1-4156-bed4-d4855749fab3", "value": "12288:kIB7TJSTCcVDcdExGlF2QxLI795gqDAsS:5FmVDcdqGs79iE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779180750, "uuid": "dbfe8b26-c722-47f9-8948-5123c0143676", "value": 448184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779180750, "uuid": "db96bc1e-faaa-4607-b9ec-cb8d91850a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779180750, "uuid": "02cbf002-5bd3-4631-b746-b79cba54e7ff", "value": "efianswrhenlni4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ffb5d6-5367-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779184111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184111, "uuid": "662f73c8-7ac6-4005-a8b6-dd9f648d329a", "comment": "Malware payload", "value": "fcf756287b32ed8326e7e6fbffd6f1f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184111, "uuid": "4133e30a-23d5-4ca3-898b-a4c9584ef046", "comment": "Malware payload", "value": "b83926bff25150588f0f348366115ddf8568e1c5e7beb69415e7574d24de66d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184111, "uuid": "d6053010-b604-44e4-a6ff-e416448acf63", "comment": "Malware payload", "value": "d69b84d894d464737afa78192e63cf13d2416187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184111, "uuid": "30bbc409-9951-46a6-be89-b76828a93697", "comment": "Malware payload", "value": "c2f57197fc0d1edb813942083b81370cf8d985cf9bd03ca0bdc64dc537f6b8cbe21dec86a65dc1004637361557c995e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184111, "uuid": "026daaae-8535-4a7a-9caf-ceaefd80577c", "value": "T1991833A3E224B2F6F1770AFF4647A5A2A0555C9CF258B330DAE0760832B0574CA1B9F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184111, "uuid": "de764048-0b20-40e7-b7e2-45baf8a447cb", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184111, "uuid": "27524c23-d8c1-4431-9598-2e2e32b0ed31", "value": "1572864:hmhuPxGBArvpRV6FhNQauyQ/yjkxdAgHJ0MkzAghxFzQkJ2pagJxGMBFG+4lWpqY:hmhuP8BAbpm/unL9p0MUAgdQkIpp/GM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779184111, "uuid": "b08896c8-379a-46ee-b3e5-16c8bc41325a", "value": 92262960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779184111, "uuid": "66a138b0-abe7-410b-bb4d-e6d8120d8545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184111, "uuid": "01ec1896-2500-4b30-b595-d598f222774d", "value": "b83926bff25150588f0f348366115ddf8568e1c5e7beb69415e7574d24de66d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27ac6b6-53be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779221419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221419, "uuid": "466c00d2-cd18-4674-a7c9-bc4e8f8d861f", "comment": "Malware payload", "value": "d234eb0d2752c99e7d4e0a0d1cab9ffc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221419, "uuid": "cb5ef1ea-86d0-4915-8852-91722bac3cb0", "comment": "Malware payload", "value": "b86876f8e57ee805c30f4e647963d744c738f6ee2746343fd6dfd5b6aff98dda", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221419, "uuid": "0fdcfc30-d7d6-45d0-aa04-f34bdcefa50b", "comment": "Malware payload", "value": "6323a16ffe87edec5a4249d323ae490ad29733fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221419, "uuid": "03e10e41-0d17-4fc4-9748-71cc0558f681", "comment": "Malware payload", "value": "7b9d3c0f3deda738d76aa86f0111bbc41457ff7a96de95caa3382762b6e8faa18735a859d30b7bdaac59e0e61d5ea52a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221419, "uuid": "9bbc6d53-39e8-405f-b56a-0510b752efe7", "value": "T116359F5AA3A901B9D0BBD274C9574A07DBF2B8461370D78F13E04B9E2F17B715A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221419, "uuid": "c99fbdc4-5afb-49e9-9307-fec7064a3130", "value": "94fbe362139fab4d909348c0629b9f50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221419, "uuid": "9efa25e6-0440-4caf-87ff-0909734f84eb", "value": "12288:709NxaFduqXi44TnCqSVVNlqQtVCm8BUgMtlb3itFkQJXLr7XpiaoFoOABlI:AQvl4TCqeDQQc1ALitSWjX8Floi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779221419, "uuid": "e141c818-1e62-49d7-82b6-fce7cec30dce", "value": 1074688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779221419, "uuid": "5d96e48d-fe15-42d6-8d41-682c2968e5d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221419, "uuid": "6c6d9f30-3342-46f8-a190-a746c78af867", "value": "chrome_decrypt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb3b277-5350-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1779173870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173870, "uuid": "5f3747c2-d2f2-4526-94ff-e119c41383a1", "comment": "Malware payload (RustyStealer)", "value": "9cf86bae4c3cf7f1cb4bc429f82a0fa1", "object_relation": "md5", "Tag": [ { "name": "PoisonX", "colour": "#33A889", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173870, "uuid": "c3998976-f67c-452b-9e23-5a577529859c", "comment": "Malware payload (RustyStealer)", "value": "b892981af3ca699d13f07ddcf75c2df62c1543b071278b4cc1ac0993d8b9dc01", "object_relation": "sha256", "Tag": [ { "name": "PoisonX", "colour": "#33A889", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173870, "uuid": "b0202d6d-72fd-4843-b612-e6369adb1e1e", "comment": "Malware payload (RustyStealer)", "value": "ca941431c42d3a4a9cf37a5114f7cb5ef8f78cff", "object_relation": "sha1", "Tag": [ { "name": "PoisonX", "colour": "#33A889", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173870, "uuid": "db536371-8f13-46ab-b302-14558adccd1a", "comment": "Malware payload (RustyStealer)", "value": "535beab79f919f175dd3f3e9709712aa3d7d7b18b15cfe32ca77b4abf0f115a55ec5723f3eb738b36af88a91122aace4", "object_relation": "sha3-384", "Tag": [ { "name": "PoisonX", "colour": "#33A889", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173870, "uuid": "79135cd5-bea7-4d59-a701-5237991830b1", "value": "T19A15334D159C76C2B31BB02D674BEF44DEA99FE97125C8AE6BC2C2011C3FE558DB8809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173870, "uuid": "ba0470c5-3206-4e8b-95d8-111b2e3546e9", "value": "24576:ilXzE98j2lip6AEap1SfIP0FzQj/5mJR+:ilXzE98sY6AE6MK0CjB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779173870, "uuid": "b68b2e35-4900-45c0-8dde-bbf2756b6f35", "value": 909069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779173870, "uuid": "6d93b7e5-e9ee-4b24-b664-1dd7f5008b85", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173870, "uuid": "804baf51-5ba6-461a-9799-b290ac598eb3", "value": "WindowsTelemetry.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3a2b0b-53d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779231879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231879, "uuid": "c931b0a7-72b9-4aff-a690-d776574c1296", "comment": "Malware payload", "value": "9fd686151b9df14ac46172fb8f1cbb35", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231879, "uuid": "251b3684-7982-4711-a0a5-17bc80b51005", "comment": "Malware payload", "value": "b8b9468c8a13441927e3e0678087d926760b3970f667ef1c944d9d9abd2ccd1a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231879, "uuid": "a1048a1a-dd3a-4c26-929f-e48e04e1c7be", "comment": "Malware payload", "value": "b8d008df2ee572eedc6520c5040d58d2a1e641fc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231879, "uuid": "303ef5f5-39bd-4cef-84ed-2a3ac6c852c2", "comment": "Malware payload", "value": "3aa10b7b881893b4cc7d47c24d36654e19a7db346a3a7b3e541d3188902f4c3805939dec16a65955c7c9793b3278dbe4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231879, "uuid": "6545fb30-0dfa-4cb4-8ba9-4aa68a490bd5", "value": "T1ADB25D0FB8154319D4E100B092719F7BC9B9A9B73788A8DBF38044CD5A686D6FC3695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231879, "uuid": "fc2e230d-8592-4d6f-b070-e3b27564efe3", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231879, "uuid": "4096776f-1558-40b3-9bb9-3cd64008019b", "value": "384:ijthb/HJnv+UL7exaxdlLHMwXud2YLNL97cpHB9z:ijt1pewdJMw+dxc1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779231879, "uuid": "6c3fc3a4-4317-41b0-9a50-6245b64a07ac", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779231879, "uuid": "0444b5a1-f331-4003-b46a-7a6dcd98c065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231879, "uuid": "f020a006-dc6d-4964-a1fd-bccc747cd558", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebf975c-53b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779217360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217360, "uuid": "294600c2-85b9-483d-aefd-a18b6cf77468", "comment": "Malware payload (Mirai)", "value": "145cb45f52475fd9a50e73027c7788bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217360, "uuid": "b7530011-fbf9-4998-82b2-f637acaca79a", "comment": "Malware payload (Mirai)", "value": "b8c031a97b494673d72fe909384eefcbe40932da508226bcf1c9d164fafb9945", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217360, "uuid": "a211a5ba-6e1b-4960-a121-6f9c8b4c0311", "comment": "Malware payload (Mirai)", "value": "a2896c1bcdcb4ae5fa3344d09e1d42f2e4248855", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779217360, "uuid": "47e7dfcc-1313-4e24-9002-bd8dec24f80c", "comment": "Malware payload (Mirai)", "value": "f995f5dd0a734843c5cc597edbb166accef15cc3f4524315d961158745c8d89980cbff70a7c447b1690f91f51e6c962a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217360, "uuid": "90f55fa1-0bd7-42b3-95bd-c8d36f3c49d4", "value": "T15333F170E25FDCB6CB70393A8A481A817E256FFD41AD73378654ED1C92408476DF95C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217360, "uuid": "a927ae55-8494-44d5-8437-91b8b270be56", "value": "1536:y8JVti6JnArYb7dulhN4To1P4XhNQ+Iw54EwLl:y8JVYcAUHdu3NZkhfH54Ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779217360, "uuid": "94d08d63-914a-404a-af4f-38407de39a18", "value": 54604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779217360, "uuid": "307d4656-5b5c-4a97-853c-22f02b52901f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779217360, "uuid": "bc1caf90-a4f7-4d68-a7b7-00303b81f814", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bc4e0a-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219552, "uuid": "d11692e2-7745-454b-9a1c-36e544948d1a", "comment": "Malware payload (Mirai)", "value": "c3af63d0a658eceb1aec03811fd9980c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219552, "uuid": "85ca085e-349d-49b2-8dfa-f82bbedeaf68", "comment": "Malware payload (Mirai)", "value": "ba174f041b3d8999cbee22469123ce9beeecf9e6a6d9243bd4d98e09a8d60804", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219552, "uuid": "d1e8f732-721f-4fa2-9c3e-78f32fc29d75", "comment": "Malware payload (Mirai)", "value": "ac9c2c76356cdabc9ac88814e47bf5debc91e0f2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219552, "uuid": "4730825b-5999-42cc-9770-c05c122d78ce", "comment": "Malware payload (Mirai)", "value": "b37f718c8ae52c734f47c8280b14615f78525e4def26727f31d636f7cc772b52e364f91ac6f15d827c5b61ba67f76c4b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219552, "uuid": "cac8b452-b068-4066-8fa0-2820df114e4d", "value": "T152E32A426656CAF3D5C31FB512A74B220633E83A1F2BCF05E32DBCF45E55588F21A668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219552, "uuid": "63b9c2bc-f9c9-42e2-a0ba-4a5c9d0093e9", "value": "3072:FhAmsYtMV0YfTIFo5TCURsngSqmA6CRg/n59T9g75dBg:F1/07IO5TCmsngSqmA6CRg/n59T9g75s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219552, "uuid": "18d307a0-d193-48e9-a996-76fe1ade352b", "value": 153258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219552, "uuid": "98871873-9d8d-42d4-a3d0-454196635e4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219552, "uuid": "4da3013b-fcbb-49a1-bdaf-7d2aa3f6e4ad", "value": "mynode.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24243672-5351-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779174338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174338, "uuid": "6b294e35-6582-4b04-a15a-81acd25ed04e", "comment": "Malware payload (RemusStealer)", "value": "18725754f8b8fc713ca46650ac82e51e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174338, "uuid": "69acc7d0-0048-4b7a-bfe4-b5a9fb19ca32", "comment": "Malware payload (RemusStealer)", "value": "bb0d811fe62f5055ac5a3d675b85b2ba38ae10d7cc1f98f24b34fd068d96d758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174338, "uuid": "d7e6bd23-cbfe-492b-a536-5fe5fa6a9aeb", "comment": "Malware payload (RemusStealer)", "value": "3a05b2746a4cf1a984dc189955f0ffe335d7585a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174338, "uuid": "9ecc44c4-ed72-4f7c-814a-13700c9edb4c", "comment": "Malware payload (RemusStealer)", "value": "47d0bc193548a93534285ce40a66e2398077138711cca8362fe232838da39871a70a28d72890a70419e0dbf7186de2e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174338, "uuid": "7e0c3e40-9cd9-4d3b-90e0-c9ad60d82515", "value": "T145643A67D39330FCD563C17892667622B732B93947709FFB03A287355E22AC05E39A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174338, "uuid": "1fac9202-cc0e-449f-a7cb-d48562d0314c", "value": "1a2688e74e6d3cf5f1549b3185a5ab14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174338, "uuid": "669e9292-596f-4f95-bc8f-ce8f0ce4d6ce", "value": "3072:fEpKu9EVR/8fQtH6EwUHB4IBtoTgsvZcBl0d3a/P6Z1maouVYSK2Oim8l0vY2gp5:Mj9EVr4EauWqH6ZQ52i9JemTqAPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779174338, "uuid": "fe0848bd-ce37-4073-ad12-ee886a0cf6fd", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779174338, "uuid": "1adcfd19-20ac-4866-9f3e-4e4e71143afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174338, "uuid": "ee3235f2-9776-4cb2-b2f1-7f4193c13e75", "value": "1azo6dkg.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4aa5ea4-53aa-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779212806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212806, "uuid": "581c04cd-8a39-4b40-b549-750db6c583b4", "comment": "Malware payload (ConnectWise)", "value": "d0fb766e30e4e831ce09de35aefdab68", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212806, "uuid": "a22660f3-df27-413d-a810-ad06100191d7", "comment": "Malware payload (ConnectWise)", "value": "bbc834bd89e6d17a1fdd034e46a0dc00a26afce8ab9f593b11bcabe837ac350b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212806, "uuid": "103f980f-34e2-469e-b605-e08f63e0d57b", "comment": "Malware payload (ConnectWise)", "value": "8e0a8db4a74b37f0e3775b186d8b94a34077ffd2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212806, "uuid": "fbfc0c94-af01-415f-8269-4c1251b892c5", "comment": "Malware payload (ConnectWise)", "value": "de5592eaff9316916a769621310ec407f97c27d0e816f6c9ad1acac7d9d44e9dc48a32aa25fd9f3c4835893d77d35d52", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212806, "uuid": "a471e7b6-c230-4646-9c88-251faedbf04f", "value": "T1E2A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212806, "uuid": "3113feea-5773-4f07-9794-84e5d62ef664", "value": "196608:PnCtVYqI5MvbWEpKkqMIJqKYnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqgnCtO:/CXvI5MvHxkJKCXvI5MvHx6CXvI5MvH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212806, "uuid": "0132e790-9a65-40e3-aa63-e4d8b3eccf63", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212806, "uuid": "0041c886-6412-49d4-8ec4-8acaf0cd4016", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212806, "uuid": "57a27c1e-5e25-4a44-9f52-7e949212a383", "value": "ScreenConnect.ClientSetup4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87933f22-5355-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779176223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176223, "uuid": "87b46d92-cbc2-46a2-99fb-95fcbc48baa7", "comment": "Malware payload", "value": "b886cc524bf838f9dfaf2c4c14222a3a", "object_relation": "md5", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176223, "uuid": "6fe571a3-b697-4056-8b98-477792b1dc58", "comment": "Malware payload", "value": "bc5be740a6d347675fb29c3322d97cb37620d0bc42aa5e82e80b9474fc0307f5", "object_relation": "sha256", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176223, "uuid": "c443b8ae-5170-4ba1-ba0c-61ddfd85d56a", "comment": "Malware payload", "value": "875ec21344a7308b8e94ef9bc79725982211aed6", "object_relation": "sha1", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176223, "uuid": "0611c2e4-4dbd-45b2-99a3-041119ed9d10", "comment": "Malware payload", "value": "387e8c3310bc63e1a193c7ef59dea4baecb15cce568390efd3c127e21e244f3940e6c1bfea659f972d765ef778dae7db", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176223, "uuid": "80a3b133-319c-4671-a788-4a0b4058d59f", "value": "T1E023E1213B35BC16FE9BE2BA66D0925C72381AB78C41DC596419B5C56C30CD8932ABFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176223, "uuid": "3e2d4352-9ea1-4a29-83a0-6cf49ec290c2", "value": "768:fifiPSLrdU0JHbPeo1BIqishzIRiPZifiPSLrdU0JHbPeo1BIqishnQBF:fiJqIHbPzIahzciiJqIHbPzIahA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176223, "uuid": "b404f382-f79a-4fa0-8ece-bebd54feb95e", "value": 49865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176223, "uuid": "7002b513-3a0f-4ac3-8158-0b2101bba21a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176223, "uuid": "f2ac39bb-3370-4fa3-a024-e28a676d6841", "value": "victry-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbceca07-534d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779172982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172982, "uuid": "b95a2a63-1573-4ba8-a943-741db457b358", "comment": "Malware payload", "value": "828df44d47c7ea77602c200fdad11ff7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172982, "uuid": "4aa229cb-39f0-4d04-821d-f7b7f158d05b", "comment": "Malware payload", "value": "bd4470b7dbbffb736e31c5fdfe96acf476d609a84b4179597ee6061461e17386", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172982, "uuid": "c32c8f63-b9e5-46ba-92ea-1c2c6476e618", "comment": "Malware payload", "value": "beea093c3a9d52896b32b630a73a53c0cf0ea961", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172982, "uuid": "77780523-25a6-45ed-b53e-b25ec96944dc", "comment": "Malware payload", "value": "0cd1024085261bf066408fe358915f248ea044347414e942572becec57d35fa44b79711bd78ee73bd88d437cca73c615", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172982, "uuid": "90ed095e-ad82-4e6a-8325-170fea4f0d77", "value": "T10B473399E87C1BE7F07FB4314DA4C84A96B22C26BD134C36AEE9761642B31E0F5F0059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172982, "uuid": "00ea52db-e477-495b-8103-042b37a16960", "value": "786432:/m57SwDmzguYXGmzD+OL0FZy3hoXmAoJrj:/m57SG9uCzyk0GxqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172982, "uuid": "4af05535-624d-4b04-90ca-1a67fcca9fe5", "value": 25960448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172982, "uuid": "4ff4fabb-8255-458f-bf1c-6c6d7a49b0c9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172982, "uuid": "5e227be1-d64b-4c61-92e9-037ba7d40ec9", "value": "bd4470b7dbbffb736e31c5fdfe96acf476d609a84b4179597ee6061461e17386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420cc3ac-53b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779215620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215620, "uuid": "83994550-ded4-4dbd-913b-51a88210dbdf", "comment": "Malware payload", "value": "e939cbc32bd8ba86f60510355dc9d122", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215620, "uuid": "3d5abf3c-3587-4fdf-96d9-5218f2bcad3a", "comment": "Malware payload", "value": "be147d97b6bf2b2de936cd2a9b6dadb1a3912d8e2f9771945901c6b7b2642d8c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215620, "uuid": "eece8f24-b4dd-4987-a2ef-a2c4de37c5da", "comment": "Malware payload", "value": "25c2d245223bab7cc9a694026e4c9c4c687c548d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779215620, "uuid": "ad71b0d4-3bca-494e-b6c7-09aea266f0b6", "comment": "Malware payload", "value": "c145800de3696c34250ace709c84f826a2a775f74668a7775a8ceae6bf69a6e61fb1a7cded1e23e9e2644d7a86f33103", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215620, "uuid": "8463289e-5cf5-4354-b0ea-ec3fbdcf8604", "value": "T19F136D6526953C25AE99883B5C7E2F0CBDA983E1304491DDBFCB3CF18C15A9CE318B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215620, "uuid": "1b2c5491-4de2-4dab-b56b-8299e6570c3b", "value": "768:Pr9NyXsZztCI9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:zHusZ0co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779215620, "uuid": "6ac7c18d-aeea-4090-b06a-01f509773151", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779215620, "uuid": "5f5dc4ae-541a-4c8f-bb0c-f9710c736505", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779215620, "uuid": "10e326fa-1c2b-40b3-8620-e322568ccea0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83333b9-53c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779224033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224033, "uuid": "f2f5d218-badc-4de6-82ce-100f0f2c877d", "comment": "Malware payload (Formbook)", "value": "c552bccc2755965fef371f3a1aa51fdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224033, "uuid": "7e4acf56-e47c-42fb-94c3-eae5fca9a04b", "comment": "Malware payload (Formbook)", "value": "be1f829c0a12b713df49c8a8cf8dd1bca669b975b7ba147a9991d4ecb8d5a8cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224033, "uuid": "e7b79838-8867-4b21-9d6e-6d1324d62597", "comment": "Malware payload (Formbook)", "value": "2cc75af6956ef953b5f2f2d6121c89fa70324925", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779224033, "uuid": "1286e9bb-285c-4ca2-901d-d17b267ebf6a", "comment": "Malware payload (Formbook)", "value": "04eb30cf362010b2955ce0976aaf5da49d78244ea923de5c3a75f3a02c773a0cb1c3024a6762392eb4d9968e94e747de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224033, "uuid": "cd7e2ae8-2958-463d-b2d3-72f46170d1e0", "value": "T1EE2512186656D407CA955BB84E71F3B603BC6DCDA600DB079FEDBEEBB82AB114C01583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224033, "uuid": "801286c4-8903-4e06-b1f4-6b9a8d9dbbc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224033, "uuid": "c5d357c0-f87a-43a4-9f42-cac7d6f4a73f", "value": "24576:imfe3ySg2lJhDoisoUbwvR29Q1hki0XxTnYvMm3T8WxI:ZWiaJhMLevR29sk1MM5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779224033, "uuid": "988c63d9-cd53-4128-a4e6-9d8abbb550c9", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779224033, "uuid": "f902d873-c957-4299-b134-655f32afc43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779224033, "uuid": "63e00376-d731-42ad-8b41-fdfa9cb19728", "value": "RFQ_PURCHASE_ORDER09853456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c7bbd4-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157260, "uuid": "0b3a2c6e-72a7-410c-b270-ba6bf7cda753", "comment": "Malware payload (Mirai)", "value": "92aedca093bdfb809eeb41ddbbb5c054", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157260, "uuid": "dca69f12-77a8-4fc1-9d5d-e38dd6ff88fc", "comment": "Malware payload (Mirai)", "value": "be27d319f75643466bcfdbbfbd522616cd38771102dcd7af6bfe7a1b088228c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157260, "uuid": "84e48fea-25ce-4388-883a-fdb51d00a196", "comment": "Malware payload (Mirai)", "value": "785332e97745a8aca1362c9d429a7eedbdf4d7cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157260, "uuid": "a89f9785-8208-4023-9815-66ba1fee1f93", "comment": "Malware payload (Mirai)", "value": "cc10bc1d44a79eb3a5e22532abb241c73a39050862a1915cd85cf0603da9f6c6354847982820ab56cc3f33f3e2eda5d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157260, "uuid": "7335f2f2-dee7-4d7f-91a3-4b66dd30ad66", "value": "T1F6B33B46EB818B13C0D5177ABAEF42453323A71493DB730689186FB43F86BAF4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157260, "uuid": "a24464f9-117f-4f7e-af68-035145d66e2d", "value": "3072:7ooFfcwB8XNYJcbRU53UngjmJ5AM/9w9Bl:soFfcwB8SJcbRUhUimJGM/9Al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157260, "uuid": "90b785e8-47b7-4efd-94fe-900e70b76e2d", "value": 114576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157260, "uuid": "8468d7d7-0690-43de-b08d-dec3549b5bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157260, "uuid": "3c5f0b47-1944-4937-a093-8e332859bfa8", "value": "upperarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b1d7d2-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779220347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "8c9b4f2d-4114-423c-ab0b-db53ee673855", "comment": "Malware payload", "value": "3b706788496cc7213fee99f48943d6be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "657fdd52-2272-4c83-9707-92376ac25dd2", "comment": "Malware payload", "value": "c06555ff0ae9016a0c2cf6e300e4213a078e98fa4739c7244a6af26849cd7034", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "616679a3-43fc-4f02-b4c7-c5bc6a54e34e", "comment": "Malware payload", "value": "600328d7e4a8e2036a47501a19fce24cc34b3162", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "ea8205a3-53fe-4107-a589-6d11d4fc900e", "comment": "Malware payload", "value": "e10478c5ac26fa698029f3f2560f7b79aeebfb651b2ecaebec321d128a57f5cb46280a140d5f966a9a74d5b1f952eabb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220347, "uuid": "109d0b45-3b35-4567-b1d2-aea2a0bf77f5", "value": "T18973F64BAB2C0B47C4AB5AF43E7B27F4879DBE6001E941C85116EEC503769B17112FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220347, "uuid": "f82f50b1-60b0-46ad-ac83-7d8100bd4f60", "value": "768:SaMt9vSQj9+o2B9D8/1l+n0jTTrenj3AN9WA9qmJYB97yq95Bf7FRatiSfvqXX1x:SaM1Rh2+jSMqPB9+qtTaQQiXF/Khc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220347, "uuid": "304cbcc2-d9b7-428b-8bba-e690a1e90067", "value": 78168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220347, "uuid": "4d7eaf0c-e162-467e-8c69-e1f962a89a16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220347, "uuid": "6c335bcb-125b-4abf-947a-f2fdfb6f3360", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efaa813f-53d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779231803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231803, "uuid": "0bb43b27-e349-4fc8-8971-8fb558195bbb", "comment": "Malware payload", "value": "429dc0db5298c1b580591696a3084868", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231803, "uuid": "f8a9e8b7-e2b2-4295-851c-37eafcf80e51", "comment": "Malware payload", "value": "c1e71e9a48704839b692313ebf469b9bc605b9abb3006f489d15742ed589cc07", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231803, "uuid": "deea6b27-f697-4052-831a-6c0d8e9e4772", "comment": "Malware payload", "value": "204e1b81d2a068a464b9aa807252a00fb318507e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231803, "uuid": "b5273313-b11f-45ec-98b3-268ed76f87b7", "comment": "Malware payload", "value": "c01c962ce2e9fdf63e3de207b66f373293e36e0c0338d772732ac167e047ce2bcd67f9260a2597475411fc62883b71b6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231803, "uuid": "cff2fed9-8f0b-493d-9731-78548ea3606c", "value": "T1BAB25D0FB8154319D4E100B092719F7BC9B9A9B73788A8DBF38044CD5A686D6FC3695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231803, "uuid": "222325e8-625e-46ff-84d2-f99123014a1c", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231803, "uuid": "c1e6b37b-a44b-41f9-a7ea-97326b2a8bee", "value": "384:iothb/HJnv+UL7exaxdlLHMwXud2YLNL97cpHB9z:iot1pewdJMw+dxc1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779231803, "uuid": "8b98dabe-769f-482c-9324-c91aa0a7ad16", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779231803, "uuid": "eecdc546-d582-4a7b-beb2-b9a70b81429d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231803, "uuid": "1c97bb18-0a37-467e-b3f3-2421a2636bd8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f07f320-536e-11f1-a769-42010a9c0008", "comment": "Malware payload (Kazuar)", "timestamp": 1779186973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779186973, "uuid": "68a078fe-a07a-481f-96be-37e283914655", "comment": "Malware payload (Kazuar)", "value": "78aaeff421355a794a6248c84871eef7", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kazuar", "colour": "#77BCC7", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779186973, "uuid": "f19bf064-ff64-4519-980c-3a1369686449", "comment": "Malware payload (Kazuar)", "value": "c1f278f88275e07cc03bd390fe1cbeedd55933110c6fd16de4187f4c4aaf42b9", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kazuar", "colour": "#77BCC7", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779186973, "uuid": "0a098956-b581-46e9-ac61-4d4feca3d941", "comment": "Malware payload (Kazuar)", "value": "ac6957ce5b1d361561d1836a6c026ab9a3279227", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kazuar", "colour": "#77BCC7", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779186973, "uuid": "c66d5b0a-7198-4909-a30d-92fd936d6597", "comment": "Malware payload (Kazuar)", "value": "5fcd416b5fa0b9aa89bb6796e0c32d165b22c40b60f01b8482d2ba35bd828e742a32ac2aad232411de0875edb200fea4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kazuar", "colour": "#77BCC7", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779186973, "uuid": "d52a8ab1-d391-4af5-ac3e-e55816a41f5b", "value": "T1DC954A1267D4BAC6C66F4E3A60AA0A2C57F0C6066757FF8732C8E1757F42314DD881AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779186973, "uuid": "bebe304c-42ed-49c8-865e-c5f43704e235", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779186973, "uuid": "23d2a24b-7053-4ce6-a58f-a99c0b97ecb7", "value": "49152:Q2ud9UEURHG7i4rWBcZaX3aiRL+XrXuUnC3s49cFjpzh2e3Uvu+hBYAaGriBBSIq:W96m7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779186973, "uuid": "c4483375-3847-44e1-a797-2dcc413fb22b", "value": 1985024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779186973, "uuid": "184704c9-62b9-41c7-95c1-501e8926d4c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779186973, "uuid": "1ff522ee-5991-4fce-8ba7-365d3de8f6a6", "value": "78aaeff421355a794a6248c84871eef7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4722dd-536f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779187502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187502, "uuid": "23f2a6ae-f380-424a-81a0-5beb96e3899d", "comment": "Malware payload", "value": "3fa4497e25c607201f52d241a8e2db2d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187502, "uuid": "f9b75d01-4070-477a-90de-bf0495aef105", "comment": "Malware payload", "value": "c2c47c5d916ee713b33de4c3c4a3fc670eae8832735c3f032fa84f882813dae4", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187502, "uuid": "eaafeb08-bd86-4e70-8820-9baadc741cca", "comment": "Malware payload", "value": "871b5b9a8b12205261fb96f74bf8e201767f6d9e", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187502, "uuid": "1a168cd1-7f84-425d-b798-b3000a80ccf0", "comment": "Malware payload", "value": "3adfb13ed77af41720765ce20d581cf929c76f5d195b33b80d8d7773493f5357a5315c582bcb5f50ed3916fb2b6745c1", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187502, "uuid": "8db710b4-50a6-49a2-a11e-e33215d01480", "value": "T1D414E0B1655B06B6E46221375F2E865682CE0BC6D538B23258CC38D6DF2313FC63DE65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187502, "uuid": "d2e6f295-09f1-4cdd-a822-be8b77bf8e9f", "value": "3072:qyOxCq8tfN5lNXlEMDoJDPDB98UK/dpowSqY3psPoLxzTatPc/TOz5/SAy:qHxktl5lNXlEMsBkUK1pownvPo1zMvsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779187502, "uuid": "e0400d01-db61-4a6d-b518-570db9101a8a", "value": 191437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779187502, "uuid": "a2633dd7-c024-4d9f-8ca6-e2a89f720072", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187502, "uuid": "4de1a09b-5f45-4a35-9195-2f02efc31feb", "value": "MACHINE SPECIFICATIONS.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ea1cea-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779168387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168387, "uuid": "2885937c-8665-446f-9066-2b9a7be86438", "comment": "Malware payload (Mirai)", "value": "fe27ffea8e417bdf84756170f82f46d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168387, "uuid": "ae032eee-8a2c-45ca-b266-6c9081c65425", "comment": "Malware payload (Mirai)", "value": "c347b0bf1c752eca1abe3e92905c333e2d8baf9a2b19cf5facb055975396e14f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168387, "uuid": "ec5a56cb-575a-4860-9ef5-2b3e6f356e67", "comment": "Malware payload (Mirai)", "value": "dc29466df595fa71555d3df22655957a823a2a44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168387, "uuid": "4deb4797-1eae-4674-8a1d-5bcaccdcc524", "comment": "Malware payload (Mirai)", "value": "699132a9c8c269387793ead7afd4ae95abe74e80b9e3ae28c0543636a8602c1689f7933027ef33af8438ede1db5af50c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168387, "uuid": "42adabb3-aaed-4ab0-924a-be0ab5ac67d9", "value": "T115621B123319542BC2A53F7015F353E0DBE5FD114AA6E3C9E92FB8888236BA0385775D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168387, "uuid": "8693da08-2026-44df-99e0-de39001dc1c0", "value": "192:zGAiDwjGGtFPp1mlc5eS4b1E3PEp7rjCqvat11wjQMDIuBFvnO5:zOlGT+KV4b1IspeMc1WDIeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168387, "uuid": "2e2318f0-075c-4ab8-b57d-18a331c510f9", "value": 15282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168387, "uuid": "885a2a3d-456d-4394-addf-a2cbfeae8047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168387, "uuid": "550e2d1c-f4e6-4629-8f5a-69080e5f4419", "value": "dlr.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0e8c66-534c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779172229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172229, "uuid": "327050bb-48e0-47ed-bde3-aa3cc4dde7cd", "comment": "Malware payload (AgentTesla)", "value": "c7865fd82ac979743dc8abbd8b1a7622", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172229, "uuid": "44da30ad-2db3-425b-a78b-d32282af2a01", "comment": "Malware payload (AgentTesla)", "value": "c34c7fa226675a37e788f4578399755075e84bc51119047fdd450b1629a30714", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172229, "uuid": "f4ffc1a1-6d87-4d99-8277-8ee77c4520d2", "comment": "Malware payload (AgentTesla)", "value": "5047979b14e6d0eb9b7a3af27ab551f87e5070dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172229, "uuid": "8f777a4a-6943-48c1-80ab-075549798edc", "comment": "Malware payload (AgentTesla)", "value": "fce82963000e1397196bd1041797e6beb11e320b7b9fb5453cead1cfaf58c6948b4906950092cbc72f5c030aff72ec43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172229, "uuid": "0496fd3e-56a9-47ae-a7d2-9c27d71804ea", "value": "T1A3063A40572AA4B0E6ADE72CE536B550494D200311C9EF2D35BD1378BB92E17A3AF9F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172229, "uuid": "4cacf4bb-b800-4100-97bb-149f76ac5e61", "value": "98304:08x+muw8FGgYyJ2hRit/ST0Af3EDoqyB0I/bFwq1so9IUeNFnpVuqHzKfAeFIM90:j4Q8t/Gf3E0qyB0wFwA/mUefnzH2j9Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172229, "uuid": "d990382d-bf03-4623-becf-ff01f5828571", "value": 3691039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172229, "uuid": "edc8ac54-3d5d-4ecc-b3c3-f266253a6e9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172229, "uuid": "f21eb3fd-6dd7-42dd-bd7e-c6f7d51675ec", "value": "justificante de pago. pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05cd89d-53a0-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779208611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208611, "uuid": "c41bdc76-c630-4c89-88ae-f88251750468", "comment": "Malware payload (RemusStealer)", "value": "31d4d39b002a20b9ba2df82420e6e2f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208611, "uuid": "2d0d670d-346a-48ee-9c4f-ed0bbc77db63", "comment": "Malware payload (RemusStealer)", "value": "c41bc26fc5be9c71d8df13ca5f2abcdeaa27af53a27f7ca3b63b2f964b1bba78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208611, "uuid": "22e37866-dba1-41c7-b6f8-af11be4c5b2e", "comment": "Malware payload (RemusStealer)", "value": "3db4c8e15b3f09b0e586c0e637bb50be8fd23a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208611, "uuid": "7d67724d-6c5d-48fc-b670-5df9fa06b422", "comment": "Malware payload (RemusStealer)", "value": "b44504702e1c338d8d3d552da8a71fbc6791e7b13aeeee7abf8551da0a7eee4a2bd908154043b07da4d63e68fbbbdf30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208611, "uuid": "2ba89c4c-dd82-4ad3-8fd6-7bdfc6662f5e", "value": "T13EC64A46BCE108FAD0AA633288A755A17B70FC590F3223C72E50B67C3EBA6D56D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208611, "uuid": "c0370828-7580-434d-a0ee-2f6e9d40d1ab", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208611, "uuid": "be1a0728-31ce-4a21-85bd-b6451e9aeccc", "value": "24576:Fm0n6MP3Z5h2YC76pHHNCyX+eQtmrtCuoxMhpS4mfWrtPaQzRuD:Fm06MPp5h2YC4NCjBgC3xofmfWHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779208611, "uuid": "79c1c4f3-ab2b-43ce-aea7-23056e3afb0d", "value": 12110464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779208611, "uuid": "41310c81-5197-4323-9339-2c16edc0b798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208611, "uuid": "31d411d4-8675-424f-908f-9c7d27af84d5", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feefe11b-534d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779172987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172987, "uuid": "85951840-bfc8-41dc-9b04-e8d792d8a044", "comment": "Malware payload", "value": "49a768348436fdae83faba4a965936fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172987, "uuid": "cda3ff21-79df-4580-947d-af1cd9f3b7cb", "comment": "Malware payload", "value": "c4aa4f6bb971a80d113244c07613f6e8059a78e20d457f0035bc0a32a03067c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172987, "uuid": "c966c0e9-8709-4d5d-a33b-35a89498050a", "comment": "Malware payload", "value": "f990307e1f186a42ab5678d5696c91e43dd5d030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172987, "uuid": "ec20632c-a3a7-4580-860b-10431eb54e17", "comment": "Malware payload", "value": "edfc9a712bc72f94c0d058d9c52296e07d795e71ce935f942a691c998123844545992cc491dcfa752fbf3b89ff6fe278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172987, "uuid": "f0bb2e52-2489-4a1f-8e27-cd8f0a0776d6", "value": "T1B2152318526654BDCC4A80FA6EF783F3CDA1B8E81625EBA603C4DF712FD1C94472D668", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172987, "uuid": "cd10e89b-1fa7-4828-a2f1-94b1585b69d2", "value": "c1f4184fc0d8e903ea01b5e3159c8812", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172987, "uuid": "11b4c1a8-a40b-488c-87df-5f1c471d392d", "value": "12288:sVrUtkHdpiVDbV4S37Y4YLQ95hQjVfr8QtxRCWj0I4/6d7glV+Zo+QwK7kSC+Im6:suWiVT7Y4lSLWC5o+Q/7bCC2L7/l5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172987, "uuid": "6259a9e7-0f0d-4af4-b27e-a9f2771e23e9", "value": 876496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172987, "uuid": "2e0fdb26-0189-4bad-812b-86659d4100cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172987, "uuid": "e0a0b060-9f37-4614-ad7b-3a5a1579f52f", "value": "c4aa4f6bb971a80d113244c07613f6e8059a78e20d457f0035bc0a32a03067c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08f93bb-5348-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779170682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779170682, "uuid": "1041f8c2-7eed-40a9-9cb4-6d50ba8d3a06", "comment": "Malware payload", "value": "a70d74d7d32dc5313e55f81bea9cd7ba", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779170682, "uuid": "4eed05d4-ff67-4aa7-a3ec-440f22378c9f", "comment": "Malware payload", "value": "c4fecb28e723e42253df90737183b16c984abdae4b2634fcd5292537ba26cd5b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779170682, "uuid": "a0299247-ee95-4640-af31-2d32b7daf6a0", "comment": "Malware payload", "value": "675cc7a1ca5db2ec76a26c70a0b3ebea21ad8f22", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779170682, "uuid": "5e00929b-0246-4483-8b90-88064a8a03b6", "comment": "Malware payload", "value": "59cf9c0bd6a109b151f68249f1e0ce489c27c8cc7c90204bcd81df98e5d693bb47a6376b3c01f732f30624b68f4afe7e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779170682, "uuid": "84de4225-90dc-43ef-9879-ab955fde3bd5", "value": "T144D6023FB28B653EE06E5A3A7A72A210583B6A2165134C56D7F4C84CCF254B01E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779170682, "uuid": "40679463-504e-49ff-9199-1523b6845311", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779170682, "uuid": "1b13cce7-8395-42f9-8b0b-2aa969adc90f", "value": "98304:U5/7+hwZE2zQf6i2ywjfK+zBUJnP8dowQtDcPD:wChwZE2MfuygfKOI8dxQNcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779170682, "uuid": "b3324227-9613-4812-a918-6186c1a1518c", "value": 13775078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779170682, "uuid": "90678384-403c-4dee-a149-3df731850aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779170682, "uuid": "f1560112-6097-486a-9d86-9660577039a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd0356b-534b-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779171749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171749, "uuid": "c16efee7-9605-4af1-8815-8924a17e2099", "comment": "Malware payload (MassLogger)", "value": "b60f656f03cc1583b18c299fa790d90b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171749, "uuid": "231172f1-a5a9-4ed3-9f9f-8b1711120d2d", "comment": "Malware payload (MassLogger)", "value": "c5dadb433964a92b506acf9c406f3af497f20ecf401b17217c1918f037cbdd2d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171749, "uuid": "1cdaae4e-65c3-4ace-ab8d-c36bdcd0590f", "comment": "Malware payload (MassLogger)", "value": "3eaed4c68e77011f8e288d44812ec1dfc6f91a58", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171749, "uuid": "6ef1b27f-2b66-4e1d-bbd0-912494962486", "comment": "Malware payload (MassLogger)", "value": "75b1305652b3afab949033adddabd3c692f671a7bcf335eb0a770a73762d97c4f0e1ad9baaa49009819f07cbfcfe809f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171749, "uuid": "c0bbac49-83ab-4c68-b48b-8d6baa6c9375", "value": "T1C5C52B3F2DB1024C9146A39C1F44259DE4139E60123975AC2A712FAD713EBFEF27E899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171749, "uuid": "54336590-d8f5-4b57-a94d-e0af8e3eb654", "value": "48:1MGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGw:ZTpqrXUXkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779171749, "uuid": "77c8603f-b3f6-40e9-a9f7-3fa3ed7dcae3", "value": 2629350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779171749, "uuid": "09db27ce-edb1-4803-964f-c25d2688657f", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171749, "uuid": "7dcbf966-19d4-4a53-b312-cad8668a2ac2", "value": "swift.pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6840a984-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "b039b32a-ff15-4290-bd22-aaa54ecf7b5a", "comment": "Malware payload (Mirai)", "value": "aeea367efa74ab76a1dea76c816fcd49", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "ebea0b80-d87b-491e-9af3-d984a465557a", "comment": "Malware payload (Mirai)", "value": "c78f862ad0a8bcbcce01e04dddcb84dd756a0f95abf44d5b722503171e2127c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "6fcfb59e-1e7e-48bb-8bf7-938d84c6b2d4", "comment": "Malware payload (Mirai)", "value": "936fb892f8b7fcc3cc09ec9783d92fff8720d1c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "8b22e34d-f4de-48ea-91c1-9a98ea63eb66", "comment": "Malware payload (Mirai)", "value": "0d1f6fa776b684eafe9e172b3840ab2d3b3c12b359385bec1a0deacb203d1d4e5c877e6d211786799ebada103191dc45", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219550, "uuid": "517fcfe0-cb36-4143-a4a1-f340f0d33916", "value": "T198141A83B904DEF3F80EE77204D30B257271BB654A531672B3177979AA3A2C43466F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219550, "uuid": "142394c3-b4be-4b27-bcf4-103ce5b85ae5", "value": "6144:Qy70YpyMSzdG3oD42sxLb/tLH0mFECj1/WZ32mg65ZBS:F06oqtLUmFECj1/WZ32mg65ZBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219550, "uuid": "861ca3de-f4b0-48a5-920f-10dc18d4c0b6", "value": 199259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219550, "uuid": "ce16292e-e639-4f02-8e0c-2a35bb4aae51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219550, "uuid": "7b444d07-d840-44c1-a7a2-cf0f6e1c4351", "value": "mynode.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60c81b7-53aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779212835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212835, "uuid": "e926dbda-383e-4bfe-9590-b8ecde826be8", "comment": "Malware payload", "value": "dfe645499a02162be32241d148fc99ce", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212835, "uuid": "e178c206-93f1-4550-8a23-adfd609d7fa0", "comment": "Malware payload", "value": "c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212835, "uuid": "47df2342-8606-483c-ae82-9b05bd6a46de", "comment": "Malware payload", "value": "efffd334bc264432c90a05af80415d957fc9d4e7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212835, "uuid": "c5497904-8252-4976-9afb-e8234330ba0b", "comment": "Malware payload", "value": "3389f930019fd40a56c46d51b5042494950e39c6a37422381f8b654f2673964cd9cc894fd5c4a8432bdda616e96dafcd", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212835, "uuid": "9471b914-9b56-45ee-a911-7e4c30419ae1", "value": "T188831416FA9F8414B2B25A4B5E93F1B54BBF391A2DBC884910CCAB474BD3A40D4117BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212835, "uuid": "9df54c3c-69f2-420b-b32d-1d651bfb0ad7", "value": "768:d1TlbFPwXGt3pjkMqBpn4hykb9bsBEnE6EH/30ZnfY2Ebt2dUG:dxxFzm32LmwnfYLAdUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212835, "uuid": "5132d924-85fc-45db-ad75-19268cf87e06", "value": 88492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212835, "uuid": "e3f4ea97-6bb4-4e01-a546-578080e100a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212835, "uuid": "c4a77bc1-6eac-4909-936c-3939555c7caf", "value": "Route_Dims&Commodity details.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5e75af-537c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779192874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192874, "uuid": "efeda76c-c723-4494-a16e-64a2c9221c0a", "comment": "Malware payload", "value": "2d2109289249c96eede94c865182b2cd", "object_relation": "md5", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192874, "uuid": "2d0a0b49-e173-4f15-96b7-b36f696bd098", "comment": "Malware payload", "value": "c803a50dad3801826a6ec5130e0c3602c1c490f4b1b0d3fb65c047601402f0be", "object_relation": "sha256", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192874, "uuid": "697bfd48-528b-4089-9de4-ae70ee6f71d0", "comment": "Malware payload", "value": "53737fb01bd27cc730871e8bc92cd8063e11b88e", "object_relation": "sha1", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192874, "uuid": "5f088e30-9213-42f3-ad60-cf9dfb8ae83e", "comment": "Malware payload", "value": "0f65d8bb6f6c4ceec5e7523ba8eefa7f37a9ae23597cf9648c3d982df3be62a13d101c36c589c56a7f6a7d47271c415e", "object_relation": "sha3-384", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779192874, "uuid": "6cb095d2-ace2-4547-905c-9dba36238c5e", "value": "T1CAF323E4E1C31E1B710F3116C3C2285156AC61EBF296C7DE5EBAAE3817D9697CD8C418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779192874, "uuid": "0fe0a141-271c-4dbe-9999-f255c3067f54", "value": "3072:lUCG9pWmA9zrMtrSeUXtTDBlA1bEq2xAX7AkDQkwSJ4gOyS2iTX2g:KZ9smA6tbwTDSEAX7LDjkzX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779192874, "uuid": "b32efe95-dac7-4f2d-9e8a-6941eb548323", "value": 170750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779192874, "uuid": "55f8183f-4411-4435-8e5a-fca0bb9db516", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779192874, "uuid": "6f3095e2-7eaf-458d-a65f-1299dbeed840", "value": "PO-000806758_Bita_Supply_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3753bd-53db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779233700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779233700, "uuid": "f7fd688d-9a5b-45e3-9116-3e5cdb3a72a9", "comment": "Malware payload (Mirai)", "value": "a91107a22199509e57e5daa076b8773b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779233700, "uuid": "c8af1b23-2577-4bab-8d9f-46010e7b6b66", "comment": "Malware payload (Mirai)", "value": "c859725375e28257c471a3f46b2cf1083d7bdb3d3a3020f9dfa9fd6e8fc4dd40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779233700, "uuid": "4298bdc6-a7c8-42ac-b916-f9f6b3aed581", "comment": "Malware payload (Mirai)", "value": "ff6aa9375504f7aa19963e4fd3d9dba90fb246c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779233700, "uuid": "b079b144-da6b-469d-9122-7804752a1f80", "comment": "Malware payload (Mirai)", "value": "b28e6613a4bbeb27fd689d46b276fca1e4fc534815ec85bb4193e1fad36ee81a63404cbcaacef5928942d983df6e9be9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779233700, "uuid": "396b0bad-d6f9-4a6a-ae77-0b61856409ba", "value": "T11B33F181DDAA4BC0CC18913F1608358A3A59F90ADB4D8BBA6DD570718CC7FB9547CAE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779233700, "uuid": "cd9a9ef3-eb8f-48c2-bf7c-330eb1438b06", "value": "1536:/Fwstm8fGHJmFadpIvUe/mD1Gnw/cRpRlXhN0RTnouy8B8p:9f04IdpY3nw4RlXhN+outB8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779233700, "uuid": "aefcdf5f-4962-4dc9-8ecb-b203613b23ff", "value": 52580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779233700, "uuid": "e4cbb9fc-160f-4ea8-911f-ceeb213cf1b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779233700, "uuid": "d8e2c35d-d486-4cd2-bbdd-36434bd8faf4", "value": "wife.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f09bb78-538b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779199455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199455, "uuid": "92043075-4056-471a-a918-9cbc3a7fea79", "comment": "Malware payload (Mirai)", "value": "f8b5311f498cfc3c69bcacb4e2bbad42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199455, "uuid": "12b7fc22-4e9d-4987-81cc-dfcc480a2fec", "comment": "Malware payload (Mirai)", "value": "c9f4f50e9556b3a0735e658efa99056eba7d597dde44bcd04b354fb39f36b504", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199455, "uuid": "bfadec48-2e62-4af8-8aec-a4e573766b1d", "comment": "Malware payload (Mirai)", "value": "6b6d88a00f3bc9381635a8efcb5d9bc7a608d23e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199455, "uuid": "7dfff4c6-7472-468b-b5c5-740aa44d123e", "comment": "Malware payload (Mirai)", "value": "ca78ae100c6db352616c1c8602cb4831407eed3caed8c673a8c17c8c2b2369bed1e31f76ccaba102428a0379b53be444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199455, "uuid": "fe3a4ba4-985a-4dce-b305-a5a03be2c204", "value": "T1B4436BC2AA47D8FAFE13057510BBB7378632D9391069DB82C769D831EC53502E66B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199455, "uuid": "a94aeb56-8e5f-49a8-98d0-81baa168b248", "value": "1536:pr4ewRPr95h2UWd5dqAnrXMtw2hCOlzbXd5Ar7zI9Xg:prfwRPRzfkqUAtvhDlbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779199455, "uuid": "dc92dea9-bece-4171-bbc9-e0b5f65b7af2", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779199455, "uuid": "f7a42314-274a-4188-bfff-79fefe313677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199455, "uuid": "d490dc88-c65f-459c-a37d-8750dc951ee4", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e069c4d-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157256, "uuid": "24dd6072-c898-4c9f-a973-162edd07bfe4", "comment": "Malware payload (Mirai)", "value": "67a39cc392d4a985d2e7e4382c0d3d72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157256, "uuid": "8ba8595b-93cf-4436-b2bd-c7572934c762", "comment": "Malware payload (Mirai)", "value": "cbbe7ef922e2127c492e4a0fcf56e198e330c964512c92bdd34ece7e08a6d2ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157256, "uuid": "b01ee14e-0c3b-49e6-83ec-6ad7eb83593b", "comment": "Malware payload (Mirai)", "value": "f360ddf9588e0e2ffdc933b94f7bdacb43eb1214", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157256, "uuid": "adcb60a1-d128-4eaf-9a44-8335e02e7a3f", "comment": "Malware payload (Mirai)", "value": "c5e6dffad40102e6b717d4468546077f8eb820dbb325710e028c2872e0f8d2335c8c34a5f2d671d0ec93a6b4c32cf312", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157256, "uuid": "bf77a657-ae09-4660-87a2-6ad2c729018c", "value": "T14A43971E2E619FFCFBAD863587F39E219648339226E1C584E15CDA011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157256, "uuid": "66b7dbff-b81b-46a6-882c-88b72838e50b", "value": "768:TDul5U9mAG5Y2zrEI/fEInwa05zNx8jMyOFy26Oybd3Hxp2gnAOxAWsFnkPDQQ:Y5smAG59zRqn5zNKlbd3HITCQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157256, "uuid": "9c8bdd73-4589-49cb-8a61-d8abc3fa09ee", "value": 57092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157256, "uuid": "e68b87ef-5770-4174-bb84-e640d1326825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157256, "uuid": "54b3d6f6-bd10-4f3f-ad4a-1d09d754e256", "value": "uppermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de02c431-53ae-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779214593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214593, "uuid": "4380a4d5-119d-4ba9-a589-3340ba96a0c9", "comment": "Malware payload (MassLogger)", "value": "140265f9acc7a7b5d70619f54846112c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214593, "uuid": "bf9d43ba-aed2-4191-b01a-e4cd560dec92", "comment": "Malware payload (MassLogger)", "value": "ccbdec866c4dc5272bf35d9e08186c71031cfc63d37e45d96a35d69cdfb5dfe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214593, "uuid": "277cfb46-d9df-434d-bcec-7992866bc2b7", "comment": "Malware payload (MassLogger)", "value": "10f907eb4dbcaab348edc1953f4a3baa482cfb4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779214593, "uuid": "348f60f9-4279-4849-baa5-f1656801b6b9", "comment": "Malware payload (MassLogger)", "value": "c724bd95cb2735a1897eb8a446cb81f00970e9adaed03d091ff0a992a0472bde8138dc3cb8b68c7c8b2df951f0398f06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214593, "uuid": "5e708682-8227-467e-9690-3d39c3199d9b", "value": "T15D25126C6A06E503CAA12B396EB2F1B4075D1CDDEA01D347DFE9BDEBBA77A041C00155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214593, "uuid": "abaa9cdc-34fb-414f-b2d4-841fb97dec70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214593, "uuid": "a252b5b5-ec4d-4d27-92f7-cc9ce94f6911", "value": "12288:DvIfO70YT9uC03AziAHVWXPyaapTw6g9hwLNi5xBheJQck4Npm7ihItAHkBCpOwB:j70YT9uClvHAXP8p8dX/jB4JxQ2EC0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779214593, "uuid": "fe39b341-091f-4c33-bf30-ba01dbf4e5d8", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779214593, "uuid": "59af8521-9f45-472f-8cee-fbf5c85f6258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779214593, "uuid": "85e76d73-26bb-4a4d-a5ca-7281a17b794d", "value": "OFFER CAPEX E2652 xls.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a882b4-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779168561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168561, "uuid": "94eb8fc9-0a78-4c3e-9392-9b993e831f15", "comment": "Malware payload (AgentTesla)", "value": "3503163f69d27645bdcb7c06bf64193d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168561, "uuid": "e802f7f8-acda-455d-8cd4-79849109da43", "comment": "Malware payload (AgentTesla)", "value": "cd9493365ff4972293f4535a8a7e6f2a6f7ad9c1842ab894f687e7e69c00f460", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168561, "uuid": "62197da5-55d3-4ccb-96cb-b169be7341d4", "comment": "Malware payload (AgentTesla)", "value": "a6ec040ddbf2dc243be27e41eaf45c8200278709", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168561, "uuid": "be9e1c39-e539-40ad-9621-a015de8bb948", "comment": "Malware payload (AgentTesla)", "value": "df1bbd5d83837e50b3a1f19342679dbfd88712ea6b65fed5d0730401656c0a6b703d1e21de3a9db6de5a25cee71f412b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168561, "uuid": "81d7f0d3-515f-4cb2-a814-83dc17dca141", "value": "T1E3453368F4D16037CC6883555939DA8ED793C95279AA83CFA83AE434CC85E134ECE9DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168561, "uuid": "a734fcf4-9623-40e8-8f70-62debe319b42", "value": "24576:xkh47azaVfUgN9hTU2Shu2RgqZK5WW0hl5AoV8C4I3FQcNXleXza:OVzalUgvNSE2RgqA55jp7ISkXlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168561, "uuid": "e4df2278-1b6b-4e1c-8f60-48e8011724c9", "value": 1280364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168561, "uuid": "cbee1908-727d-4360-ab04-ed9d69c89535", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168561, "uuid": "a5427e9c-b116-47ac-a182-68dae82adddb", "value": "PO0012321.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39d0bb7-5390-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779201718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201718, "uuid": "8b1a1af3-c74d-4c98-80d2-89ace036b0c9", "comment": "Malware payload (Formbook)", "value": "0e2ff29318190fd59fa5cbcfb0a5c7d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201718, "uuid": "35e09ca0-e58d-42b2-a672-c3ec9ce26909", "comment": "Malware payload (Formbook)", "value": "cdb4f964fdb6348bd4e59b47cbd43a15bb41acac2098e41dc397f055147713c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201718, "uuid": "b60e21c5-5dde-48c7-8b68-1140b24b4790", "comment": "Malware payload (Formbook)", "value": "450d1d446b49219a4d642580dcdb36b92c14b14b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201718, "uuid": "1cbc2e31-0366-4133-865e-100daffef83d", "comment": "Malware payload (Formbook)", "value": "7b654df2edd73d0af06816eec5ce31e530b9ea2f679c45d0a3d75054fed93e12bd773795386e186554d86df8afe30729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201718, "uuid": "b1cc2a9e-b3af-4e68-b284-343541de59b9", "value": "T1AD25125C664AD207CA8047395F31F7F8129E5DEDA410EA136FDDBEDBB8B3A090D14262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201718, "uuid": "c889b316-e335-455a-a161-c1d3eb1e88cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201718, "uuid": "4a75c9ed-c7d4-4a34-bd1b-788d50b5f49c", "value": "12288:V2l9QULtqEuL3wGhCKtir+p1tCJ+OjPzQB1QDpKwF+sHiIn+OtaO54zh0+zRhSqy:sQ7woXNnxuPzQoDpK0HaO62WVC4sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779201718, "uuid": "4b8cfaa5-bca7-484b-b7e9-8ccfdaf5a483", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779201718, "uuid": "c10ca325-b384-4293-80e0-2754007fa563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201718, "uuid": "770fac3c-139b-420f-a530-578510eecb8a", "value": "MV_SPIRIT_VESSEL_PARTICULARS BALTIC QUESTIONAIARES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1b380d-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779168391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168391, "uuid": "a9a1c5ea-fb70-4b25-90da-b59c9fe78a20", "comment": "Malware payload (Mirai)", "value": "aa3109c881cadbaabfa63dad6888b605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168391, "uuid": "b2443843-f3e5-4505-913e-e7b5b6871f71", "comment": "Malware payload (Mirai)", "value": "cdb6fc7c23815fde4048a7a9d7acbd8acca75ff416d8bcc99239b6f5996dada0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168391, "uuid": "4f2e42fb-2cc4-4258-8ade-2f07cf8bd2c9", "comment": "Malware payload (Mirai)", "value": "89791da6b75855787fd55c24264dd0c40dea03f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168391, "uuid": "ace8f890-80c0-4244-a14a-82cf3320fcab", "comment": "Malware payload (Mirai)", "value": "87c299c21ef1328665bf9447affa95cd0bf6962a5a762af21a6c343acd2ac27da7d077bc772a1b2747ec4ff4e8d13db4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168391, "uuid": "25294cf8-be09-4e2d-8950-29abd8ec9eba", "value": "T106921B35FB636C2BC0A5D57286EB073DB7F6441B89A6071B3C236C547E45BC4AA323A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168391, "uuid": "ceecd398-1df8-48fa-90f1-f11f87408091", "value": "192:G9ajl/I5OztsyuZVUCyu4P0eB6kd+D2rrPllTTTo0GB4RSHQzC+VYg1FSgiKCcxi:I5mtsrFU+iDsgbJ7jyPPqQxDIcZAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168391, "uuid": "23693826-fed9-45ab-a204-528373be1852", "value": 20960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168391, "uuid": "cd862da8-ed85-45b8-a323-eabcc1b5a5fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168391, "uuid": "03333f1f-cbf5-4a44-96a8-6e9b49ab272a", "value": "dlr.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54574f98-53d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779229395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779229395, "uuid": "06b2ec28-a456-4631-bbf1-14ac7c906613", "comment": "Malware payload", "value": "5765efd3cff3f1f7d625da943d98b21b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779229395, "uuid": "7f50c8af-4c86-4812-909c-ed1b3e9cf890", "comment": "Malware payload", "value": "ce30d5972e0782596cca25a635e182a8d6215b8f16a3a8b0e99c6f53368605d7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779229395, "uuid": "96ae7873-0eea-4074-9d8e-1dfc43805a28", "comment": "Malware payload", "value": "beb482f52df1e9af5d5a6b70385f0d27c17ab92d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779229395, "uuid": "f9a978f0-10cc-4149-8a2c-36a9210157ef", "comment": "Malware payload", "value": "c28e18fcfe7783c2004f44888d37533ae200aae4aaf02bf563a68031dfd21756c8ee2c228f136a65e3c01ab99573b921", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779229395, "uuid": "4210d746-6572-4c74-b77c-cbdca45f786c", "value": "T145E1F90AEC838031D7AD0DB06E6140D59BBE059327D691FFFBA350D907E198594A41B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779229395, "uuid": "a791c8fc-1d8e-4e36-9a51-fa3d30784e0d", "value": "0adaa643a2083142effb1f9363ea3a95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779229395, "uuid": "066eef42-e30e-487c-9d61-a440d5dbb207", "value": "96:09RIud3De0F+xI7J1JxSEp2qpaC7tCE9q:09SyF+ujJx3ptpX9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779229395, "uuid": "05e2d83c-7757-4906-852a-1aaf0c5de3ea", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779229395, "uuid": "002f2ea2-af98-4362-86bc-2828c3b4ab0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779229395, "uuid": "71c3cd47-42b6-447c-b8d8-43bc5d2029b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85f6c56-538b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779199552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199552, "uuid": "028bf8d9-cb88-4180-8495-f5812367df71", "comment": "Malware payload", "value": "fe3345189b03df554a86f10cb63fcf2f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199552, "uuid": "3c730442-001a-4d36-83d6-75c187f33086", "comment": "Malware payload", "value": "ced33995208f9f726482453f17d7c2fc870edc94dab7833f730a9a9ca963f2b2", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199552, "uuid": "c914b091-9c86-4bc6-8152-b4745d1c1849", "comment": "Malware payload", "value": "14c92c9db4c66c103cd4952c0d5c7ef1afd6a0ba", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199552, "uuid": "c650643b-2e1c-43a5-b648-207ee2593c47", "comment": "Malware payload", "value": "caf55100ad7700f9e7a271ea11d18e8cccf8d255c63b33c2a3441441780a0efb079cc1acd147b992cec511dfb06f7199", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199552, "uuid": "501b6d10-7c0b-4cb0-85d9-c6486b07d8a7", "value": "T1CED5337F1ACB0317C56399F47F00B61D51D9BBDE0A4EA92468C51D1F2423E821AFBAB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199552, "uuid": "92d09e94-fe31-41aa-801a-254bf96b594d", "value": "66db527ecf770d18e418b81750e20910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199552, "uuid": "33b7ae25-af4e-48be-aae1-c5bb8103a5b8", "value": "49152:QyBJdZ8VKdjWCHmZbsTmF6Cdc9QGy8/rFBqth3F0cfTUmRzVA2NHi:jBJwKdFmZb8TGHoZQ3Fb7jNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779199552, "uuid": "6d2fc2da-eca2-4804-9f5e-71daf2e20143", "value": 3001856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779199552, "uuid": "67c760ce-bc84-45fe-ade2-32d03d7cdb92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199552, "uuid": "78b6ffc0-33c9-4e4e-acd1-556f7e7586c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d89e85c-536f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779187266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187266, "uuid": "96e0dfcc-3ccc-4d2e-a6c4-13116f5f9514", "comment": "Malware payload", "value": "deba9182d5e9e4d9bba090cfca87ee6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187266, "uuid": "ad6c6002-f146-474e-aa3d-350f26097181", "comment": "Malware payload", "value": "ceebe07d63b190a5c239bc39e9341b6979072fb6d87457d60c5f682df515940d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187266, "uuid": "3513d88b-26a4-493d-a6c0-bda3f3f20dd7", "comment": "Malware payload", "value": "a023b82c82da6324c22e07329cf79d8dc1c51022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779187266, "uuid": "4a95300b-e06a-416f-b7ef-b3fece509793", "comment": "Malware payload", "value": "ec6d11fe6846bce057bd47d2500b9bd7254fb063d1c8e1597b5f24c55a6f56692db0b7fb620b5e1d5abd4a7b61f7b878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187266, "uuid": "25c5d0a6-688e-4a46-9dcb-aef4eb8ce385", "value": "T112769D03F2E941D8E0AED678DB2A5332E9B27C854B35A1DF075076151E76EE09B38B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187266, "uuid": "3eedb97a-25c4-42db-8485-bdde0a5b222b", "value": "7fa18b7f665d16cb2c86c23cadc1097c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187266, "uuid": "ed1b5cc5-cecc-4cdd-b0d3-897458d1c0de", "value": "98304:UVG21W4E02i3X9BaTK4AvevUkojhns2wUzCj8Z9HZ:C2OzaC2vGjhOv8zZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779187266, "uuid": "a48bc9b0-804b-454e-a963-edda13c26a64", "value": 7527472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779187266, "uuid": "01125fbd-786c-49de-8d23-c152aa8b82f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779187266, "uuid": "23637ba6-c13c-427c-a307-71d5bde81f18", "value": "setup (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e30dd44-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219560, "uuid": "ebafa902-2d37-4867-b3b2-b57a39727b9b", "comment": "Malware payload (Mirai)", "value": "10687a34147a54f3a8d2bcda2cf61f82", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219560, "uuid": "d5d78797-557c-457e-96f9-823f0c4e5b70", "comment": "Malware payload (Mirai)", "value": "d05056d44f69995c6379704827fee45334f4689d66b6f9c3ae71785d3788d5a9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219560, "uuid": "bad4b235-ecd7-4974-a497-7aafd0c57a29", "comment": "Malware payload (Mirai)", "value": "50a01dad6b46b6ce304e73dd42043fcdcbecb185", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219560, "uuid": "8f5fb2ac-6b19-4bf2-ba3f-8395cdc125a9", "comment": "Malware payload (Mirai)", "value": "1e839f01a31c8a2c2b4ba23ea111b79d3b087a616c0572e7e16547723eaf7f81a1b676d94af6f4ca57c868359bbe0b9d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219560, "uuid": "0b5a058b-aa1f-491a-a364-8c6399738d29", "value": "T130639E16D82509A9C286C5B471EC8E3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219560, "uuid": "79931654-c72f-44d2-97a9-c6992a35ce87", "value": "1536:D/rMkOtfaR0glv2ZKsT5Z7BPxznCI0sCp8ud9:DYkwfCFlugsz9xznsxrd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219560, "uuid": "1c58596a-3747-45f7-afd3-5762b541eec9", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219560, "uuid": "a6fc376d-d321-49d5-804b-c2541212a8ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219560, "uuid": "cd2778db-6a91-4172-9b5a-7aeaf941fa29", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e3127a-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779168389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168389, "uuid": "40a01399-c39b-417f-81f4-a06216e26162", "comment": "Malware payload (Mirai)", "value": "b6b05b49ab4c3cb5a5936d9eab87adea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168389, "uuid": "eccfbbcd-7e2a-4606-a16d-83db451ed5ff", "comment": "Malware payload (Mirai)", "value": "d2217bfae48ccb1fe619cb2f541dd3acc51c69b51e1201c45a912f79ea0b5f71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168389, "uuid": "e6e5bc90-af28-41d9-bac3-68600bc5878f", "comment": "Malware payload (Mirai)", "value": "d29e0aac1aa6b8a5e5b5f315e3c1d7b8f0dc7c0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168389, "uuid": "c5bd47f9-8ef5-4c44-af01-f2b5f4584e5c", "comment": "Malware payload (Mirai)", "value": "3182f1c01a686ae102f552684e1509376419379d3eaec1ade1ddef68906fe368c76eec75a52ad01c1508ca596949d201", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168389, "uuid": "82d668c0-dfc9-4d83-8550-9da851eca60a", "value": "T11282A45926329BFDF678C7304EF74334A298A64516D2A2C9E25DF8101F6078CBC9E79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168389, "uuid": "ebf6d6e6-2447-450f-85ad-009109c73ddd", "value": "192:k0QjIAuLh16PjTN3KbAbBrKS/767Lwbe1hIWbjCsPsg/1/I4oAOaDIiyADJ3nt5:BjD+PHNabYA42Lwb2hpKYsg/KYDIiyaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168389, "uuid": "109f9775-1c7b-4120-bc4f-a429e0ec517d", "value": 18569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168389, "uuid": "8b743dd5-90ef-4f6a-a6d4-933958e97bf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168389, "uuid": "c1555ea2-6951-4ab4-a18c-ab90e6e2919e", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70f771e-5326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779156170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156170, "uuid": "c0c22e96-742a-4399-bd20-da523a974858", "comment": "Malware payload (Mirai)", "value": "99fc3b32a8644d040193369bf3574302", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156170, "uuid": "274b05ed-f0ac-4eac-abad-c6e469a6a613", "comment": "Malware payload (Mirai)", "value": "d22818c491e823c74e12b83f1cb482075423d4f3b4a4f7e987949930854e0e17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156170, "uuid": "c2879947-8c3d-41f7-ac5c-5fdf53cb4b5e", "comment": "Malware payload (Mirai)", "value": "0b8bb22e5979ad81ceb7dcb51127318c58ae0d20", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156170, "uuid": "8a1bf922-7535-4da7-8086-4b74c95ea76c", "comment": "Malware payload (Mirai)", "value": "ab72b4275b80a6701ecf0203250f713f45a3d66035c886893ac8dbce6ebbef53fc03da8f9e183cea80cebff746c512a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156170, "uuid": "ab91d918-7993-4326-bcce-458083553f84", "value": "T17D51BBC81372777A7C52643231E78508B2AEB24173C21E16BADD78EAC08CD06679DE73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156170, "uuid": "2ae682c7-399e-43b4-b552-2e6e3f87f66f", "value": "24:uXYvjNjTC7BPzXYvMdMj8UYsG9XYvMyMO8U0GAXYvvRHmrWXYv26/rWXYvZBhzsr:HWBPkHG2SGxHQLZL+iHi+wlFOSmFq8s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779156170, "uuid": "c5799097-580d-4679-a5f1-8268ff48ff9a", "value": 2698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779156170, "uuid": "239192e5-a546-453a-b7f2-932470b46952", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156170, "uuid": "1123aa42-a14a-4b08-9d5a-da219486f40d", "value": "femboy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7782de0e-5369-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779184786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184786, "uuid": "2132bee9-38f6-40de-bb57-e81866205983", "comment": "Malware payload", "value": "cfb12735b005d12a36c1e63de6175ebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184786, "uuid": "53ba4974-a76e-4fcb-8d9c-53a05514c65d", "comment": "Malware payload", "value": "d26ea6828cc01ae151d99bbee78c4e6d132e9077842a558bce3901fa0970d9be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184786, "uuid": "72fd59b0-765b-4726-ba89-d33b58c0a251", "comment": "Malware payload", "value": "5472e75bd286418cf826416d646e1612314c3882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184786, "uuid": "88ffc34a-7195-4ce1-83b1-6ed4008cea5d", "comment": "Malware payload", "value": "a8bb721362d53c44d66c263b93c2e8b4fb2038f2ea7f4ecbba778900544fc3f53c8d61abe5d7ab1b426a7126e74e5530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184786, "uuid": "b06b9c93-4342-4344-aa30-bfce66291d74", "value": "T168383377E5A80CEBF62DB7B0AA0BF473F0A506ED59E4B93C4B75C1249139A7001C6E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184786, "uuid": "395c6503-d5ea-49bb-bb41-3e6a0ba72ff2", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184786, "uuid": "6eede0a2-8d40-4f64-b24d-5d1977903da6", "value": "3145728:tLaqeuFn44mS+xYTqk/gsGKyu3dUfTAlvZtniJU0Fg2:F9pFOKTAsZyuNCARn45FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779184786, "uuid": "661ce316-ef51-4d13-83cb-943cf5f6f1ca", "value": 103332856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779184786, "uuid": "87d1106a-4e4a-4a5c-8ce5-8e250f2509a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184786, "uuid": "01b4f5a4-0558-4497-ab4a-1d3c6f0cbf69", "value": "d26ea6828cc01ae151d99bbee78c4e6d132e9077842a558bce3901fa0970d9be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846c9f57-5392-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779202417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202417, "uuid": "ca16d71f-8789-460c-a2f7-3c364fed3eb3", "comment": "Malware payload", "value": "4f849cb0846b198f5788c3fe9b897f4e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202417, "uuid": "28fed1c6-4577-4668-8757-c2c59d18cbee", "comment": "Malware payload", "value": "d334056829c10a82b87ea760f536a0047c3c77718adc2cbbb861a3586af4f29b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202417, "uuid": "c6d8e998-bc5f-4452-8874-6cea12ebeeb9", "comment": "Malware payload", "value": "2a1edc7816d7bd0d278f9bf7f81294e238dd5c8f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202417, "uuid": "1bdf3222-5e71-481e-bbd1-80ff9c64fc94", "comment": "Malware payload", "value": "744c57d7e1c20492533c4a5cbf231871fda8b84de7a69d11f737c400c5bd9594533ac7a045646b5aea78d204c35fbb72", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202417, "uuid": "2022d3b0-8f21-42bc-9f25-9c737b9dd55f", "value": "T1A775BD0B7FA12925E8A70E758937075DD2367D1066A0869B02B0F279DEFB3C0593BBD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202417, "uuid": "331a5cfb-5cf0-417b-ba31-40059cdbb0d4", "value": "24576:vaSabUBZKzXyyDV9IZevsaSabKQYECTyu9U2kNHU0oxk7slDr:la4KzXyUV9IZev6aOQ1pu9hJTxNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779202417, "uuid": "12260ebf-2831-4bb9-848a-63c9b287f367", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779202417, "uuid": "c8a31ce2-fc2e-48e9-a853-b64158f3addf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202417, "uuid": "8beba90a-254b-40c8-ae66-b6cc8b28635a", "value": "Postman-win64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75326d58-53bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779220001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220001, "uuid": "f0778f9f-b5d7-47dd-ac6d-92e5f49344f8", "comment": "Malware payload", "value": "178523d40cab8c9443fb279c92de7b05", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220001, "uuid": "36e9c514-d03c-4945-96ff-95b78a3ef772", "comment": "Malware payload", "value": "d4bf851a4af33553c48a7545dffa8a6b76cf7fcae624a0f79a58d599c75edaf5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220001, "uuid": "8f9363b6-f65c-4dca-aa0c-72cb370cd477", "comment": "Malware payload", "value": "9a05e6c1d6b7b743ce46de2e1c561fbd3d9184e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220001, "uuid": "4bf17627-6bab-4c56-80a7-9042f65be708", "comment": "Malware payload", "value": "cd8dc03a7cbc6a55258b414b71fddf59b142dfde42fa964850aa72cc5d6a2b1de80bf73d7ae7ec271387e6cde5b194a4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220001, "uuid": "10eea907-53bd-4916-afbb-22c91a8c42f6", "value": "T1AD348D03B5C0E935E67E003408A9AEE7456DE9216F20DDC7E394DD7AA9347C1B631BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220001, "uuid": "6684b31a-6a8c-4657-977e-047fe8dfc109", "value": "8904621f776f729e6a4cd3e0e2691742", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220001, "uuid": "bd6a2a9d-8ec6-406b-91f2-8f55467e691d", "value": "6144:SMtGUnWSvdy6wwuM4jyRC7F+Z1s+W/VOBIvua+iUl:SMkUJyP0QTJ/VymUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220001, "uuid": "e52399af-1f75-4fdb-ab09-a51f54125c69", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220001, "uuid": "c083db0c-fc27-4608-9f3b-0a432ead8fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220001, "uuid": "4fb1d56f-06b6-4675-b70c-012408780fc1", "value": "v32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdd981d-5363-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779182163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182163, "uuid": "f653df16-5c19-409c-a907-13ec2f62d6e8", "comment": "Malware payload", "value": "c1153c68921d532440735282e405347c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182163, "uuid": "d2227197-db33-4c62-89cd-3f6ed0c49b63", "comment": "Malware payload", "value": "d4d09e09257fb99c110c16c77fbc8369fcb168d4571462a19fe2213654fedafa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182163, "uuid": "7244b78f-5138-4522-9af0-d794d3442dcc", "comment": "Malware payload", "value": "66b9ce39da03dc41c8f13de6161e603fe5d30c1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182163, "uuid": "de2d84eb-8d30-4d9a-8b7f-3b7ec287dc72", "comment": "Malware payload", "value": "416a560179cfee4a82e2d7dd56d8484df8e5f721a1f063990db52b27d2a52266b9c6a446b02564a266e9311b8381508f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182163, "uuid": "c1255a3d-ff3c-4162-99dd-3cc7fa39ec1a", "value": "T188F02B5A834C3641C2283334420F0B322711D4C0E2E1370743701804DD057811DBDD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182163, "uuid": "faefcf25-f612-497a-92d2-c605207fee91", "value": "6:BBn4bgk16LR/8CCKlVwIs/CcWfIlXCqvUQ:BB4Ms4/2gw1/CxwXZv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182163, "uuid": "948af556-54b9-4a58-aaab-97c29b318380", "value": 464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182163, "uuid": "29f26b73-62ae-4b32-af14-e9c28564d919", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182163, "uuid": "fae7c15a-47bf-4439-849b-c5c66eb0173f", "value": "dlr.pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ff9c1d-5394-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779203393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203393, "uuid": "494c7af8-6392-44b4-adc7-a21bace42267", "comment": "Malware payload (LummaStealer)", "value": "64f7ff31a9bcbb17d5b545ecf47e5b43", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203393, "uuid": "2a1f28eb-c1d9-4e8f-a336-98342aca3235", "comment": "Malware payload (LummaStealer)", "value": "d4e9e7d1176b0c13f19b21e1af40d41e7049e8d000c568987709321c62a34291", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203393, "uuid": "b7e8e4fb-45d4-4db6-91e4-9084dfb26ecc", "comment": "Malware payload (LummaStealer)", "value": "0883523a64e7607c6e1d569c64f73b98ec573f60", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779203393, "uuid": "834bf89a-91b9-4036-9fad-f2e889659da9", "comment": "Malware payload (LummaStealer)", "value": "0f3859ffe5679bf17c718fbf4ab132d0c6ae0017d93b79bbb362080e866024517c2059336b99c03f4f578540ae8d2090", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203393, "uuid": "82b373b8-d9d4-48b4-b0f0-b656100c95b1", "value": "T184E3129B9F550E37C115E0FA7B1E73EDB669B38B06829A0DDB4EC88F5F238154245223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203393, "uuid": "6603be84-5338-4021-ae39-b3d6cd7dbed8", "value": "42d476bd6c4e105e3a5e1538b871b450", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203393, "uuid": "5e991c54-f28f-4baa-a800-9a47f4b4f4d9", "value": "3072:SXEzJesfpYWgO40MYugdCQMXhazQzecLhIeV9WYT2UgDmRpazqAx33ppItk:MEzsNiXd1lefWeDWYTXgDyxK3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779203393, "uuid": "cee89291-2c41-4e38-9709-bb0a054174c0", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779203393, "uuid": "27ff1628-7911-43d6-83c4-edd7bdb91688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779203393, "uuid": "96cb0394-0a86-4637-a08f-4636b45ce375", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb5421c-5351-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779174594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174594, "uuid": "626d6da9-9c50-4bb2-9eb6-b9550db42f37", "comment": "Malware payload", "value": "530e4d07214e493a3f4e65350cf9f76e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174594, "uuid": "47927a98-bbca-4caa-a3ea-d5b35a5442c7", "comment": "Malware payload", "value": "d509cd9b5dca4180a710de15f9c33a1d44354478408e3fe3ce6d7701a64cb4b0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174594, "uuid": "61108dc6-d911-4756-ad80-d3aba9b63667", "comment": "Malware payload", "value": "55ab8fd0c0fc60e163bb8b12e64947e0a724cd1c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174594, "uuid": "b7fb9598-333d-4e92-a1a0-c217d96c4f0d", "comment": "Malware payload", "value": "432f64d30a846a8789c186654a3782afefb74ee05f2403390b7fcf34d46d6cc0a96ed8c0208d7e6aa95411850aaffa23", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174594, "uuid": "2cfd1283-5b63-4fec-b37a-a3046af24218", "value": "T160136D6516953C25AE99883B5C7F2F0CB9A983E2304491DDBFCA3CF18C15A9CE718B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174594, "uuid": "dbcae041-37c8-49e9-bb26-3f190091f512", "value": "768:Mr9NyXsZztC99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:KHusZfco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779174594, "uuid": "10f6dadc-5deb-438f-a3d1-375021e1c145", "value": 45525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779174594, "uuid": "feab89ec-e280-46e8-a990-e1efbd417207", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174594, "uuid": "90ac9e93-1534-4396-a48f-761042daebb4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c00ffc6-5371-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1779188283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779188283, "uuid": "714ba828-8f47-47f8-94db-7311ac0ac0f6", "comment": "Malware payload (XWorm)", "value": "9a04b22fb7a125ed2cd11c769bbc207f", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779188283, "uuid": "fab037b7-99fa-4395-bfb4-17062a5ddc0e", "comment": "Malware payload (XWorm)", "value": "d525980f1544c29c69351fd14f91a1441bc4d7a9cc530d4b6867d027a055a06d", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779188283, "uuid": "68914e4c-48a0-4fe1-9be2-ad913631c1e0", "comment": "Malware payload (XWorm)", "value": "fa93e87d8d4c2af9b56db528b52727e742b481f3", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779188283, "uuid": "b14b0516-968b-4d80-9bdb-2fabf8a034a5", "comment": "Malware payload (XWorm)", "value": "4e428d25b7c0a0a4a488706e81266b9ae02183bc19afec35abfab809e104a39ed21bf1f8d356d8ceccad3f1e51db2069", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779188283, "uuid": "02324d80-4a42-4bac-bdfb-c2ecb962ce1d", "value": "T12A4533BD5BA39C326E34E80C23B4A9D64F419186D8DED5C4AE03EE9DC59949FC904CCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779188283, "uuid": "58edc6fe-cc94-4942-917f-5ed236a63f2c", "value": "24576:O0ziwCgaOwjy8pPa/KAFkc/2//PlLVjbnl+pfp59pbDDJcPC:O0LwjppP9AyD3PlBjbEp59JDDJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779188283, "uuid": "a9027c45-fa14-4e4d-b788-fdc722a4070a", "value": 1202538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779188283, "uuid": "092686b9-c7e8-4865-af79-f6641afbd80c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779188283, "uuid": "96392232-4d9f-4f64-bc52-6ce98edab799", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac926bb-534a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779171477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171477, "uuid": "4319b767-de1f-4e8b-883d-b4d3395e4528", "comment": "Malware payload", "value": "95e80db87f4f515bfd8a8bbbe47f9131", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171477, "uuid": "458a7270-ee10-42ab-9e31-957201e659f8", "comment": "Malware payload", "value": "d63269c15b9a046787c84b552449efc2e578e6be583f2a6d7a31b6cbd0fc7b4c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171477, "uuid": "9c58fed6-fb38-45b5-aaa3-47c5e5ad4dc2", "comment": "Malware payload", "value": "95ee1bab4c1df8db61ada9a7271bff475249be4b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779171477, "uuid": "b182241a-4611-4053-acaa-1555644adba9", "comment": "Malware payload", "value": "07f07f30595557431be791753de9262c50e20da926d1e1ceff605cc8d995f32da795826e4dc39808fca05b0e23aa1d0f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171477, "uuid": "169850cb-476d-4cbc-a7dd-bb0a0bdd30a4", "value": "T12D7402F2DD46C532E6942846087D65B87FE6CF8BF12E22C6D57079E4A0E2EB1CF25058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171477, "uuid": "703adf25-9639-485c-9854-86cf24d21cee", "value": "6144:rge4K2/N6RtnLj+/6dXF5ixQzVpvjVAdaOdroGjfUqRGQI/OYVRHqzwr:aNyjldDi2VVjJOdUGwq8t/OYVRHOwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779171477, "uuid": "d2f1c894-d55a-4924-bf74-7d913cd97413", "value": 350876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779171477, "uuid": "029ed4fc-f105-4d48-be47-81d6d7412abc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779171477, "uuid": "99d4c747-f62f-4d02-a6c3-55827fe13485", "value": "d63269c15b9a046787c84b552449efc2e578e6be583f2a6d7a31b6cbd0fc7b4c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e5ca59-537d-11f1-a769-42010a9c0008", "comment": "Malware payload (LQTOREQ)", "timestamp": 1779193446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193446, "uuid": "ac9e3a6c-2866-4107-999b-2e008393d92f", "comment": "Malware payload (LQTOREQ)", "value": "d2d1b73225b9f7452459eac230fd0052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LQTOREQ", "colour": "#4C2962", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193446, "uuid": "90ed63d8-1a90-447b-9d83-4dbb02a48fa2", "comment": "Malware payload (LQTOREQ)", "value": "d71360b6a04bea2f22a755c11f87b96411c027cf8a50d3f20ca3c4f10ca13691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LQTOREQ", "colour": "#4C2962", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193446, "uuid": "c59ceae3-83d3-4163-8ee9-ac5fc5ad3ccb", "comment": "Malware payload (LQTOREQ)", "value": "cd67a53480286844b5dc62a483d667785e745e83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LQTOREQ", "colour": "#4C2962", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193446, "uuid": "39236fbc-a252-4ec7-901d-f17251ca4d0d", "comment": "Malware payload (LQTOREQ)", "value": "522365a5c48c124acb6e0b9257c5e26fbc74f59f74dcf42d7f5cda2abd248588610a50e643fddeadf9b8bb60dd0ea5bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LQTOREQ", "colour": "#4C2962", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193446, "uuid": "fc41db22-6e87-4f39-8a4c-d73b18dd1512", "value": "T1C684172BD25328ECC22BC23485A7A37278B1B4548761BDBF6598CB715D24D10B73EF29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193446, "uuid": "5a1a33fa-db09-46ea-bd31-f7fd71e16fd9", "value": "751084a3c0cf643f0c31b1b7df6aba7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193446, "uuid": "7a445ece-0486-4759-9621-d7fbefb29cc0", "value": "6144:R+bXqGU6MqNyjFdDVwA6zdJ1470ADIcVYRXcDqoZyPVJLv3x64S4XRnSOc:R+27yIFXW/a4/cdivhzS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193446, "uuid": "fa509c65-9728-4429-b108-8200dcb11ec9", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193446, "uuid": "c64381be-837d-4d66-92d7-7ad413966feb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193446, "uuid": "2451a197-b649-48fa-944d-57dddcafb621", "value": "d71360b6a04bea2f22a755c11f87b96411c027cf8a50d3f20ca3c4f10ca13691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c0882f-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779168384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168384, "uuid": "2598fc0a-f492-4476-83d7-faf6d570c892", "comment": "Malware payload (Mirai)", "value": "400aa6601906838c5a37e131d3ea3553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168384, "uuid": "07f733a8-8010-4230-8481-f99cb72e09db", "comment": "Malware payload (Mirai)", "value": "d8825281019bc5006591e32fc4cffe52f38239e7c6c9161e80d266994e95039b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168384, "uuid": "2ffea7f4-6c75-419f-b588-4caf2a1246a8", "comment": "Malware payload (Mirai)", "value": "f64f4d4a2ec7d24d4109bb86b6ab4a5d31ac1bd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168384, "uuid": "2c9ae03f-1a63-4a01-9463-51e6691b2316", "comment": "Malware payload (Mirai)", "value": "15aeb9f31d05d2134f12d3c8ee042f113244a7395a0ebefe8ce0018648ec39a9f5cc77dd87ce3cb2c813c8b98d9da1c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168384, "uuid": "517d220c-65d6-4783-9fdd-36b87106822b", "value": "T1E633086AEB808F57C4A1177669DF83527333C700A79B730B122C96B43E467B8AE1391D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168384, "uuid": "be67be72-089c-4bec-a66a-83f30ef9c922", "value": "768:HmnCZK0DWZiemY4JROeAzhBDO/yaGJQQPzw/90zV8UnD/61Zsuv6:HmnYK0DWZiNOBzHK7RCzw/9lsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168384, "uuid": "deb89d9d-e3f7-47e6-ade5-443ceb24a4b5", "value": 50696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168384, "uuid": "e0d3c071-ab48-475e-9047-79f98f41d9f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168384, "uuid": "8de51bd7-14d1-4fa2-9594-5a561b176741", "value": "dlr.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593f3613-53c1-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779222531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222531, "uuid": "455e0bca-2cff-4b84-a4b6-d607856da1b0", "comment": "Malware payload (LummaStealer)", "value": "2b5eb8be241364c1b501eb6397f32741", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222531, "uuid": "1c0afb16-b3df-4a4e-bc65-28455e6ae6fd", "comment": "Malware payload (LummaStealer)", "value": "d9c2c2d1513831f3ea9fb436917606169d14f21359dd09a5fa277c82171ea6cb", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222531, "uuid": "7c970732-e5fe-4f1b-b35c-ca593ef8f69b", "comment": "Malware payload (LummaStealer)", "value": "d0831821d95d1bde779be2222e4c90957fc729be", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779222531, "uuid": "3ed44e0f-284d-4b85-80c3-e18aa8e396b2", "comment": "Malware payload (LummaStealer)", "value": "ca29085a9bb819e89d2fe7996a812b296257dc48a3a70a5bae82375899aa00eeaea00f10d981d1febe4184f6ed2cba6f", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222531, "uuid": "4e4ad450-afc2-4f0e-9aae-30d01e0c5cf1", "value": "T1A0459E96F0549CA8E86D567FFCB8DD4CA1B887C9DC48B45AF2CA32171130BBA74016ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222531, "uuid": "3412444e-b6db-4809-bcd3-89b457f0597b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222531, "uuid": "d4c89069-3af6-48b6-91db-944e633e9862", "value": "24576:ve67FoEN6BWfuPKt/IuHn1ORky8M/VMlHQB5mpQ9tdl:ve6poEN6BWfuSnF6ilwB5mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779222531, "uuid": "02ae46c0-2e7b-4760-8870-3f81786e79e5", "value": 1204224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779222531, "uuid": "e9107340-94a0-47d9-a402-e480069dc18c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779222531, "uuid": "1e2cd64e-9de9-416f-a5c7-638b52ed1791", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adda69bf-534e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779173281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173281, "uuid": "52a9f217-e6a1-4561-aea4-98e57b2c1a6f", "comment": "Malware payload (Mirai)", "value": "2716d6d1ec2b730dbf882aabda9c4e02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173281, "uuid": "5a749a9e-8284-4551-a2ae-2c15885f70ed", "comment": "Malware payload (Mirai)", "value": "db1f9b8df4479bcda8d96f176dff4dbedaa37aeff780c27ef32ff5879220d52f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173281, "uuid": "6be2699d-c70f-4298-aed0-0fa7420fcf37", "comment": "Malware payload (Mirai)", "value": "ac7c9e277127cae1d6657bc46f301bed188efaf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779173281, "uuid": "51aa4f8a-7e5d-4a74-b932-ebc175c504fc", "comment": "Malware payload (Mirai)", "value": "bdc794300132bc4e86a585c4b1f6ec904ca47285984df2c829f361cf1121faedc6af839c270de1907a7ef317cc59d231", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173281, "uuid": "bb932b3e-cc0e-40be-8435-538a09909bfc", "value": "T12D631B52BE429F03C5D221F2BB9F05593B16AB69D5EE3242ED35BF9027878D70E27210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173281, "uuid": "c6a991cc-a1c0-49ee-bc8f-273e03f7882d", "value": "1536:/Sbvvbo8Y7TUlJfiGYrK0J3XO6l2hIYR/wJ8zj:/Uv0UXfiGIJO88zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779173281, "uuid": "829fb684-d425-4e23-b30a-dd32587d51a5", "value": 70904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779173281, "uuid": "f0097af0-906c-43b5-8674-923899b45ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779173281, "uuid": "458c259f-c451-4ecd-9920-81048d1d3044", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b928f22-537f-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1779194188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194188, "uuid": "d1e8f157-d9e1-449f-86c5-defa93ee541e", "comment": "Malware payload (DarkTortilla)", "value": "2d68d8350f601daa0059641abcb488fd", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194188, "uuid": "93ba7b70-9ede-4fd5-9012-4d958ceb5c64", "comment": "Malware payload (DarkTortilla)", "value": "db232cdc7fa77347a41af1313242bff38f2c5fbdf8f53f5083c59f3b8d318826", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194188, "uuid": "adbb71a6-3efa-451c-a34f-b42e85bd068c", "comment": "Malware payload (DarkTortilla)", "value": "e1e70826794c7278171cd75f0454f64003d0dfa9", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779194188, "uuid": "ff5ce429-f4ce-4298-bf77-e16fe0d51d05", "comment": "Malware payload (DarkTortilla)", "value": "16451f5546abc9a338c1a88d166f3fd9c38e0caae37658b443ed80a89556890460777b1e06c6a42ac6e2df2e133446da", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779194188, "uuid": "ff4cf338-ed9c-45d8-9c16-1b17d49e99c0", "value": "T137E49D232D4EAFD5D97D1B76C0AB115863F2C84361A2DB1A3FED02F81993BD98F12416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779194188, "uuid": "82e637bc-f916-4166-ad6d-75e5ba11e83f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779194188, "uuid": "f9ee172c-eeaa-42d3-b765-eef0dd4c550c", "value": "12288:EivJhLD/KCX+rNf1OV45vKgxPs3hHaUxe2Hg2EUgkrCdl8mzuQBdG:NMbKd3Nxe6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779194188, "uuid": "9a4636b1-016d-4445-8d42-0e992bc996da", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779194188, "uuid": "60dde952-3c5a-48f2-b048-645c3e59584f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779194188, "uuid": "22c8316d-78bb-4362-919c-6f9f458b767f", "value": "QT_368164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195b42c1-5393-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779202667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202667, "uuid": "7697f4ac-260c-419d-b111-a71dacbed77a", "comment": "Malware payload", "value": "e878e5ba4c219801d5fd88776f43a53f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "zitmo", "colour": "#01260C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202667, "uuid": "b59e7c7f-f961-429f-b6b0-87bc94a2fdf8", "comment": "Malware payload", "value": "db30e3f8c09d36e8b9e1d8093b700f97f6a6061484e4db673e78d6a5e88d43bf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "zitmo", "colour": "#01260C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202667, "uuid": "b3baa631-4328-46a2-b365-b3edd2800c92", "comment": "Malware payload", "value": "98e6a3fdbd2f5b482002a4968aa62b2671b1c69d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "zitmo", "colour": "#01260C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779202667, "uuid": "5781959e-052a-4afc-804a-cf98a9ca881c", "comment": "Malware payload", "value": "9c58947ae42155184120d4b33222fda2c269196049985a081810181e47ba6b7027215ca2d4f419f3918731abf9beb4a0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "zitmo", "colour": "#01260C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202667, "uuid": "d5bc898d-cf06-4b63-9403-393551d98db2", "value": "T15F141209D3C4F5A7EFB6EFB82675B0606E561E04E1ABB18B625FD53928281C0536DC8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202667, "uuid": "6f29300d-0390-450f-869b-587ec4525c62", "value": "6144:JXzSTj6hzaq7A6KpGuplwTGvSGDFa3VidFiVpvDiylNCWW:s2z97uGjTGd+VOiVpvxlsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779202667, "uuid": "68f8bdcf-c4f8-4cf0-8c3a-ab0eb52ac178", "value": 206322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779202667, "uuid": "6e6e5fb3-7176-4cd7-8f4c-aeb6eeca66a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779202667, "uuid": "8b518907-8993-4b5d-a115-5c2b1100cb33", "value": "postbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50714c8-53b8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779218927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218927, "uuid": "0d43ad80-ccb6-47ca-87c9-2ccf01406494", "comment": "Malware payload (ConnectWise)", "value": "ea60240d8503be083ee57871e5633328", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218927, "uuid": "9da8ea6c-f546-4f1f-836c-f53e193ee501", "comment": "Malware payload (ConnectWise)", "value": "dc52da555092232b88970333cdf4d3064264afd5ed8177313fd4ae753d6b948c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218927, "uuid": "d888c19a-10c3-492d-b0e1-7b8f9e7ea62a", "comment": "Malware payload (ConnectWise)", "value": "2e26e29cde1eb1d7865238e6e85deca16689b21c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218927, "uuid": "5fc0e9ee-9a53-4067-9f9e-e0ed6fdc074b", "comment": "Malware payload (ConnectWise)", "value": "f2f63245ed65456b8f7697ed8df6f5ef8c45f294a241c02eeee0182fdf4a11bca2f645dd736d6127d2d117cb8d1ff2d6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218927, "uuid": "b500adfb-60ef-4ca0-aa92-c513282e0a16", "value": "T10A646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218927, "uuid": "1e102d84-8618-4d7a-9459-9a6bc9b50bd7", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218927, "uuid": "c91f9a18-46e4-4f03-ba8f-fd9639c97f72", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779218927, "uuid": "d62fa881-7fa7-4b71-a41e-3245f662ba59", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779218927, "uuid": "72392a28-1554-4259-adcf-e7c093b3d20f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218927, "uuid": "1822862e-7aee-4af4-84be-8c40d8b93683", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561f4443-5363-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779182153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182153, "uuid": "134290f9-0aac-4ca4-bcd8-e95244cb0771", "comment": "Malware payload", "value": "09679eca801b625b45273dcd5047ff26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182153, "uuid": "8a913898-d71c-405b-88b6-bf4e48ab0ac8", "comment": "Malware payload", "value": "dc87b733bd70b903e4d0a0116ee52bf15a68f813aa2bd5c88f929eabc737a624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182153, "uuid": "e7115bcc-30b4-4ae2-80a3-d6078325791b", "comment": "Malware payload", "value": "f84d9725d82d67013231641278121a93813e4242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182153, "uuid": "8eb07b3d-9839-4ab7-9269-f7173bbdc1b9", "comment": "Malware payload", "value": "f315e5173bf39bc6c8d61190ca74ec8951220a09657547ba5b2442977e47b31cf32bec3302e1036703ba67f5b84da1bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182153, "uuid": "b22c8d5d-207c-47f5-992b-ec1e16dfd35e", "value": "T1D1016D15678A2F53CE8EA2FB15A7872567D1FC228C729787B2086C809E2A1C53D22A10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182153, "uuid": "700a1b77-2af0-4a81-a50e-529c39369122", "value": "12:BBAXWXzzDFmFmFmF/EDxgi8Q838XSsqlKXQK:3HTFmFmFmFgas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182153, "uuid": "1f7daa3a-91c2-4b68-8525-1132c8af0679", "value": 717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182153, "uuid": "33fd0486-6dfd-4fce-91f2-4c36e08a9359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182153, "uuid": "a428793f-f970-4b61-bc83-e19c51afc365", "value": "dlr.pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8838710-5343-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779168574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168574, "uuid": "ca658d26-f16b-40de-ac78-43239c1f6378", "comment": "Malware payload (AgentTesla)", "value": "a8cc442eea24b1796c2494ea2dbae7c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168574, "uuid": "0ea81d01-1ab6-47ca-85e5-31d3b4ebeeed", "comment": "Malware payload (AgentTesla)", "value": "dce04b626574c990b7a1d873006c10a7f3fdfca21f63660e36a9e681f588825f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168574, "uuid": "08cc366d-8237-41da-8d36-9373449f627e", "comment": "Malware payload (AgentTesla)", "value": "a0624dee4b4164c7d957afc1f68f86b73014ce7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779168574, "uuid": "d26199e9-a802-4f02-a93a-f82d8ac63ec4", "comment": "Malware payload (AgentTesla)", "value": "c6f30e0f67e7f664ff1657310e8d38c67faf1096e96e304dc747b30b814687d75fade014cd29c0d9e16050dae36160c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168574, "uuid": "5a950e5e-d760-4c6c-8ec0-c3142b2ea26f", "value": "T190A401542F7CCE43E6468CB45EB5EA6BC6309C428D6D5B03EF317D0DA8397C4BA89A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168574, "uuid": "76ca0814-55d9-4e81-8268-a21b074e7c9c", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168574, "uuid": "1789d03d-dad9-4d8f-bc8c-835c1b86c368", "value": "6144:+pkXGh6aeKHGX2RK49s2RuUQH23WSzI0JSJJ7O98TNdUevz+FpP:XBGRhe2GSzI7LOIddLmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779168574, "uuid": "dab918c0-6f9f-492b-b6ae-c2bd20c1ffd8", "value": 479360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779168574, "uuid": "fbf4da3b-a67b-4a89-87b4-5150659fc271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779168574, "uuid": "bf7eea70-7a22-4278-b11f-bcf429803d4f", "value": "order5886969689606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aeb39b1-5363-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779182161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182161, "uuid": "1bc2c2d2-da6d-41be-9aa2-7dca702ece4d", "comment": "Malware payload", "value": "58fbb7661513cc5a8fe006116442c47d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182161, "uuid": "5c5bb906-b417-4fc4-a715-1aa1fc4567ae", "comment": "Malware payload", "value": "dd11ac9ad011f11d6779957f65ad17a9ba37bbc4fe6d397d3432aca2dd35d101", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182161, "uuid": "1f5a94a6-fee1-4e9f-88b4-f80c819555d6", "comment": "Malware payload", "value": "3002a5555648d0a3174a2139f9b4b51d99f7956d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182161, "uuid": "2d3ed5be-11d9-43fb-825f-8c857ff1a125", "comment": "Malware payload", "value": "b42d9e199762464a00554b529dfccc8315ac04cf7f7e3ecd4c0225d23d2ae5de293c90c2417c120a4449dcbb11532f87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182161, "uuid": "ab8693c9-0a50-44e8-b3e2-44d0a1321dfd", "value": "T1EC019B4637E34FA3CE9672FE2BA787681791F82349668747731C68D90E171C53D68710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182161, "uuid": "72359f04-5b38-41b6-a81e-b3fffadc557c", "value": "12:B9+rTFmFmFmF/EDrgiJmQ5t8ZP/fT+a+XyrlKXQgQl:+/FmFmFmFAtObLWGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182161, "uuid": "fd367586-ee1d-4928-b079-28acd5699e62", "value": 746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182161, "uuid": "f153cc18-5313-4d88-b31d-772ae2ff08c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182161, "uuid": "b36edb3f-7483-485f-b811-7cb11f5bab7c", "value": "dlr.psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac082ee0-539f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779208067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208067, "uuid": "cbd9de6f-1209-427d-83f1-1322131e2dc7", "comment": "Malware payload (Mirai)", "value": "bf5f9907e3c7c7434405d1e351888502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208067, "uuid": "a0de3470-8ff4-40e8-acf1-b63235b0c347", "comment": "Malware payload (Mirai)", "value": "dd9b1129285f2771eca9cb0a288d5618302fc5f684cb514b52a516bc936b49e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208067, "uuid": "3bbe651e-7c25-467f-a645-10c9dc4392a8", "comment": "Malware payload (Mirai)", "value": "1b279c882f6e17e9b5d72d133ad4587af51dff7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779208067, "uuid": "6e808637-5b7e-465b-9954-642412bfd3ab", "comment": "Malware payload (Mirai)", "value": "8ee8195f598c045c8fd1a1c32b813a5d3316fc708114892523cd990f6028ed66cab4ab60377d002c5faac522d0fe7434", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208067, "uuid": "99c95f24-6e10-4ba1-853a-0fbcd6294a6e", "value": "T103F2E13A245C0351E22BCC7B553961F1AD697C017F1BC801B625EAB96B8113BEC74BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208067, "uuid": "e28dba3b-4a30-40ce-82c7-07b0dcf40fed", "value": "768:HMQKjTdGhKWIArLbjAeMA9cMG6wQ+pGmGH3U/gq3tBSDe90y:sQeTdGhKhMj1MA9cMG6wQGBTL3tiez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779208067, "uuid": "3f38ee8f-1dcc-4f1c-a46f-eac9d3578ac3", "value": 36068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779208067, "uuid": "499ecdf5-7263-4f5d-9476-7ef542a32e88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779208067, "uuid": "841f384d-0792-4982-bdfb-8c87e3f05059", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a8b887-537d-11f1-a769-42010a9c0008", "comment": "Malware payload (BlakcSeeStealer)", "timestamp": 1779193457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193457, "uuid": "92247bab-e0a0-4611-b969-761d3e771bb2", "comment": "Malware payload (BlakcSeeStealer)", "value": "bfa823f6cf6383e022b85268670790b8", "object_relation": "md5", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193457, "uuid": "4ff2e17f-5135-4321-9823-a6877045c36b", "comment": "Malware payload (BlakcSeeStealer)", "value": "ddf23bce7cad878a3e635d6daef6919440296a42561e93227380e51f928528a8", "object_relation": "sha256", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193457, "uuid": "40c98f07-0436-4f6e-856f-9fe89506e682", "comment": "Malware payload (BlakcSeeStealer)", "value": "dcc0aaf1ec347f0840af2fab9049acfc90b5f0cd", "object_relation": "sha1", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193457, "uuid": "ece38279-7c96-473f-880c-31f5ae2ffbbe", "comment": "Malware payload (BlakcSeeStealer)", "value": "1ff128f307995b5a31fb8aa39d606ca0a099547984640cbe0c915ea4c9a9f45bfc2a0a613dc0ffd3c90c760c60f031b5", "object_relation": "sha3-384", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193457, "uuid": "035f325e-899c-49be-b557-4aec76523715", "value": "T11B156C1AE66800BDD0B7C6B4CE665D43D771B84B03706ADB03D05AA63F277E49A3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193457, "uuid": "43e09876-9a3c-4a33-98ad-cb7ef03dd45d", "value": "2a7a90c4040bf7fc633278e7bfd55661", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193457, "uuid": "64741892-3f8e-4a41-982a-1468b1c98654", "value": "12288:N9KG6Ewi7nUcJS97UlCiYUZ0+PeupPVNMe1R/OiMWAYNh2vpfj4flmDxcTgKpNE0:n3zqcJg+BVNMe1RXDHh2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193457, "uuid": "af2ac9b9-d6c2-4c0c-851d-c8b5c07d369f", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193457, "uuid": "2f9da41c-7e02-4d57-b6a7-51c455d5265b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193457, "uuid": "70f393d2-b38e-431c-b84d-6d839545c41b", "value": "ddf23bce7cad878a3e635d6daef6919440296a42561e93227380e51f928528a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411aa9be-5379-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779191567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779191567, "uuid": "a7159d76-61be-4454-a64c-08e3990adfaa", "comment": "Malware payload (MassLogger)", "value": "275edb1d0ff164fb38efe4e9a9a32608", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779191567, "uuid": "e4170980-0c9f-4f0b-9333-245168419461", "comment": "Malware payload (MassLogger)", "value": "de3d7388267c446c95182678f6a0bc5ae4d6837b7b7522ca3250f59a2e3e88a1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779191567, "uuid": "6b1ec4a5-48a5-4c8f-aaee-de7221dfd4a3", "comment": "Malware payload (MassLogger)", "value": "81400bcded98b15729e3c8d059ad7fce2a06cc15", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779191567, "uuid": "fbc0edf2-f047-48d6-9c4d-1ae9df7af445", "comment": "Malware payload (MassLogger)", "value": "f39486d535b49f6f51eb3a7f38441df5349e7a0778f8b3db907e08cf6f8da74e875a389896f37f0a4d2ecdedd28fd708", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779191567, "uuid": "2d217649-9a7b-4fa3-8297-fec9be5c3f99", "value": "T102A567FC8FF564E79DF104852C227C4DC5AA7E2AC796CD2DBF0B41BE320A5850296D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779191567, "uuid": "ab3cff1b-3d7a-44c6-9368-a82fa0c17769", "value": "1536:9CqwZQgL4ICDrNU4I89DN8lEEl/8kAWh4b3rPiQXptjWfXU9bfFPtjWa2eqwZQg8:9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779191567, "uuid": "07d1939f-65bf-40e2-b426-19a7e3283893", "value": 2073579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779191567, "uuid": "bc9fbb10-fd55-46b3-a4ab-2b41b18e701f", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779191567, "uuid": "691b0bc4-db37-4d8f-9ec9-d28e5faf4d6a", "value": "dekont.pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed657e57-53d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779231799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231799, "uuid": "653a3b6e-b082-4963-8ca7-b9b5547cef00", "comment": "Malware payload", "value": "c7b41b3898b84e7f95b12440e017c420", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231799, "uuid": "2a22a793-3312-49b0-b92a-12a3321991f8", "comment": "Malware payload", "value": "dee39422478df6026f8fe6e86048379d8fbc0f7e2acdd31fb5bb5296370fc927", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231799, "uuid": "013c7c99-3bec-4134-945b-79b69f636ca3", "comment": "Malware payload", "value": "ea6be05487f4129e234bb50afb89320a3729c654", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231799, "uuid": "c6cd60f6-6a3b-4fcd-9282-8c91848b6981", "comment": "Malware payload", "value": "366a0c5b3a83c46567ec3e6ff0968cba1b4d97d16f5adbda4be76e08c247d09d8bd4018d15b49afb9f2eb50376dfe521", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231799, "uuid": "032e1c44-0f10-4e8b-8217-77852d82bd45", "value": "T121B25D0FB8154329D4E100B092619F7BC9B9A9B73788A8DBF38044CD5A686D6FC3695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231799, "uuid": "cea772c6-7df4-47f2-ba22-8e8007d8188c", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231799, "uuid": "742e41f5-159b-468e-9218-bcaedac15444", "value": "384:iPthb/HJnv+UL7exaxdlLHMwXud2YLNL97cpHB9z:iPt1pewdJMw+dxc1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779231799, "uuid": "5e071123-7997-4b38-bb0c-257c4561ad08", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779231799, "uuid": "0e392f80-e82f-4928-82a0-4631965eedea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231799, "uuid": "2911e4cb-a6fc-4b4d-9837-7745054fb0b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8efe20-5328-11f1-a769-42010a9c0008", "comment": "Malware payload (Fuery)", "timestamp": 1779156986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156986, "uuid": "30e5e3e2-51de-4ef9-939c-fe37b9eb8aa0", "comment": "Malware payload (Fuery)", "value": "6b3ce695efb881fd013e596d8fa5644a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "smtp-module", "colour": "#6B652C", "exportable": true, "hide_tag": false }, { "name": "td2", "colour": "#E23BCF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156986, "uuid": "76b6cf25-c4d2-4ff2-89a7-d9f2ec9c38d3", "comment": "Malware payload (Fuery)", "value": "df1e09ca640b5ed14fd80cf8343529ff51e53ae4f16de84f1c5651f55a0c00cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "smtp-module", "colour": "#6B652C", "exportable": true, "hide_tag": false }, { "name": "td2", "colour": "#E23BCF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156986, "uuid": "23abebe6-890a-49a3-abd2-eafad1bcd63a", "comment": "Malware payload (Fuery)", "value": "5ddeb07d0bbab7a8cfeb1898c1a6b7ba6ff9edc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "smtp-module", "colour": "#6B652C", "exportable": true, "hide_tag": false }, { "name": "td2", "colour": "#E23BCF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779156986, "uuid": "361a7603-7950-4356-ba0c-889427c0e4db", "comment": "Malware payload (Fuery)", "value": "4b4b771f98c89c0ea9a45e12ae5bc41b9d3f7078ea8eed2080b7788bc513a1edcf1054c59d3226fc419c0bfc09c79ef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "smtp-module", "colour": "#6B652C", "exportable": true, "hide_tag": false }, { "name": "td2", "colour": "#E23BCF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156986, "uuid": "a2a7a424-59f6-473a-b6e5-1af2f17c581e", "value": "T1E9863319C2D8CE09E8AA37F984B5E2740BB96C49D015C2127FD97EEB386273D4705B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156986, "uuid": "159c2762-ba2c-47f8-8d32-0bcaac1cd4f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156986, "uuid": "81fcc3bd-81f1-4744-8082-59d2b1edc5b7", "value": "196608:AP0JJVFwVKR9VIaMaTl+IKvmjimkf2xP3hagV+:AP4JVCUVIajTlDM+UuxvhBV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779156986, "uuid": "58e0579a-f4ec-489a-b7f6-2019153baf45", "value": 7832576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779156986, "uuid": "f9a6bef9-b18c-45eb-b1cd-216c51de445e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779156986, "uuid": "4a57fb30-bd9d-4e1e-8290-865711fb637e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77bed88-5355-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779176411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176411, "uuid": "e10f1273-3bfe-41c0-9776-77960a17ba07", "comment": "Malware payload", "value": "ec48225e2dfff54d8bbb9a23c96137d0", "object_relation": "md5", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176411, "uuid": "0124bcd0-648e-43cc-860a-41766ae055a1", "comment": "Malware payload", "value": "e0052de5a9673f74be5a49fe13cae9b16b6f271972901b17236090667bb53d31", "object_relation": "sha256", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176411, "uuid": "950ae523-6b06-43fe-8dac-12fa5adacd03", "comment": "Malware payload", "value": "1749c7d673fb14504246b51ddd9e5cb51e0787b9", "object_relation": "sha1", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176411, "uuid": "b41fb33c-697b-4287-bc2c-90bfa57f509e", "comment": "Malware payload", "value": "53c3d23110f8003944233084728497c424fc15008468bc1ea35e49d786ec89031658dbdeb7573dd8c3f75eff63ebdd33", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176411, "uuid": "47567a3d-c57e-44a4-9f43-6751d6ad364c", "value": "T1DDF122384208576949B2226AAB48C549FA5741F30BBF2E51F8CC82355F7605DE13AFFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176411, "uuid": "a392ecab-e742-4fdb-bda3-4c01979162ad", "value": "96:F9o11ft+114VSIoNckF073kmBWX/wAkqU1u2xBeH5af8nJlE:x14VSId3u/wA7UZxsH5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176411, "uuid": "63b70d1b-6b40-4caf-881e-5ebf86fb349c", "value": 7559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176411, "uuid": "89182ee6-483f-41c5-a7bc-905bf11c45f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176411, "uuid": "208fd025-7b25-4f16-917b-0c5f07fe5f31", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402e2a37-537e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779193713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193713, "uuid": "4ff0c823-4031-4aac-b97d-7d75b1d38cc1", "comment": "Malware payload", "value": "6be68868c5157b7575e4ee4390860982", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193713, "uuid": "b956b7d4-7ed7-4853-a257-b61b91859201", "comment": "Malware payload", "value": "e044238a4bf845880b811ad3c5d5b8d67d82a97fc1c37b76c4fe29f76fda2ff5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193713, "uuid": "2b0aa609-100f-4c71-b7d3-db97fa661fb6", "comment": "Malware payload", "value": "adc5f9fab969c69d93283ebbddf89982be3e4138", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193713, "uuid": "568ee90b-a9cc-4ed3-834d-ddd81db98752", "comment": "Malware payload", "value": "c3e373fd1c96ce2fbcfd5960689d93627291b80988c7ee108d10ef7ad5225f023d0f28b90283ac9ce43b2c6f3fafc85d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193713, "uuid": "83121303-887c-4da7-9d7c-bbc5efb6d009", "value": "T18BA302389A0B5D64C06FE37301AF4D30EFA4494AD921091F982FD27C4EB05A9C57FAA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193713, "uuid": "396f6bdd-f8c8-49bb-a235-709549123fc6", "value": "3072:zNHHHHHV377z+Vc5hPJs1iRJT2KfiNMNmNmdZPp+nQzMaUAT:5HHHHHV3j+2H2Gx2KHymz9dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193713, "uuid": "64af1220-75a7-402d-9d94-e272947a0590", "value": 104334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193713, "uuid": "bc2e9ab7-3fbc-436a-8ea2-95471d7481ae", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193713, "uuid": "4a4e63e3-751b-4f61-91ab-690666156ca0", "value": "Transfer_Advise_Swift.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69328934-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "98614379-0742-43b1-8b08-962124ebf582", "comment": "Malware payload (Mirai)", "value": "26d0f659830d48506d3fb0ab3f08977d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "2c3b3bac-132a-45df-9c51-d3129b028bb1", "comment": "Malware payload (Mirai)", "value": "e1af70e6cabcd0f3c7ad9f199b3d81125143fe5b7eda34e796a2297c99022c98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "b0d1765a-9e82-449f-a05b-87081ae60ee0", "comment": "Malware payload (Mirai)", "value": "befc56d9c8a67b2f21dff84baf41052080e906f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219551, "uuid": "95f8f44d-e011-427e-b71b-8c4956291818", "comment": "Malware payload (Mirai)", "value": "97e489865c3bd525e5b99472962c97ebd3ef36916cbe3db9d90d848ed0b539ca29b33aee0ceed6beafbe4bfdbdaa765c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "561dd043-4759-48b7-930b-872a459e6f7c", "value": "T107F32A03AC655FA7C186AFB526F74A750753EC154B4B0B8AB63AEAF406079CCF809374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "1c48ab00-b577-40f0-a936-f5ac2310f8c5", "value": "3072:OQGmUJ7EPqKbBECpfUhEJf5LqWlmJivZ9RWu7TmzqJj2/W6622g65+BS:OQGmUREPjBECpu43leuZ9RWufmzqJj2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219551, "uuid": "759c7b4d-c343-484a-ab03-d9bb54344e78", "value": 161177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219551, "uuid": "ea2dc4b7-ea9f-4b61-b80b-c27aa5372421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219551, "uuid": "a46382a3-cc29-48dd-8d15-21ef4de760d6", "value": "mynode.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5244d55c-5363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779182147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182147, "uuid": "74626773-3744-4ace-b643-4715f772c6db", "comment": "Malware payload (Mirai)", "value": "0c036cf3c8256f1d037781351a37656c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182147, "uuid": "18694ada-c73b-442a-b63d-a5a9d3d4b9a0", "comment": "Malware payload (Mirai)", "value": "e2df6bfbfb0dc8f574353586fa1c9b74f05d0508361260d8659f51c85cb3a98a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182147, "uuid": "50d7956c-1e17-419f-9f8a-1c443e020194", "comment": "Malware payload (Mirai)", "value": "ce77fff6a1c20aa92fb5a1ce1b40dd44b005e91a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182147, "uuid": "b7fc3aa4-014f-4ecc-aaab-5d2821f5fd65", "comment": "Malware payload (Mirai)", "value": "6bf2b976cab13c9f42d02b55fbf2556d527e08d9431e89348a99ce079ab8002764a8a53fc7657501df2f449284824d7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182147, "uuid": "8034766e-e7d0-45b1-9d2c-d67d11710367", "value": "T175731A42BD429F03C1C321F6FB9E01593B166B79D6FA3242ED25BF9027868DB0E27651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182147, "uuid": "3faf4001-6648-42c2-bd5f-b70f8189c048", "value": "1536:UsYQt6q6XEPM7liyAIOFn1fdnjJYEvQhI/R/wyjYj:ls60BiyAIOf1tsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182147, "uuid": "e98fb4c3-4594-4fb0-bd72-4470fcc4d4ea", "value": 75000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182147, "uuid": "c16a83b2-ee3d-4358-9dd9-3f9f7af74bc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182147, "uuid": "129e982d-ff7f-49e5-806c-592d27b31830", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc65086-5352-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1779175105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779175105, "uuid": "57fe792d-0d9f-446e-a31a-48372b9f75a7", "comment": "Malware payload (WeedHack)", "value": "d0aa3d443eb450a5792f7d9ae910ea20", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779175105, "uuid": "ebf7bf6e-8d21-4043-9f52-28031a1c1657", "comment": "Malware payload (WeedHack)", "value": "e465fd43b88c5aa0cd527c4e5e2ad29abe30ac4807218e59657b822cad94e0ee", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779175105, "uuid": "dfa9a429-94b6-429a-a98a-8503c7c30993", "comment": "Malware payload (WeedHack)", "value": "15a08a32cc6c2cd28c5602f1c708dc0ec39f92ec", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779175105, "uuid": "6368aa6c-d507-40e3-a734-7e0d91267a1b", "comment": "Malware payload (WeedHack)", "value": "52f68b182b42c37d1d9ae3ce88e64cb51f510d4d9599b8027f57989886766f1e30c61f13a9b1bd54b90c877ca55edc6c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779175105, "uuid": "f3c6c8c1-4336-450f-abd5-df91cdbae8f1", "value": "T117E30BD8AB6BC5A9F0639171010CCA22AF3486CD9BC8F93F2D51D81948F0995E9DF9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779175105, "uuid": "de68b8fd-cc7c-4e64-8bc1-3a284b759535", "value": "1536:p+1AInYLHls4WUNQHs/qXSm5J6VsqofB8wCnKraxl4wCEE7xyAKJ:Q1nYRsKQfSmuVs5WxwhxynJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779175105, "uuid": "48fec0ea-9464-4d43-9d43-372b59ed1380", "value": 146373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779175105, "uuid": "f9036c43-dabe-46c6-ace9-3ba010bd984f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779175105, "uuid": "ab38868f-6cb0-41cb-af45-b9ad82dfa49e", "value": "DonutDupe-1.2.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1a5e7d-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220551, "uuid": "78d5bfec-cd9a-4347-a787-bd27c4a7bd2e", "comment": "Malware payload (Mirai)", "value": "48ce407ae240d1c53fe719eb9bf7abb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220551, "uuid": "198e4ec1-92ea-431d-b69f-ae0a25b088b3", "comment": "Malware payload (Mirai)", "value": "e46f10c0e74bc822fce4350172cc360a237919597d3703597c9def3fde27f236", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220551, "uuid": "30d4a90f-59c7-4c1c-bc33-bbb2d458c117", "comment": "Malware payload (Mirai)", "value": "a82d5d63f346b663098360feeedebffd443af3bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220551, "uuid": "32c883b4-dff5-48cd-8849-443895845a9f", "comment": "Malware payload (Mirai)", "value": "386f273acd541e9aa697947d116635611fe2fa6275e4405150b840cd40481ea6bd699972f474308f10c015dd7bf8ecfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220551, "uuid": "0f78f8a3-8b04-485e-a49c-f71854189bde", "value": "T108D3E606BB610FFBD86FCD370AB9170625CC651A22F97B367A34D81CB54B24B19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220551, "uuid": "2514fbdf-f523-491b-bca4-025dffa5ed76", "value": "3072:VLgECHfNIIx3ro6u86EX/P/2vjudW7FKom:ZgEC/SIlEPBIOvydWsom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220551, "uuid": "6a0a1390-54b8-4096-9037-c6f91f3ec50c", "value": 130676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220551, "uuid": "368be69e-1084-4e18-9974-a2fdbfd8fe8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220551, "uuid": "f9217ed8-cd1b-4031-bbef-9c44c98f7d01", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165e9ca1-53d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779231868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231868, "uuid": "20b4fd67-6fcd-4222-b4b7-34a5b66f0c37", "comment": "Malware payload", "value": "d85474b2a0e1d4b0a56ff292b8822fe5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231868, "uuid": "f845f000-c677-489c-8ae8-396cadc0c006", "comment": "Malware payload", "value": "e4a37723d45b2a5a7181b784f5e9eef1f9f6244f4545843800581cc5740ea8a4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231868, "uuid": "1b3dbc48-ffc1-4c7e-9e85-58f3fb884fa2", "comment": "Malware payload", "value": "a469151de62f7d3cb669f342a2772dab3d23687a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779231868, "uuid": "4fd43bd7-284f-4bc4-9cc7-e8b6f700086b", "comment": "Malware payload", "value": "a8a3d10f133f90fac76149495328e886a89d6eb42127301bf56b5c93393e394b015347168757ee8251e7c977316d1f44", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231868, "uuid": "1fec4e19-f11d-4cd0-b3b0-af45f51731bb", "value": "T181B25D0FB8154329D4E100B092719F7BC9B9A9B73788A8DBF38044CD5A646D6FC3695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231868, "uuid": "b6975b29-9c63-4a6b-8179-106f020e48d7", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231868, "uuid": "b89ce8f8-d7be-4f7f-ab32-da29ff21fde9", "value": "384:i1thb/HJnv+IP7rGNutdlLHMwXud2YLSLf7cpHB9z:i1t15y0dJMw+dwc1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779231868, "uuid": "c9ccd61c-d532-4f16-b751-51463a59e7df", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779231868, "uuid": "a41db8ac-80c0-40b9-bef3-a2bedb19e089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779231868, "uuid": "96a475da-2b2c-4010-91c7-ad149e66f693", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59441365-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157248, "uuid": "f0fde72c-5ace-4390-bf2e-a0e36d74db3c", "comment": "Malware payload (Mirai)", "value": "f061bc17412617367006e0cfb9156a68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157248, "uuid": "ec833f78-cb1e-4ebf-a899-34eb843db014", "comment": "Malware payload (Mirai)", "value": "e5428a65be4c6471ee1d6de70cce489fa5319b7310a21ab8a3d9b8f3e44e7759", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157248, "uuid": "739daadc-2d61-4610-b25d-6cb58e8cceb8", "comment": "Malware payload (Mirai)", "value": "b80fd56e4220ba2f577d8e7c46ca2bbbce059a9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157248, "uuid": "094c957c-78bb-41a9-a577-b3a95b9c1993", "comment": "Malware payload (Mirai)", "value": "0432f2b0d002c5cad674926918b67752920c5ef246d47540688cda551da29515b1dcd9fbdbd953e8c536c6c75a47150f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157248, "uuid": "cfd0472f-f49e-466d-98e5-3fa4c85e7318", "value": "T1CC234B21B9392F17C4D4B8BA62F74768B1F5124E25E8CB4E3D720E8EFF54A4095136B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157248, "uuid": "78ef19c6-9f24-405f-b4c9-13e75282556a", "value": "768:MMouY0Fbq9jJWijbp9NboVo+N11sO+2jzhB:MMlY0FbSjJWijb7po71WQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157248, "uuid": "1dec8879-7c2a-4c10-8b95-6e5d0f160028", "value": 46804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157248, "uuid": "4a398c5b-a20d-4da4-bb0a-bbca3cf38240", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157248, "uuid": "4a64b5d7-f6ae-489d-b78e-b47e1d1f8e52", "value": "upperspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a80ff6-537c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779192892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192892, "uuid": "f7538d5a-cda7-4133-b11c-a74b45ba7c90", "comment": "Malware payload", "value": "6c9bf27f15d3add8dfbcde41111af70d", "object_relation": "md5", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192892, "uuid": "b0b8911d-6562-4ac9-a651-5430bd76f485", "comment": "Malware payload", "value": "e62b4c831554c333c470bbbdefc269d87c23c86f5e8c975b16b76deb27e0a7e6", "object_relation": "sha256", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192892, "uuid": "b4a84983-0dad-4354-ba93-06abe077e2ff", "comment": "Malware payload", "value": "dc3694228849f1821c447a9ccc8f56ec427af93d", "object_relation": "sha1", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779192892, "uuid": "148c76b9-4cbc-4853-ac46-8c2b9cc89248", "comment": "Malware payload", "value": "a68b2e94c8dad060420d33a94b14dbd22fe9acd2f2e5d0981a3be99a5b0e83c9c0eac276fc7d9473bce8c74fc2088f6b", "object_relation": "sha3-384", "Tag": [ { "name": "51-89-204-80", "colour": "#72BE80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779192892, "uuid": "1ff32a68-b6c1-4036-8dda-7f8ec14f1fe3", "value": "T140C402823B918721C2995A76C4E3C92503F6E5C76FB7C346BA4912AB0D913F1CE67B4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779192892, "uuid": "7f5b586c-f910-458a-bd69-cc1f035a0195", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779192892, "uuid": "6432593a-a44f-445d-b74e-4db6a5eb5a60", "value": "12288:JkgUP33wH2yGazGHTm1b0nH/Byc23Xmcew8ANcy0:JkgU4HlG+Gab0nfZ23Xiwx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779192892, "uuid": "628d6451-a58d-45c5-880f-f9a63adb506e", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779192892, "uuid": "09f559d2-682b-4e7f-ad01-b5f16b0da040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779192892, "uuid": "f5723d6e-2134-4896-a5e2-da927cf89171", "value": "solar-sanat.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583cb31c-537d-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1779193324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193324, "uuid": "324ee3f6-06ef-4061-b517-cd6be24482a5", "comment": "Malware payload (a310Logger)", "value": "9c63db0d93d358b8a51448e9f6642fb9", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193324, "uuid": "6eb2fcc1-a4a9-4a63-85c9-7a0e8c3492c7", "comment": "Malware payload (a310Logger)", "value": "e68348184be3f6e351e01bc8ee7912ae57c16ae29f5863c7914a04f823cdd2bf", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193324, "uuid": "8f4e4af1-5134-4ee0-a03d-fd40fe8caae0", "comment": "Malware payload (a310Logger)", "value": "f9af5ca08b1f6a17abe3f3d02bbe2a6feb195b57", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193324, "uuid": "a38e4c1e-44a6-433e-8388-b9f4095510c1", "comment": "Malware payload (a310Logger)", "value": "95ae3419109eb3d508b12dd88e81d78316608b49d61c91f7aea937e7b3d3130f3cd3e46470e8392d20edc4dbd383fa87", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193324, "uuid": "ab9ccf09-a386-42ab-9e04-2bd83ddb91b3", "value": "T135B45A53EA10611EF063C9F1A9B8824768656E3626E8EC9BF3405F4935755E3ACF032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193324, "uuid": "3bc1c229-485b-4a92-ac95-831c6f1b7a32", "value": "82dac2152b870a3a8f059f7d652fe8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193324, "uuid": "55f4afda-373a-4359-81bb-8faade1b394d", "value": "12288:AKskjv95jYKkJj6GmZU3WJMe5yJTOiGZ:AKscv9hYb6nZRJMe5yTzGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193324, "uuid": "ec687888-2ea5-42f9-8eda-1c6d8b0b4831", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193324, "uuid": "5540d751-ee10-47be-b358-7a18714405da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193324, "uuid": "0f89be06-3c4d-42cc-893b-a585d74d1e56", "value": "e68348184be3f6e351e01bc8ee7912ae57c16ae29f5863c7914a04f823cdd2bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bb30fe-5385-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779196667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779196667, "uuid": "e1ea2e5b-03a0-434a-89fd-7b4cbc9266de", "comment": "Malware payload (AsyncRAT)", "value": "932adc5cbe80088f507205eb68a7d9ba", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779196667, "uuid": "d9f3729d-b5d3-45d6-ac72-971c00beae4e", "comment": "Malware payload (AsyncRAT)", "value": "e94c2520b761f43bec8bd9dfed688bbb7167d7e55f48d62c6772f28165912785", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779196667, "uuid": "c2babc8d-9a8c-4006-895d-86dd564d062f", "comment": "Malware payload (AsyncRAT)", "value": "fc2dff489e47ea64dfcccf7b9311ca4c7b7542be", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779196667, "uuid": "43a375a1-ebff-4d38-9ec4-9f9015525cdd", "comment": "Malware payload (AsyncRAT)", "value": "f7bb76cffbc0d4e32ad9a5c4e60413a6b00d2fd2a95c74f1b0ea69e7e24754774e2192d3f4aabd42650efd94f71b73b6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779196667, "uuid": "54a33ff5-5cd8-4881-bece-8ee95bf93a49", "value": "T149233D003BE9C12BF27E4F78ADF26245857BF1672603D65A1CC442D74A23FC69A426F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779196667, "uuid": "bf23612d-35aa-4a0d-9121-7a2119353e5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779196667, "uuid": "0957a754-b342-4c06-9620-b4a8420347d1", "value": "768:ju/qcT8A03OWU8hhQmo2q9fFPAC+DPINoQTSGHAxn0brjU3L2ZBV6LBZajnwywo3:ju/qcT8XG2KKMNoQTSGgebrjA+BV69Zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779196667, "uuid": "23cb1fee-bb42-4e8f-b4e7-736c9312cfca", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779196667, "uuid": "4a2c2254-cdf4-43bc-ac3b-1518c50dc778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779196667, "uuid": "34a50c95-f5df-492a-a3d0-4544aaae56a8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f571364e-53b8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779218928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218928, "uuid": "c36683fa-d90a-4109-9cbc-863a02c0c0cf", "comment": "Malware payload (ConnectWise)", "value": "cf5d7dd4e7c503acdce3d3e557e43c4b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218928, "uuid": "cbceb6a9-e1c0-45ed-9d71-a1b28e003ada", "comment": "Malware payload (ConnectWise)", "value": "eb486d43e2d0232815e6f77a4a8587a65e7d0170467881a8b827c6b9ad7e8c02", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218928, "uuid": "2f1dadcb-18bd-4b7f-bc0f-fc51f2f5f448", "comment": "Malware payload (ConnectWise)", "value": "001067d8dd9c27499b3b73cdeab7f6cd206c37c6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218928, "uuid": "f855a129-47a8-4f67-872e-30b4c255d4c7", "comment": "Malware payload (ConnectWise)", "value": "e6ac56c62def47fa3d4f3407d87253e95414d80feeb65af49dfac13427412ba0ce33ddd2fba651bf1a010f8ffbaab7d2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218928, "uuid": "d7f13c4e-2780-4d48-8d1d-5975b49a9c96", "value": "T113646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218928, "uuid": "e907758d-41ca-4e2f-929e-3eeb03845794", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218928, "uuid": "0626e0d4-4b4e-4be5-aa8f-71146898fdb3", "value": "6144:tmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9aPovN:I1iw7gryNkSV1hy1Z1u2JLa9aPoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779218928, "uuid": "a92418e4-cd84-4382-988d-d05cbcc66438", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779218928, "uuid": "d3d2a321-87e3-42cd-9739-dd7ab6050689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218928, "uuid": "1029a904-adb7-494d-9f5d-98ade81c820f", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9a6222-53c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779223750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223750, "uuid": "9bc79c37-0fe5-4c57-ad8f-4b81f9077f17", "comment": "Malware payload", "value": "c399f1c798034fdad7a2de41322fb1f3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223750, "uuid": "6697891b-24e7-43f4-9ede-415ae5696153", "comment": "Malware payload", "value": "ebe94b352f02fc9c2247c3802d0ba356aa734ad139138c357e0c3e81c88022f6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223750, "uuid": "925af9e1-2e62-4996-8551-05ed5548e0e3", "comment": "Malware payload", "value": "b618881301061af426055e13b861edb863508313", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223750, "uuid": "25dad540-3e27-4d84-abd3-420e86f9306a", "comment": "Malware payload", "value": "ce4af2891e27757dda99ec4a5e01d5e12992ee5df2c09859783321420ebb29b19cddec53117aee26b97382569bc012a2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779223750, "uuid": "077c04e0-b500-4307-a756-7515b5e45154", "value": "T15D25208C3BA67004E1091CE7E367DD9E92FBEA95122911F8D97B2EDB3C3159C2433919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779223750, "uuid": "df40440d-4ce4-40da-9cad-4363af6466e8", "value": "6144:9F9PdCTwPdF5qya69Jnpl6TatGERAh3kkKo:9FhdCTw1FAyaGnSTasIAZk1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779223750, "uuid": "2c68dd55-4a3f-407d-989a-7f69593d6245", "value": 1002620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779223750, "uuid": "018bf2b9-d37a-4d10-a3da-eadbad04dc5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779223750, "uuid": "794a5dc7-0f80-464d-aa5b-fc98869bed9b", "value": "index.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a0aaa3-5358-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1779177567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177567, "uuid": "3104a99b-9ff6-46fc-a1da-5015cebd03c6", "comment": "Malware payload (RatonRAT)", "value": "c71d8a2e312c9d605d0b364005e324c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177567, "uuid": "10b04b33-c79d-4b6e-b233-3eabb5bad17b", "comment": "Malware payload (RatonRAT)", "value": "ec7ac6f77efe4b0d4af417cdc566a511cafeb6dd7a9f11d560ea66b362b24b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177567, "uuid": "e56dd0a2-7065-4dba-b0d7-c7731b4b75d2", "comment": "Malware payload (RatonRAT)", "value": "55890edb4150601f3f953305fd721555379c6e30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779177567, "uuid": "68e5b60c-f367-4681-855e-0e21eb96629e", "comment": "Malware payload (RatonRAT)", "value": "fcea77d2bff37067760506313132eac5885026264f96f99655190ed8f87974ed8da86a5b82b1ff2a1985439fd4644da6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177567, "uuid": "59e76d2f-1216-4a8f-85f3-3a93c14331c4", "value": "T12B936D0033EC521AFABF8F7DACB560014A737A176D71E65D0C86519D09B2781DE24F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177567, "uuid": "8acf29d8-ebea-4177-af5d-99b8a440453c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177567, "uuid": "b8d18e96-c4e2-44c9-8793-94afa478b6e5", "value": "1536:lr/cVcmRMEQid3ebUc9TVTsqa4tsi5qQf+1LGyamlbTKhC6msww:lDcVfE9NAX4tncQWRG9mlbTK86mlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779177567, "uuid": "995b6887-e794-4884-9ea8-a6370e757d93", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779177567, "uuid": "48efd0da-9a49-407d-a7c7-06ba8ca0f34d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779177567, "uuid": "bac94b09-607e-401e-a50d-e8ac4c6c6e05", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b48bb4-538c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779199728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199728, "uuid": "c0ba2844-3ad9-446f-99cb-603afae739f1", "comment": "Malware payload (Mirai)", "value": "bdbbba015eab9f8045461b0909bd1ad8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199728, "uuid": "408de6cf-b528-441b-b1da-49a26b87368f", "comment": "Malware payload (Mirai)", "value": "ecc4c998de14675b570c2e6856e973fecb124b5883b7cbda5bfb52f550cf1d00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199728, "uuid": "e8755731-0f0c-4d1a-bf81-397ff05d4510", "comment": "Malware payload (Mirai)", "value": "beec36d5ab10a836f6da8c91f4ca639d0c660d77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779199728, "uuid": "a6c1a441-7609-411a-bff5-b560b7c38edd", "comment": "Malware payload (Mirai)", "value": "e40bf08a1ce9d2822448ea3be8df4d532af06bd3476f1eb2219045a9453ca082e0f859750884b928c08f9b0b2ece8efa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199728, "uuid": "b42420d4-9aea-45d9-a6b6-2245602a3bb3", "value": "T1A593B75E6E319FFDF66C833047B78A21A75D23D626E1D685E29CD2001F6024D682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199728, "uuid": "15514300-47cd-490f-ba86-743c9c35b56c", "value": "1536:moWpmrIUCy66D7777H+vMue8qmUyteOMadkahIgR/0Po+:moirzMuCmUy5kHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779199728, "uuid": "7062ec48-3c52-46d2-9dde-4786742e11a9", "value": 89944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779199728, "uuid": "cfb07af0-b2b7-4746-b1b9-c17d88eb49a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779199728, "uuid": "986e0ee8-e78f-4b1c-8ff1-f34d52694911", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dad744c-5363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779182139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182139, "uuid": "69918086-e42e-49ab-8012-01bf303f2a67", "comment": "Malware payload (Mirai)", "value": "e8e1f2c05b56ae6c88913b28d0e55413", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182139, "uuid": "c1ed0a59-822f-42df-80c7-d9eb30f6db6d", "comment": "Malware payload (Mirai)", "value": "ee026a63a557a14f75cc9df92d43645019002b007f8312d0943ca86553260ba1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182139, "uuid": "89690e07-7022-4e40-ab32-612d1d0e3450", "comment": "Malware payload (Mirai)", "value": "fc891dad8079b1b1c8c51bd019ff66d1ee12f094", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182139, "uuid": "8a2ea5e8-f65a-4390-bc96-41a6bcaba287", "comment": "Malware payload (Mirai)", "value": "e85adcc95664a4c4c40419ba0c61ce3e5f0231aefc9fbc14fa6be9919aae36dd8de8a707f2fad6f07b623181945af676", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182139, "uuid": "8b7b6265-f325-4355-896b-f01035363407", "value": "T17493B75E6E319FBDF66D833047B38A21A75D23D626E1D685E2ACD2001F7024D681FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182139, "uuid": "02d2f4ce-f1b3-4406-8068-3f3cd6426feb", "value": "1536:73zZmbgU6KCCTrrLL32VsLF8cmUCPeOM490KhI2R/UPm:73dTpsLtmUCV05m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182139, "uuid": "72810ac9-83ed-443d-b5f5-ae1b187358f2", "value": 89944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182139, "uuid": "530b00b2-ef22-4cfd-8ae2-62fef78b2610", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182139, "uuid": "0223182e-d723-4396-bb6a-c692502d0674", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5bc9a1-53d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779232202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232202, "uuid": "7173bea4-be79-4433-9f42-f429df22ad4b", "comment": "Malware payload", "value": "b554a3738bfa1093aacac75bbe1fceef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232202, "uuid": "7cfc5ba4-41d9-47dd-bb18-ecbfc3eea9ee", "comment": "Malware payload", "value": "eec4d40ff10e228f61464c822de9e4e12fe37f4e1c3b83fe3323c58e51c87546", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232202, "uuid": "8a1f49bd-cd85-47e6-a311-0cbfb66f9767", "comment": "Malware payload", "value": "91847c322a4e27706ba30e7f300053b91d59ae59", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232202, "uuid": "d619d924-4650-422d-93e0-4b2b8e371e97", "comment": "Malware payload", "value": "4f258cfe76c2b116d40e3cd7cddd621729897afa04919e65383f4e11b4361ae21ced90ef1b1796515d4da442737c632c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232202, "uuid": "a8dcc8bc-656c-4a13-972a-915effde0715", "value": "T131B25D0FB8154329D4D100B092719F7BC9B9A9B73788A8DBF38044CD5A686D6FC36A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232202, "uuid": "e63872de-804a-4e5b-99a9-206e7f7aa72b", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232202, "uuid": "3ca528ed-825e-43e1-b992-c26ac6dc221a", "value": "384:ikthb/HJnv+UL7exaxdlLHMwXud2YLNL97cpHB9z:ikt1pewdJMw+dxc1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779232202, "uuid": "09574858-18dd-4d29-be4a-6f12cd3361b1", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779232202, "uuid": "c85a29d4-6432-4d96-8554-d05e06158b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232202, "uuid": "20b74edb-d490-465c-81af-396a95f124e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0e16a9-534b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779172095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172095, "uuid": "96ab4ca5-1cf1-46b1-82b0-12a8525040ca", "comment": "Malware payload", "value": "4d846cff4796736a1ed7d39e5c499987", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172095, "uuid": "7d0bd2e1-0ce1-4c70-b7e0-de144694bd47", "comment": "Malware payload", "value": "ef5372ff306946fbe8176462f4c32a877ad1bef812dbdf724429633e2c834d3b", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172095, "uuid": "373f6a01-81ad-4678-96e7-00a0f762a756", "comment": "Malware payload", "value": "41d6dd33707365d999e0d466fe3a3c91219736f9", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172095, "uuid": "cfa9128f-1619-4082-9813-7ea72768cb48", "comment": "Malware payload", "value": "f0a2ad35c12ab6025f2274acda8b04aa4e429cebcbaf096ca913a1aa7c51ada848895f176457443b284e6b51e7dc60df", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172095, "uuid": "ce45f558-7015-45de-a078-b7dc03af095b", "value": "T1D514E0B6694B06B6E4A121332F2E825692CD4BC38934B23159CC78D2CF6753FC63ED61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172095, "uuid": "3f69f98e-d05d-4881-a9ea-64a61e9ca3b3", "value": "3072:lXtyOxCq8tfN5lNXlEMDoJDPDB98UK/dpowSqY3psPoLxzTaeDf/tzMJwn/bWoVz:lXtHxktl5lNXlEMsBkUK1pownvPo1zrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172095, "uuid": "f1a25986-358f-49d9-a538-8700ae5f9736", "value": 191560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172095, "uuid": "21456a32-858a-4d30-9d20-174e3c9c3f11", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172095, "uuid": "3e20cdaf-dbc6-4936-bad9-114f2c996005", "value": "Decatech_3162189XPRHO64.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cb21db-53aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779212815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212815, "uuid": "6191e46c-aeb9-4826-8ca0-1189efaf13ab", "comment": "Malware payload", "value": "81223fb68efdd00a9d0abaaf5c098842", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212815, "uuid": "b757efe8-71bc-468b-ba35-157174f7fe3e", "comment": "Malware payload", "value": "ef79a62c937cebec4b4883d40362518446a44c1c985878469a24cec2761cbca7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212815, "uuid": "cb1eebb7-aa0e-4946-8fec-7dda4f37effd", "comment": "Malware payload", "value": "5fcf3ffbecc19febfacc04badcd7d4bfad206149", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212815, "uuid": "0097fb15-b0ed-4786-8554-687a69b74af9", "comment": "Malware payload", "value": "1e49dd0d669311a08c8d8c8ddd8dbddce8c2d7eb90882f72a722bfd39339d22b827fe666d79f4fcc83910a5328ba832c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212815, "uuid": "16600870-9622-4acc-a35c-416a732046d7", "value": "T14696F65B93D403EA01B2B106E84D3A69F712C4BC6B3693652D58793D33B6638873E5F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212815, "uuid": "f31e26f9-e129-4fb5-a9ae-d6eabb4a7d1a", "value": "49152:1Cgm7ly469/+5H98WSC7ffSNOOiHMSW2UGtnOmdbllDpPcPraXdQ6q:1R+9Fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212815, "uuid": "c38a655a-ad0e-49a1-8c94-447f3bc7981c", "value": 9299945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212815, "uuid": "35a5dd87-ebae-4b31-a953-5b687a056eef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212815, "uuid": "5ad10619-9195-4a5b-bed5-29a11a2123df", "value": "nouveau_curriculum_vitae.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d61b285-5351-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1779174354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174354, "uuid": "3f5f56b1-37e4-48bf-925b-6d6e26b6922f", "comment": "Malware payload (Stealc)", "value": "f87fd8891c767f0695e85728f238d33b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174354, "uuid": "4ba4f464-a080-48f8-9f07-c3a9e81267ea", "comment": "Malware payload (Stealc)", "value": "efe7eb517cc449cc7721c5c0acfb8cf454f28fdf2f37c08854aad4deefd7edc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174354, "uuid": "1d5804eb-d4f4-4b13-bc49-1d06816c5e4c", "comment": "Malware payload (Stealc)", "value": "84ca77ca0b27789b8236978ef3fb8cf774597555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174354, "uuid": "58091c4e-0077-43e2-8987-d5ee11046190", "comment": "Malware payload (Stealc)", "value": "062de94db4e56d38c81ca65d7dd1e7d5d6a6e7a0c266d9cd1ba5bf9a165b701f0417158b1d1eeda7eeaeb3ad46d7598f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174354, "uuid": "04af471d-2f76-41f6-810f-86512d8d51ed", "value": "T195F48D1EF7A612F8D0B7C274CA428952E77278465370978F03E15AAA5F372905F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174354, "uuid": "a0264d64-b092-4e16-a07c-ac62e8303608", "value": "c5a49d74dbeba2b4cb56b327e236efe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174354, "uuid": "e123f72f-e3ed-4b9d-955e-1dc8da0dfecc", "value": "12288:TrHqQr5XgvVozsROaYzPIP17vMKrrhYyxBlDetAqxSv:nPgvVqsI0d70eVYyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779174354, "uuid": "ebbf72e7-437b-4ab9-831a-b146e5de7c16", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779174354, "uuid": "7a8826e2-b718-45b9-949a-9113f24cf4ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174354, "uuid": "d4d06d47-c58a-4708-8aac-53c0752b87f8", "value": "XTCQAFOA.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b90d03-53b8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779218927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218927, "uuid": "31d177be-0d31-45bb-bdd8-0a96864ec8a2", "comment": "Malware payload (ConnectWise)", "value": "bd7f72607fd8fcafa2dbe528f4a67214", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218927, "uuid": "da110d84-d6c8-42a9-829b-a032d0ae31a9", "comment": "Malware payload (ConnectWise)", "value": "f0578bb4e6affc38ffb6a6f79aae9a2a500870d6ebc48f78ee89ba6e31d57e35", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218927, "uuid": "9d3283e4-2c10-4081-b4e8-0c8a9119d8c8", "comment": "Malware payload (ConnectWise)", "value": "4c98b104d9ca6f00ef2b5448eb51f10ad09388f0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779218927, "uuid": "c4f58a22-015f-4b77-a4af-e2f483f51662", "comment": "Malware payload (ConnectWise)", "value": "3eef36272b680af910e2905b801c165cf3b80f4f044355a913b70617b53847e4f8d95f632f42a2a44a5bd96cb3284ca3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218927, "uuid": "61769926-a31d-4992-88a8-98817b4cfbc3", "value": "T13B46E003B3D599B7C07B8778ED7A46656734BC048311EAEB5394B9292F32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218927, "uuid": "6392667c-357f-45a9-82ea-7fd0ebcd560f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218927, "uuid": "f72a4069-baba-4d80-aaa3-abe898d2795f", "value": "98304:7zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:7hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779218927, "uuid": "41114db9-4129-4835-8484-331e7a87db9c", "value": 5687216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779218927, "uuid": "6ee8ec9b-1774-4a15-8118-85c6f1f3ba11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779218927, "uuid": "41bdfd95-176c-4137-b911-fdd38880a337", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b9cd26-5316-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779149160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149160, "uuid": "053d038f-433e-48d1-94fd-501209e36ab8", "comment": "Malware payload (Mirai)", "value": "11fc1501edf2bafdabc02a2094efb593", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149160, "uuid": "d242cadb-122c-4669-970f-1019fc283ecf", "comment": "Malware payload (Mirai)", "value": "f2d8c6e989ad805302ca207f8237c58dd6febfd3d64dd6eeb0d21c8b2e8015d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149160, "uuid": "1cd96085-2c7b-4605-a6f8-1af8f9f562b2", "comment": "Malware payload (Mirai)", "value": "13aa135a4a6f4e1f56bb93a5bde922937fa458cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779149160, "uuid": "cdd7049c-fd78-4657-b67a-d655e68fb57a", "comment": "Malware payload (Mirai)", "value": "56204300f320af0db3634da6bbb60ff10ca842b1e6e38b9a855ac4f3f27cbd2981c279961e90b5c7082095291ce1f658", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149160, "uuid": "9cd037b3-9813-4179-b0b7-604a7fab0a19", "value": "T11E243B93B905DEBBF40EA77604D307317231FB6649531632B31BB9B5AA3A3C4242AF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149160, "uuid": "269cc860-6ac8-461e-9231-bb5d752e8a3d", "value": "6144:Q25/0GqF4TyhnUIPIhrXcxILoCmZEcEfY4KH+Ehh6a1A2nONsl1:Qq/xrm/ZWY4KH+Ehh6a1A2nONsl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779149160, "uuid": "6551277b-f67c-485f-8310-d40e9caf105e", "value": 227680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779149160, "uuid": "c251a70d-3b3f-4705-a9df-066401caece3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779149160, "uuid": "5eb90b64-67ca-4f05-bc66-70fd4e945eaa", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d867cb-53c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779223847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223847, "uuid": "fded4286-8fb0-42ae-83db-c69b05844c14", "comment": "Malware payload", "value": "441d5051066da2668c2f50407197fd1c", "object_relation": "md5", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223847, "uuid": "695b878a-5d87-4934-afc7-fe7a1413e00e", "comment": "Malware payload", "value": "f3378f8d4822c3f8b676c71512008efce737cdf845497856bb7a7445b1e2f5cd", "object_relation": "sha256", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223847, "uuid": "097743b0-c70c-4e76-999d-29625aac6bb8", "comment": "Malware payload", "value": "33eb4c4771853defce1ae5f7d2f874d6c5b0309b", "object_relation": "sha1", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779223847, "uuid": "498df82d-7e70-40f7-8aa6-b873f5f6e9c1", "comment": "Malware payload", "value": "e71a98f0fb8fffe06f5f7e38b6a26beb86741e2d8150712c7e927091f11e61d50201119ef7988fc09281be74d8f1776b", "object_relation": "sha3-384", "Tag": [ { "name": "38-180-78-240", "colour": "#701B6C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779223847, "uuid": "34d1fa16-005e-46b3-8407-b90b8d6365b0", "value": "T16AC28340B7E80658F1FB9F35EDFA140348B6BE16B926C60E0859559E0D72B88DC36F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779223847, "uuid": "e4004987-0d4d-4af9-b81b-4987964b8c6d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779223847, "uuid": "7cb604e3-f916-44a1-b96f-453dd0a6d9c6", "value": "384:1ID2z25m2WKfJeL9cmTccMTnG7tOgOaJCObT8cAm4z9FpxhD9FYgCEx3kpT2:1Y2z25JWK+9pTccMKR9rJCFZYgCx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779223847, "uuid": "642d4341-18b8-45ac-8aae-1618c3c6694a", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779223847, "uuid": "84fd9de0-c5d5-44ca-b62e-685539bfe83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779223847, "uuid": "319706fb-dd8b-446d-92b9-f75ade12da01", "value": "f3378f8d4822c3f8b676c71512008efce737cdf845497856bb7a7445b1e2f5cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433bab59-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "2859da9e-d78e-4c36-8acf-dc91c60654ab", "comment": "Malware payload (Mirai)", "value": "08fc05bcd82992bf478a0dd074e819da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "050e6cef-91fc-4fb3-94cf-bf221d10aac9", "comment": "Malware payload (Mirai)", "value": "f47e314988c14a89a47032eb8ab5c0bdaad1fa81d331a785f15848c05eadd777", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "b90ef651-15ba-4138-9169-23218e134136", "comment": "Malware payload (Mirai)", "value": "b16ea1a4d503e79fbe9f6d3f069e9ea6a2b212b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220347, "uuid": "e66c6944-89ce-49fb-bb13-eb88b8c36f84", "comment": "Malware payload (Mirai)", "value": "9350a77d991a71a2c6ffed890716edfa7637d989bfb24997962841675b9336f7671aa825c1b3c5763aa1cfc141203a2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220347, "uuid": "bbf6a60b-362f-4456-908e-8b2c6133c6ee", "value": "T142631A8A9962AFB7C106F4F069F95D79075A7C561A2F09D86439DAE0034F4CBB04F3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220347, "uuid": "822f7b6f-7418-420c-b1a6-3b9ccfeb613a", "value": "1536:6amhVsHhuxOZRgrYAXVloKChJ1xnRpCmZp3Yql:6amhOMXbCnRp6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220347, "uuid": "723e495d-745f-4072-8fd9-84e3b244cc20", "value": 69916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220347, "uuid": "91d9c78c-c9d4-40e2-813b-51faad83b6ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220347, "uuid": "c4100d50-c1af-4c9e-8bb0-4b18bdf91671", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dafec63-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779219559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219559, "uuid": "8c4d2643-c628-4c97-bed6-e558c316db7f", "comment": "Malware payload (Mirai)", "value": "67eb051d36a60a4cc61a6f89234386bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219559, "uuid": "1f853a5c-f5e6-403a-b1da-f3f915e936bd", "comment": "Malware payload (Mirai)", "value": "f4885352562a914842c07a4e52a35acfa974d4c11d465b048276d847cbcfa27f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219559, "uuid": "60ae9d0e-42d2-462b-8e72-b58f86907eb5", "comment": "Malware payload (Mirai)", "value": "0f3f303cdf54dc99db4ea088740dbe7eb8da3f97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219559, "uuid": "3dba7c7d-95fd-4b0b-83a6-27d0a99e2d49", "comment": "Malware payload (Mirai)", "value": "3434d839ef6b1c3aed9abf543eb97803c118a3cfebbb93d5ed57490d4e40b614636bf0961d84775576b85c55e5e69c23", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219559, "uuid": "b5a1c449-a126-4e33-addc-287d34998ec9", "value": "T13F03E156A4A1706EC51F1C3F638E12BE0990F1D6711A3B3A6334CCC8AB3795BA48DCA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219559, "uuid": "03d4f68e-b1ad-45de-a6f5-5cafe0eb0539", "value": "768:tF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0f0LpPpfWI:zl5JnsrXvrKy9QjyBZLvDmR0f0NPp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219559, "uuid": "842a04ec-b826-424f-a602-655df51e21c7", "value": 38640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219559, "uuid": "f0d96205-0880-44b9-9900-cb53820bdf8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219559, "uuid": "310d62f1-161b-48b1-a8ef-4a74fb001c1e", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8804fe33-53be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779221321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221321, "uuid": "5c56e3fb-cf7f-4a0e-920b-50beb0c77ea1", "comment": "Malware payload", "value": "d28e48a1d7567b9954c06efddf4043e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221321, "uuid": "bbc6190e-bb77-4d5a-9dc6-19081b1b8eaf", "comment": "Malware payload", "value": "f5641f0181ca8a49b34a35edb438a62d49a82da24aaa0bf64d96706d4f7f1257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221321, "uuid": "351af293-7616-468c-b0ff-37c4628cb59d", "comment": "Malware payload", "value": "da245f8607f5b136de2c2915c93dca0c3598793e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221321, "uuid": "0080f870-d7ff-406d-a4a4-f29317cbd9bf", "comment": "Malware payload", "value": "dd1ac5d05e9cb32658440bd91e3c242738d84167378e6cb888b7c80e5617799d9619dcddffbf63669d05d1791ef2e76d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221321, "uuid": "e34ac662-8617-44ab-95ec-e47417b6d904", "value": "T107D31945F8509F17C6D512BBFB5E428D372A57A8D2EE72039C255F20378B96B0E3B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221321, "uuid": "7dcdbc23-c0bc-4428-b5a1-d96b291016b3", "value": "1536:5gcloROIsenf7HDQpHyd5YRdB27gFLk4w4VE65714vNexztdtbY0tMlgawywGQzp:5gcAVKyUdBdFwH4T5uvuR1f08ElO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779221321, "uuid": "1b0408c2-b663-4c3e-bed4-6d57916504ee", "value": 133484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779221321, "uuid": "7fd589f1-2148-44d6-a341-22d7d92bc7da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221321, "uuid": "6161d0bb-80c2-47a1-8c49-b389f0f0a97f", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff5337e-53d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779232233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232233, "uuid": "982b38bb-c978-46c5-a688-db0974c22cd9", "comment": "Malware payload", "value": "e5a4f081814141157f100fc95162ef00", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232233, "uuid": "9775e265-52b7-4eb0-9acf-69a250608bb0", "comment": "Malware payload", "value": "f5a0bdd90c40986a317a98d7278c127fb9991021a0f93cf31e07c62d19f9e48e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232233, "uuid": "1833e682-4a9c-4ac4-8448-f4a656c88400", "comment": "Malware payload", "value": "8c328c07f9918c2789da5f5e68222229d8e946e2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779232233, "uuid": "4e3d496b-64f4-45ba-b38c-d2da6302f976", "comment": "Malware payload", "value": "2e714f4686b710e8f1de0d398945190cbe66d1e309676a56b9fea09e7bf8965c87c7eba282959d4419db41e4c70ea65d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232233, "uuid": "87bcdef7-e384-47fd-90cc-489adc861798", "value": "T1F0B25D0FB8154329D4E100B092729F7BC9B9A9B63788A8DBF38044CD5A646D6FC3695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232233, "uuid": "5c8d14e9-98d8-40cc-aa83-421cd855964c", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232233, "uuid": "402c318a-7b28-4472-8ad7-e330d91847ac", "value": "384:itthb/HJnv+IP7rGNutdlLHMwXud2YLLLf7cpHB9z:itt15y0dJMw+d5c1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779232233, "uuid": "fa992692-b5b9-4776-9954-317ef35da84f", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779232233, "uuid": "220919a8-fc50-4b38-9224-75faa7e513e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779232233, "uuid": "dd9e631f-301c-4704-8ac7-08e815dd63c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ff9f59-53aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779212802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212802, "uuid": "cf616e1a-b218-49e1-b511-d2023dcb82a9", "comment": "Malware payload (Formbook)", "value": "4c2b0e1bf0402feac37329867330a374", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212802, "uuid": "330ccf1b-1053-4bf4-915f-212d6c47a3c6", "comment": "Malware payload (Formbook)", "value": "f61680c5c6a002afd35dda833be1cb419c0aa284082d9dbfa95d3d704186d074", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212802, "uuid": "44852434-4a25-43fb-9b9b-6d02d7bdce0c", "comment": "Malware payload (Formbook)", "value": "14aa9035ee192247595568e7d8f9b9be504a3d4d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212802, "uuid": "de8b5c08-7bce-4961-b025-b9c39b7466a8", "comment": "Malware payload (Formbook)", "value": "e2ab3cc1bfb5d8317e04fca9906ed7913f2b6201c38e37b9886550035af58b4d0bbeaebf7b348adf387925dd87326dd5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212802, "uuid": "bec4510c-5875-4171-98d7-1e5fe487ca50", "value": "T18605074226EA4008F2F39B05ADFB50B1487BBF672A39C61D10CC668D07B3D559D9EB27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212802, "uuid": "eafcfc30-6920-4661-8a47-123e1b320894", "value": "3072:5+wMFSUqzs+YIkAV9AtoqfDuPLrQwb8cHCjToqPCIgX:t8fDCrQdzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212802, "uuid": "5ee0776b-1939-43b8-9f34-f2de7f284f2b", "value": 819098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212802, "uuid": "044999e6-ba8e-469e-b793-c9c478afe033", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212802, "uuid": "42531b67-ca79-488d-9dbf-0df60ff8cc43", "value": "PO-34748.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9f43ad-5365-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779183182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183182, "uuid": "611d5742-3e4f-426b-bd9e-ccd558af6f32", "comment": "Malware payload (AgentTesla)", "value": "84442168d1f31869c5c2bbdae69b8a21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183182, "uuid": "2b72e6a0-a044-4d52-8c32-b15ad044512a", "comment": "Malware payload (AgentTesla)", "value": "f68e160f1af6992aa57eaca163e2fbb534369b862ddec67083cbdcacdc1466fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183182, "uuid": "ca7cdb38-8e55-4400-aa65-5f9bcbba991b", "comment": "Malware payload (AgentTesla)", "value": "9d5c4f46f2b8e68d2e2067c0ad9f70750f028943", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779183182, "uuid": "ec273221-bdb2-4843-bda9-a5dc4078df90", "comment": "Malware payload (AgentTesla)", "value": "9ceab983b33d052f9ede763b1762e1824b0e00481147295330f5c2b90a713b89b47522b67416cba8da554a6952daacf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183182, "uuid": "d30cfba8-89df-44f9-adf3-68c598d1a68b", "value": "T13CB401543F7DCE03D2858CB45EB1E9ABD6384D824D6E4B039BB17E0DA8797C8BE48641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183182, "uuid": "f807972d-b719-4a0c-876b-9568169150f6", "value": "6144:UpkXGh6aeKHGX2RK49s2wWzZKKcLJnqqKkE/1vLgY5AE5lDcxlrq6uaP4o/OITs8:xBGLTSNqqK5h5Z6u2m09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779183182, "uuid": "ad4826fa-edd4-4878-b31a-c0a8a61bfbb8", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779183182, "uuid": "19c51569-a4c7-48a5-859a-0c60f0b2a4c1", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779183182, "uuid": "8ca2d911-befc-4b1c-a2c8-ef1c0904edf6", "value": "10045_2026-05-19.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5beadc4e-537e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779193759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193759, "uuid": "7a6b40a2-27f4-46d5-a68b-77a182011b55", "comment": "Malware payload", "value": "e76d402591c0c60abda8214b9004840e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193759, "uuid": "9de996c8-4382-41ce-b827-498ac1336ed2", "comment": "Malware payload", "value": "f7441eb345c664427781f475ae0d3b306a5a0475fbd8df3c01b3adc8584a4efb", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193759, "uuid": "492fc52d-bd39-481b-adde-ac09b8bc249a", "comment": "Malware payload", "value": "7d2355bfcafe06b662af78bda91b0093d7a8f497", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779193759, "uuid": "3f4ccfbc-aad4-4c22-b718-85b247cec4e6", "comment": "Malware payload", "value": "b1b2185c1308630e941e8240cc7d167204c9f01b5caff5ef68d798b3de7553318a8ba4b325a4f9fc3ad6a3b2c001dc5f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193759, "uuid": "57bcfb9f-1b60-4a51-aacf-e12e5b8df462", "value": "T1CAF322A34EE71736843AED0260901C741B6783F88D3F5C7F5204CAA9C60866D1BDEEB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193759, "uuid": "d2a5fd60-7a63-4f1a-934c-ac2112177f4a", "value": "3072:8AyRS4rscBhqZPwzSkWdZ0VNvQ6gxu081ec/q1iZgTXpO1AFmnvsaosJ:8AyRS4DhqZPwmH70VdQ6gZl8q1i4iACN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779193759, "uuid": "1adc2246-1353-4b6d-b6b6-48aa37501ba9", "value": 161035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779193759, "uuid": "9c91efa3-715e-42f3-b60e-abd7fd22ccaf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779193759, "uuid": "949e4019-1014-4632-b024-c4df84576e98", "value": "Purchase_Order_PO2603-00127_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b491e68-5329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779157251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157251, "uuid": "d6811280-a6d7-46fa-a74b-0e4bfd134836", "comment": "Malware payload (Mirai)", "value": "5e99ca90e3472d62200a81b6714c93af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157251, "uuid": "f286b868-7dfb-4c6e-8283-dfc46a6022dc", "comment": "Malware payload (Mirai)", "value": "f869e1756e74e7d8f86424ddc1bb1bc2af4deec739376c43149963dcd620437d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157251, "uuid": "746f735b-5567-4496-962a-29a601b2f4b9", "comment": "Malware payload (Mirai)", "value": "8b6516f38237b90e3fd53a544ce961f89e061416", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779157251, "uuid": "bdffd9c9-db5c-4f6c-9803-9e3e3a05365e", "comment": "Malware payload (Mirai)", "value": "0c9bd7b82f61ac8b69591427bb3d367006e1133954da08331aa82cde89563c8ff622a831042a4ffe28258082c11dd104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157251, "uuid": "eb1f571e-e822-4c42-bade-876388b09297", "value": "T1DFF2F892B8929D26C6E4237AFAAE018D336163E8D1EF3217DD251F047BCA51F0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157251, "uuid": "c547c04a-70cf-4fc0-9bfb-873d79ef6d52", "value": "768:awPX3fF7ugIpYqaHPkL7uKMlnhEXC8waU0eCSCcdTD44o/N/NPN:aafFygzFPTT8w4UD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779157251, "uuid": "36b6ec0b-fc0f-48a2-973f-a1e39d721487", "value": 37152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779157251, "uuid": "6cae249d-29d3-4ba3-86bf-6e47835d6f09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779157251, "uuid": "2499a610-f167-4342-b117-6d9b278149db", "value": "upperarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45a20b6-534d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779172970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172970, "uuid": "4375573a-4f7c-46ee-a49e-24d460d3546c", "comment": "Malware payload", "value": "9909cd12049db5cc68b51fa66a6b4464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172970, "uuid": "dba92d55-c222-4b49-813b-dd1bf4dca24a", "comment": "Malware payload", "value": "f91b9940cafb2e655588b0f7997b5815a05e0bd517c5912f2e4351579ba74d2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172970, "uuid": "b447fa82-7144-4ca9-a436-b340b10f98a6", "comment": "Malware payload", "value": "efef4ea308864f73798a87703e57faafbbf89c99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172970, "uuid": "c917918a-198e-4eb5-b625-0aaa6dd9ed92", "comment": "Malware payload", "value": "aafd289691650b960b3d5f42905c474c03447b5ae17bf8b4709b7c3f7425612b1568c9dbbe65551b3bbb6828dac6f336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172970, "uuid": "5f516fc5-efc6-4f27-a842-7a11336e90ba", "value": "T1F9B60205A8D991F6E1D3D230CA97C99BB496721677E24F9A31CD8E011931CBDC60FFA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172970, "uuid": "c84a32dd-97dc-4d7a-a7dd-34413c6ce208", "value": "f28e448d052f660b80fb54c44c21f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172970, "uuid": "5a51586c-eed3-4385-8a01-a2516795e390", "value": "196608:tW1OFwzllC991N1CPwDv3uFfJODGdAr2/A3vCKzTOWpyVa2NJ+OPvpJiFXEXJo6N:tW1OFwzllC9jN1CPwDv3uFh9doK+CWcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172970, "uuid": "d766654e-43b0-4423-b0fe-526c008f593f", "value": 10596952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172970, "uuid": "3cd2b771-87f1-4cc8-ac2f-e690bbb13981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172970, "uuid": "463b5022-bdbc-44c7-ac8d-a4eb76c62b4f", "value": "f91b9940cafb2e655588b0f7997b5815a05e0bd517c5912f2e4351579ba74d2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59130200-5363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779182158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182158, "uuid": "ce26f178-efa7-4e6f-8e91-a164e261863c", "comment": "Malware payload (Mirai)", "value": "3dfde9b32cb6854f22801d3362cd27fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182158, "uuid": "ed2b1b35-6ce9-47b1-bb85-6e03d38d04f3", "comment": "Malware payload (Mirai)", "value": "fa6dd67a0703a23f2c74a2dd5c9df52f1baf5d9e3856142da695c62254536cce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182158, "uuid": "ae82bf6e-21d8-489a-8014-e76c5e34aa2c", "comment": "Malware payload (Mirai)", "value": "9e518a5004c63d4fc84b050abdb2c88867365dc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182158, "uuid": "119f2993-81d8-4c75-9578-3d2a09e3b459", "comment": "Malware payload (Mirai)", "value": "71210261458306bdd04d1ab36d35d020d62bf79f2c7c6eb08457462293f8d23c9eb77c128dfd35cf88193ebd4fe2077f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182158, "uuid": "999d65fd-1e98-47f3-904f-3833d8a7cabe", "value": "T1DA730A56BA528F12C4C311B9FBAE414D77137FB8D3EE32129D20AFA067864E70E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182158, "uuid": "8bdd7dae-6e23-4698-93d7-04b451177cbd", "value": "1536:cGntHiKBLYiUnujoAAikbIGmGTa9+33QEMJipul3G57nP5GYHhIxR/wQQ+d:Qrik8GmGTa90ul3G5zPkxQ+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182158, "uuid": "1aff9491-871e-4363-9d73-c7618c7f56f7", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182158, "uuid": "9aa52b1b-4207-4b82-8315-90fcdcbe8dfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182158, "uuid": "5ae92ad9-14bc-4d10-b56c-c843c8fff258", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e05a13d-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220284, "uuid": "dfb3c22e-0d95-471a-86c9-b5ceb3390026", "comment": "Malware payload (Mirai)", "value": "548f9ceba914f51ac142b91d335bbf29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220284, "uuid": "6059d38c-e20c-417f-9130-ef375e80179b", "comment": "Malware payload (Mirai)", "value": "fa8c9a682ba6c612c498e8501c873b1e2bd1e2c02b456cc60bdcb7c9cec691e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220284, "uuid": "77c4f530-3206-4f37-9503-619d1d65e780", "comment": "Malware payload (Mirai)", "value": "799cea58f403035b584412e2b704a7eae6c8251a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220284, "uuid": "33294093-ccc7-41b4-bbeb-87214ad9e740", "comment": "Malware payload (Mirai)", "value": "9713161885dde61fbcdec3aa2cbea5ef718bc4666128875a2b876c14f4cc56aa86a04a18e75902262d312b2e5c928bf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220284, "uuid": "22930472-8997-4282-a816-e37a89e652cc", "value": "T17C44E91A3E228F7EF26D877047F38A31976976D617E2D640E26CD6101F2438D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220284, "uuid": "cd9253c3-cf85-405c-b1ca-1b416ee55fa7", "value": "6144:+p9wcuD8CKlHMRfz5U+xuXimnMaQJw1hWF5NqohWUkzn7MwA0:+LwcsXKWRfzA17QJw1hWF5NqohWUkznd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220284, "uuid": "611c39ec-de39-4258-86d6-1771d56b2707", "value": 257319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220284, "uuid": "9b10babd-ef54-4048-882b-e61560cc2805", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220284, "uuid": "c82bc3d0-c075-431b-b8d8-78062d5e11e6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bbaef2-534d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779172975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172975, "uuid": "15d1c7e1-876e-4315-b7c7-26915b22eeb1", "comment": "Malware payload", "value": "ee445cdf7afd28322b1373ff3df9c2d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172975, "uuid": "8a13dba9-188a-4e56-ad29-c8bd3a98ab22", "comment": "Malware payload", "value": "fbc23a51c37f58eddef8c5b14fd5eff834ec91a30769e26f03298f3f1386c7a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172975, "uuid": "d68eee37-909b-4c81-a475-aaf4894be49a", "comment": "Malware payload", "value": "e6fa8cbc0fe2b955f8e984ff1f8409edc8eda44f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779172975, "uuid": "eab9822e-696b-444d-84ca-df171b456f26", "comment": "Malware payload", "value": "c4a8b784aee99e7b2c2cf89c15d0b392f2f1e54e2eb9230f1cf1c21b39a7b31c77e9f2a4bfaf83e6dadf8724e5430895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Quesangweng-Technology-Co-Ltd", "colour": "#993D37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172975, "uuid": "a2e8f7f4-dd05-436a-a193-efd652282dac", "value": "T1A2B60205D4D941F6E5D3D170DACB88ABB086722A2AE64F5B26CE4E011931DBDC60FF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172975, "uuid": "7d89b091-0a44-4163-8474-fd806ad442b1", "value": "f28e448d052f660b80fb54c44c21f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172975, "uuid": "0b13d4ef-882d-4d83-b4ba-a17936e6ecf3", "value": "196608:wW1OFwzllC991S1CPwDv3uFfJ1c14Ys9MsyhTufL3XnuDHn9gW46grIQaqSduF04:wW1OFwzllC9jS1CPwDv3uFh1kxsmsCTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779172975, "uuid": "992afcb3-e51a-43eb-87c6-34939c87e806", "value": 10643520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779172975, "uuid": "deee987c-c022-4cc2-b999-d86844ecba5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779172975, "uuid": "d9d6e4c3-a826-4f90-817b-a2d420b8e25b", "value": "fbc23a51c37f58eddef8c5b14fd5eff834ec91a30769e26f03298f3f1386c7a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60939ed4-5390-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779201498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201498, "uuid": "8ff4e9b0-9f1e-4025-9ac0-ee8b2964ccc3", "comment": "Malware payload", "value": "919325f41078198374d0c7fcbb88d64c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201498, "uuid": "ad3769f3-0b47-4e36-b9f0-ab8bab71862a", "comment": "Malware payload", "value": "fbcef10dbd43ec1faaf0607f7548bc628544edc7803d71209f5419b8e076e4c6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201498, "uuid": "878b426d-dfd8-48ea-932b-b63baa445dd6", "comment": "Malware payload", "value": "647efea7f94074c470c0f4b9f210ea7c246d8fa7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779201498, "uuid": "ab7e093b-02c3-4fcb-b34f-cd78d546cf50", "comment": "Malware payload", "value": "7af523ee0129785085f64d64d06c877940dfadf59ca0927e0762a7aca409610e723704d322689f214a40dd7eac2db8af", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201498, "uuid": "415d7655-f53a-46ee-8021-14825a5a3afa", "value": "T1AF137D6956857C24AE99883B1C7E2F0CB9A983E1310851DDBFCB3CF58C49ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201498, "uuid": "57d5f2bd-f5e6-4bca-bddc-e650552e7f2f", "value": "768:q+d9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:q++co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779201498, "uuid": "dc9ddb37-e753-4c43-9e17-7c08dd8ed5d1", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779201498, "uuid": "cbb0be6a-d8be-4056-ae84-9aef4780c11c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779201498, "uuid": "e5daace3-bc84-4892-af04-08676b6fd418", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1090c60a-5368-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779184184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184184, "uuid": "89ddc7c7-e8e1-42fb-b6c9-30f264aaa250", "comment": "Malware payload", "value": "bf7c6bae6f07c6eae1d8d40a5325f356", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184184, "uuid": "79dacd77-41f9-4c80-97f4-cea6b3ae85f8", "comment": "Malware payload", "value": "fcce8576ecd6c65dc06b657403b54747b06e5a203ca3c0f1a88b813fd4f21894", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184184, "uuid": "0dbaf454-8805-4f3e-9b27-da4c1b73c9be", "comment": "Malware payload", "value": "8d9716612a05e01023bb084784a74b12e6244ba6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779184184, "uuid": "4b6799ed-d074-4206-a310-348c92602828", "comment": "Malware payload", "value": "bb9dd3119015b96b894e368dfaa470a29a753a25fa40319bae8805660f19a17b974e9a7fb1c1429ea0e5c86967519646", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNOLOGY-APPRAISALS-LIMITED", "colour": "#D2CA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184184, "uuid": "83cdfb4f-c131-4710-9d3c-64f44e8fa594", "value": "T13718334520B68E37F75EB33248394A587762AE24061042F7AC637F192BB75A57FB430E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184184, "uuid": "3acdf6aa-228d-403e-b834-00422ba79e93", "value": "1572864:xlj4gkE54oASNJm7yPPDYTM5e/0mRq5PAfkeUmvJ4ruPWoiSwy:jjXN2WJn8TM5J95P+CmvJTu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779184184, "uuid": "450a7727-8b6d-42c9-8570-9fbb444e8062", "value": 89915392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779184184, "uuid": "2ef3e507-e686-42bf-93ce-4c480a0b726f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779184184, "uuid": "e341de38-88ef-458b-8e17-324475e2feee", "value": "fcce8576ecd6c65dc06b657403b54747b06e5a203ca3c0f1a88b813fd4f21894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d290ea75-53be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779221446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221446, "uuid": "d7876959-cc5f-4ac3-bc38-e51bfa29deac", "comment": "Malware payload (Mirai)", "value": "02e140c32c596a35cc780ba22b70952d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221446, "uuid": "587647a5-4fd5-4b6e-88be-1cf728673af4", "comment": "Malware payload (Mirai)", "value": "fccfac75141967ecd10c2286054324e62b872b282ec1398c3134cd43afafc87a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221446, "uuid": "1689913f-2bd6-47a2-8d6a-4432961cb460", "comment": "Malware payload (Mirai)", "value": "019b45e792f412e8792854c1d2a38829faa65d95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779221446, "uuid": "f2402e2e-1020-4944-8208-dfff2a2798c9", "comment": "Malware payload (Mirai)", "value": "9ff76f54aaf3684e62f68fdf351311a9f4ff3a2d84f6662cd182111ebbe0c0c5606be364698ae6432f319cfc2592f074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221446, "uuid": "4df33583-3d01-4a56-9b5e-f45e832fe3ed", "value": "T17BD3391BB480C0FDC4D9C5B44BAEF13AD932B06D1238B25B27C8BF266E49E205F6D655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221446, "uuid": "15ddca71-78bc-406e-96dd-18bbe17b4feb", "value": "3072:hO7tLjvQReU2jOhCq9r5YXDKGJdN1OaKcCsR:hO7tLjvQRNhVUdN19X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779221446, "uuid": "b862c517-dfa3-4be1-a3b4-1014c8f0093e", "value": 138904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779221446, "uuid": "fafd17be-55e1-4213-b084-fc6029c162cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779221446, "uuid": "08159dd0-8240-4523-81c5-65d385a8cbb0", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683e37f8-53ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779219550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "3666c26b-7013-4494-a58f-2ab7dfd1da47", "comment": "Malware payload", "value": "ff57ed54a8dba7f660befc831dac8acf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "d9a87dd6-5723-4cfb-8340-12ea3477b5ee", "comment": "Malware payload", "value": "fd3900e420a0d9c9d26783b2f6aa023087e006b3eb8b44094849cbcdd3c84e49", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "5956961a-7879-4219-af52-bf37c9fdd725", "comment": "Malware payload", "value": "fd9fe43586854a75ef8ceda045447af8e7645a2c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779219550, "uuid": "b847da35-8944-495a-b176-3a81fd350f5a", "comment": "Malware payload", "value": "313c0f5f7a76f3d7a8e24a216ad4ea33a56afee35e66ff72113af78d046907fd23b54fc43be59ca5ecb912f4ace46f15", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219550, "uuid": "30621e35-f8aa-403e-8942-fd4fd0966bb2", "value": "T186140A01B9104B57C5C32BBAF7DF46993B336B1897EB3301AA28BEB42F4679D1D29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219550, "uuid": "8883703d-435e-4ce2-a22e-1c873191e8b0", "value": "3072:t6Pnp049wm19trxoPZnlHXVo6BdQdJl8m+ECssFZTkrakpZgiBS:t6Pp049/19tlSn1XVo6bm+ECssFZTkrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779219550, "uuid": "71748410-46ff-4e27-af64-181d62952ad4", "value": 191409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779219550, "uuid": "17138170-385f-4930-97e7-4bb9aebc9142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779219550, "uuid": "79a449cd-95db-428c-b54e-98613d9cb664", "value": "mynode.armv4_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99678ae9-53d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779229511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779229511, "uuid": "52c9ee6f-91f9-4f01-8c93-343e455b8cea", "comment": "Malware payload", "value": "522f8b998e53264b366ee733307169ca", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779229511, "uuid": "8b7bfa3f-8039-40a0-a270-acc013ef52c4", "comment": "Malware payload", "value": "fd45bcbe1f3e240aacec2b30fc4f1c6aae00c95b020e22584f185942b967c35b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779229511, "uuid": "0012bbcc-c9a5-4665-833a-c32fdbaec93f", "comment": "Malware payload", "value": "9f94668768b08413c8753fcd049f181b00310f26", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779229511, "uuid": "2d59ed7a-912e-4dcf-b0a0-21fc0df43b44", "comment": "Malware payload", "value": "865b12a0033f139eafaef36fa498d6f90d2ea60cf92f8cdf3cebe954275cb36a519871b58fb56f8aebeb069b2b5a9189", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779229511, "uuid": "99258c10-207e-425d-9802-849bdfe9985d", "value": "T1A5C40247BA898B62D65942B2C4F3942503F7F8D32A73D34A3B45139A1D817E4CE5ABCC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779229511, "uuid": "da168855-05c0-4787-897d-7699ff2841de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779229511, "uuid": "c8ea2095-ceae-4055-be26-3ab1ed6d0254", "value": "12288:4w2BB+U798N7cZ/KtK4GgAShoAVIbb4pjz0H7UcS6fOjpts:lDURVlSipbbuyotaO3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779229511, "uuid": "7ad0142a-d470-4b6a-b106-2717779e26e4", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779229511, "uuid": "7bc4f924-2170-48ec-b0c9-c6ca100d9a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779229511, "uuid": "befb5232-0a56-4d73-96f4-7007c71bb2fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf6548a-53a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779212042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212042, "uuid": "6d4bf73e-be7f-4335-9777-c7fd164b9594", "comment": "Malware payload", "value": "9e041819ca201bd4750fa61ec1f33e08", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212042, "uuid": "999f76d4-ee7b-4545-82e7-171882e2f744", "comment": "Malware payload", "value": "fdef36a4771015461fa01873a4c9fffee4afa5c6995156443cccc2dfdacd8ae2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212042, "uuid": "02750966-d8e8-4f8b-aa77-a60584b59579", "comment": "Malware payload", "value": "1704637ebca3eeb350c3b9d289769f134d56c265", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779212042, "uuid": "73cca546-8af5-4fa9-98b9-e46ad02a5e2a", "comment": "Malware payload", "value": "660314e04bf757aaed1f4a592ce0af145be3a77413d60a0eb17732a66c08a44526bb396486adce32b3c0675a998e825d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212042, "uuid": "91e3157c-407c-4577-a0e8-fd8fdff85966", "value": "T1A8E42326F4D49FAFD4171AB51725A184122CECAA420BEE0B1321F459FCFEBB607E15D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212042, "uuid": "7e4a67d9-9c59-468d-bd8b-6acc5dbf9f5d", "value": "12288:NTQ+YPrvypoY5bNIiMzcAfpOJQClyT/QLQvMpIwHjDEI5kesO:e+TpoY5bNghsi3jgHHEuQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779212042, "uuid": "1bdd4312-8604-4fc4-831d-f8a3bdd079c0", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779212042, "uuid": "2dc4e6b2-62b0-4403-966a-88298feadecc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779212042, "uuid": "bcbd74cb-86a9-4b3d-8f50-9211783d39e2", "value": "SecuriteInfo.com.X97M.DownLoader.2343.2736.7696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dec742f-5351-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779174408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174408, "uuid": "8129d230-2258-47c5-bc87-201ee528e81f", "comment": "Malware payload", "value": "d79d7465f8b6f6162fae24a985600fae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174408, "uuid": "350a0cd9-038a-49b7-9bcb-a5c7a4b3aa7a", "comment": "Malware payload", "value": "fe010fe2c5ad9b4c1b0e1cf3a0f6e5468ba94812d1d271c02fb9adfc7ed823f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174408, "uuid": "dfb42b92-ccb9-4fe8-bc46-5cca0c67ac75", "comment": "Malware payload", "value": "17f8a9cb59a1c5fa4f65386c448cdb910ce1b95e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779174408, "uuid": "f3de6f91-9960-42dd-84e3-c98d45c1a017", "comment": "Malware payload", "value": "edd5945f23bbb86f0a45bfb1ff77349ad5e15eeaa036fb136e587818c26caba42d8b451d6a5e2e59908637c539e4c2b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174408, "uuid": "e9530172-e3b5-4a0a-9076-2882ac016c36", "value": "T1F26733989EB1596BC932117B1CA0EEA0433EC0AD2673D817DB3544A7F5A3BE0F11562F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174408, "uuid": "8be2fd06-d127-406e-a906-3ed5a3a0f7a5", "value": "661446f93b0f89e48ba1c6a5d9b856b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174408, "uuid": "417b9244-2777-43de-81ac-733e394c745b", "value": "786432:1F8WWxUdUd1LRphkc7FphBWGlso5EYW8GUoVLFtCu1L0o1nwrX:1F8WWxUUddRnFphBZd5E7UolF4Mn1nwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779174408, "uuid": "393dd449-8602-495a-a8c2-e02f78d0103e", "value": 30396077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779174408, "uuid": "b4f21602-0d3b-42ad-9adf-fd9925d986f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779174408, "uuid": "54d96d6d-10c5-4ccb-96d0-65e69a4dae11", "value": "RichAddrDownloader.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5075d415-5363-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779182144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182144, "uuid": "358b8248-156c-479d-9b80-2c4c82731cbf", "comment": "Malware payload", "value": "6f44cd1aa3b80df3cf764fbd6fc7fb2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182144, "uuid": "6ca18371-ed77-47be-9715-9f37f4636d1b", "comment": "Malware payload", "value": "fe60bc425d328404aa069877762a71deacd1467b01da6ec604a5df1634cd4207", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182144, "uuid": "da959ece-0f47-4ce1-a201-94f78cd69875", "comment": "Malware payload", "value": "5679d135612ac6854eeeecc12a2f8886d6ad0d38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779182144, "uuid": "c984de46-c291-49e3-84da-cdd5485afb6a", "comment": "Malware payload", "value": "8bb0dc1add189b821243efa1071a8dfb3ea4c194970ab925f852d13a886c16a3e1430737abdecacec2b4c3b532b42ea8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182144, "uuid": "548e15f9-67e5-43cc-8e64-52c3f96d1fdd", "value": "T1B801824516E20F27CD92327E37E28B5C6791F8370966C745B20CA8BE0F522CE2DB8E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182144, "uuid": "3beedaa9-8b7e-470a-bf35-e2434c8f680b", "value": "12:BLFmFmFmF/EDrACpQCQqt8ZP/fzaXMXOXKX2X/mXY+lXrmXZly2nXLWnXZgQl:1FmFmFmFgc17ulul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779182144, "uuid": "96c2a494-9147-4368-b0ea-1007d10cb9a1", "value": 759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779182144, "uuid": "e2c50df1-294f-497e-81bf-4f1f76df36f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779182144, "uuid": "1f7566d7-6458-4a6b-9a90-e46dd317e3e5", "value": "dlr.parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c304bd5-5356-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779176446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176446, "uuid": "28112aba-caed-46d2-aa76-23d623297cc8", "comment": "Malware payload (RemcosRAT)", "value": "e6ab33748bf3d2ce95eec38c0c780468", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176446, "uuid": "22b30677-c86c-477f-90db-fa7cfef140cb", "comment": "Malware payload (RemcosRAT)", "value": "ff5a2a1e73da7496961c05686e7723fd3a20d41eb74a612b25742cd7e18cdbce", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176446, "uuid": "50b1926d-80f7-42fe-911a-69bf9061fe0d", "comment": "Malware payload (RemcosRAT)", "value": "98625eb8ac2726d32770bd30ef7134e5b84c6532", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779176446, "uuid": "e91abedc-1caf-4ae4-97c6-aadb467d8594", "comment": "Malware payload (RemcosRAT)", "value": "8fb6e0e4f023d038977559014c5990c486a911aac8256a41a4f021f49bdf0951e6aaa004f289130a60c84339061546d3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--grere856-dot", "colour": "#A6AFBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176446, "uuid": "bf08beac-6b8b-4f06-b726-f21a8e4150ca", "value": "T198E0C013B740ED0C4D6399F9D0E54804515550C1571357C332B1C80CB948332C3CB999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176446, "uuid": "a2ce0b1a-0c14-43ad-a8b4-60857a13dd81", "value": "6:hmR9R3O2kX0IBRTciRIoLNKvDcAUFKQ98qbUtzVeJAunQHOi338XIYAGQO0cR9RB:w7RxkXH+yIRvDcHKQ980qWAa5i338XIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779176446, "uuid": "c6d3f062-2b0a-4433-9a6c-b46664fb368a", "value": 344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779176446, "uuid": "a51708ba-8dd7-4b6b-8ec2-1ab1c128a9bc", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779176446, "uuid": "d3f29e4f-6ac3-4fbb-b33f-2da2b89863a1", "value": "run_final.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41abb2a2-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779220344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "0c3bea39-4247-436c-beb8-e5e0afeed6ca", "comment": "Malware payload (Mirai)", "value": "22c106c778ec2808bc966fec218cdf72", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "0c80ea49-7b36-4bef-962b-07c242aaec15", "comment": "Malware payload (Mirai)", "value": "ff6956bbbaee8c070a95f15f6212df37f89e84b4b188edba86f1fa10960affa6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "2e3c3f7c-bd3e-44d7-8d2b-bea92bf23e81", "comment": "Malware payload (Mirai)", "value": "f27a050173c424f1fe21c26ef25a247cb5d1611e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220344, "uuid": "b961c073-8c76-40cd-81ac-aedeb8529d49", "comment": "Malware payload (Mirai)", "value": "ab1df312f503704a4078646ef43efee7f034815371926240c527f764d5dbed62b9072221599198b5f203b72db14706dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220344, "uuid": "98ae4277-61d9-44aa-bcf5-f71a727ad6e0", "value": "T18E83E949E925AB19C3E232FFFB8D528E72131FACB3EA31258D309F6133C1A951539525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220344, "uuid": "e678368f-a5dd-4ca7-bec3-1a9ed2ff6606", "value": "1536:8Fn9EVUKUFrSfoJf1ea4sOLSITifC5Ebbgio55N63Io3Yhr7:QEVsrWaEazC5Ebbgic3mOr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220344, "uuid": "022cd36f-a7c3-4364-a32c-1375e2b35dc5", "value": 87668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220344, "uuid": "021bc270-a3cf-4b96-95d2-7ad50a337bf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220344, "uuid": "b9f3c231-5e24-42e4-a07b-89861e180602", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42eefc9c-53bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779220346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220346, "uuid": "6e7fa8a4-e55e-46fb-a9ff-66e65e7327e3", "comment": "Malware payload", "value": "fdee66f1bc4081cc4d169bb8d2e9d4d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220346, "uuid": "3a30e6de-eaa1-4d4e-9c67-138675e84f0b", "comment": "Malware payload", "value": "ffab0457940304f6a089041b63a425dbf67d00f458477e8dcae5fe4129b49afc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220346, "uuid": "cb77fecb-496d-465d-8388-f108a7884eb1", "comment": "Malware payload", "value": "221486a322143bfa6362f94853006bdaf7167c2c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779220346, "uuid": "9d90baa0-25b8-4e3e-a20a-685fc0915142", "comment": "Malware payload", "value": "febb181e2fe41443d2c0a0f7b8e6fb1b9116d483b016ccfee049914999a1ca584a200c1a6e2ef90caf976ae10c6a2300", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220346, "uuid": "88273791-d046-4d59-acf2-f86902594a23", "value": "T1DEB3742ABB619FBBDC5FCD7301A94501208CA45A12D92B7FF1B4D628E38AD4F09E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220346, "uuid": "475e604c-7f1a-40db-9609-4b2522922402", "value": "1536:dWEitAZOcFrnwJb+YyLWNxfwQvjcmEAADVszsIGc:z38RSdhIGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779220346, "uuid": "6fc57843-fa12-4f5f-8cea-14c33074603d", "value": 112844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779220346, "uuid": "d7d2586a-de1d-4a45-b48e-f1226d2df55c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779220346, "uuid": "102436a8-d2a4-4e8e-a3db-5cac21ed1b70", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }